Posts

Box Info OS Linux Difficulty Easy Nmap [root@kali] /home/kali ❯ nmap 192.168.56.131 -sV -A -p- PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2 (protocol 2.0) | ssh-hostkey: | 256 f6:91:6b:ad:ea:ad:1d:b9:44:09:d8:74:a3:02:38:35 (ECDSA) |_ 256 b6:66:2f:f0:4c:26:7f:7d:14:ea:b3:62:09:64:a7:94 (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-title: Apache2 Ubuntu Default Page: It works |_http-server-header: Apache/2.4.62 (Debian) 进入80端口查看，是一个apache默认页 ...

Box Info OS Linux Difficulty Easy Nmap [root@kali] /home/kali/Code ❯ nmap code.htb -sV -A PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 b5:b9:7c:c4:50:32:95:bc:c2:65:17:df:51:a2:7a:bd (RSA) | 256 94:b5:25:54:9b:68:af:be:40:e1:1d:a8:6b:85:0d:01 (ECDSA) |_ 256 12:8c:dc:97:ad:86:00:b4:88:e2:29:cf:69:b5:65:96 (ED25519) 5000/tcp open http Gunicorn 20.0.4 |_http-title: Python Code Editor |_http-server-header: gunicorn/20.0.4 Own www-data SSTI 注入 - Hello CTF 进入到5000端口是一个python代码执行窗口 ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali/Strutted ❯ nmap strutted.htb -sV PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0) 80/tcp open http nginx 1.18.0 (Ubuntu) CVE-2024-53677 存在一个Download路由可以下载到网站源码 查看pom.xml发现使用的是struts2 6.3.0.1 ...

Box Info OS Linux Difficulty Hard Nmap [root@kali] /home/kali/Interceptor ❯ nmap 192.168.56.123 -sV -A -p- PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-title: Apache2 Debian Default Page: It works |_http-server-header: Apache/2.4.62 (Debian) Gobuster [root@kali] /home/kali/Interceptor ❯ gobuster dir -u http://192.168.56.123 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.56.123 [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,html,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.html (Status: 403) [Size: 279] /.php (Status: 403) [Size: 279] /index.html (Status: 200) [Size: 10701] /wordpress (Status: 301) [Size: 320] [--> http://192.168.56.123/wordpress/] /backup (Status: 301) [Size: 317] [--> http://192.168.56.123/backup/] /.html (Status: 403) [Size: 279] /.php (Status: 403) [Size: 279] /server-status (Status: 403) [Size: 279] /fping.php (Status: 200) [Size: 1958] Progress: 882240 / 882244 (100.00%) =============================================================== Finished =============================================================== Crack ZIP 在**/backup里发现一个压缩包，应该是涉及到了/fping**这个路由的。 ...

Box Info OS Windows Difficulty Medium Nmap [root@kali] /home/kali/TheFrizz ❯ nmap thefrizz.htb -sV -A PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH for_Windows_9.5 (protocol 2.0) 53/tcp open domain Simple DNS Plus 80/tcp open http Apache httpd 2.4.58 (OpenSSL/3.1.3 PHP/8.2.12) |_http-title: Did not follow redirect to http://frizzdc.frizz.htb/home/ |_http-server-header: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 88/tcp open kerberos-sec Microsoft Windows Kerberos 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: frizz.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: frizz.htb0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 将frizz.htb添加到**/etc/hosts** ...

Box Info OS Linux Difficulty Low Nmap [root@kali] /home/kali/Loweb ❯ nmap 192.168.56.122 -sV -A -p- PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0) | ssh-hostkey: | 256 65:bb:ae:ef:71:d4:b5:c5:8f:e7:ee:dc:0b:27:46:c2 (ECDSA) |_ 256 ea:c8:da:c8:92:71:d8:8e:08:47:c0:66:e0:57:46:49 (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-title: Apache2 Debian Default Page: It works |_http-server-header: Apache/2.4.62 (Debian) Gobuster [root@kali] /home/kali/Loweb ❯ gobuster dir -u http://192.168.56.122 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.56.122 [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /library (Status: 301) [Size: 318] [--> http://192.168.56.122/library/] /server-status (Status: 403) [Size: 279] Progress: 220560 / 220561 (100.00%) =============================================================== Finished =============================================================== [root@kali] /home/kali/Loweb ❯ gobuster dir -u http://192.168.56.122/library -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.56.122/library [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,html,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.php (Status: 403) [Size: 279] /.html (Status: 403) [Size: 279] /index.html (Status: 200) [Size: 1068] /login (Status: 301) [Size: 324] [--> http://192.168.56.122/library/login/] /admin (Status: 301) [Size: 324] [--> http://192.168.56.122/library/admin/] /.html (Status: 403) [Size: 279] /.php (Status: 403) [Size: 279] Progress: 882240 / 882244 (100.00%) =============================================================== Finished =============================================================== SQL Injection 进入登录页面，用户名处存在SQL注入 ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali ❯ nmap 192.168.56.119 -sV -A PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0) | ssh-hostkey: | 256 a9:a8:52:f3:cd:ec:0d:5b:5f:f3:af:5b:3c:db:76:b6 (ECDSA) |_ 256 73:f5:8e:44:0c:b9:0a:e0:e7:31:0c:04:ac:7e:ff:fd (ED25519) 80/tcp open http nginx 1.22.1 |_http-server-header: nginx/1.22.1 |_http-title: Massively by HTML5 UP 8000/tcp open ftp pyftpdlib 1.5.7 | ftp-syst: | STAT: | FTP server status: | Connected to: 192.168.56.119:8000 | Waiting for username. | TYPE: ASCII; STRUcture: File; MODE: Stream | Data connection closed. |_End of status. Dirsearch [root@kali] /home/kali/Zerotrace ❯ dirsearch -u http://192.168.56.119 -t 50 /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 50 | Wordlist size: 11460 Output File: /home/kali/Zerotrace/reports/http_192.168.56.119/_25-03-15_19-12-30.txt Target: http://192.168.56.119/ [19:12:30] Starting: [19:12:30] 301 - 169B - /.admin -> http://192.168.56.119/.admin/ [19:12:30] 403 - 555B - /.admin/ [19:12:31] 403 - 555B - /.ht_wsr.txt [19:12:31] 403 - 555B - /.htaccess.bak1 [19:12:31] 403 - 555B - /.htaccess.orig [19:12:31] 403 - 555B - /.htaccess.sample [19:12:31] 403 - 555B - /.htaccess.save [19:12:31] 403 - 555B - /.htaccess_extra [19:12:31] 403 - 555B - /.htaccess_orig [19:12:31] 403 - 555B - /.htaccess_sc [19:12:31] 403 - 555B - /.htaccessOLD [19:12:31] 403 - 555B - /.htaccessBAK [19:12:31] 403 - 555B - /.htaccessOLD2 [19:12:31] 403 - 555B - /.htm [19:12:31] 403 - 555B - /.html [19:12:31] 403 - 555B - /.httr-oauth [19:12:31] 403 - 555B - /.htpasswds [19:12:31] 403 - 555B - /.htpasswd_test [19:12:37] 301 - 169B - /assets -> http://192.168.56.119/assets/ [19:12:37] 403 - 555B - /assets/ [19:12:43] 403 - 555B - /images/ [19:12:43] 301 - 169B - /images -> http://192.168.56.119/images/ [19:12:44] 200 - 17KB - /LICENSE.txt [19:12:50] 200 - 930B - /README.txt [19:12:54] 403 - 555B - /uploads/ [19:12:54] 403 - 555B - /uploads/affwp-debug.log [19:12:54] 403 - 555B - /uploads/dump.sql Task Completed 发现存在一个**/.admin**目录 ...

Box Info OS Linux Difficulty Low Nmap [root@kali] /home/kali/Lower4 ❯ nmap 192.168.56.120 -sV -A PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 f0:e6:24:fb:9e:b0:7a:1a:bd:f7:b1:85:23:7f:b1:6f (RSA) | 256 99:c8:74:31:45:10:58:b0:ce:cc:63:b4:7a:82:57:3d (ECDSA) |_ 256 60:da:3e:31:38:fa:b5:49:ab:48:c3:43:2c:9f:d1:32 (ED25519) |_auth-owners: root 80/tcp open http Apache httpd 2.4.56 ((Debian)) |_http-server-header: Apache/2.4.56 (Debian) |_http-title: Apache2 Debian Default Page: It works 113/tcp open ident? |_auth-owners: lucifer MAC Address: 08:00:27:DE:A3:91 (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 从113端口上扫描到一个用户名：lucifer ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali/Entropy ❯ nmap 192.168.56.117 -sV -A -p- PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0) | ssh-hostkey: | 256 cc:05:ab:8c:ea:28:eb:b1:9d:da:8c:ce:65:ee:63:43 (ECDSA) |_ 256 3f:9f:0a:7d:61:f8:6f:4b:46:01:c4:db:74:b2:b6:a7 (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-server-header: Apache/2.4.62 (Debian) |_http-title: Apache2 Debian Default Page: It works 目录扫描没有任何结果，在apache默认页中发现路径 ...

Box Info OS Linux Difficulty Hard Nmap [root@kali] /home/kali ❯ nmap 192.168.56.116 -sV -A -p- PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u4 (protocol 2.0) | ssh-hostkey: | 2048 5d:41:2a:c1:2d:3b:6c:78:b3:af:ae:9d:42:fe:88:b8 (RSA) | 256 3c:e9:64:eb:84:fe:5c:83:94:07:27:6c:12:14:c8:4c (ECDSA) |_ 256 09:9b:2b:18:de:6c:6d:f8:8b:15:df:6c:0f:c0:7c:b2 (ED25519) 80/tcp open http Apache httpd 2.4.59 ((Debian)) |_http-server-header: Apache/2.4.59 (Debian) |_http-title: News Website 65000/tcp filtered unknown Gobuster [root@kali] /home/kali ❯ gobuster dir -u http://192.168.56.116/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -x php,html,txt =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.56.116/ [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,html,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.php (Status: 403) [Size: 279] /index.html (Status: 200) [Size: 3118] /news.php (Status: 200) [Size: 1301] /.html (Status: 403) [Size: 279] /.php (Status: 403) [Size: 279] /.html (Status: 403) [Size: 279] /littlesecrets (Status: 301) [Size: 324] [--> http://192.168.56.116/littlesecrets/] /server-status (Status: 403) [Size: 279] Progress: 882240 / 882244 (100.00%) =============================================================== Finished =============================================================== 针对这个**/littlesecrets**再次进行扫描 ...