Vulnhub 96 SKYTOWER-1

考点: sqlinject,proxychains-ng,commandinject

靶机链接:https://www.vulnhub.com/entry/skytower-1,96/

环境配置

名称IP
Kali Linux10.0.2.15
SKYTOWER: 110.0.2.44

初步打点

端口扫描

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
$ export rip=10.0.2.44
$ sudo nmap -v -A -p- $rip
PORT     STATE    SERVICE    VERSION
22/tcp   filtered ssh
80/tcp   open     http       Apache httpd 2.2.22 ((Debian))
|_http-title: Site doesn't have a title (text/html).
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.2.22 (Debian)
3128/tcp open     http-proxy Squid http proxy 3.1.20
|_http-title: ERROR: The requested URL could not be retrieved
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported: GET HEAD
|_http-server-header: squid/3.1.20

3128

squid代理,测试连接无密码。可以配合proxychains-ng使用

WEB测试

测试发现sql注入

使用burpsuite和sqli_auth.listquick-SQLi.txt加速测试

找到多个可利用的注入字符

获得权限

获得用户名密码

john

hereisjohn

proxychains-ng

$ sudo vim /etc/proxychains4.conf

配置http代理

john

尝试ssh登录john

ssh登录成功后退出,sftp可以登录,下载了根目录下的几个文件,本地翻看

发现是.bashrc结尾的exit导致ssh登录成功后退出

重命名.bashrc后,ssh登录成功

翻看web目录找到数据库配置

连接数据库

idemailpassword
1john@skytech.comhereisjohn
2sara@skytech.comihatethisjob
3william@skytech.comsenseable

尝试了ssh登录,william登录失败。

sara

提权

拼接1

拼接2

获得root密码theskytower


最后修改于 2014-06-26