Notes Site.
post @ 2024-05-12

Perfection (Linux · Easy)

RubySSTI+hashcat

枚举

nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
nmap -sC -sV -sT -T4 10.10.11.253

Nmap scan report for 10.10.11.253 (10.10.11.253)
Host is up (0.26s latency).
Not shown: 984 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
6/tcp filtered unknown
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 80:e4:79:e8:59:28:df:95:2d:ad:57:4a:46:04:ea:70 (ECDSA)
|_ 256 e9:ea:0c:1d:86:13:ed:95:a9:d0:0b:c8:22:e4:cf:e9 (ED25519)
33/tcp filtered dsp
80/tcp open http nginx
|_http-title: Weighted Grade Calculator
1010/tcp filtered surf
1151/tcp filtered unizensus
1277/tcp filtered miva-mqs
1352/tcp filtered lotusnotes
3221/tcp filtered xnm-clear-text
5431/tcp filtered park-agent
6129/tcp filtered unknown
6566/tcp filtered sane-port
6792/tcp filtered unknown
10616/tcp filtered unknown
10629/tcp filtered unknown
41511/tcp filtered unknown
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

dirsearch

image-20240429203253429

网页底部,提供了相关信息,Ruby Web

image-20240430134229759

/weighted-grade,在此测试

Read More
post @ 2024-05-10

Headless (Linux · Easy)

XSS+SUID提权

枚举

nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
nmap -sC -sT -sV - 10.10.11.8

Nmap scan report for 10.10.11.8 (10.10.11.8)
Host is up (0.23s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
| 256 90:02:94:28:3d:ab:22:74:df:0e:a3:b2:0f:2b:c6:17 (ECDSA)
|_ 256 2e:b9:08:24:02:1b:60:94:60:b3:84:a9:9e:1a:60:ca (ED25519)
5000/tcp open upnp?
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 200 OK
| Server: Werkzeug/2.2.2 Python/3.11.2
| Date: Sun, 28 Apr 2024 07:24:48 GMT
| Content-Type: text/html; charset=utf-8
| Content-Length: 2799
| Set-Cookie: is_admin=InVzZXIi.uAlmXlTvm8vyihjNaPDWnvB_Zfs; Path=/
| Connection: close
| <!DOCTYPE html>
| <html lang="en">
| <head>
| <meta charset="UTF-8">
| <meta name="viewport" content="width=device-width, initial-scale=1.0">
| <title>Under Construction</title>
| <style>
| body {
| font-family: 'Arial', sans-serif;
| background-color: #f7f7f7;
| margin: 0;
| padding: 0;
| display: flex;
| justify-content: center;
| align-items: center;
| height: 100vh;
| .container {
| text-align: center;
| background-color: #fff;
| border-radius: 10px;
| box-shadow: 0px 0px 20px rgba(0, 0, 0, 0.2);
| RTSPRequest:
| <!DOCTYPE HTML>
| <html lang="en">
| <head>
| <meta charset="utf-8">
| <title>Error response</title>
| </head>
| <body>
| <h1>Error response</h1>
| <p>Error code: 400</p>
| <p>Message: Bad request version ('RTSP/1.0').</p>
| <p>Error code explanation: 400 - Bad request syntax or unsupported method.</p>
| </body>
|_ </html>

...

http://10.10.11.8:5000/

image-20240428182551382

dirsearch

image-20240428182842525

/support

Read More
⬆︎TOP