Network Attack and Defense: Summary of instructor server penetration

1. prelude
At the invitation of a friend, I entered 90sec for the first time. Nima, having been tossing for a long time, could not read the article. When you enter the forum, you have nothing to do with it. You just want to learn the ideas of the experts. However, the rule is the rule, or write a penetration article.


2. A brief introduction to the situation of coriander
Because it was a senior doll, we opened the course of network attack and defense. This name sounds domineering, but for me, I understand a lot of things, so I also ignore this course. Because we are teaching in the lab, we can't skip classes, and the teachers will find out if we skip classes. I was forced to go crazy. Sometimes I was forced to do some questions assigned by the teacher. In order to end this hard life early, the food decides to give this server (many websites built by teachers are on it) to xxoo. If the teacher asks me in the future, do you have any questions? I can be proud, teacher. Is this the legendary key? Okay. Let's get down to the truth.

3. Start
The website ip address is 222.18.xx.xx, the server is apache (win32), and the script is php (nonsense, apache does not use php scripts ). The teacher used the one-click Integration Environment wamp. On this day, the teacher was talking about php script injection and said that there was a question on the website (our course is to take the key for the question ), it's about php injection. Let's do it. When I heard this, I was so excited that I could finally use the server of my instructor xxoo. How proud, how proud, and how glorious it was! Let's work together. At this time, when is x. Decisive start.


4. Penetration
The question is very simple, but at this time I like it. Inject existing pages, for example, (NO, NO)



Injection Point Graph

After a simple test, and 1 = 1 and 1 = 2 are added to the backend, different pages are displayed. After the test, no filtering is found. Next, use the injection tool I wrote. The test results are as follows:


Injection result

All right, fill in the total number of fields and the displayed position. All the information is displayed.

Write the following shell. To write the shell, you must know the physical path. Because it is a one-click wamp integrated environment, you can access phpinfo on the home page to obtain the physical path C:/wamp/www.




Write the shell, for example, to C:/wamp/www/shell. php)


Access http://www.bkjia.com/shell. php, successful, as shown in:

 

The connection is successful in shell writing, as shown in:

5. Elevation of Privilege

Because the one-click integrated installation environment is used, and the permission to start the apache service is not modified, the permission is directly raised. Activate the guest user and add it to the Administrator group:

6. log on to the server

 

 

In this way, xxoo is the teacher's server, so happy!

7. Summary

I showed off in front of my classmates, but I thought that my teacher would ask me a question and I could just find the key. There are many people who feel that this is a false move. Of course, this is undeniable. However, this is also a little bit of thinking of the side dish. I hope you will forgive me a lot. So far, I really don't want to dig any 0day to prove my own strength. I will certainly have it in future articles. So write a simple article to fill up the amount of data.