OSCP靶场--Shenzi

OSCP靶场–Shenzi

考点(1.目录扫描：可以尝试使用多个工具(扫描不出来任何东西，可以结合机器名拼接url 2.WP 目标插入webshell getshell 3.windows环境AlwaysInstallElevated提权)

1.nmap扫描

┌──(root㉿kali)-[~/Desktop]└─# nmap -sV -sC -p- 192.168.161.55 --min-rate 5000Starting Nmap 7.92 ( https://nmap.org ) at 2024-02-29 05:04 ESTNmap scan report for 192.168.161.55Host is up (0.24s latency).Not shown: 65520 closed tcp ports (reset)PORT      STATE SERVICE       VERSION21/tcp    open  ftp           FileZilla ftpd 0.9.41 beta| ftp-syst: |_  SYST: UNIX emulated by FileZilla80/tcp    open  http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6| http-title: Welcome to XAMPP|_Requested resource was http://192.168.161.55/dashboard/135/tcp   open  msrpc         Microsoft Windows RPC139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn443/tcp   open  ssl/http      Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)|_ssl-date: TLS randomness does not represent time|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6| ssl-cert: Subject: commonName=localhost| Not valid before: 2009-11-10T23:48:47|_Not valid after:  2019-11-08T23:48:47| http-title: Welcome to XAMPP|_Requested resource was https://192.168.161.55/dashboard/| tls-alpn: |_  http/1.1445/tcp   open  microsoft-ds?3306/tcp  open  mysql?| fingerprint-strings: |   DNSVersionBindReqTCP, NULL: |_    Host '192.168.45.200' is not allowed to connect to this MariaDB server5040/tcp  open  unknown7680/tcp  open  pando-pub?49664/tcp open  msrpc         Microsoft Windows RPC49665/tcp open  msrpc         Microsoft Windows RPC49666/tcp open  msrpc         Microsoft Windows RPC49667/tcp open  msrpc         Microsoft Windows RPC49668/tcp open  msrpc         Microsoft Windows RPC49669/tcp open  msrpc         Microsoft Windows RPC1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :SF-Port3306-TCP:V=7.92%I=7%D=2/29%Time=65E056D3%P=x86_64-pc-linux-gnu%r(NUSF:LL,4D,"I
2.user priv
2.1 目录扫描dirsearch扫描无发现，feroxbuster扫描发现内容：
\x01\xffj\x04Host\x20'192\.168\.45\.200'\x20is\x20not\x20alSF:lowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(DNSVersioSF:nBindReqTCP,4D,"I
┌──(root㉿kali)-[~/Desktop]└─# dirsearch --url http://192.168.161.55/              _|. _ _  _  _  _ _|_    v0.4.2 (_||| _) (/_(_|| (_| )Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927Output File: /root/.dirsearch/reports/192.168.161.55/-_24-02-29_05-11-04.txtError Log: /root/.dirsearch/logs/errors-24-02-29_05-11-04.logTarget: http://192.168.161.55/[05:11:04] Starting: [05:11:07] 403 -    1KB - /%C0%AE%C0%AE%C0%AF                              [05:11:07] 403 -    1KB - /%3f/                                            [05:11:08] 403 -    1KB - /%ff                                             [05:11:12] 403 -    1KB - /.ht_wsr.txt                                     [05:11:12] 403 -    1KB - /.htaccess.bak1                                  [05:11:12] 403 -    1KB - /.htaccess.sample[05:11:12] 403 -    1KB - /.htaccess.save[05:11:12] 403 -    1KB - /.htaccess.orig[05:11:12] 403 -    1KB - /.htaccess_extra[05:11:12] 403 -    1KB - /.htaccess_orig[05:11:12] 403 -    1KB - /.htaccess_sc[05:11:12] 403 -    1KB - /.htaccessBAK[05:11:12] 403 -    1KB - /.htaccessOLD[05:11:12] 403 -    1KB - /.htaccessOLD2[05:11:12] 403 -    1KB - /.htm                                            [05:11:12] 403 -    1KB - /.html[05:11:12] 403 -    1KB - /.htpasswd_test[05:11:12] 403 -    1KB - /.httr-oauth[05:11:12] 403 -    1KB - /.htpasswds[05:11:27] 403 -    1KB - /Trace.axd::$DATA                                 [05:11:29] 200 -  780B  - /Webalizer/                                       [05:11:59] 403 -    1KB - /cgi-bin/                                         [05:11:59] 500 -    1KB - /cgi-bin/printenv.pl                              [05:12:04] 301 -  344B  - /dashboard  ->  http://192.168.161.55/dashboard/  [05:12:04] 200 -    6KB - /dashboard/howto.html                             [05:12:05] 200 -   31KB - /dashboard/faq.html                               [05:12:05] 200 -   78KB - /dashboard/phpinfo.php                            [05:12:12] 403 -    1KB - /error/                                           [05:12:14] 200 -   30KB - /favicon.ico                                      [05:12:15] 503 -    1KB - /examples/[05:12:15] 503 -    1KB - /examples/servlets/index.html[05:12:15] 503 -    1KB - /examples/servlets/servlet/CookieExample          [05:12:15] 503 -    1KB - /examples                                         [05:12:15] 503 -    1KB - /examples/jsp/snp/snoop.jsp                       [05:12:15] 503 -    1KB - /examples/jsp/%252e%252e/%252e%252e/manager/html/[05:12:15] 503 -    1KB - /examples/servlet/SnoopServlet                    [05:12:15] 503 -    1KB - /examples/servlets/servlet/RequestHeaderExample[05:12:21] 301 -  338B  - /img  ->  http://192.168.161.55/img/              [05:12:21] 302 -    0B  - /index.php  ->  http://192.168.161.55/dashboard/  [05:12:22] 302 -    0B  - /index.php/login/  ->  http://192.168.161.55/dashboard/[05:12:22] 403 -    1KB - /index.php::$DATA                                 [05:12:22] 302 -    0B  - /index.pHp  ->  http://192.168.161.55/dashboard/[05:12:22] 302 -    0B  - /index.php.  ->  http://192.168.161.55/dashboard/[05:12:35] 403 -    1KB - /phpmyadmin/ChangeLog                             [05:12:35] 403 -    1KB - /phpmyadmin/docs/html/index.html                  [05:12:35] 403 -    1KB - /phpmyadmin/doc/html/index.html                   [05:12:35] 403 -    1KB - /phpmyadmin/README                                [05:12:36] 403 -    1KB - /phpmyadmin                                       [05:12:38] 403 -    1KB - /phpmyadmin/                                      [05:12:38] 403 -    1KB - /phpmyadmin/index.php[05:12:38] 403 -    1KB - /phpmyadmin/phpmyadmin/index.php                  [05:12:38] 403 -    1KB - /phpmyadmin/scripts/setup.php                     [05:12:44] 403 -    1KB - /server-info                                      [05:12:44] 403 -    1KB - /server-status[05:12:44] 403 -    1KB - /server-status/[05:13:05] 403 -    1KB - /web.config::$DATA                                [05:13:06] 403 -    1KB - /webalizer                                        [05:13:08] 200 -  772B  - /xampp/                                                                         Task Completed  
2.2 feroxbuster目录扫描发现wp:
\x01\xffj\x04Host\x20'192\.168\.45\.200'\x20is\x20SF:not\x20allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server");Service Info: OS: Windows; CPE: cpe:/o:microsoft:windowsHost script results:| smb2-security-mode: |   3.1.1: |_    Message signing enabled but not required|_clock-skew: -1s| smb2-time: |   date: 2024-02-29T10:07:54|_  start_date: N/AService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 204.23 seconds

┌──(root㉿kali)-[~/Desktop]└─# feroxbuster -u http://192.168.161.55/shenzi                     302      GET        0l        0w        0c http://192.168.161.55/shenzi/login => http://192.168.161.55/shenzi/wp-login.php

2.2 smb共享可读：发现wp凭据：

## ┌──(root㉿kali)-[~/Desktop]└─# smbmap -H 192.168.161.55 -u guest -p ""    [+] IP: 192.168.161.55:445      Name: 192.168.161.55                                            Disk     Permissions     Comment        ----     -----------     -------        IPC$     READ ONLY       Remote IPC        Shenzi   READ ONLY                                ## 下载smb文件并查看：┌──(root㉿kali)-[~/Desktop]└─# smbclient -N  //192.168.161.55/Shenzi         Try "help" to get a list of possible commands.smb: \> dir  .                                   D        0  Thu May 28 11:45:09 2020  ..                                  D        0  Thu May 28 11:45:09 2020  passwords.txt                       A      894  Thu May 28 11:45:09 2020  readme_en.txt                       A     7367  Thu May 28 11:45:09 2020  sess_klk75u2q4rpgfjs3785h6hpipp      A     3879  Thu May 28 11:45:09 2020  why.tmp                             A      213  Thu May 28 11:45:09 2020  xampp-control.ini                   A      178  Thu May 28 11:45:09 2020                12941823 blocks of size 4096. 6493064 blocks availablesmb: \> get passwords.txtgetting file \passwords.txt of size 894 as passwords.txt (0.9 KiloBytes/sec) (average 0.9 KiloBytes/sec)smb: \> get readme_en.txtgetting file \readme_en.txt of size 7367 as readme_en.txt (4.1 KiloBytes/sec) (average 2.9 KiloBytes/sec)smb: \> get sess_klk75u2q4rpgfjs3785h6hpippgetting file \sess_klk75u2q4rpgfjs3785h6hpipp of size 3879 as sess_klk75u2q4rpgfjs3785h6hpipp (3.9 KiloBytes/sec) (average 3.2 KiloBytes/sec)smb: \> get why.tmp getting file \why.tmp of size 213 as why.tmp (0.2 KiloBytes/sec) (average 2.5 KiloBytes/sec)smb: \> get xampp-control.inigetting file \xampp-control.ini of size 178 as xampp-control.ini (0.2 KiloBytes/sec) (average 2.1 KiloBytes/sec)smb: \> SMBecho failed (NT_STATUS_CONNECTION_RESET). The connection is disconnected now

2.3 登陆wp dashboard:

���意目录扫描：目录扫描 不到的时候，注意url后添加机器名称shenzi试试：

http://192.168.161.55/shenzi/wp-login.php

2.4 wp 404模板插入php webshell:

### 1. php 正向webshellhttps://github.com/WhiteWinterWolf/wwwolf-php-webshell/blob/master/webshell.php#

1. WordPress:

   User: admin

   Password: FeltHeadwallWight357

https://192.168.161.55/shenzi/wp-admin/

5) WordPress:

User: admin

Password: FeltHeadwallWight357