IA: Nemesis (1.0.1) vulnhub walkthrough

最新推荐文章于 2023-12-16 18:28:24 发布

xdeclearn

最新推荐文章于 2023-12-16 18:28:24 发布

阅读量1.2k

点赞数

分类专栏： vulnhub

本文链接：https://blog.csdn.net/xdeclearn/article/details/109309103

版权

IA: Nemesis (1.0.1)

虚拟机页面：http://www.vulnhub.com/entry/ia-nemesis-101,582/

Description

Difficulty: Intermediate to Hard
Goal: Get the root shell and read all the 3 flags.
Information: You need some good encryption and programming skills to root this box. Please solve this challenge by using only the intended way, any unintended way will not be apprecitated.
If you need any hints, you can contact us on Twitter (@infosecarticles)

服务探测

PORT      STATE SERVICE VERSION
80/tcp    open  http    Apache httpd 2.4.38 ((Debian))
52845/tcp open  http    nginx 1.14.2
52846/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

web渗透测试

80端口服务有一个登录入口，在页面的validateForm函数中得到了用户名和密码，但是登录后没有任何东西。

<!DOCTYPE html>
function validateForm() {
   
  var x = document.forms["myForm"]["uname"].value;
  var y = document.forms["myForm"]["pass"].value; 
  if (x == "") {
   
    alert("Name must be filled out");
    return false;
  }
 if (y == "") {
   
    alert("Password must be filled out");
    return false; 
}
 if (x == "hacker_in_the_town" && y == "thanos")
	{
   
		document.write("You will be redirected to main page in 3 sec.");
            	setTimeout('validate()', 3000);
	}
}

紧接着访问52845端口，在#contact中尝试输入任意信息然后提交，出现提示Message has been saved in a file,于是在Message中输入/etc/passwd，成功实现了LFI。
lfi
passwd

之后，尝试了一些常见log读取失败后，尝试ssh登录thanos，发现需要私钥认证。

kali@kali:~$ ssh -p 52846 thanos@192.168.56.42 
thanos@192.168.56.42: Permission denied (publickey).

尝试利用LFI获取thanos私钥/home/thanos/.ssh/id_rsa，成功并实现ssh登录，获取到第一个flag。

kali@kali:~$ ssh -p 52846 -i id thanos@192.168.56.42 
Linux nemesis 4.19.0-11-amd64 #1 SMP Debian 4.19.146-1 (2020-09-17) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Oct 26 08:48:39 2020 from 127.0.0.1
thanos@nemesis:~$ ls -all
total 40
drwxr-xr-x 4 thanos thanos 4096 Oct 25 10:05 .
drwxr-xr-x 4 ro

最低0.47元/天解锁文章

xdeclearn

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
1
评论
IA: Nemesis (1.0.1) vulnhub walkthrough

文章目录IA: Nemesis (1.0.1)服务探测web渗透测试获取第二个flag提权至root获取第三个flag参考IA: Nemesis (1.0.1)虚拟机页面：http://www.vulnhub.com/entry/ia-nemesis-101,582/DescriptionDifficulty: Intermediate to HardGoal: Get the root shell and read all the 3 flags.Information: You need
复制链接

扫一扫