hackthebox-traceback（lua提权/ssh密钥覆盖/motd提权）

1、扫描

masscan全局快速扫，nmap再具体扫，不过么，就22 80 俩端口，太常规，没啥新花样。22想到可能有ssh登录，80进web信息搜集。

C:\root> masscan -p1-65535,U:1-65535 10.10.10.181 --rate=1000 -e tun0

Starting masscan 1.0.5 (http://bit.ly/14GZzcT) at 2021-01-06 05:10:33 GMT
 -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [131070 ports/host]
Discovered open port 22/tcp on 10.10.10.181                                    
Discovered open port 80/tcp on 10.10.10.181                                    


C:\root> nmap -A 10.10.10.181                                                
Starting Nmap 7.80 ( https://nmap.org ) at 2021-01-06 13:20 CST
Nmap scan report for 10.10.10.181 (10.10.10.181)
Host is up (0.37s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 96:25:51:8e:6c:83:07:48:ce:11:4b:1f:e5:6d:8a:28 (RSA)
|   256 54:bd:46:71:14