Skip to main content

Agent T

端口扫描​

root@ip-10-10-22-151:~# nmap -sT -p- --min-rate 1000 10.10.187.221

Starting Nmap 7.60 ( https://nmap.org ) at 2023-08-22 12:06 BST
Nmap scan report for ip-10-10-187-221.eu-west-1.compute.internal (10.10.187.221)
Host is up (0.00037s latency).
Not shown: 65534 closed ports
PORT   STATE SERVICE
80/tcp open  http
MAC Address: 02:C6:91:BD:FE:21 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 2.50 seconds

80 - HTTP​

访问 80 站点, 做了目录扫描以及查询但是没有找到任何可以利用的地方, 所以我计划查看 HTTP Header 以及服务器信息或许会有突破, 查看 HTTP Header时, 我发现这里泄露了版本信息

20240601190532

进行谷歌后我发现了一个利用脚本 php-8.1.0-dev-backdoor-rce

后渗透​

root​

下载并执行上面的脚本就可以获得 Shell

20240601190608