Penetration path cracking clearance game server

Text/graphic sword

In other words, I saw some hakc game games on my love blog two days ago. At that time, I felt bored. I just opened it and looked at it.

Click the link to view details.

 

So many levels? It immediately fell victim to the storm. But it doesn't matter. It's just entertainment. It's also idle .....

 

It hurts a bit. Cannot be registered ??

Forget it. Go to the main site and check out other things.

The main site is full of games.Technology,Benefits,Knowledge,Entertainment...And so on--I foundHack.

 

--I suddenly felt like this game.....Speechless??

Okay. Continue...

When the fourth level is reached

 

He asked us to intrude into a server. UseTelnetLogin method. Needless to say,The explicit intention of the author isTelnetVulnerabilities exist. Then takeX-scanScan the serverTelnetWeak password. Actually exists...

CheckDosInterface,There is a kind of heart to raise the right.--,,Are you hungry???

I tried several common commands. The permission is not bad. Very loose,,No special settings are made. But onlyGuestPermission

 

Think that the guest permission should be huge, and there are a lot of things to do. I wanted to upload a permission escalation tool, but Baidu could not find the command to upload files under dos... Enough cups.

Forget it. Ignore him first. Continue customs clearance ......

Starting from the 9th mark, the system intrude into a blog program set by the author.

 

The last few Customs also had a good trip. But when I saw the last mark, I was excited ..

 

Isn't it clear that you want to send us webshell ?? What are you waiting ??

 

The program did not re-name the uploaded files, directly upload a 1.asp;1.jpg file to win.

 

I passed a shell and checked it out. Although each drive letter cannot be browsed, aspx and php are not supported, and the server has not enabled 1433,3306. Fortunately, ws exists, and I am thinking about it. He should have crashed. Find a writable directory and upload it to cmd. However, the upload type does not match. We can ignore this. In fact, we have uploaded it. First, systeminfo is used to check the server information and no pr or barbecue patch number is found.

 

Pr seckilling should be available.

Upload pr and execute C: WINDOWSTemppr.pdf "ipconfig", but the ECHO is blank. Tried

C: WINDOWSTemppr.pdf "ipconfig"> C: windowstemp1.txt00001.txt indicates that the input exceeds the end of the file. It seems that there is indeed no echo content. Then I tried again.

 

The echo content is displayed. In this case, you should pass a custom path to the barbecue to solve the problem.

Or an error is prompted. Ah, a little cup of cake. I threw a few more ms, but it was still useless ..

Suddenly, what if I think of another telnet user with the guest permission? Ah, I am so old that my memory is poor. The world is after 00 ..

Run the question. Let's continue.

Telnet the server again. Cd to the temp directory. Run the command with pr and barbecue. Or an error is returned. It is a bit difficult to get this .. is this a legendary rp problem ???

I tried ms Privilege Escalation before disabling telnet.

The execution was successful.

 

Haha, since it is intranet. The forwarding port. After successful forwarding, check the Intranet. It's actually vmware. I wanted to penetrate into his host. It would be too much to detect friendship, and it would be immoral. Clear logs. Notification management. Quit ~~