Post

hackmyvm Ginger靶机复盘

难度-Hard

Posted
By
1 min read
hackmyvm Ginger靶机复盘

网段扫描

1
2
3
4
5
6
7

root@LingMj:~/xxoo/jarjar# arp-scan -l       
Interface: eth0, type: EN10MB, MAC: 00:0c:29:d1:27:55, IPv4: 192.168.137.190
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.137.1	3e:21:9c:12:bd:a3	(Unknown: locally administered)
192.168.137.64	a0:78:17:62:e5:0a	Apple, Inc.
192.168.137.142	3e:21:9c:12:bd:a3	(Unknown: locally administered)
192.168.137.114	62:2f:e8:e4:77:5d	(Unknown: locally administered)

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

root@LingMj:~/xxoo/jarjar# nmap -p- -sV -sC 192.168.137.142
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-19 02:58 EDT
Nmap scan report for ginger.mshome.net (192.168.137.142)
Host is up (0.069s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 0c:3f:13:54:6e:6e:e6:56:d2:91:eb:ad:95:36:c6:8d (RSA)
|   256 9b:e6:8e:14:39:7a:17:a3:80:88:cd:77:2e:c3:3b:1a (ECDSA)
|_  256 85:5a:05:2a:4b:c0:b2:36:ea:8a:e2:8a:b2:ef:bc:df (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.38 (Debian)
MAC Address: 3E:21:9C:12:BD:A3 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.43 seconds

获取webshell

picture 0
picture 1
picture 2
picture 3
picture 4
picture 5
picture 6

登录和插件其中一个

picture 7

看来是登录 webmaster / sanitarium

picture 8
picture 9
picture 10
picture 11
picture 12
picture 13

好了成功弹shell

提权

picture 14
picture 15
picture 16
picture 17
picture 18

看来不是这个方向

picture 19

看不懂

picture 20
picture 21
picture 23

picture 22
picture 24
picture 25
picture 26

不行开始迷茫了,看一下wp告诉我dmesg 这个东西

picture 27
picture 28
picture 29
picture 30
picture 31

给我个*能帮助我穿越么

picture 32
picture 33
picture 34

sabrina:dontforgetyourpasswordbitch

picture 35
picture 36
picture 37

王炸一下

picture 38

调来调去太麻烦直接搞公钥得了

picture 39
picture 40

5秒啊那得看手速了

picture 41

做一下准备

picture 42
picture 43

结束，前面那个dmegs不知道其他都没啥难度

userflag:f65aaadaeeb04adaccba45d7babf5f8c

rootflag:ae426c9d237d676044e5cd8e8af9ef7f

hackmyvm
upload
This post is licensed under CC BY 4.0 by the author.