【Vulnhub】Vulnhub2018-DeRPnStiNK

信息收集

开了三个端口21，22，80
访问80端口，flag1在源码下

没什么东西就扫描目录

几个有用的
http://192.168.83.154/php/phpmyadmin/
http://192.168.83.154/weblog/
http://192.168.83.154/weblog/wp-admin/----弱口令爆破 admin admin

对文件上传没有过滤，上传一个后门

配置文件，还有一个phpmyadmin没登陆

root mysql

flag2

unclestinky $P$BW6NTkFvboVVCHU2R9qmNai1WfHSC41
用john爆破  wedgie57

再次登录wordpress没发现啥，前面用web打入服务器了，先用那个，有两个用户，尝试用之前的密码登录一下

stinky wedgie57

flag3

尝试用stinky wedgie57登录ftp

mv derpissues.pcap ~/ftp/files/---移动到ftp目录下

发现了sshkey

用xshell连接。然后对derpissues.pacp进行分析

mrderp："derpderpderpderpderpderpderp" 

mrderp@DeRPnStiNK:~/Desktop$ cat helpdesk.log
From: Help Desk helpdesk@derpnstink.local
Date: Thu, Aug 23, 2017 at 1:29 PM
Subject: sudoers ISSUE=242 PROJ=26
To: Derp, Mr (mrderp) [C]
When replying, type your text above this line.
Help Desk Ticket Notification
Thank you for contacting the Help Desk. Your ticket information is below. If you have any
additional information to add to this ticket, please reply to this notification.
If you need immediate help (i.e. you are within two days of a deadline or in the event of a
security emergency), call us. Note that the Help Desk’s busiest hours are between 10 a.m. (ET)
and 3 p.m. (ET).
Toll-free: 1-866-504-9552
Phone: 301-402-7469
TTY: 301-451-5939
Ticket Title: Sudoers File issues
Ticket Number: 242
Status: Break/fix
Date Created: 08/23/2017
Latest Update Date: 08/23/2017
Contact Name: Mr Derp
CC’s: Uncle Stinky
Full description and latest notes on your Ticket: Sudoers File issues
Notification
Regards,
Service Desk
Listen with focus, answer with accuracy, assist with compassion.
From: Help Desk
Date: Mon, Sep 10, 2017 at 2:53 PM
Subject: sudoers ISSUE=242 PROJ=26
To: Derp, Mr (mrderp) [C]
When replying, type your text above this line.
Closed Ticket Notification
Thank you for contacting the Help Desk. Your ticket information and its resolution is
below. If you feel that the ticket has not been resolved to your satisfaction or you need additional
assistance, please reply to this notification to provide additional information.
If you need immediate help (i.e. you are within two days of a deadline or in the event of a
security emergency), call us or visit our Self Help Web page at https://pastebin.com/RzK9WfGw
Note that the Help Desk’s busiest hours are between 10 a.m. (ET)
and 3 p.m. (ET).
Toll-free: 1-866-504-9552
Phone: 301-402-7469
TTY: 301-451-5939
Ticket Title: sudoers issues
Ticket Number: 242
Status: Closed
Date Created: 09/10/2017
Latest Update Date: 09/10/2017
CC’s:
Resolution: Closing ticket. ticket notification.
Regards,
eRA Service Desk
Listen with focus, answer with accuracy, assist with compassion.
For more information, dont forget to visit the Self Help Web page!!!

没啥用，看看有什么root权限的文件

sudo -l

没有这个文件，直接运行

echo “/bin/bash” > /home/mrderp/binaries/derpy.sh
chmod +x derpy.sh
sudo ./derpy.sh

然后就是root权限