hack the box - tier0

2023-10-30

Tier0

Meow

Recommended Academy Modules

INTRO TO ACADEMY

STARTING POINT

Tier 0 Machines

Tags

Enumeration

Telnet

External

Penetration Tester Level 1

SOFT RESETReset Machine

OPEN

Walkthrough

CONNECT

Connect to Starting Point VPN before starting the machine

Spawn Machine

Click to Spawn the machine

Task 1

What does the acronym VM stand for?

******* ******e

Virtual Machine

Hide Answer

Task 2

What tool do we use to interact with the operating system in order to issue commands via the command line, such as the one to start our VPN connection? It’s also known as a console or shell.

*******l

terminal

Hide Answer

Task 3

What service do we use to form our VPN connection into HTB labs?

******n

openvpn

Hide Answer

Task 4

What is the abbreviated name for a ‘tunnel interface’ in the output of your VPN boot-up sequence output?


tun

Hide Answer

Task 5

What tool do we use to test our connection to the target with an ICMP echo request?

***g

ping

Hide Answer

Task 6

What is the name of the most common tool for finding open ports on a target?

***p

nmap

Hide Answer

Task 7

What service do we identify on port 23/tcp during our scans?

*****t

telnet

Hide Answer

Task 8

What username is able to log into the target over telnet with a blank password?

***t

root

Hide Answer

Submit Flag

Submit root flag


b40abdfe23665f766f9c61ecba8a4c19

Fawn

Recommended Academy Modules

INTRO TO ACADEMY

STARTING POINT

Tier 0 Machines

Tags

Enumeration

Telnet

External

Penetration Tester Level 1

SOFT RESETReset Machine

OPEN

Walkthrough

CONNECT

Connect to Starting Point VPN before starting the machine

Spawn Machine

Click to Spawn the machine

Task 1

What does the acronym VM stand for?

******* ******e

Virtual Machine

Hide Answer

Task 2

What tool do we use to interact with the operating system in order to issue commands via the command line, such as the one to start our VPN connection? It’s also known as a console or shell.

*******l

terminal

Hide Answer

Task 3

What service do we use to form our VPN connection into HTB labs?

******n

openvpn

Hide Answer

Task 4

What is the abbreviated name for a ‘tunnel interface’ in the output of your VPN boot-up sequence output?


tun

Hide Answer

Task 5

What tool do we use to test our connection to the target with an ICMP echo request?

***g

ping

Hide Answer

Task 6

What is the name of the most common tool for finding open ports on a target?

***p

nmap

Hide Answer

Task 7

What service do we identify on port 23/tcp during our scans?

*****t

telnet

Hide Answer

Task 8

What username is able to log into the target over telnet with a blank password?

***t

root

Hide Answer

Submit Flag

Submit root flag


b40abdfe23665f766f9c61ecba8a4c19

┌──(kwkl㉿kwkl)-[~]
└─$ sudo openvpn /home/kwkl/桌面/starting_point_hashdea6(2).ovpn
[sudo] kwkl 的密码:
2022-10-20 21:37:28 WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.
2022-10-20 21:37:28 OpenVPN 2.5.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jul  5 2022
2022-10-20 21:37:28 library versions: OpenSSL 3.0.5 5 Jul 2022, LZO 2.10
2022-10-20 21:37:28 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-10-20 21:37:28 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-10-20 21:37:28 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-10-20 21:37:28 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-10-20 21:37:28 TCP/UDP: Preserving recently used remote address: [AF_INET]23.19.225.248:443
2022-10-20 21:37:28 Socket Buffers: R=[131072->131072] S=[16384->16384]
2022-10-20 21:37:28 Attempting to establish TCP connection with [AF_INET]23.19.225.248:443 [nonblock]
2022-10-20 21:37:28 TCP connection established with [AF_INET]23.19.225.248:443
2022-10-20 21:37:28 TCP_CLIENT link local: (not bound)
2022-10-20 21:37:28 TCP_CLIENT link remote: [AF_INET]23.19.225.248:443
2022-10-20 21:37:29 TLS: Initial packet from [AF_INET]23.19.225.248:443, sid=b1569284 0357cadc
2022-10-20 21:37:29 VERIFY OK: depth=1, CN=HackTheBox
2022-10-20 21:37:29 VERIFY KU OK
2022-10-20 21:37:29 Validating certificate extended key usage
2022-10-20 21:37:29 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2022-10-20 21:37:29 VERIFY EKU OK
2022-10-20 21:37:29 VERIFY OK: depth=0, CN=htb
2022-10-20 21:37:31 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2022-10-20 21:37:31 [htb] Peer Connection Initiated with [AF_INET]23.19.225.248:443
2022-10-20 21:37:31 PUSH: Received control message: 'PUSH_REPLY,route 10.10.10.0 255.255.254.0,route 10.129.0.0 255.255.0.0,route-ipv6 dead:beef::/64,tun-ipv6,route-gateway 10.10.16.1,topology subnet,ping 10,ping-restart 120,ifconfig-ipv6 dead:beef:4::1085/64 dead:beef:4::1,ifconfig 10.10.16.135 255.255.254.0,peer-id 0,cipher AES-256-CBC'
2022-10-20 21:37:31 OPTIONS IMPORT: timers and/or timeouts modified
2022-10-20 21:37:31 OPTIONS IMPORT: --ifconfig/up options modified
2022-10-20 21:37:31 OPTIONS IMPORT: route options modified
2022-10-20 21:37:31 OPTIONS IMPORT: route-related options modified
2022-10-20 21:37:31 OPTIONS IMPORT: peer-id set
2022-10-20 21:37:31 OPTIONS IMPORT: adjusting link_mtu to 1627
2022-10-20 21:37:31 OPTIONS IMPORT: data channel crypto options modified
2022-10-20 21:37:31 Data Channel: using negotiated cipher 'AES-256-CBC'
2022-10-20 21:37:31 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2022-10-20 21:37:31 Outgoing Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-10-20 21:37:31 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
2022-10-20 21:37:31 Incoming Data Channel: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-10-20 21:37:31 net_route_v4_best_gw query: dst 0.0.0.0
2022-10-20 21:37:31 net_route_v4_best_gw result: via 10.10.10.2 dev eth0
2022-10-20 21:37:31 ROUTE_GATEWAY 10.10.10.2/255.255.255.0 IFACE=eth0 HWADDR=00:0c:29:8a:ff:f9
2022-10-20 21:37:31 GDG6: remote_host_ipv6=n/a
2022-10-20 21:37:31 net_route_v6_best_gw query: dst ::
2022-10-20 21:37:31 sitnl_send: rtnl: generic error (-101): Network is unreachable
2022-10-20 21:37:31 ROUTE6: default_gateway=UNDEF
2022-10-20 21:37:31 TUN/TAP device tun0 opened
2022-10-20 21:37:31 net_iface_mtu_set: mtu 1500 for tun0
2022-10-20 21:37:31 net_iface_up: set tun0 up
2022-10-20 21:37:31 net_addr_v4_add: 10.10.16.135/23 dev tun0
2022-10-20 21:37:31 net_iface_mtu_set: mtu 1500 for tun0
2022-10-20 21:37:31 net_iface_up: set tun0 up
2022-10-20 21:37:31 net_addr_v6_add: dead:beef:4::1085/64 dev tun0
2022-10-20 21:37:31 net_route_v4_add: 10.10.10.0/23 via 10.10.16.1 dev [NULL] table 0 metric -1
2022-10-20 21:37:31 net_route_v4_add: 10.129.0.0/16 via 10.10.16.1 dev [NULL] table 0 metric -1
2022-10-20 21:37:31 add_route_ipv6(dead:beef::/64 -> dead:beef:4::1 metric -1) dev tun0
2022-10-20 21:37:31 net_route_v6_add: dead:beef::/64 via :: dev tun0 table 0 metric -1
2022-10-20 21:37:31 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2022-10-20 21:37:31 Initialization Sequence Completed


┌──(kwkl㉿kwkl)-[~]
└─$ sudo nmap -T4 10.129.106.33                                                                                                                                             1[sudo] kwkl 的密码:
对不起,请重试。
[sudo] kwkl 的密码:
Starting Nmap 7.91 ( https://nmap.org ) at 2022-10-20 21:41 HKT
Nmap scan report for 10.129.106.33
Host is up (0.98s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
21/tcp open  ftp

Nmap done: 1 IP address (1 host up) scanned in 6.09 seconds
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~]
└─$ sudo nmap -A -v -sS -sV -p 21 10.129.106.33                       
Starting Nmap 7.91 ( https://nmap.org ) at 2022-10-20 21:43 HKT
NSE: Loaded 153 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 21:43
Completed NSE at 21:43, 0.00s elapsed
Initiating NSE at 21:43
Completed NSE at 21:43, 0.00s elapsed
Initiating NSE at 21:43
Completed NSE at 21:43, 0.00s elapsed
Initiating Ping Scan at 21:43
Scanning 10.129.106.33 [4 ports]
Completed Ping Scan at 21:43, 0.40s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:43
Completed Parallel DNS resolution of 1 host. at 21:43, 0.02s elapsed
Initiating SYN Stealth Scan at 21:43
Scanning 10.129.106.33 [1 port]
Discovered open port 21/tcp on 10.129.106.33
Completed SYN Stealth Scan at 21:43, 0.76s elapsed (1 total ports)
Initiating Service scan at 21:43
Scanning 1 service on 10.129.106.33
Completed Service scan at 21:43, 0.91s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 10.129.106.33
Retrying OS detection (try #2) against 10.129.106.33
Initiating Traceroute at 21:43
Completed Traceroute at 21:43, 0.65s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 21:43
Completed Parallel DNS resolution of 2 hosts. at 21:43, 0.02s elapsed
NSE: Script scanning 10.129.106.33.
Initiating NSE at 21:43
NSE: [ftp-bounce] PORT response: 500 Illegal PORT command.
Completed NSE at 21:43, 9.03s elapsed
Initiating NSE at 21:43
Completed NSE at 21:44, 5.53s elapsed
Initiating NSE at 21:44
Completed NSE at 21:44, 0.00s elapsed
Nmap scan report for 10.129.106.33
Host is up (0.74s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.16.135
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.6 (95%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.3 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 17.444 days (since Mon Oct  3 11:04:53 2022)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Unix

TRACEROUTE (using port 21/tcp)
HOP RTT       ADDRESS
1   636.50 ms 10.10.16.1
2   324.93 ms 10.129.106.33

NSE: Script Post-scanning.
Initiating NSE at 21:44
Completed NSE at 21:44, 0.00s elapsed
Initiating NSE at 21:44
Completed NSE at 21:44, 0.00s elapsed
Initiating NSE at 21:44
Completed NSE at 21:44, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 33.38 seconds
           Raw packets sent: 59 (4.192KB) | Rcvd: 38 (2.952KB)
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~]
└─$ ftp 10.129.106.33
Connected to 10.129.106.33.
220 (vsFTPd 3.0.3)
Name (10.129.106.33:kwkl): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> 
ftp> 
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
226 Directory send OK.
ftp> get flag.txt
local: flag.txt remote: flag.txt
200 PORT command successful. Consider using PASV.
150 Opening BINARY mode data connection for flag.txt (32 bytes).
226 Transfer complete.
32 bytes received in 0.00 secs (236.7424 kB/s)
ftp> 

                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~]
└─$ cat flag.txt          
035db21c881520061c53e0536e44f815                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~]
└─$ 

Dancing

CONNECT

Connect to Starting Point VPN before starting the machine

Spawn Machine

Click to Spawn the machine

Task 1

What does the 3-letter acronym SMB stand for?

****** ******* ****k

server message block

Hide Answer

Task 2

What port does SMB use to operate at?


445

Hide Answer

Task 3

What is the service name for port 445 that came up in our Nmap scan?

*********-*s

microsoft-ds

Hide Answer

Task 4

What is the ‘flag’ or ‘switch’ we can use with the SMB tool to ‘list’ the contents of the share?

**

-L

Hide Answer

Task 5

How many shares are there on Dancing?

4

Hide Answer

Task 6

What is the name of the share we are able to access in the end with a blank password?

*********s

WorkShares

Hide Answer

Task 7

What is the command we can use within the SMB shell to download the files we find?


get

Hide Answer

Submit Flag

Submit root flag


5f61c10dffbc77a704d76016a22f1664

Hide Answer

                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~]
└─$ sudo nmap -A -v -sS -sV -p 445  10.129.72.163                                                                                                                     1301[sudo] kwkl 的密码:
Starting Nmap 7.91 ( https://nmap.org ) at 2022-10-20 22:28 HKT
NSE: Loaded 153 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 22:28
Completed NSE at 22:28, 0.00s elapsed
Initiating NSE at 22:28
Completed NSE at 22:28, 0.00s elapsed
Initiating NSE at 22:28
Completed NSE at 22:28, 0.00s elapsed
Initiating Ping Scan at 22:28
Scanning 10.129.72.163 [4 ports]
Completed Ping Scan at 22:28, 0.45s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:28
Completed Parallel DNS resolution of 1 host. at 22:28, 0.01s elapsed
Initiating SYN Stealth Scan at 22:28
Scanning 10.129.72.163 [1 port]
Discovered open port 445/tcp on 10.129.72.163
Completed SYN Stealth Scan at 22:28, 0.77s elapsed (1 total ports)
Initiating Service scan at 22:28
Scanning 1 service on 10.129.72.163
Completed Service scan at 22:29, 38.16s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against 10.129.72.163
Retrying OS detection (try #2) against 10.129.72.163
Initiating Traceroute at 22:29
Completed Traceroute at 22:29, 0.92s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 22:29
Completed Parallel DNS resolution of 2 hosts. at 22:29, 0.15s elapsed
NSE: Script scanning 10.129.72.163.
Initiating NSE at 22:29
Completed NSE at 22:29, 11.79s elapsed
Initiating NSE at 22:29
Completed NSE at 22:29, 1.32s elapsed
Initiating NSE at 22:29
Completed NSE at 22:29, 0.00s elapsed
Nmap scan report for 10.129.72.163
Host is up (0.72s latency).

PORT    STATE SERVICE       VERSION
445/tcp open  microsoft-ds?
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows Server 2016 (92%), Microsoft Windows Longhorn (92%), Microsoft Windows 10 1709 - 1909 (91%), Microsoft Windows Server 2012 R2 (90%), Microsoft Windows Server 2012 (90%), Microsoft Windows Server 2008 SP2 (90%), Microsoft Windows Vista SP1 (89%), Microsoft Windows XP SP3 (89%), Microsoft Windows 10 1709 - 1803 (88%), Microsoft Windows 10 1809 - 1909 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: Randomized

Host script results:
|_clock-skew: 3h59m58s
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2022-10-20T18:29:30
|_  start_date: N/A

TRACEROUTE (using port 445/tcp)
HOP RTT       ADDRESS
1   914.16 ms 10.10.16.1
2   552.97 ms 10.129.72.163

NSE: Script Post-scanning.
Initiating NSE at 22:29
Completed NSE at 22:29, 0.00s elapsed
Initiating NSE at 22:29
Completed NSE at 22:29, 0.00s elapsed
Initiating NSE at 22:29
Completed NSE at 22:29, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 60.24 seconds
           Raw packets sent: 47 (3.472KB) | Rcvd: 48 (3.328KB)
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~]
└─$     


┌──(kwkl㉿kwkl)-[~]
└─$ sudo masscan -e tun0 -p-  --max-rate 500 10.129.72.163                                                                                                            1481 ⚙
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2022-10-20 14:08:27 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [65535 ports/host]
Discovered open port 139/tcp on 10.129.72.163                                  
Discovered open port 49667/tcp on 10.129.72.163                                
Discovered open port 5985/tcp on 10.129.72.163                                 
Discovered open port 445/tcp on 10.129.72.163                                  
Discovered open port 135/tcp on 10.129.72.163                                  
Discovered open port 49664/tcp on 10.129.72.163                                
Discovered open port 49665/tcp on 10.129.72.163                                
Discovered open port 49668/tcp on 10.129.72.163                                
Discovered open port 49669/tcp on 10.129.72.163                                
Discovered open port 47001/tcp on 10.129.72.163                                
Discovered open port 49666/tcp on 10.129.72.163                                
                                                    
            
┌──(kwkl㉿kwkl)-[~]
└─$ smbclient \\\\10.129.72.163\\WorkShares                                                                                                                                 1 ⚙
Password for [WORKGROUP\kwkl]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Mon Mar 29 16:22:01 2021
  ..                                  D        0  Mon Mar 29 16:22:01 2021
  Amy.J                               D        0  Mon Mar 29 17:08:24 2021
  James.P                             D        0  Thu Jun  3 16:38:03 2021


                5114111 blocks of size 4096. 1751240 blocks available
smb: \> 
smb: \> cd Amy.J
smb: \Amy.J\> dir
  .                                   D        0  Mon Mar 29 17:08:24 2021
  ..                                  D        0  Mon Mar 29 17:08:24 2021
  worknotes.txt                       A       94  Fri Mar 26 19:00:37 2021
get work
                5114111 blocks of size 4096. 1751224 blocks available
smb: \Amy.J\> get worknotes.txt
getting file \Amy.J\worknotes.txt of size 94 as worknotes.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
smb: \Amy.J\> cd ..
smb: \> cd James.P
smb: \James.P\> dir
  .                                   D        0  Thu Jun  3 16:38:03 2021
  ..                                  D        0  Thu Jun  3 16:38:03 2021
  flag.txt                            A       32  Mon Mar 29 17:26:57 2021
get 
                5114111 blocks of size 4096. 1751225 blocks available
smb: \James.P\> get flag.txt
getting file \James.P\flag.txt of size 32 as flag.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
smb: \James.P\> 


┌──(kwkl㉿kwkl)-[~]
└─$ cat worknotes.txt     
- start apache server on the linux machine
- secure the ftp server
- setup winrm on dancing                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~]
└─$ cat flag.txt     
5f61c10dffbc77a704d76016a22f1664                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~]
└─$ 



                                                    

Redeemer

Linux

Redis

Enumeration

Penetration Tester Level 1

Attacks/Anonymous/Guest Access

SOFT RESETReset Machine

OPEN

Walkthrough

CONNECT

Connect to Starting Point VPN before starting the machine

ONLINE

TARGET MACHINE IP ADDRESS

10.129.178.4

CONNECT

Connect to Starting Point VPN before starting the machine

Spawn Machine

Click to Spawn the machine

Task 1

Which TCP port is open on the machine?

***9

6379

Hide Answer

Task 2

Which service is running on the port that is open on the machine?

****s

Redis

Hide Answer

Task 3

What type of database is Redis? Choose from the following options: (i) In-memory Database, (ii) Traditional Database

-**** *******e

In-memory Database

Hide Answer

Task 4

Which command-line utility is used to interact with the Redis server? Enter the program name you would enter into the terminal without any arguments.

*****-**i

redis-cli

Hide Answer

Task 5

Which flag is used with the Redis command-line utility to specify the hostname?

**

-h

Hide Answer

Task 6

Once connected to a Redis server, which command is used to obtain the information and statistics about the Redis server?

***o

info

Hide Answer

Task 7

What is the version of the Redis server being used on the target machine?

..7

5.0.7

Hide Answer

Task 8

Which command is used to select the desired database in Redis?

*****t

select

Hide Answer

Task 9

How many keys are present inside the database with index 0?

4

Hide Answer

Task 10

Which command is used to obtain all the keys in a database?


keys *

Hide Answer

Submit Flag

Submit root flag


03e1d2b376c37ab3f5319922053953eb

Hide Answer

┌──(kwkl㉿kwkl)-[~]
└─$ sudo masscan -e tun0 -p-  --max-rate 500 10.129.178.4                                                                                                             1301[sudo] kwkl 的密码:
Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2022-10-21 12:52:37 GMT
Initiating SYN Stealth Scan
Scanning 1 hosts [65535 ports/host]
Discovered open port 6379/tcp on 10.129.178.4                                  
                                                                                                                                                                                
┌──(kwkl㉿kwkl)-[~]
└─$          




┌──(kwkl㉿kwkl)-[~]
└─$ redis-cli -h 10.129.178.4                                                                                                                                               110.129.178.4:6379> 
10.129.178.4:6379> 
10.129.178.4:6379> 
10.129.178.4:6379> ls
(error) ERR unknown command `ls`, with args beginning with: 
(0.59s)
10.129.178.4:6379> help
redis-cli 6.0.16
To get help about Redis commands type:
      "help @<group>" to get a list of commands in <group>
      "help <command>" for help on <command>
      "help <tab>" to get a list of possible help topics
      "quit" to exit

To set redis-cli preferences:
      ":set hints" enable online hints
      ":set nohints" disable online hints
Set your preferences in ~/.redisclirc
10.129.178.4:6379> info
# Server
redis_version:5.0.7
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:66bd629f924ac924
redis_mode:standalone
os:Linux 5.4.0-77-generic x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:atomic-builtin
gcc_version:9.3.0
process_id:752
run_id:4fa4207320be9d46612aa006067e817ea8207688
tcp_port:6379
uptime_in_seconds:648
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:5412954
executable:/usr/bin/redis-server
config_file:/etc/redis/redis.conf

# Clients
connected_clients:1
client_recent_max_input_buffer:2
client_recent_max_output_buffer:0
blocked_clients:0

# Memory
used_memory:859624
used_memory_human:839.48K
used_memory_rss:5951488
used_memory_rss_human:5.68M
used_memory_peak:859624
used_memory_peak_human:839.48K
used_memory_peak_perc:100.12%
used_memory_overhead:846142
used_memory_startup:796224
used_memory_dataset:13482
used_memory_dataset_perc:21.26%
allocator_allocated:1570200
allocator_active:1892352
allocator_resident:9101312
total_system_memory:2084024320
total_system_memory_human:1.94G
used_memory_lua:41984
used_memory_lua_human:41.00K
used_memory_scripts:0
used_memory_scripts_human:0B
number_of_cached_scripts:0
maxmemory:0
maxmemory_human:0B
maxmemory_policy:noeviction
allocator_frag_ratio:1.21
allocator_frag_bytes:322152
allocator_rss_ratio:4.81
allocator_rss_bytes:7208960
rss_overhead_ratio:0.65
rss_overhead_bytes:-3149824
mem_fragmentation_ratio:7.28
mem_fragmentation_bytes:5133872
mem_not_counted_for_evict:0
mem_replication_backlog:0
mem_clients_slaves:0
mem_clients_normal:49694
mem_aof_buffer:0
mem_allocator:jemalloc-5.2.1
active_defrag_running:0
lazyfree_pending_objects:0

# Persistence
loading:0
rdb_changes_since_last_save:4
rdb_bgsave_in_progress:0
rdb_last_save_time:1666356690
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:-1
rdb_current_bgsave_time_sec:-1
rdb_last_cow_size:0
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
aof_last_cow_size:0

# Stats
total_connections_received:5
total_commands_processed:5
instantaneous_ops_per_sec:0
total_net_input_bytes:291
total_net_output_bytes:11543
instantaneous_input_kbps:0.00
instantaneous_output_kbps:0.00
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:0
expired_stale_perc:0.00
expired_time_cap_reached_count:0
evicted_keys:0
keyspace_hits:0
keyspace_misses:0
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:0
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0

# Replication
role:master
connected_slaves:0
master_replid:27b5bfac54d7be8af8ca561c34cb3b241ce66f6e
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:0
second_repl_offset:-1
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0

# CPU
used_cpu_sys:0.544686
used_cpu_user:0.645040
used_cpu_sys_children:0.000000
used_cpu_user_children:0.000000

# Cluster
cluster_enabled:0

# Keyspace
db0:keys=4,expires=0,avg_ttl=0
(0.68s)
10.129.178.4:6379> select 0
OK
10.129.178.4:6379> keys *
1) "stor"
2) "numb"
3) "flag"
4) "temp"
10.129.178.4:6379> select flag
(error) ERR invalid DB index
10.129.178.4:6379> get flag
"03e1d2b376c37ab3f5319922053953eb"
10.129.178.4:6379> 


本文内容由网友自发贡献,版权归原作者所有,本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容,请联系:hwhale#tublm.com(使用前将#替换为@)

hack the box - tier0 的相关文章

  • 使用 Hibernate 用瞬态对象更新持久对象

    每天 数据都是通过网络服务导入的 我创建一个新的 暂时的 实例我通过 JPA 注释在 hibernate 中映射的 pojo 的 我将数据从 Web 服务填充到瞬态实例中 我从数据库加载持久对象 我想用瞬态实例中的数据更新该持久对象 我以某
  • 如何打印JTable中选定的行

    我尝试使用主 JTable 的选定行和相同的头和单元格渲染来创建临时 JTable 但是当我尝试打印它时 我只得到一个带有线边框的空矩形 我在如何打印 JTable 的特定行 列 https stackoverflow com questi
  • 合并 2 个 .jks 信任库文件

    我正在使用启用了 SSL 的 Tomcat 并使用信任库进行客户端身份验证 我有两个 jks trustore 文件 第一个 我将其用于 PROD 环境 另一个用于 TEST 环境客户端证书 我在 Tomcat 上部署了 Web 应用程序
  • 配置 Eclipse 将 App Engine 类预先捆绑到单个 JAR 中以加快预热速度

    在与另一家同样使用 App Engine 的公司的同事进行讨论后 他告诉我 他通过以下步骤成功地将应用程序预热时间从约 15 秒缩短到约 5 秒 配置 Eclipse 将编译过程中生成的类捆绑到单个 JAR 文件中 配置 Eclipse 以
  • 如何从球衣服务端点发送实体列表?

    我正在从球衣服务器发送实体列表 在客户端 我试图获取这些实体列表 但它给了元帅例外 为什么它在元素名末尾添加 s 即 emps 而不是 emp XmlRootElement public class Emp Server side code
  • 将更改(永久)保存在数组列表中?

    那可能吗 例如 用户将新的项目 元素添加到数组列表 缓冲读取器进程 中 并且肯定会发生更改 我的问题是 即使用户多次更改数组列表 它也可能会永久存在 即使他们关闭程序并再次打开它 它也会一直存在 注意 不使用 txt 很抱歉问这样的问题 但
  • Jboss EAP 7 - 如何从部署中排除隐式模块(javax.jms)?

    我没想到我会来到这里 但经过大量 Google 和 StackOverflow 搜索后 我来到了这里 这就是我的确切问题 https www linkedin com pulse tale two jars marco antonio al
  • 如何在 Android 中签署 AAR Artifacts?

    我目前正在开发一个 AAR android 库 我想用我自己的密钥对已发布的工件进行签名 以便我可以确定我是否发布了具有相同名称和功能的假 aar 注意事项1 我希望能够以编程方式检查我的库的真实性 即使是一个伪造的库 只是伪造了我的 aa
  • 是否有任何理由使用 ZoneId.of("UTC") 而不是 ZoneOffset.UTC ?

    有什么理由使用ZoneId of UTC 代替ZoneOffset UTC 我们知道两者之间的区别 如ZoneOffset UTC 和 ZoneId of UTC 之间有什么区别 https stackoverflow com questi
  • 如何注册 org.springframework.integration.monitor.IntegrationMBeanExporter

    根据http www ibm com support knowledgecenter en SS7K4U 8 5 5 com ibm websphere nd multiplatform doc ae cspr data access tr
  • 错误包括 bouncycastle 提供商

    我需要使用bouncycastle provider我的项目中的库 我已将其包含在 gradle 项目中 apply plugin application sourceCompatibility 1 6 version 1 0 0 main
  • 用二进制数、常规数字和格雷编码填充矩阵

    我有一个包含 1 s 或 0 s 的矩阵 用于创建二进制数 其宽度为n 对于 n 2 和 n 3 它看起来像 00 000 01 001 10 010 11 011 100 101 110 111 等等 现在我正在使用以下代码来生成它 in
  • Java 日期和 MySQL 时间戳时区

    我正在编辑一段代码 其基本功能是 timestamp new Date 然后坚持下去timestamp中的变量TIMESTAMPMySQL 表列 然而 通过调试我看到Date显示在正确时区的对象 GMT 1 当持久化在数据库上时 它是GMT
  • 如何在列表视图中选择时启用视频序列自动播放?

    大家好 有人可以与我分享一下我如何编写我的 viewvideo java 类 以便它允许自动播放视频功能 自动排序在列表视图中播放所选视频的任务 从当前位置到最新录制的视频 按顺序直到最新的视频播放完毕 这类似于 YouTube 自动播放功
  • 使用 ProcessBuilder 启动 CMD

    我尝试使用以下代码在 Windows 中启动 CMD 应用程序 但它无法按预期工作 来自不同网站的几个示例表明 cmd 作为 ProcessBuilder 构造中的参数应该有效 我需要做什么才能让我的 Java 应用程序在 Windows
  • 使用 SimpleDateFormat、Java 进行错误的日期解析

    我需要使用日期模式 yyyy MM dd 解析输入字符串中的日期 如果日期采用任何其他格式 则抛出错误 这是我解析日期的代码 private void validateDate throws MyException Date parsedD
  • 不鼓励在Web应用程序中使用线程吗?

    我们与同事就在 Java 的 Web 应用程序中使用线程进行了激烈的讨论 他们的观点是 不建议在 Java Web 应用程序中使用线程 因为它们不受容器管理 一般来说 我对此表示同意 因为线程可能会干扰容器 但是 如果它不是 Java EE
  • 优雅地避免 Java 中的 NullPointerException

    考虑这一行 if object getAttribute someAttr equals true 显然这一行是一个潜在的错误 属性可能是null我们会得到一个NullPointerException 因此我们需要将其重构为以下两个选择之一
  • Android NDK - 仅用 C/C++ 编写

    有没有一种可能的方法可以使用 C C 编写整个 NDK 应用程序 而无需像 hello jni 示例项目 HelloJni java 中那样的 Java 入门 类 以某种方式创建一个 HelloJni c 来执行相同的操作 从 Androi
  • Spring Boot 2 中的 401 代替 403

    With 春季启动 https projects spring io spring boot 1 5 6 发布我能够发送 HTTP 状态代码401代替403如中所述如果请求未经身份验证的uri 如何让Spring Security响应未经授

随机推荐

  • 安装Apache Atlas遇到的错误

    安装apache atlas 启动atlas server报错 查看logs atlas 20220524 115239 out文件 Caused by org springframework beans factory Unsatisfi
  • mysql从视图中获取字段值_MYSQL中视图的使用

    1 什么是视图 执行一条SQL 将结果集保存在一张虚拟表中 2 为什么要使用视图 重复利用SQL语句 简化SQL查询 快速取数据 只用知道表的部分结构 保护数据 根据特定授权 更改数据格式和表示 视图可返回与底层表的表示和格式不同的数据 注
  • maven私有仓库nexus3.5搭建与使用

    maven私有仓库nexus3 5搭建与使用 参考网址 http blog csdn net clj198606061111 article details 52200928 http www cnblogs com jingmoxukon
  • leetcode刷题日志4.0

    目录 前言 1 三个数的最大乘积 2 错误的集合 3 机器人能否返回原点 4 最长连续递增序列 5 验证回文串 II 6 交替位二进制数 前言 五一假期结束了 大家玩的开心吗 不过我们还得回到我们的日常生活学习工作当中 那今天我就分享一下我
  • 性能测试最佳实践的思考,7个要点缺一不可!

    性能测试是软件开发和应用过程中至关重要的环节 它是评估系统性能 稳定性和可扩展性的有效手段 可以确保软件在真实环境中高效运行 在现代技术快速发展的时代 性能测试的重要性愈发显著 性能测试在软件开发和应用过程中的重要性不可低估 它是保障用户体
  • 预编码技术

    预编码的基本原理 TD LTE下行传输采用了MIMO OFDM的物理层构架 通过最多4个发射天线并行传输多个 最多4个 数据流 能够有效地提高峰值传输速率 LTE的物理层处理过程中 预编码是其核心功能模块 物理下行共享信道的几种主要传输模式
  • The ‘import.meta‘ meta-property is only allowed when the ‘--module‘ option is ‘esnext‘ or ‘system‘

    问题描述 使用vite的import meta const allImage import meta glob assets images console log allImage 报提示 需要配置 module option为exnext
  • 根据fabric官方文档,自己整理hello world的过程中出现的bug

    在对fabric的官方文档下的 fabric samples中的test network项目中的network sh的分析 进行到创建通道时候又出现了之前出现的bug Error got unexpected status BAD REQU
  • mysql查询练习(二)

    11 查询每门课的平均成绩 查询3 105课程的平均分 mysql gt select avg degree from score where cno 3 105 avg degree 81 7500 1 row in set 0 00 s
  • 零拷贝( Zero-copy )

    一 背景 零拷贝 描述了计算机操作 其中CPU 不执行将数据从 一个存储区 复制到 另一个存储区 的任务 通过网络传输文件时 通常用于节省CPU周期和内存带宽 在传统的 Linux 操作系统的标准 I O 接口是基于数据拷贝操作的 即 I
  • C++基本语句(一)

    学习C 的第二天 一 C 的基本语句 1 1声明语句和变量 P21 P22 声明语句和变量 各自的作用是什么 为什么变量必须要声明 以及下面这段代码提供了哪两项信息 定义一个整型变量 int carrots 定义一个整型变量 int car
  • 尤里的复仇Ⅰ 小芳!

    尤里的复仇 小芳 作者 admin 时间 2021 06 15 分类 封神台 第一章 为了女神小芳 找到get参数id 使用 1 1 or 1 1 1 or 1 2 测试 发现存在sql注入 最终payload为 id 1 and 1 2
  • XMind中的 “甘特图”视图

    2019独角兽企业重金招聘Python工程师标准 gt gt gt 甘特图 视图 当所有任务信息添加完成后 点击 任务信息 视图底部的 显示甘特图 按钮 XMind将弹出 甘特图 视图 所有任务信息将不同属性的线条展现 如果此时切换画布或者
  • math模块

    math 模块是Python中的标准模块 并且始终可用 要在此模块下使用数学函数 您必须使用导入模块import math 它提供对基础C库函数的访问 导入数学函数库 import math 查看 math 查看包中的内容 print di
  • C99与C89主要区别

    http www cnblogs com xiaoyoucai p 6146784 html
  • P4162 [SCOI2009]最长距离

    题目链接 这道题数据范围比较小 所以方法还是比较暴力的 思路 先按每个格子的状态 让所有格子与他周围的格子连一条权值为它连向那个格子的值 0或1 然后我们n方枚举所有格子跑最短路 最短路即为从起点到终点的最小障碍数 然后我们枚举所有最短路
  • Spring的两种定时器

    1 spring学习系列 定时器一TimerTask spring定时器一般有两种 TimerTask Quartz 本节只讲TimerTask 需要的包 aopalliance 1 0 jar commons logging 1 1 1
  • 使用html2Canvas跟jspdf将一部分页面生成PDF

    刚好碰到这么一个需求 前端需要将后端返回的json对象数据生成表单样式的pdf文件 首次接触所以简单记录一下 经过反复查找大致流程为 现在页面画一个表单 gt 拿到数据将数据放表单中 gt 给表单最外层加个ref利用html2Canvas生
  • Linux:NTP服务离线安装及配置

    0 常用命令 rpm qa grep ntp 查询已安装的ntp版本信息等 service ntpd status 查询ntp服务状态 service ntpd start 启动 service ntpd stop 停止 service n
  • hack the box - tier0

    Tier0 Meow Recommended Academy Modules INTRO TO ACADEMY STARTING POINT Tier 0 Machines Tags Enumeration Telnet External