HackTheBox:Lame writeup
開始根據TJ null's OSCP list 刷靶機。
這是第1台。希望能堅持把它刷完。
先 nmap 檢查它開什麼服務
加 -sC 做script scan
仔細看看smb:
Samba 3.0.20 查一下看到有 CVE (CVE-2007-2447) 跟 metasploit 模組
直接拿來用:
然後就拿到root shell了。
TOTOLINK N200RE_v5 Telnet Backdoor
Wenyi Li @UCCU Hacker Description The telnet service on the router, though disabled by default, can be enabled by an unauthenticated attacker with a single POST request. The attacker can then login as root with hardcoded credentials. Affected versions Tested on firmware version V9.3.5u.6139, other versions may also be vulnerable. Cause Analysis The web interface issues a SESSION_ID cookie upon a successful login. However, the request endpoints do not check for it, resulting in broken access control. POC demo
留言
張貼留言