Title: Record once the spinach website penetrates semi-finished products

Posted April 10Apr 10

Preface

On a sunny afternoon, we were talking enthusiastically under the leadership of Blank, women.

And Mr. float discovered a strange IP that visited his blog.

Alas, I don’t take any network security laws seriously at all, just start fighting.

Browser access will directly jump to the login interface.

Knock an X on the path. Get ThinkPHP and version number.

At the same time, Mr. float nmap scanned to port 801 and confirmed that it was Baota website building. However, there is no further study here.

5.0.21 can directly RCE, and payload is flying all over the sky. But I still encountered a little pitfall.

The module name is not the usual index and must exist. Log in according to the jump:

/admin/login/index.html

It was guessed that the module was admin, and it was indeed successful.

Disable_functions is in the column, and rce is indeed unsuccessful.

The good news is that the file was successfully written.

Visit shell.php and see the phpinfo interface.

The backhand wrote about the ice scorpion and horse connecting it.

I took the opportunity to take a look, loan, manager, salesperson, bc. OK, keep on playing.

Hard coding is really a problem in the universe, and the database password is obtained.

The first time I encountered MySQL password, there is @ in it, writing it directly will destroy the connection string. like:

mysql://root:[email protected]:3306/mysql

The @ in password will make the judgment that the ip: port will go to the ip: port in advance. It needs to be encoded as %40

There is no progress in flipping the web directory and code, so try to log in to the system.

There is an account password in the database, of course, the password is a hash with salt.

Whoever has a good family must have a password, just patch the login code, and then you won’t check the table.

This business looks so advanced, I can't understand it a little, so I leave the backdoor user in case of missed

Reprinted from the original link: https://mp.weixin.qq.com/s/f4nWOGgPXlSA_ChgpBj7Zw

Quote