Windy's little blog

一切生活中的杂七杂八, and I like CTF.

Vulnhub The Office: Doomsday Device done!,627/Very interesting machine.Recommand you the writeup by ghost26082012 here:

Vulnhub hacksudo: 1 Walkthough,650/Simple walkthrough.Scan ports.Scan port 80, check each file's source code, but nothing useful.Port 8080 is tomcat, with default creds. Use msfconsole to get reverse shell.Now we are user tomcat.Upload

Vulnhub DOUBLE: 1 Walkthough,632/Scan ports opened.Port 8080 need auth, we don't know yet. So we start from port 80.Check http://url/production. Try to send some cmd, like cmd="id", code="1", then we can see the comm

Vulnhub Alfa: 1 Simple Walkthrough,655/Simple walkthroug:nmap -sV -sC -p-  -oN ports.logftp log in as anonymous, get a pic file.check robots.txt, find brain fuck strings, decode it, and get a new url.enum4linux, get username.ente

Vulnhub bassamCTF: 1 Walkthough

Machine is here.Nmap scan ports.Port 80 only has one file.Get domain name from index.html.Add it to /etc/hosts, then brute force vhost.gobuster vhost -u http://bassam.ctf  -w /usr/share/seclists/Discovery/DNS/subdomains-

HackMyVm Crossroads Walkthrough

Machine can be download here.Nmap scan ports, 80,139 and 445 are open.Port 80 is a static index.html, with nothing interesting. Gobuster scan  port 80, we get robots.txt and note.txt, but nothing useful too.Move to smb. Smbclient with no usernam

HackMyVm Satori Walkthrough

Machine can be download here.Nmap scan ports. 21,22,80 three ports open.Ftp login as anonymous, find a mkv file with no use.Scan port 80, find index.html and stream.php.Open index.html, looks like a youtube downloader.Check source code of index.html,

HackMyVm Driftingblues5 Walkthrough

A not so easy machine made by tasiyanci, can be download here.Thanks tasiyanci for the hints.Nmap scan ports, 22 and 80.Open port 80, it's a wordpress site.Wpscan the site, found some usernames, but no vulnerable plugins.wpscan --url ht


边学习边记录。首先推荐一篇介绍SSTI的好文章。按照官方指南,docker-compose下载并运行,访问本机5000商品,显示一个输入框。随便输入个123,显示N1 page页面,且123被输出了。在burpsuite中看一下,这是个post页面,其中的session是可以注入的,后面看到。点击article后,在bp中随便输入后,可以爆出路径。这个参数带有LFI漏洞。尝试不同输入,/proc/self/environ查看环境变量,爆出服务器路径为/home/sssssserver。Serve

HackMyVm Speed Walkthrough

Another interesting machine from HackMyVm, can be download here.Nmap scan ports, find 22,80,7080 and 8088.Port 80 is a service named "sar2html".Port 7080 is OpenLiteSpeed Control Panel.Port 8088 is a sample site of OpenLiteSpeed.Search the
<< < 2 3 4 5 6 7 8 9 10 11 > >>

Powered By Z-BlogPHP 1.7.0