This is also a practical question. Opening the website page shows an authentication page, which tells us that the username is admin, so we need to crack the password.
Packet capture reveals that it is Authorization authentication.
Send the packet to intruder and set the traversal node.
The above traversal point is base64 encoded. After decoding, it is admin:123, so we need to set the payload to match this format.
Set payload type: Custom iterator.
The first value is the username admin.
The second value is a colon.
The third value loads the dictionary file.
Add payload processing to base64 the above content (admin:123).
After setting is complete, you can start the brute force attack and successfully obtain the result.
Obtained username and password: admin.
After logging in with the username and password, there is a key.
Try weak password login, but it is unsuccessful. Access robots.txt to see if there are any other directories, and find an SQL file.
Try to access the SQL file and find an account and password for the admin user, with the password encrypted in MD5.
Crack the MD5 and find the password: qwerty.
Try directory traversal to see if there are other directories. Use a scanner and find phpmyadmin, but it shows 401 unauthorized.
Since there is no authentication, you can only use authentication to brute force the directory.
No useful information is found through brute force.
Log in with the password cracked by MD5 and successfully log in. The backend interface is as follows:
There is a function to upload images in the backend. Try file upload.
Directly uploading a PHP file fails.
Change the content-type to image/jpeg format, and the file is uploaded successfully.
Go back to the backend page and copy the link.
The webshell link is http://10.1.10.71/uploadfile/16899143312s.php. Connect to the webshell, add HTTP headers, and use base64 authentication.
Encode in base64.
Successfully connect to the webshell.
Execute commands with system privileges.
Add an account.
Enable port 3389, directly use the system's built-in tools to enable it.
The key cannot be obtained with the account created by oneself, so the administrator's password needs to be modified.
The key is in the recycle bin, restore it.
