digitalworld.local FALL

https://download.vulnhub.com/digitalworld/FALL.7z

靶场IP：192.168.32.202

扫描对外端口服务

┌──(root💀kali)-[/tmp]
└─# nmap -p 1-65535 -sV  192.168.32.202
Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-05 02:20 EDT
Nmap scan report for 192.168.32.202
Host is up (0.00024s latency).
Not shown: 65368 filtered tcp ports (no-response), 154 filtered tcp ports (host-prohibited)
PORT      STATE  SERVICE     VERSION
22/tcp    open   ssh         OpenSSH 7.8 (protocol 2.0)
80/tcp    open   http        Apache httpd 2.4.39 ((Fedora) OpenSSL/1.1.0i-fips mod_perl/2.0.10 Perl/v5.26.3)
111/tcp   closed rpcbind
139/tcp   open   netbios-ssn Samba smbd 3.X - 4.X (workgroup: SAMBA)
443/tcp   open   ssl/http    Apache httpd 2.4.39 ((Fedora) OpenSSL/1.1.0i-fips mod_perl/2.0.10 Perl/v5.26.3)
445/tcp   open   netbios-ssn Samba smbd 3.X - 4.X (workgroup: SAMBA)
3306/tcp  open   mysql       MySQL (unauthorized)
8000/tcp  closed http-alt
8080/tcp  closed http-proxy
8443/tcp  closed https-alt
9090/tcp  open   http        Cockpit web service 162 - 188
10080/tcp closed amanda
10443/tcp closed cirrossp
MAC Address: 00:0C:29:18:2F:1F (VMware)
Service Info: Host: FALL; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 193.85 seconds

浏览器访问80端口

image-20220905142656824

爆破web目录

发现test.php，需要添加GET参数

image-20220906101233631

爆破参数

image-20220906112025018

获取qiu用户的私钥

ssh登录qiu用户

查看.bash_history文件

image-20220906112352166

提权成功

image-20230208134746313
上一页digitalworld.local DEVELOPMENT下一页digitalworld.local JOY

最后更新于

这有帮助吗？