vulnhub靶场实战系列-DC-2实战

最新推荐文章于 2025-01-10 17:27:14 发布

原创

最新推荐文章于 2025-01-10 17:27:14 发布 · 1.7k 阅读

关于本文的所有留言评论与转载、引用文纯属文字原作者个人观点，与本文观点及立场无关；浏览者在本文发表信息时需要遵守中国现行相应法律，不得发布违法信息；本站提供的资源，都来自网络，版权争议与本站无关，所有内容及软件的文章仅限用于学习和研究目的；不得将上述内容用于商业或者非法用途，否则，一切后果请用户自负,通过使用本文内容随之而来的风险与本文无关；禁止一切未授权进行渗透测试活动，违者与作者无关；本文只是供学习和研究使用。

前言

Vulnhub是一个提供各种漏洞环境的靶场平台，大部分环境是做好的虚拟机镜像文件，镜像预先设计了多种漏洞，需要使用VMware或者VirtualBox运行，本文使用VMware测试，每个镜像会有破解的目标，挑战的目标是获取操作系统的root权限和获得flag。

一、环境配置

官网：https://www.vulnhub.com
1.在官网搜索你想要的镜像,然后下载【建议下载 (Mirror)版本】
2.下载好后解压得到dc-2.ova的文件
3.在Vmware中导入下载解压后的dc-2.ova，点击“文件”→“打开”
4.将DC-2虚拟机环境的网络模式设置为nat模式
5.导入成功以后，在“我的计算机”中，
选中“DC-2”，点击“鼠标右键”→“管理（M）”→“更改硬件兼容性（H）”’
在弹出的选项框中，选择“我已复制该虚拟机”→“下一步”→“硬件兼容性”**选择低版本（如Workstation 16.2.x）**→“下一步”→选择“更改此虚拟机（A）”→“下一步”→完成硬件兼容性更改。【此步骤是非必要步骤，当修改虚拟机网络出现闪退时，执行第5步操作】
修改硬件兼容性
6.拍摄快照，点击“鼠标右键”→选择“拍摄快照”→输入“初始化状态”【该步骤可以在渗透测试不成功或者环境损害的时候，恢复初始化环境】
创建快照

二、信息收集

2.1 主机发现

使用kali系统的arp-scan工具，扫描kali系统所处的网络环境（192.168.6.0）

┌──(root㉿kali)-[/home/kali]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:b6:02:f0, IPv4: 192.168.6.66
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.6.1	00:50:56:c0:00:08	VMware, Inc.
192.168.6.2	00:50:56:f5:7b:9f	VMware, Inc.
192.168.6.1	00:50:56:c0:00:08	VMware, Inc. (DUP: 2)
192.168.6.154	00:0c:29:fa:50:aa	VMware, Inc.
192.168.6.254	00:50:56:fa:ae:e4	VMware, Inc.

6 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.348 seconds (109.03 hosts/sec). 4 responded

获得目标主机信息

目标主机信息：
IP地址：192.168.6.154
MAC地址：00:0c:29:fa:50:aa

2.2 端口扫描

┌──(root㉿kali)-[/home/kali]
└─# nmap -sV -p- 192.168.6.154
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-18 03:48 EDT
Nmap scan report for 192.168.6.154
Host is up (0.00089s latency).
Not shown: 65533 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.10 ((Debian))
7744/tcp open  ssh     OpenSSH 6.7p1 Debian 5+deb8u7 (protocol 2.0)
MAC Address: 00:0C:29:FA:50:AA (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.61 seconds

扫描结果显示：
DC-2目标靶机开放的端口有80和7744端口，
80端口为：http服务,协议及版本为：Apache httpd 2.4.10 ((Debian)) ，
7744端口为：ssh服务，版本号为：OpenSSH 6.7p1 Debian 5+deb8u7 (protocol 2.0)

2.3 网站指纹识别

┌──(root㉿kali)-[/home/kali]
└─# whatweb -v 192.168.6.154
WhatWeb report for http://192.168.6.154
Status    : 301 Moved Permanently
Title     : <None>
IP        : 192.168.6.154
Country   : RESERVED, ZZ

Summary   : Apache[2.4.10], HTTPServer[Debian Linux][Apache/2.4.10 (Debian)], RedirectLocation[http://dc-2/]

Detected Plugins:
[ Apache ]
	The Apache HTTP Server Project is an effort to develop and 
	maintain an open-source HTTP server for modern operating 
	systems including UNIX and Windows NT. The goal of this 
	project is to provide a secure, efficient and extensible 
	server that provides HTTP services in sync with the current 
	HTTP standards. 

	Version      : 2.4.10 (from HTTP Server Header)
	Google Dorks: (3)
	Website     : http://httpd.apache.org/

[ HTTPServer ]
	HTTP server header string. This plugin also attempts to 
	identify the operating system from the server header. 

	OS           : Debian Linux
	String       : Apache/2.4.10 (Debian) (from server string)

[ RedirectLocation ]
	HTTP Server string location. used with http-status 301 and 
	302 

	String       : http://dc-2/ (from location)

HTTP Headers:
	HTTP/1.1 301 Moved Permanently
	Date: Sat, 18 May 2024 16:16:32 GMT
	Server: Apache/2.4.10 (Debian)
	Location: http://dc-2/
	Content-Length: 0
	Connection: close
	Content-Type: text/html; charset=UTF-8

扫描结果显示：Apache[2.4.10], HTTPServer[Debian Linux][Apache/2.4.10 (Debian)], RedirectLocation[http://dc-2/]

三、渗透测试

flag1

1.修改hosts文件

hosts文件路径：

C:\Windows\System32\drivers\etc\hosts

2.添加内容

192.168.6.154 dc-2

3.返回页面：

flag

4.获得flag1

flag1提示

Flag 1:
Your usual wordlists probably won’t work, so instead, maybe you just need to be cewl.
More passwords is always better, but sometimes you just can’t win them all.
Log in as one to see the next flag.
If you can’t find it, log in as another.
提示用cewl来获取密码，所以应该是爆破密码之类的，且提示自己所有的密码字典可能无效，且有时没法获得所有密码，提示用其他的身份去登录。

flag2

1.目录扫描

┌──(root㉿kali)-[/home/kali]
└─# dirsearch -u 192.168.6.154 -e *          
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _