OSCP - Proving Grounds - Muddy

最新推荐文章于 2025-02-21 16:26:30 发布

原创

最新推荐文章于 2025-02-21 16:26:30 发布 · 590 阅读

3 ·

CC 4.0 BY-SA版权

文章标签：

#网络安全 #安全性测试

主要知识点

CVE-2019-1010268漏洞利用
apache配置文件路径
Linux 系统path 路径覆盖，Linux会优先从靠前的路径寻找可执行文件，借此覆盖相应命令达到提权目的

具体步骤

执行nmap扫描，发现很多端口都开了，不过有用的就是8888

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-08-29 20:15 EDT
Warning: 192.168.189.161 giving up on port because retransmission cap hit (10).
Nmap scan report for muddy.ugc (192.168.189.161)
Host is up (0.11s latency).
Not shown: 65503 closed tcp ports (conn-refused)
PORT      STATE    SERVICE       VERSION
22/tcp    open     ssh           OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 74:ba:20:23:89:92:62:02:9f:e7:3d:3b:83:d4:d9:6c (RSA)
|   256 54:8f:79:55:5a:b0:3a:69:5a:d5:72:39:64:fd:07:4e (ECDSA)
|_  256 7f:5d:10:27:62:ba:75:e9:bc:c8:4f:e2:72:87:d4:e2 (ED25519)
25/tcp    open     smtp          Exim smtpd 4.92
| smtp-commands: muddy Hello muddy.ugc [192.168.45.157], SIZE 52428800, 8BITMIME, PIPELINING, CHUNKING, PRDR, HELP
|_ Commands supported: AUTH HELO EHLO MAIL RCPT DATA BDAT NOOP QUIT RSET HELP
80/tcp    open     http          Apache httpd 2.4.38 ((Debian))
|_http-generator: WordPress 5.7
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Muddy | Found some mud? Call us! &#8211; A muddy WordPress!
111/tcp   open     rpcbind       2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|_  100000  3,4          111/udp6  rpcbind
8888/tcp  open     http          WSGIServer 0.1 (Python 2.7.16)
|_http-title: Ladon Service Catalog

对80端口执行dirsearch,发现安装了一个webdav