Title: A penetration test for a spinach website

A spinach-to-day from a big brother, which is a 0-day upload of any file. The webshell is obtained by uploading any file, but you can see that the pagoda is opened by scanning the port.

Then the following problem arose.

Use Godzilla's bypass plugin to execute commands.

The user is WWW, the default user of Baota. The next step is to regular operations, increase authority and log in to Baota.

First carry out the escalation, upload the escalation cow and then look at the escalation exp that can be used.

After running, use CVE-2021-4034 to increase the rights, and first upload the EXP file to the spinach server.

Bounce the shell, then enter the exp folder to compile and run to obtain root permissions.

After obtaining the root permissions, you will do the work, just create an account and grant permissions. The rebound shell cannot vim, then saves its passwd file locally and then gives 0 to the third column, so that logging in afterwards is root.

The account created is ftpp, then save it as passwd file and upload it to the web directory. Use the root permissions after the privilege escalation to delete passwd first and then copy it.

Because this server has a Baota control panel, first enter /www/server/panel/data. There is a default.db file in this folder, which is the Baota configuration data file. After saving it locally, modify its pagoda password and log in. Then remember to restore the db data file after the end, so that his password will be the original password.

Then change the password and log in.

By logging in, you can see the complete information of the site, as well as the database password, web directory, and his mobile phone number, but the mobile phone number is only the first three and the last four, and the middle four digits are number *. The previous method of checking the mobile phone number is useless. In fact, just call it here, and just hand it over to the police to arrest the person.

Reprinted from the original link: https://mp.weixin.qq.com/s/iUipOa4BI8mCBJ7o2QgJrA