我是如何一步一步渗透校园网服务器的

（1）信息收集

从校园网登录认证的web服务器入手

认证登录URL:

http://10.0.0.2:9090/zportal/loginForWeb?wlanuserip=a7366ddc0f7012124df59542a882d7f2&wlanacname=c26c295bb262381f&ssid=&nasip=3dac9c253b8a73863be917b781d0bc9f&snmpagentip=&mac=db64968dc5536339374c4231e429bdf7&t=wireless-v2&url=b29991859141310b90cfc837042cef1080ede65f8fc0c5bb71caa4d767015ba5878fd061a5c8d6c8&apmac=&nasid=c26c295bb262381f&vid=a86c2d091d722253&port=dc20d085dece716c&nasportid=df0afb2364635e0979c2f2f3f4999d54304f0b2ccc9db0e352810ed24e3ecf2d

可以看到URL中的参数都被加密成一大串密文

登录成功后跳转的页面:http://10.0.0.2:9090/zportal/goToAuthResult

服务器OS:CentOS CentOS release 6.5 (Final)

服务器IP:10.0.0.2

WEB端口:9090

丢NMAP里

PORT STATE SERVICE REASON

22/tcp open ssh syn-ack ttl 128

135/tcp filtered msrpc no-response

139/tcp filtered netbios-ssn no-response

445/tcp filtered microsoft-ds no-response

514/tcp filtered shell no-response

1099/tcp open rmiregistry syn-ack ttl 128

3306/tcp open mysql syn-ack ttl 128

8009/tcp open ajp13 syn-ack ttl 128

8080/tcp open http-proxy syn-ack ttl 128

9009/tcp open pichat syn-ack ttl 128

9050/tcp open tor-socks syn-ack ttl 128

9090/tcp open zeus-admin syn-ack ttl 128

开放的端口很多,我们有戏了

祭出神器

没错，我们可以直接遍历服务器文件 这里没有保存密码 我们去看看能不能遍历shadow文件

bingo 获取root密码

用john跑了5个小时都没跑出来root密码

要换个思路了

查看下系统历史命令 看看管理员曾经都用过什么命令

发现管路员写过一个数据库备份的sh 我们看下这个sh

mysql 配置文件# The following options will be passed to all MySQL clients[client]port            = 3306socket          = /tmp/mysql.sock[mysqld]port            = 3306socket          = /tmp/mysql.sockskip-external-lockingserver-id=1basedir=/opt/mysql/mysql[mysql]default-character-set = utf8sql_mode=NO_ENGINE_SUBSTITUTION,STRICT_TRANS_TABLES mysql db_bak.sh\#!/usr/bin/env bash############################################################################################DB_HOST=`ifconfig|grep "inet addr:"|grep -v "127.0.0.1"|cut -d: -f2|awk '{print $1}'`DB_USER="root"DB_PASS=DB_PORT=3306DB_DATA_DIR=/opt/mysql/mysql/data#INDEX_FILE_NAME=mysqlmaster-bin.index# Weekly backup dayDOW='7'# Monthly backup dayDOM='01'BACK_UP_FOLDER=/opt/backup/dataBACK_UP_LOG_FOLDER=/opt/backup/log# 'daily'D_DELETE_BACKUP_OLDER_THAN_DAYS=7# 'weekly'W_DELETE_BACKUP_OLDER_THAN_DAYS=30# Dates format for naming backupsDATE_FORMAT="%Y-%m-%d_%H-%M" # currentD_DATE_FORMAT="%Y-%m-%d" # dailyW_DATE_FORMAT="%Y-%m-%d" # weeklyM_DATE_FORMAT="%Y-%m-%d" # monthly# Backup folders namesCURRENT_FOLDER='01_current'DAILY_FOLDER='02_daily'WEEKLY_FOLDER='03_weekly'MONTHLY_FOLDER='04_monthly'log_backup(){#delete binlog before 7 dayTIME=$(date "-d 7 day ago" +%Y%m%d%H%M%S)#back up binlog from yesterdayStartTime=$(date "-d 1 day ago" +"%Y-%m-%d %H:%M:%S")mysql -u$DB_USER -p$DB_PASS -e "purge master logs before ${TIME}" && echo "delete binlog before 7 day"filename=`cat $DB_DATA_DIR/$INDEX_FILE_NAME |awk -F "/" '{print $2}'`for db in $DB_LISTdodbfolder=""if [ ! -e $BACK_UP_LOG_FOLDER/$db ]; thenmkdir $BACK_UP_LOG_FOLDER/$dbfifor i in $filenamedoif [ ! -e $BACK_UP_LOG_FOLDER/$db/logBak$(date "-d " +%Y%m%d).sql.gz ]; then/usr/local/mysql/bin/mysqlbinlog -u$DB_USER -p$DB_PASS -d $db --start-datetime="$StartTime" $DB_DATA_DIR/$i |gzip >> $BACK_UP_LOG_FOLDER/$db/logBak$(date "-d " +%Y%m%d).sql.gzfidonedone}db_backup(){local dir=${BACK_UP_FOLDER}if [ ! -d $dir ]; then${MKDIR} $dirfilocal currentdirfiles="${BACK_UP_FOLDER}/${CURRENT_FOLDER}/*"local currentdir="${BACK_UP_FOLDER}/${CURRENT_FOLDER}/data"local currentdirbase="${BACK_UP_FOLDER}/${CURRENT_FOLDER}"local dailydir="${BACK_UP_FOLDER}/${DAILY_FOLDER}"local weeklydir="${BACK_UP_FOLDER}/${WEEKLY_FOLDER}"local monthlydir="${BACK_UP_FOLDER}/${MONTHLY_FOLDER}"for i in $currentdir $dailydir $weeklydir $monthlydir; doif [ ! -d $i ]; thenmkdir -p $ifidonelocal filename="${currentdirbase}/bak_`date +"$DATE_FORMAT"`_full.tar.gz"local dailyfile="${dailydir}/bak_`date +"$DATE_FORMAT"`_full.tar.gz"local weeklyfile="${weeklydir}/bak_`date +"$DATE_FORMAT"`_full.tar.gz"local monthlyfile="${monthlydir}/bak_`date +"$DATE_FORMAT"`_full.tar.gz"local posfile="${BACK_UP_FOLDER}/${CURRENT_FOLDER}/data/xtrabackup_checkpoints"local tmpdir=""#full backupif [ "`date +"%u"`" = "$DOW" ]; thenrm -rf $currentdirfilesecho `innobackupex --backup --user=$DB_USER --password=$DB_PASS --no-lock --no-timestamp ${currentdir}`filename="${currentdirbase}/bak_`date +"$DATE_FORMAT"`_full.tar.gz"echo `tar -zcvf ${filename} ${currentdir}`elif [ "`date +"%d"`" = "$DOM" ]; thenrm -rf $currentdirfilesecho `innobackupex --backup --user=$DB_USER --password=$DB_PASS --no-lock --no-timestamp ${currentdir}`filename="${currentdirbase}/bak_`date +"$DATE_FORMAT"`_full.tar.gz"echo `tar -zcvf ${filename} ${currentdir}`#incremental backupelseif [ ! -e $posfile ]; thenecho `innobackupex --backup --user=$DB_USER --password=$DB_PASS --no-lock --no-timestamp ${currentdir}`filename="${currentdirbase}/bak_`date +"$DATE_FORMAT"`_full.tar.gz"echo `tar -zcvf ${filename} ${currentdir}`elsetmpdir="${BACK_UP_FOLDER}/${CURRENT_FOLDER}/tmp"mkdir -p $tmpdirmv $currentdir $tmpdirfilename="${currentdirbase}/bak_`date +"$DATE_FORMAT"`_incremental.tar.gz"mkdir -p $currentdirlocal tmpdirtrue="${BACK_UP_FOLDER}/${CURRENT_FOLDER}/tmp/data"echo "${tmpdirtrue}"echo `xtrabackup --backup --user=$DB_USER --password=$DB_PASS --no-lock --no-timestamp --target-dir=${currentdir} --incremental-basedir=${tmpdirtrue}`echo `tar -zcvf ${filename} ${currentdir}`fifichmod +x ${filename}# Daily backupecho "doing daily backup file copy"cp $filename $dailydir# Weekly backupif [ "`date +"%u"`" = "$DOW" ]; thenif [ ! -e $weeklyfile ]; thenecho "doing weekly backup file copy"cp $filename $weeklydirfifi# Monthly backupif [ "`date +"%d"`" = "$DOM" ]; thenif [ ! -e $monthlyfile ]; thenecho "doing monthly backup file copy"cp $filename $monthlydirfifiecho `rm -f ${filename}`echo `rm -rf ${tmpdir}`}delete_old_backups(){local dailydir="${BACK_UP_FOLDER}/${DAILY_FOLDER}"local weeklydir="${BACK_UP_FOLDER}/${WEEKLY_FOLDER}"log_b "Deleting old backups on database ${database}"find ${dailydir} -name "*.tar.gz" -mtime +${D_DELETE_BACKUP_OLDER_THAN_DAYS} -type f -print -exec rm -f {} \;find ${weeklydir} -name "*.tar.gz" -mtime +${W_DELETE_BACKUP_OLDER_THAN_DAYS} -type f -print -exec rm -f {} \;}db_backup#log_backup#delete_old_backups

bingo 得到数据库的密码

连接一下 连接失败 mysql不允许远程连接

试一下用mysql的密码登录ssh

bingo

修改mysql权限 我们远程访问它

大概逃了一天课就把它数据库搞出来了 不得不说学校联通服务器的安全实在堪忧