Mhz_c1f靶场-简记

靶机

名称：mhz_cxf:clf

download url：https://www.vulnhub.com/entry/mhz_cxf-c1f,471/

IP地址探测

sudo netdiscover -i eth1 -r 192.168.56.0/24

 sudo netdiscover -i eth1 -r 192.168.56.0/24
Currently scanning: 192.168.56.0/24   |   Screen View: Unique Hosts                                                                                        
                                                                                                                                                            
 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                                                            
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.56.1    0a:00:27:00:00:11      1      60  Unknown vendor                                                                                           
 192.168.56.100  08:00:27:64:18:1b      1      60  PCS Systemtechnik GmbH                                                                                   
 192.168.56.249  08:00:27:02:7b:29      1      60  PCS Systemtechnik GmbH       

IP:192.168.56.0/24

NMAP扫描

sudo nmap -sS -sV -sc -sC -p- 192.168.56.249 -oA full_nmap

Starting Nmap 7.92 ( https://nmap.org ) at 2023-04-07 02:18 EDT Nmap scan report for localhost (192.168.56.249) Host is up (0.00013s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 38:d9:3f:98:15:9a:cc:3e:7a:44:8d:f9:4d:78:fe:2c (RSA) | 256 89:4e:38:77:78:a4:c3:6d:dc:39:c4:00:f8:a5:67:ed (ECDSA) |_ 256 7c:15:b9:18:fc:5c:75:aa:30:96:15:46:08:a9:83:fb (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-title: Apache2 Ubuntu Default Page: It works |_http-server-header: Apache/2.4.29 (Ubuntu) MAC Address: 08:00:27:02:7B:29 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.20 seconds

open port: 22、80

获得Shell

gobuster -u http://192.168.28.39/ -x txt,sql,php,tar -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

dirsearch -u http://192.168.56.249/

---remb.txt --  存在 账户密码：ssh first_stage：

 

---remb2.txt

SSH

ssh first_stage@192.168.56.249

sudo -l   #无果

sudo scp first_stage@192.168.28.39:/home/mhz_clf/Paintings/* ./Paintings

下载四张图片jpeg

 xdg-open  图片jpeg   #可以卡看图片

steghide info name.jpeg   # 查看隐写信息

sudo steghide extract -sf wool.jpeg   # 分离文件出来

cat remb2.txt

mhz_clf:1@eclf

su mhz_clf

查看权限

sudo -l

whoami

uname -a