DC3

清疚 2022-10-25 04:43 190阅读 0赞

# 本关考验的主要是工具的使用 #

## 1.信息收集 ##

## 端口信息收集    从80端口可以看到使用的CMS是Joomla ##

[![image][]][image 1]

##     joomla目录信息收集       可以看到几个关键信息，版本3.7.0 ##

[![image][image 2]][image_image 2]

## 2.漏洞利用 ##

## 根据得到的信息，可以尝试去搜索joomla 3.7的漏洞 ##

## 找到一个关于sql注入的漏洞，将42033.txt说明文档导入到当前路径 ##

[![image][image 3]][image_image 3]

## 查看文档，第一个框是漏洞所在，第二个框是如何利用这个漏洞，我们按照提示将IP修改为目标IP ##

[![image][image 4]][image_image 4]

## 使用sqlmap，我们的到了库，依次我们去获取表列，拿到账号密码 ##

## 查看当前用户为root用户连接，应该会联想到--os-shell，可以作为备用获取webshell的方案 ##

[![image][image 5]][image_image 5]

[![image][image 6]][image_image 6]

[![image][image 7]][image_image 7]

[![image][image 8]][image_image 8]

## 得到一段admin的账号和密码 ##

[![image][image 9]][image_image 9]

## 利用joomla漏洞方法二 ##

## 这里还有一个joomla脚本可以直接获取joomla的账号密码 ##

[![image][image 10]][image_image 10]

## 直接获取到账号admin，密码的hash值 ##

[![image][image 11]][image_image 11]

## 尝试使用john破解该密码 ##

## 将所需破解密码存入test.txt文件中 ##

[![image][image 12]][image_image 12]

## john --wordlist='/usr/share/wordlists/rockyou.txt' test.txt ##

## john --show test.txt ##

## 执行以上两条命令可以看到密码为snoopy ##

[![image][image 13]][image_image 13]

## 登陆后台 ##

## 依次进入该模块 ##

[![image][image 14]][image_image 14]

[![image][image 15]][image_image 15]

## 创建php文件 ##

[![image][image 16]][image_image 16]

## 将红线标记处路径中的php反弹文件内容复制到所创建的文件中 ##

[![image][image 17]][image_image 17]

## IP地址换成监听的IP ##

[![image][image 18]][image_image 18]

## 启动监听，访问该文件，获取shell ##

[![image][image 19]][image_image 19]

## 尝试提权 ##

## 进行服务器信息收集，由于可以查看历史命令，系统信息，suid权限的工具等等 ##

## 查看系统相关信息 ##

## [![image][image 20]][image_image 20] ##

## 这里就直接使用内核提权了，选取我标记的exp，选取的标准：内核版本 4.4.0，Ubuntu版本 16.04，Privilege Escalation意思是权限提升，所以优先选择标记的 ##

[![image][image 21]][image_image 21]

## 将39772.txt复制到当前路径 ##

## searchsploit –m 39772 ##

## 查看文档，要求下载压缩包文件，解压后将exploit压缩文件放到目标机/tmp下，放的方法有很多，可以下载，可以上马上传，这个自行研究 ##

[![image][image 22]][image_image 22]

## 解压后获得两个文件，按文档执行就可以获得root权限，第二个执行的过程稍微有点长 ##

[![image][image 23]][image_image 23]

# 总结 #

## joomlascan的使用，知道版本后尝试寻找该版本漏洞并利用，通过漏洞通过john破解密码得到明文账号密码，进入后台添加可执行webshell文件或反弹文件，通过得到的shell获取版本信息等，进行内核提权 ##

## 重点考察searcploit的利用 ##

[image]: /images/20221024/bcd417f55b4a4d139d4a6cee006aa7ad.png
[image 1]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103722936-339230087.png
[image 2]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103724465-1443762389.png
[image_image 2]: /images/20221024/6704d06a6b2148be817b7117459da1ca.png
[image 3]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103725045-1153872503.png
[image_image 3]: /images/20221024/47b85b739b544f3682438a51b029a6b4.png
[image 4]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103725603-1080521676.png
[image_image 4]: /images/20221024/2fcb190fad814f2aba223655fce93681.png
[image 5]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103726177-2127245654.png
[image_image 5]: /images/20221024/0d263e44de3c441e86e481a758c7eb1f.png
[image 6]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103726786-1737533145.png
[image_image 6]: /images/20221024/9e23bd27638a4a7f9b9a95fcf5c35b84.png
[image 7]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103727406-339289925.png
[image_image 7]: /images/20221024/93174c77dfa64d1ea2827fe69754eff6.png
[image 8]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103728018-386974789.png
[image_image 8]: /images/20221024/e10ed9fdc04d45ef9b21899aface7b0a.png
[image 9]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103728595-281647030.png
[image_image 9]: /images/20221024/ddc1f785fe884f3b93d04a2983f5d2a1.png
[image 10]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103729125-1407426162.png
[image_image 10]: /images/20221024/dc6ca34cc4714afd9123de645058d1db.png
[image 11]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103729610-1855693743.png
[image_image 11]: /images/20221024/9ec8c534efe044709430a1fa49a846a6.png
[image 12]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103730087-1410965772.png
[image_image 12]: /images/20221024/6ca97fc05acb4eac98a5a25949dad803.png
[image 13]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103730711-685677356.png
[image_image 13]: /images/20221024/9abd51b1915147fd8241db96613e589e.png
[image 14]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103731312-2106094361.png
[image_image 14]: /images/20221024/d755854cf544421489d93cca8137c0c4.png
[image 15]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103731970-640538440.png
[image_image 15]: /images/20221024/ec979ead962040eeb4b7ab0c513eb51d.png
[image 16]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103732494-442881525.png
[image_image 16]: /images/20221024/f156d54fc0944edfae4d1ebf545c93c9.png
[image 17]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103733017-1821222648.png
[image_image 17]: /images/20221024/b68e72b5aad34a44bc86a1b1f9b69760.png
[image 18]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103733590-1316344407.png
[image_image 18]: /images/20221024/961f77c2f611475796be6e0bad221b5f.png
[image 19]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103734445-1575072197.png
[image_image 19]: /images/20221024/abfd3ff36d894050aa6b98baab24fc8b.png
[image 20]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103735031-742482393.png
[image_image 20]: /images/20221024/f55374b6a55545728d69d54585e78299.png
[image 21]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103735721-640759287.png
[image_image 21]: /images/20221024/92a133cc865948fc9dcbab6b1c7d288c.png
[image 22]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103736298-1181058624.png
[image_image 22]: /images/20221024/5dfcd12fbf45496e90bcd03c6be0325d.png
[image 23]: https://img2018.cnblogs.com/blog/1943028/202003/1943028-20200303103736853-711303811.png
[image_image 23]: /images/20221024/bde31798bf0343689110979cb6dc6a95.png