{"id":348,"date":"2025-12-03T14:57:10","date_gmt":"2025-12-03T06:57:10","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=348"},"modified":"2026-01-29T16:18:59","modified_gmt":"2026-01-29T08:18:59","slug":"348","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2025\/12\/03\/348\/","title":{"rendered":"HTB\u9776\u673a Gavel \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"
\n

\u76ee\u6807\u4fe1\u606f<\/h1>\n

IP\u5730\u5740\uff1a<\/strong>10.129.44.242<\/strong><\/code>\uff08\u975e\u56fa\u5b9aIP\u5730\u5740\uff09<\/strong><\/p><\/blockquote>\n

\n

\u4fe1\u606f\u6536\u96c6<\/h1>\n

ICMP\u68c0\u6d4b<\/h2>\n
PING 10.129.43.68 (10.129.43.68) 56(84) bytes of data.\n64 bytes from 10.129.43.68: icmp_seq=1 ttl=63 time=281 ms\n64 bytes from 10.129.43.68: icmp_seq=2 ttl=63 time=275 ms\n64 bytes from 10.129.43.68: icmp_seq=3 ttl=63 time=276 ms\n64 bytes from 10.129.43.68: icmp_seq=4 ttl=63 time=273 ms\n\n--- 10.129.43.68 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3004ms\nrtt min\/avg\/max\/mdev = 272.598\/276.100\/280.553\/2.900 ms<\/code><\/pre>\n
\u653b\u51fb\u673a\u548c\u9776\u673a\u95f4\u7f51\u7edc\u901a\u4fe1\u6b63\u5e38\u3002<\/p>\n
\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n
# Nmap 7.95 scan initiated Sun Nov 30 13:25:47 2025 as: \/usr\/lib\/nmap\/nmap -sF -p- --min-rate 3000 -oN fin_result.txt 10.129.43.68\nNmap scan report for 10.129.43.68\nHost is up (0.28s latency).\nNot shown: 65533 closed tcp ports (reset)\nPORT   STATE         SERVICE\n22\/tcp open|filtered ssh\n80\/tcp open|filtered http\n\n# Nmap done at Sun Nov 30 13:26:22 2025 -- 1 IP address (1 host up) scanned in 34.90 seconds<\/code><\/pre>\n
\u9776\u673a\u7591\u4f3c\u5f00\u653e2<\/code>\u4e2aTCP<\/code>\u7aef\u53e3\u3002<\/p>\n
\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n
TCP<\/strong><\/code>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sun Nov 30 13:30:02 2025 as: \/usr\/lib\/nmap\/nmap -sT -sV -A -p- --min-rate 3000 -oN tcp_result.txt 10.129.43.86\nWarning: 10.129.43.86 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.129.43.86\nHost is up (0.27s latency).\nNot shown: 64382 closed tcp ports (conn-refused), 1151 filtered tcp ports (no-response)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 1f:de:9d:84:bf:a1:64:be:1f:36:4f:ac:3c:52:15:92 (ECDSA)\n|_  256 70:a5:1a:53:df:d1:d0:73:3e:9d:90:ad:c1:aa:b4:19 (ED25519)\n80\/tcp open  http    Apache httpd 2.4.52\n|_http-title: Did not follow redirect to http:\/\/gavel.htb\/\n|_http-server-header: Apache\/2.4.52 (Ubuntu)\nDevice type: general purpose|router\nRunning: Linux 4.X|5.X, MikroTik RouterOS 7.X\nOS CPE: cpe:\/o:linux:linux_kernel:4 cpe:\/o:linux:linux_kernel:5 cpe:\/o:mikrotik:routeros:7 cpe:\/o:linux:linux_kernel:5.6.3\nOS details: Linux 4.15 - 5.19, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)\nNetwork Distance: 2 hops\nService Info: Host: gavel.htb; OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using proto 1\/icmp)\nHOP RTT       ADDRESS\n1   262.86 ms 10.10.14.1\n2   262.97 ms 10.129.43.86\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Sun Nov 30 13:31:20 2025 -- 1 IP address (1 host up) scanned in 77.94 seconds<\/code><\/pre>\n
UDP<\/strong><\/code>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sun Nov 30 13:36:16 2025 as: \/usr\/lib\/nmap\/nmap -sU -p- --min-rate 3000 -oN udp_ports.txt 10.129.43.86\nWarning: 10.129.43.86 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.129.43.86\nHost is up (0.28s latency).\nAll 65535 scanned ports on 10.129.43.86 are in ignored states.\nNot shown: 65288 open|filtered udp ports (no-response), 247 closed udp ports (port-unreach)\n\n# Nmap done at Sun Nov 30 13:40:26 2025 -- 1 IP address (1 host up) scanned in 249.41 seconds<\/code><\/pre>\n
UDP<\/strong><\/code>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
\uff08\u65e0\uff09<\/code><\/pre>\n
\u540c\u65f6\u53d1\u73b0\u9776\u673a\u8fd0\u884cUbuntu Linux<\/code>\u64cd\u4f5c\u7cfb\u7edf\uff0c\u8fd0\u884c22\/ssh<\/code>\u548c80\/http<\/code>\u670d\u52a1\uff0c\u7f51\u7ad9\u4e3b\u57df\u540d\u4e3agavel.htb<\/code>\u3002<\/p>\n
\n
\u670d\u52a1\u63a2\u6d4b<\/h1>\n
SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n
\u5c1d\u8bd5\u4f7f\u7528ssh<\/code>\u5de5\u5177\u8fde\u63a5\u9776\u673a\uff0c\u67e5\u770b\u5141\u8bb8\u7684\u767b\u5f55\u65b9\u5f0f\uff1a<\/p>\n
ssh root@gavel.htb<\/code><\/pre>\n
\"\"<\/p>\n
\u53d1\u73b0\u9776\u673aSSH<\/code>\u670d\u52a1\u5141\u8bb8\u4f7f\u7528\u5bc6\u94a5\u548c\u5bc6\u7801\u4e24\u79cd\u65b9\u5f0f\u767b\u5f55\u3002<\/p>\n
Web\u5e94\u7528\u7a0b\u5e8f\uff0880\u7aef\u53e3\uff09<\/h2>\n
\u6253\u5f00\u4e3b\u9875\uff1ahttp:\/\/gavel.htb\/<\/code><\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u8be5\u7ad9\u70b9\u4e3a\u6a21\u62df\u8d2d\u7269\u7684\u4e2a\u4eba\u7f51\u7ad9\u3002\u5c1d\u8bd5\u8fdb\u884c\u76ee\u5f55\u626b\u63cf\uff1a<\/p>\n
# Dirsearch started Mon Dec  1 08:20:29 2025 as: \/usr\/lib\/python3\/dist-packages\/dirsearch\/dirsearch.py -u http:\/\/gavel.htb -x 400,403,404 -e php,js,html,txt,zip,tar.gz,json,xml,pdf,pcap,md -t 70 -w \/usr\/share\/wordlists\/dirb\/common.txt\n\n200    23B   http:\/\/gavel.htb\/.git\/HEAD\n302     0B   http:\/\/gavel.htb\/admin.php    -> REDIRECTS TO: index.php\n301   307B   http:\/\/gavel.htb\/assets    -> REDIRECTS TO: http:\/\/gavel.htb\/assets\/\n301   309B   http:\/\/gavel.htb\/includes    -> REDIRECTS TO: http:\/\/gavel.htb\/includes\/\n200     3KB  http:\/\/gavel.htb\/index.php\n301   306B   http:\/\/gavel.htb\/rules    -> REDIRECTS TO: http:\/\/gavel.htb\/rules\/<\/code><\/pre>\n
\u53d1\u73b0\u76ee\u6807\u7ad9\u70b9\u5b58\u5728.git<\/code>\u76ee\u5f55\uff0c\u76f4\u63a5\u4f7f\u7528GitHack<\/code>\u5de5\u5177\u8fdb\u884c\u6e90\u4ee3\u7801\u4e0b\u8f7d\uff1aGitHub - lijiejie\/GitHack: A .git<\/code> folder disclosure exploit<\/a><\/p>\n
\"\"<\/p>\n
python \/home\/misaka19008\/Documents\/Programs\/GitHack\/GitHack.py http:\/\/gavel.htb\/.git\/<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\u4e0b\u8f7d\u7ad9\u70b9\u6e90\u4ee3\u7801\uff01<\/p>\n
\n
\u6e17\u900f\u6d4b\u8bd5<\/h1>\n
PHP\u6e90\u4ee3\u7801\u5ba1\u8ba1<\/h2>\n
\u7f51\u7ad9\u529f\u80fd\u5206\u6790<\/h3>\n
\u5728\u670d\u52a1\u63a2\u6d4b\u8fc7\u7a0b\u4e2d\uff0c\u6211\u4eec\u5df2\u7ecf\u6210\u529f\u53d1\u73b0\u4e86\u7ad9\u70b9\u7684Git<\/code>\u6cc4\u9732\u6f0f\u6d1e\u5e76\u4e0b\u8f7d\u4e86\u6e90\u4ee3\u7801\uff0c\u73b0\u5728\u8fdb\u884cPHP<\/code>\u6e90\u4ee3\u7801\u5ba1\u8ba1\u3002<\/p>\n
\u5728\u8fdb\u884c\u4ee3\u7801\u5ba1\u8ba1\u4e4b\u524d\uff0c\u6211\u4eec\u9996\u5148\u9700\u8981\u719f\u6089\u7f51\u7ad9\u7684\u4e3b\u8981\u529f\u80fd\u3002\u6253\u5f00\u4e3b\u9875\uff0c\u6211\u4eec\u53ef\u4ee5\u770b\u5230\u5b58\u5728\u201c\u767b\u5f55\u201d\u548c\u201c\u6ce8\u518c\u201d\u4e24\u4e2a\u529f\u80fd\uff0c\u73b0\u5728\u6ce8\u518c\u4e00\u4e2a\u8d26\u53f7\u767b\u5f55\uff0c\u63a2\u67e5\u7f51\u7ad9\u666e\u901a\u7528\u6237\u62e5\u6709\u7684\u529f\u80fd\uff1a<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u5b58\u5728Bidding<\/code>\u548cInventory<\/code>\u4e24\u4e2a\u529f\u80fd\uff0c\u5148\u67e5\u770bBidding<\/code>\uff1a<\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u8be5\u529f\u80fd\u4e3a\u6a21\u62df\u6263\u6b3e\u6e38\u620f\u3002\u6bcf\u4e2a\u7528\u6237\u65b0\u6ce8\u518c\u65f6\u90fd\u4f1a\u62e5\u670950000<\/code>\u4e2a\u91d1\u5e01\uff0c\u800c\u7ad9\u70b9\u6a21\u62df\u6263\u6b3e\u6e38\u620f\u5b58\u57283<\/code>\u4e2a\u9009\u9879\uff0c\u7528\u6237\u9700\u8981\u5728\u6587\u672c\u6846\u5185\u8f93\u5165\u7b26\u5408\u9898\u76ee\u8981\u6c42\u7684\u6570\u503c\uff08\u57fa\u672c\u8981\u6c42\u4e3a\u8f93\u5165\u91d1\u5e01\u6570\u503c\u5fc5\u987b\u5927\u4e8e\u9898\u76eeCurrent<\/code>\u6570\u503c\uff0c\u4e14\u5c0f\u4e8e\u7528\u6237\u5f53\u524d\u62e5\u6709\u7684\u91d1\u5e01\u6570\u503c\uff09\uff0c\u5982\u4e0d\u7b26\u5408\u57fa\u672c\u8981\u6c42\u548c\u9898\u76ee\u8981\u6c42\u5c31\u4f1a\u8fd4\u56de\u9519\u8bef\u63d0\u793a\u3002\u6309\u7167\u9898\u76ee\u8981\u6c42\u64cd\u4f5c\uff0c\u53ef\u4ee5\u770b\u5230\u5f53\u524d\u7528\u6237\u4f1a\u88ab\u6263\u6b3e\uff1a<\/p>\n
\"\"<\/p>\n
\u70b9\u51fbInventory<\/code>\u5207\u6362\u529f\u80fd\uff0c\u53d1\u73b0\u8be5\u529f\u80fd\u53ef\u4ee5\u67e5\u8be2\u7528\u6237\u5b8c\u6210\u7684\u9898\u76ee\uff1a<\/p>\n
\"\"<\/p>\n
\u6309F12<\/code>\u6253\u5f00\u7f51\u7edc\u8bf7\u6c42\u76d1\u89c6\u5668\uff0c\u70b9\u51fb\u53f3\u4e0a\u89d2\u7684\u6392\u5e8f\u65b9\u5f0f\uff0c\u67e5\u770b\u8bf7\u6c42\u5305\uff0c\u53d1\u73b0\u67e5\u8be2\u6240\u9700\u7684\u7528\u6237ID<\/code>\u53c2\u6570\u53ef\u4ee5\u7531\u653b\u51fb\u8005\u6307\u5b9a\uff1a<\/p>\n
\"\"<\/p>\n
\u9664\u6b64\u4e4b\u5916\uff0c\u6ca1\u6709\u53d1\u73b0\u5176\u5b83\u7684\u529f\u80fd\u548c\u654f\u611f\u4fe1\u606f\u3002<\/p>\n
\u6e90\u4ee3\u7801\u5206\u6790<\/h3>\n
\u6211\u4eec\u9996\u5148\u5206\u6790\u7f51\u7ad9\u5165\u53e3index.php<\/code>\uff1a<\/p>\n
\"\"<\/p>\n
\u901a\u8bfb\u6e90\u4ee3\u7801\uff0c\u53d1\u73b0\u5728\u5f00\u5934\u5904\u5f15\u5165\u4e86config.php<\/code>\u548cdb.php<\/code>\u3002\u67e5\u770bconfig.php<\/code>\uff0c\u627e\u5230\u4e86MySQL<\/code>\u8fde\u63a5\u51ed\u636e\uff1a<\/p>\n
\"\"<\/p>\n