Post

hackmyvm Nowords靶机复盘

难度-Medium

Posted Updated
By
5 min read
hackmyvm Nowords靶机复盘

网段扫描

1
2
3
4
5
6
7
8
9
10
11

root@LingMj:/home/lingmj# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:df:e2:a7, IPv4: 192.168.56.110
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1    0a:00:27:00:00:13       (Unknown: locally administered)
192.168.56.100  08:00:27:fd:61:55       (Unknown)
192.168.56.127  08:00:27:a3:e0:b0       (Unknown)

3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.859 seconds (137.71 hosts/sec). 3 responded

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

root@LingMj:/home/lingmj# nmap -p- -sC -sV 192.168.56.127        
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-02 22:52 EST
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.56.127
Host is up (0.00058s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 08:00:27:A3:E0:B0 (Oracle VirtualBox virtual NIC)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 575.42 seconds

获取webshell

图 0
图 1
图 2
图 3

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

/ewqpoiewopqiewq
/490382490328423
/fdsnmrewrwerew
/uoijfdsijiofds
/rewjlkjsdf
/rwen908098vcxvcx
/kvjciovcuxioufhydsfdsyr
/klvcxhyvcxkljhyvcxiuzxcioyv
/oiufdsaoifndasuiofhdsa
/klhvcoixzuyvxcizoyvzxcuiyv
/pvycuxivhyzxcuivyzxiouvyzxc
/kifjdsaoipfuasoifjasipofudas
/oidfphkljerhwqlkjrheqwkjlh
/mncvmzxoiurewqioyrwqrewqrr
/oiupoiuopiuopiuioyuiyiuyio
/ghasfdhasfdhasdghasfdhgasfdasjf
/nbvnmvnbvnmzxvncvznbxcvznvzx
/vnbewqveqwbmvenqwbvrnwevrhjwefhjvwerj
/hvuixctyvcyuxgivxcyuvfxcyuvigfxc
/uihysaidouyasiudysquidhqiuodhqiudqhiodu
/hfdsioufhdsiuhvcxiuovyhcxiuvgxcivhcxbcviux
/vhsdiufyhdsuivhxcuivhuisdhfids
/jfd9s87fds89cvxyvxc789v6cx
/m98789789ds7a89d7sah98zxc78
/dsaknewiquiodusjadsa
/vcxjhkluioyfdsrew
/vcxoiufdsnkjnewq
/iouoiuvcxvcxfds
/uoihbnnmxcbmxcnbvx
/mdsaydqnfdsoiurewnh
/ioufdosijnmieowryu
/oiufdsnrewjhuiyfsd
/rewnkvoiuxvfdsfdsrwqe
/kuviosjdfiojdsifoyuewhq
/hvioxcuyiofuasdhfkjlsnafoidsy

图 4

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

root@LingMj:/home/lingmj/xxoo# cat tmp|xargs|tr ' ' '\n'|tr '/' '' 
tr: when not truncating set1, string2 must be non-empty
                                                                                                                                                                                             
root@LingMj:/home/lingmj/xxoo# cat tmp|xargs|tr ' ' '\n'|tr '\/' ''
tr: when not truncating set1, string2 must be non-empty
                                                                                                                                                                                             
root@LingMj:/home/lingmj/xxoo# cat tmp|xargs|tr ' ' '\n'|sed 's/\///g'
ewqpoiewopqiewq
490382490328423
fdsnmrewrwerew
uoijfdsijiofds
rewjlkjsdf
rwen908098vcxvcx
kvjciovcuxioufhydsfdsyr
klvcxhyvcxkljhyvcxiuzxcioyv
oiufdsaoifndasuiofhdsa
klhvcoixzuyvxcizoyvzxcuiyv
pvycuxivhyzxcuivyzxiouvyzxc
kifjdsaoipfuasoifjasipofudas
oidfphkljerhwqlkjrheqwkjlh
mncvmzxoiurewqioyrwqrewqrr
oiupoiuopiuopiuioyuiyiuyio
ghasfdhasfdhasdghasfdhgasfdasjf
nbvnmvnbvnmzxvncvznbxcvznvzx
vnbewqveqwbmvenqwbvrnwevrhjwefhjvwerj
hvuixctyvcyuxgivxcyuvfxcyuvigfxc
uihysaidouyasiudysquidhqiuodhqiudqhiodu
hfdsioufhdsiuhvcxiuovyhcxiuvgxcivhcxbcviux
vhsdiufyhdsuivhxcuivhuisdhfids
jfd9s87fds89cvxyvxc789v6cx
m98789789ds7a89d7sah98zxc78
dsaknewiquiodusjadsa
vcxjhkluioyfdsrew
vcxoiufdsnkjnewq
iouoiuvcxvcxfds
uoihbnnmxcbmxcnbvx
mdsaydqnfdsoiurewnh
ioufdosijnmieowryu
oiufdsnrewjhuiyfsd
rewnkvoiuxvfdsfdsrwqe
kuviosjdfiojdsifoyuewhq
hvioxcuyiofuasdhfkjlsnafoidsy
                                                                                                                                                                                             
root@LingMj:/home/lingmj/xxoo# cat tmp|xargs|tr ' ' '\n'|sed 's/\///g' > dir
                                                                                                                                                                                             
root@LingMj:/home/lingmj/xxoo# gobuster dir -w dir -u 'http://192.168.56.127/'                     
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.127/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                dir
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/oiufdsnrewjhuiyfsd   (Status: 200) [Size: 58506]
Progress: 35 / 36 (97.22%)
===============================================================
Finished
===============================================================

图 5

又是一个文件

图 6
图 7
图 8
图 9
图 10

有思路了直接进行提权爆破ftp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

Brielle
Quinn
Mary
Athena
Delilah
Nevaeh
Andrea
Leilani
Jasmine
Lyla
Margaret
Alyssa
Adalyn
Arya
Norah
Isla
Piper
Ruby
Rylee
Katherine
Serenity
Willow
Sophie
Josephine
Ivy
Everly
Cora
Kaylee
Liliana
Lydia
Jade
Aubree
Maria
Arianna
Taylor
Khloe
Hadley
Kayla
Eden
Eliza
Eliana
Kylie
Peyton
Emery
Melanie
Rose
Gianna
Adalynn
Natalia
Ariel
Isabelle
Melody
Alexis
Isabel
Sydney
Juliana
Brianna
Lauren
Mackenzie
lris
Raelynn
Madeline
Bailey
Emerson
Julia
Annabelle
Faith
Valentina
Nova
Alexandra
Ximena
Clara
Vivian
Ashley
Reagan

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

root@LingMj:/home/lingmj/xxoo# cat tmp|tr 'A-Z' 'a-z'                       
brielle
quinn
mary
athena
delilah
nevaeh
andrea
leilani
jasmine
lyla
margaret
alyssa
adalyn
arya
norah
isla
piper
ruby
rylee
katherine
serenity
willow
sophie
josephine
ivy
everly
cora
kaylee
liliana
lydia
jade
aubree
maria
arianna
taylor
khloe
hadley
kayla
eden
eliza
eliana
kylie
peyton
emery
melanie
rose
gianna
adalynn
natalia
ariel
isabelle
melody
alexis
isabel
sydney
juliana
brianna
lauren
mackenzie
lris
raelynn
madeline
bailey
emerson
julia
annabelle
faith
valentina
nova
alexandra
ximena
clara
vivian
ashley
reagan
                                                                                                                                                                                             
root@LingMj:/home/lingmj/xxoo# cat tmp|tr 'A-Z' 'a-z' > user

图 11

图 12
图 13

有ssh，但是没有22端口，查看ipv6

图 14

无法上传到www，所以不能直接获取东西

图 15
图 16
图 17

图 18
图 19
图 20

有点问题

图 21

猜测定时任务进行操作

图 22
图 23
图 24

没成功

图 25
图 26

成功了

提权

1
2
3
4
5
6

sophie@nowords:~$ sudo -l
[sudo] password for sophie: 
Sorry, try again.
[sudo] password for sophie: 
Sorry, user sophie may not run sudo on nowords.
uid=1000(sophie) gid=1000(sophie) groups=1000(sophie),24(cdrom),30(dip),46(plugdev),132(sambashare)

id,可以进行一下

图 27

图 28

有一个631

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

sophie@nowords:/home/me$ id
uid=1000(sophie) gid=1000(sophie) groups=1000(sophie),24(cdrom),30(dip),46(plugdev),132(sambashare)
sophie@nowords:/home/me$ find / -groups 'sambashare' 2>/dev/null
sophie@nowords:/home/me$ find / -group sambashare 2>/dev/null
sophie@nowords:/home/me$ find / -group dip 2>/dev/null
/etc/chatscripts
/etc/chatscripts/provider
/etc/ppp
/etc/ppp/peers
/etc/ppp/peers/provider
/usr/sbin/pppd
sophie@nowords:/home/me$ find / -group cdrom 2>/dev/null
/dev/sg0
/dev/sr0
sophie@nowords:/home/me$ find / -group plugdev 2>/dev/null

算了尝试内核吧，老靶机内核提权都是很正常

图 29
图 30

结束

userflag:Icanreadyeah

rootflag:Ihavenowords

hackmyvm
ftp image les
This post is licensed under CC BY 4.0 by the author.