Posts

Box Info OS Linux Difficulty Hard Nmap [root@kali] /home/kali/crackoff ❯ nmap 172.17.0.2 -sV -A -p- Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-28 21:28 CST Nmap scan report for sitio.dl (172.17.0.2) Host is up (0.00010s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 3d:fc:bd:41:cb:81:e8:cd:a2:58:5a:78:68:2b:a3:04 (ECDSA) |_ 256 d8:5a:63:27:60:35:20:30:a9:ec:25:36:9e:50:06:8d (ED25519) 80/tcp open http Apache httpd 2.4.58 ((Ubuntu)) |_http-server-header: Apache/2.4.58 (Ubuntu) |_http-title: CrackOff - Bienvenido MAC Address: 02:42:AC:11:00:02 (Unknown) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.10 ms sitio.dl (172.17.0.2) OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.67 seconds Gobuster [root@kali] /home/kali/crackoff ❯ gobuster dir -u http://172.17.0.2/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://172.17.0.2/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.php (Status: 403) [Size: 275] /index.php (Status: 200) [Size: 2974] /login.php (Status: 200) [Size: 3968] /welcome.php (Status: 200) [Size: 2800] /db.php (Status: 302) [Size: 75] [--> error.php] /error.php (Status: 200) [Size: 2705] /.php (Status: 403) [Size: 275] /server-status (Status: 403) [Size: 275] Progress: 441120 / 441122 (100.00%) =============================================================== Finished =============================================================== SQL Injection 进入login.php，发现在username字段中存在SQL注入漏洞，单引号闭合 ...

Box Info OS Linux Difficulty Hard Nmap [root@kali] /home/kali/r00tless ❯ nmap 172.18.0.2 -sV -A -p- Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-01 11:27 CST Nmap scan report for 172.18.0.2 Host is up (0.000092s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 fa:7b:d3:96:f6:83:bb:bd:24:86:b4:a8:f6:59:c3:62 (ECDSA) |_ 256 29:49:38:ae:44:75:d8:88:2a:b6:98:55:00:bd:24:76 (ED25519) 80/tcp open http Apache httpd 2.4.58 ((Ubuntu)) |_http-server-header: Apache/2.4.58 (Ubuntu) |_http-title: Subir Archivo 139/tcp open netbios-ssn Samba smbd 4.6.2 445/tcp open netbios-ssn Samba smbd 4.6.2 MAC Address: 02:42:AC:12:00:02 (Unknown) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2025-03-01T03:27:48 |_ start_date: N/A TRACEROUTE HOP RTT ADDRESS 1 0.09 ms 172.18.0.2 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 20.77 seconds Gobuster [root@kali] /home/kali/r00tless ❯ gobuster dir -u http://172.18.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://172.18.0.2 [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,txt,html [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.html (Status: 403) [Size: 275] /index.html (Status: 200) [Size: 2410] /.php (Status: 403) [Size: 275] /upload.php (Status: 200) [Size: 56] /readme.txt (Status: 200) [Size: 78] /.php (Status: 403) [Size: 275] /.html (Status: 403) [Size: 275] /server-status (Status: 403) [Size: 275] Progress: 882240 / 882244 (100.00%) =============================================================== Finished =============================================================== Own passsamba ...

Box Info OS Windows Difficulty Medium Nmap [root@kali] /home/kali/Desktop ❯ nmap 192.168.56.103 -sSV -Pn -A -T4 PORT STATE SERVICE VERSION 53/tcp open domain? 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-03-02 03:01:34Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped MAC Address: 08:00:27:46:72:D1 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|11|2016 (97%) OS CPE: cpe:/o:microsoft:windows_server_2016 Aggressive OS guesses: Microsoft Windows Server 2022 (97%), Microsoft Windows 11 21H2 (91%), Microsoft Windows Server 2016 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required |_clock-skew: 14h59m36s | smb2-time: | date: 2025-03-02T03:03:53 |_ start_date: N/A |_nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:46:72:d1 (Oracle VirtualBox virtual NIC) 把DC01.SOUPEDECODE.LOCAL添加到**/etc/hosts** ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali/Inclusion ❯ nmap 172.17.0.2 -sV -A -p- Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-28 20:33 CST Nmap scan report for sitio.dl (172.17.0.2) Host is up (0.000081s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0) | ssh-hostkey: | 256 03:cf:72:54:de:54:ae:cd:2a:16:58:6b:8a:f5:52:dc (ECDSA) |_ 256 13:bb:c2:12:f5:97:30:a1:49:c7:f9:d0:ba:d0:5e:f7 (ED25519) 80/tcp open http Apache httpd 2.4.57 ((Debian)) |_http-server-header: Apache/2.4.57 (Debian) |_http-title: Apache2 Debian Default Page: It works MAC Address: 02:42:AC:11:00:02 (Unknown) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.08 ms sitio.dl (172.17.0.2) OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.70 seconds Gobuster [root@kali] /home/kali/Inclusion ❯ gobuster dir -u http://172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://172.17.0.2 [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.php (Status: 403) [Size: 275] /shop (Status: 301) [Size: 307] [--> http://172.17.0.2/shop/] /.php (Status: 403) [Size: 275] /server-status (Status: 403) [Size: 275] Progress: 441120 / 441122 (100.00%) =============================================================== Finished =============================================================== 再扫**/shop** ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali/sites ❯ nmap 172.17.0.2 -sV -A -p- Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-28 20:05 CST Nmap scan report for 172.17.0.2 Host is up (0.000077s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 cb:8f:50:db:6d:d8:d4:ac:bf:54:b0:62:12:7c:f0:01 (ECDSA) |_ 256 ca:6b:c7:0c:2a:d6:0e:3e:ff:c4:6e:61:ac:35:db:01 (ED25519) 80/tcp open http Apache httpd 2.4.58 ((Ubuntu)) |_http-server-header: Apache/2.4.58 (Ubuntu) |_http-title: Configuraci\xC3\xB3n de Apache y Seguridad en Sitios Web MAC Address: 02:42:AC:11:00:02 (Unknown) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.08 ms 172.17.0.2 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 10.63 seconds Gobuster [root@kali] /home/kali/sites ❯ gobuster dir -u http://172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php ⏎ =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://172.17.0.2 [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.php (Status: 403) [Size: 275] /.php (Status: 403) [Size: 275] /vulnerable.php (Status: 200) [Size: 37] /server-status (Status: 403) [Size: 275] Progress: 441120 / 441122 (100.00%) =============================================================== Finished =============================================================== ReadAnyFiles ...

Box Info OS Linux Difficulty Hard Nmap [root@kali] /home/kali/Checker ❯ nmap checker.htb -sV PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 8080/tcp open http Apache httpd Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 在checker.htb:8080页面上发现了一个子域名：vault ...

Environment Pom.xml <dependency> <groupId>org.apache.commons</groupId> <artifactId>commons-collections4</artifactId> <version>4.0</version> </dependency> <dependency> <groupId>org.javassist</groupId> <artifactId>javassist</artifactId> <version>3.22.0-GA</version> </dependency> TemplatesImpI 这个类用于加载恶意类，当声明一个实例的时候会触发getTransletInstance方法 查看getTransletInstance中**_name**变量为空则直接返回 ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali/swiss ❯ nmap 172.17.0.2 -sV -A Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-25 19:53 CST Nmap scan report for realgob.dl (172.17.0.2) Host is up (0.00026s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |_ 256 f1:2d:b0:54:e3:57:94:c8:3a:1a:7a:ba:d8:2d:7e:f9 (ECDSA) 80/tcp open tcpwrapped |_http-server-header: Apache/2.4.58 (Ubuntu) |_http-title: \xF0\x9F\x91\x8B Mario \xC3\x81lvarez Fer\xC5\x84andez MAC Address: 02:42:AC:11:00:02 (Unknown) No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.94SVN%E=4%D=2/25%OT=22%CT=1%CU=40368%PV=Y%DS=1%DC=D%G=Y%M=0242A OS:C%TM=67BDAF4F%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=107%TI=Z%CI=Z%I OS:I=I%TS=A)SEQ(SP=107%GCD=2%ISR=107%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M5B4ST11NW7 OS:%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4ST11NW7%O6=M5B4ST1 OS:1)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(R=Y%DF=Y%T=40% OS:W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R= OS:Y%DF=N%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T2(R=Y%DF=N%T=40%W=0%S=O%A=Z%F=R% OS:O=%RD=0%Q=)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF= OS:Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=% OS:RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%I OS:PL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.25 ms realgob.dl (172.17.0.2) OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.18 seconds ffuf 扫描得到一个file参数可以进行读取文件 ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali ❯ nmap 172.17.0.2 -sV -A Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-25 16:15 CST Nmap scan report for 172.17.0.2 Host is up (0.000089s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.58 ((Ubuntu)) |_http-server-header: Apache/2.4.58 (Ubuntu) |_http-title: Apple Store MAC Address: 02:42:AC:11:00:02 (Unknown) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop TRACEROUTE HOP RTT ADDRESS 1 0.09 ms 172.17.0.2 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.98 seconds Dirsearch [root@kali] /home/kali ❯ dirsearch -u 172.17.0.2 -t 50 -i 200 /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 50 | Wordlist size: 11460 Output File: /home/kali/reports/_172.17.0.2/_25-02-25_16-19-18.txt Target: http://172.17.0.2/ [16:19:18] Starting: [16:19:35] 200 - 631B - /login.php [16:19:41] 200 - 626B - /register.php [16:19:47] 200 - 405B - /uploads/ [16:19:48] 200 - 0B - /vendor/composer/autoload_static.php [16:19:48] 200 - 1KB - /vendor/composer/LICENSE [16:19:48] 200 - 520B - /vendor/ [16:19:48] 200 - 0B - /vendor/autoload.php [16:19:48] 200 - 0B - /vendor/composer/autoload_classmap.php [16:19:48] 200 - 0B - /vendor/composer/autoload_psr4.php [16:19:48] 200 - 0B - /vendor/composer/ClassLoader.php [16:19:48] 200 - 3KB - /vendor/composer/installed.json [16:19:48] 200 - 0B - /vendor/composer/autoload_namespaces.php [16:19:48] 200 - 0B - /vendor/composer/autoload_real.php Task Completed 可以看到存在uploads目录 ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali/chatme ❯ nmap 172.17.0.2 -sV -A Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-24 19:54 CST Nmap scan report for 172.17.0.2 Host is up (0.000088s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http nginx 1.24.0 (Ubuntu) |_http-title: ChatMe - The Best Online Chat Solution |_http-server-header: nginx/1.24.0 (Ubuntu) MAC Address: 02:42:AC:11:00:02 (Unknown) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.09 ms 172.17.0.2 网页中存在chat.chatme.dl，将其添加到**/etc/hosts** ...