https://633k.org/tags/jwt/ Recent content in JWT on 633k Hugo zh-CN Wed, 16 Oct 2024 00:00:00 +0000 https://633k.org/posts/instant/ Wed, 16 Oct 2024 00:00:00 +0000 https://633k.org/posts/instant/ <h1 id="instanthtb-medium">Instant（HTB Medium）</h1> <h2 id="基本信息">基本信息</h2> <ul> <li>IP：<code>10.10.11.37</code></li> <li>VPN：<code>10.10.16.4</code></li> <li>域名：<code>instant.htb</code></li> </ul> <h2 id="信息收集">信息收集</h2> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>vim /etc/hosts </span></span></code></pre></div><pre tabindex="0"><code>10.10.11.37 instant.htb </code></pre><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>rustscan -a 10.10.11.37 -- -sCVT </span></span><span style="display:flex;"><span>nmap -sC -sV -Pn -T4 10.10.11.37 </span></span></code></pre></div><pre tabindex="0"><code>22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 80/tcp open http Apache httpd 2.4.58 |_http-title: Instant Wallet </code></pre><p>前端可下载 APK。目录穿越被限制。逆向 APK：</p> https://633k.org/posts/yummy/ Fri, 11 Oct 2024 00:00:00 +0000 https://633k.org/posts/yummy/ <h1 id="yummyhtb-hard">Yummy（HTB Hard）</h1> <h2 id="基本信息">基本信息</h2> <ul> <li>IP：<code>10.10.11.36</code></li> <li>VPN：<code>10.10.16.3</code></li> <li>域名：<code>yummy.htb</code></li> </ul> <h2 id="信息收集">信息收集</h2> <p>修改 <code>/etc/hosts</code> 后扫描：</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>rustscan -a 10.10.11.36 -- -sCTV </span></span><span style="display:flex;"><span>nmap -sC -sV -Pn -T4 10.10.11.36 </span></span></code></pre></div><pre tabindex="0"><code>22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 80/tcp open http Caddy httpd |_http-title: Yummy </code></pre><p>前端用 JWT。预订套餐有下载功能，重放失败（有 token）。拦截后改下载路径做目录穿越：</p>