DC-6

DC-6

发现主机

image-20210314184338139

扫描主机

image-20210314184439283

80服务

image-20210314184528664

image-20210314184546015

WordPress扫描

image-20210314184704376

image-20210314184751011

image-20210314184859816

默认后台

image-20210314184843929

image-20210314184926369

制作字典爆破

image-20210314185044082

wpscan扫描用户

image-20210314185155179

开始爆破

image-20210314185259547

登陆后台

image-20210314185341627

考虑插件漏洞

image-20210314185412133

image-20210314185623977

利用

image-20210314185722451

image-20210314185817111

反弹shell

image-20210314190250422

交互式

image-20210314190319179

graham密码

image-20210314190346393

ssh登陆graham

image-20210314190440212

image-20210314190502581

脚本写入

image-20210314190555240

jens无密码执行

image-20210314190640772

反弹gens的shell

image-20210314190833171

交互式

python -c "import pty;pty.spawn('/bin/bash')"

image-20210314190933892

nmap提权

echo 'os.execute("/bin/bash")' > /tmp/root.nse
cat /tmp/root.nse

image-20210314191554077

image-20210314191540646

image-20210314191622489

posted @ 2021-03-14 19:18  木捏牛  阅读(71)  评论(0)  编辑  收藏  举报