Post

hackmyvm Deba靶机复盘

难度-Hard

Posted Updated
By
1 min read
hackmyvm Deba靶机复盘

网段扫描

1
2
3
4
5
6
7
8

Interface: eth0, type: EN10MB, MAC: 00:0c:29:d1:27:55, IPv4: 192.168.137.190
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.137.1	3e:21:9c:12:bd:a3	(Unknown: locally administered)
192.168.137.42	3e:21:9c:12:bd:a3	(Unknown: locally administered)
192.168.137.64	a0:78:17:62:e5:0a	Apple, Inc.

7 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.049 seconds (124.94 hosts/sec). 3 responded

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

root@LingMj:~/tools# nmap -p- -sV -sC 192.168.137.42
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-18 07:14 EDT
Nmap scan report for debian.mshome.net (192.168.137.42)
Host is up (0.043s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 22:e4:1e:f3:f6:82:7b:26:da:13:2f:01:f9:d5:0d:5b (RSA)
|   256 7b:09:3e:d4:a7:2d:92:01:9d:7d:7f:32:c1:fd:93:5b (ECDSA)
|_  256 56:fd:3d:c2:19:fe:22:24:ca:2c:f8:07:90:1d:76:87 (ED25519)
80/tcp   open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.38 (Debian)
3000/tcp open  http    Node.js Express framework
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
MAC Address: 3E:21:9C:12:BD:A3 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.47 seconds

获取webshell

picture 0
picture 1

没收获

picture 2
picture 3 picture 5

picture 4
picture 6
picture 7

随便试，没有线索我查查这个nodejs

picture 8

不是这个

picture 9
picture 10
picture 11
picture 12
picture 13
picture 14

没成功但是卡住

picture 15

方向不对没弹回来

picture 16
picture 17
picture 18

一摸一样确实是这个，地址：https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/

picture 19
picture 20
picture 21

还是没成

picture 22

好像靶机bug了

picture 23
picture 24

好了出现了

提权

picture 25
picture 26

可以改main直接bin/bash

picture 27
picture 28
picture 29
picture 30

我刚想一下它是all啊我直接root得了，哈哈哈哈

userflag:justdeserialize

rootflag:BoFsavetheworld

hackmyvm
upload
This post is licensed under CC BY 4.0 by the author.