Posts

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali/pycrt ❯ nmap 192.168.55.36 -sV -A -p- PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-title: Apache2 Debian Default Page: It works |_http-server-header: Apache/2.4.62 (Debian) 6667/tcp open irc | irc-info: | users: 1 | servers: 1 | chans: 0 | lusers: 1 | lservers: 0 | server: irc.local | version: InspIRCd-3. irc.local | source ident: nmap | source host: 192.168.55.4 |_ error: Closing link: (nmap@192.168.55.4) [Client exited] 80端口没有可以利用的信息，只是一个静态页面 ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali/Environment ❯ nmap Environment.htb -sV -A PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0) | ssh-hostkey: | 256 5c:02:33:95:ef:44:e2:80:cd:3a:96:02:23:f1:92:64 (ECDSA) |_ 256 1f:3d:c2:19:55:28:a1:77:59:51:48:10:c4:4b:74:ab (ED25519) 80/tcp open http nginx 1.22.1 |_http-title: Save the Environment | environment.htb |_http-server-header: nginx/1.22.1 Dirsearch [root@kali] /home/kali/Environment ❯ dirsearch -u http://environment.htb _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12289 Target: http://environment.htb/ [07:23:08] Scanning: [07:23:23] 403 - 555B - /admin/.config [07:23:23] 403 - 555B - /admin/.htaccess [07:23:39] 403 - 555B - /administrator/.htaccess [07:23:43] 403 - 555B - /admpar/.ftppass [07:23:43] 403 - 555B - /admrev/.ftppass [07:23:46] 403 - 555B - /app/.htaccess [07:23:52] 403 - 555B - /bitrix/.settings.bak [07:23:52] 403 - 555B - /bitrix/.settings [07:23:52] 403 - 555B - /bitrix/.settings.php.bak [07:23:54] 301 - 169B - /build -> http://environment.htb/build/ [07:23:54] 403 - 555B - /build/ [07:24:15] 403 - 555B - /ext/.deps [07:24:15] 200 - 0B - /favicon.ico [07:24:26] 200 - 4KB - /index.php [07:24:26] 200 - 2KB - /index.php/login/ [07:24:31] 403 - 555B - /lib/flex/varien/.project [07:24:31] 403 - 555B - /lib/flex/uploader/.actionScriptProperties [07:24:31] 403 - 555B - /lib/flex/varien/.flexLibProperties [07:24:31] 403 - 555B - /lib/flex/varien/.actionScriptProperties [07:24:31] 403 - 555B - /lib/flex/uploader/.flexProperties [07:24:31] 403 - 555B - /lib/flex/uploader/.project [07:24:31] 403 - 555B - /lib/flex/uploader/.settings [07:24:31] 403 - 555B - /lib/flex/varien/.settings [07:24:34] 200 - 2KB - /login [07:24:34] 200 - 2KB - /login/ [07:24:35] 302 - 358B - /logout/ -> http://environment.htb/login [07:24:35] 302 - 358B - /logout -> http://environment.htb/login [07:24:36] 403 - 555B - /mailer/.env [07:25:01] 403 - 555B - /resources/sass/.sass-cache/ [07:25:01] 403 - 555B - /resources/.arch-internal-preview.css [07:25:02] 200 - 24B - /robots.txt [07:25:12] 301 - 169B - /storage -> http://environment.htb/storage/ [07:25:12] 403 - 555B - /storage/ [07:25:19] 403 - 555B - /twitter/.env [07:25:21] 405 - 244KB - /upload/ [07:25:22] 405 - 244KB - /upload [07:25:24] 403 - 555B - /vendor/ Task Completed Env Bypass 进入登录页，进行抓包，可以看到直接带出了报错信息 ...

Box Info OS Linux Difficulty Easy Nmap [root@kali] /home/kali/balufood ❯ nmap 172.17.0.2 -sV -A -p- PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0) | ssh-hostkey: | 256 69:15:7d:34:74:1c:21:8a:cb:2c:a2:8c:42:a4:21:7f (ECDSA) |_ 256 a7:3a:c9:b2:ac:cf:44:77:a7:9c:ab:89:98:c7:88:3f (ED25519) 5000/tcp open http Werkzeug httpd 2.2.2 (Python 3.11.2) |_http-server-header: Werkzeug/2.2.2 Python/3.11.2 |_http-title: Restaurante Balulero - Inicio Weak Pass 进入到172.17.0.2:5000/login ...

Box Info OS Linux Difficulty Hard Nmap [root@kali] /home/kali/Eureka ❯ nmap Eureka.htb -sV -A PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 d6:b2:10:42:32:35:4d:c9:ae:bd:3f:1f:58:65:ce:49 (RSA) | 256 90:11:9d:67:b6:f6:64:d4:df:7f:ed:4a:90:2e:6d:7b (ECDSA) |_ 256 94:37:d3:42:95:5d:ad:f7:79:73:a6:37:94:45:ad:47 (ED25519) 80/tcp open http nginx 1.18.0 (Ubuntu) |_http-title: Did not follow redirect to http://furni.htb/ |_http-server-header: nginx/1.18.0 (Ubuntu) 添加furni.htb到**/etc/hosts** ...

Box Info OS Linux Difficulty Hard Nmap [root@kali] /home/kali/Gallery ❯ nmap 172.17.0.3 -sV -A -p- PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.9 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 19:95:1a:f2:f6:7a:a1:f1:ba:16:4b:58:a0:59:f2:02 (ECDSA) |_ 256 e7:e9:8f:b8:db:94:c2:68:11:4c:25:81:f1:ac:cd:ac (ED25519) 80/tcp open http PHP cli server 5.5 or later (PHP 8.3.6) |_http-title: Galer\xC3\xADa de Arte Digital Feroxbuster [root@kali] /home/kali/Gallery ❯ feroxbuster -u 'http://172.17.0.3/' -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.11.0 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://172.17.0.3/ 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.11.0 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [php, txt] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 200 GET 29l 83w 1478c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 404 GET 7l 57w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 266l 543w 5288c http://172.17.0.3/style.css 200 GET 28l 63w 1104c http://172.17.0.3/login.php 200 GET 0l 0w 0c http://172.17.0.3/config.php 302 GET 0l 0w 0c http://172.17.0.3/dashboard.php => login.php SQL Injection 在用户名这里存在注入点 ...

Box Info OS Linux Difficulty Medium Nmap [root@kali] /home/kali/immportal ❯ nmap 192.168.55.17 -sV -A -p- PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:192.168.55.4 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 3 | vsFTPd 3.0.3 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_-rw-r--r-- 1 0 0 504 Feb 27 2024 message.txt 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 e8:79:ad:8b:d1:a8:39:1b:ac:ed:52:ef:d0:22:0e:eb (RSA) | 256 65:df:6d:1d:49:11:bd:f3:2f:fa:10:0c:3b:48:69:39 (ECDSA) |_ 256 f6:b7:bf:cf:a5:d5:1b:26:4e:13:08:31:07:d5:79:b1 (ED25519) 80/tcp open http Apache httpd 2.4.56 ((Debian)) |_http-title: Password |_http-server-header: Apache/2.4.56 (Debian) Own www-data ...

Box Info OS Linux Diffculty Easy Nmap [root@kali] /home/kali/up ❯ nmap 192.168.55.16 -sV -A -p- PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-server-header: Apache/2.4.62 (Debian) |_http-title: RodGar - Subir Imagen 进入之后是一个上传页面，经过测试没有漏洞 Feroxbuster [root@kali] /home/kali/up ❯ feroxbuster -u 'http://192.168.55.16/' -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.11.0 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://192.168.55.16/ 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.11.0 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [php, txt] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 403 GET 9l 28w 278c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 404 GET 9l 31w 275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 150l 388w 4489c http://192.168.55.16/ 301 GET 9l 28w 316c http://192.168.55.16/uploads => http://192.168.55.16/uploads/ 301 GET 9l 28w 319c http://192.168.55.16/javascript => http://192.168.55.16/javascript/ 200 GET 150l 388w 4489c http://192.168.55.16/index.php 403 GET 31l 94w 964c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 1l 1w 1301c http://192.168.55.16/uploads/robots.txt 301 GET 9l 28w 329c http://192.168.55.16/javascript/clipboard => http://192.168.55.16/javascript/clipboard/ 200 GET 858l 3081w 26377c http://192.168.55.16/javascript/clipboard/clipboard Own www-data 注意到**/uploads下还有一个robots.txt**，经过解码得到源码 ...

Box Info OS Linux Difficulty Easy Nmap [root@kali] /home/kali/bicho ❯ nmap 172.17.0.2 -sV -A -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-24 09:26 EDT Nmap scan report for 172.17.0.2 Host is up (0.000089s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.58 ((Ubuntu)) |_http-title: Did not follow redirect to http://bicho.dl |_http-server-header: Apache/2.4.58 (Ubuntu) 添加bicho.dl到**/etc/hosts** ...

Box Info OS Linux Difficult Easy Nmap [root@kali] /home/kali ❯ nmap 192.168.55.13 -sV -A -p- PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) | ssh-hostkey: | 2048 ac:78:16:74:49:a1:68:9d:54:84:8a:59:e9:38:10:bc (RSA) | 256 06:0c:4d:9d:2c:32:43:d2:3d:f7:4f:82:c8:15:85:60 (ECDSA) |_ 256 3b:cd:fc:1f:dd:48:0f:ee:17:78:9a:f1:09:cb:8c:ec (ED25519) 7577/tcp open http Apache Tomcat (language: en) | http-title: Site doesn't have a title (application/hal+json). |_Requested resource was http://192.168.55.13:7577/api | http-methods: |_ Potentially risky methods: PUT PATCH DELETE 9393/tcp open http Apache Tomcat (language: en) | http-methods: |_ Potentially risky methods: PUT PATCH DELETE |_http-title: Site doesn't have a title (application/hal+json). CVE-2024-37084 进入到9393端口的dashboard ...

Box Info OS Linux Difficulty Easy Nmap [root@kali] /home/kali/atom ❯ nmap 192.168.55.12 -sV -A -p- PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0) | ssh-hostkey: | 256 e7:ce:f2:f6:5d:a7:47:5a:16:2f:90:07:07:33:4e:a9 (ECDSA) |_ 256 09:db:b7:e8:ee:d4:52:b8:49:c3:cc:29:a5:6e:07:35 (ED25519) 只有22端口开放？有趣 扫一下UDP端口 [root@kali] /home/kali/atom ❯ nmap 192.168.55.12 -sU --top-ports 100 ⏎ PORT STATE SERVICE 623/udp open asf-rmcp IPMI IPMI（智能平台管理接口）能够横跨不同的操作系统、固件和硬件平台，可以智能的监视、控制和自动回报大量服务器的运作状况，以降低服务器系统成本。 ...