# Deception

> https://download.vulnhub.com/haclabs/Deception.ova

靶场IP：`192.168.32.19`

扫描对外端口服务

```
┌──(root㉿kali)-[~]
└─# nmap -sV -p1-65535 192.168.32.19 
Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-13 21:52 EDT
Nmap scan report for 192.168.32.19
Host is up (0.00010s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
MAC Address: 08:00:27:5B:E3:02 (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.76 seconds

```

访问80端口

![image-20220914100249737](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-9ef18fa032c2ccf67e9dc714e7ca58c8515597e3%2Fimage-20220914100249737.png?alt=media)

爆破目录

```
┌──(root㉿kali)-[~]
└─# dirb http://192.168.32.19/ 

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Tue Sep 13 22:07:45 2022
URL_BASE: http://192.168.32.19/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.32.19/ ----
+ http://192.168.32.19/index.html (CODE:200|SIZE:11026)                                                                                                                                                                                   
==> DIRECTORY: http://192.168.32.19/javascript/                                                                                                                                                                                           
==> DIRECTORY: http://192.168.32.19/phpmyadmin/                                                                                                                                                                                           
+ http://192.168.32.19/server-status (CODE:403|SIZE:278)                                                                                                                                                                                  
==> DIRECTORY: http://192.168.32.19/wordpress/                                                                                                                                                                                            
                                                                                                                                                                                                                                          
---- Entering directory: http://192.168.32.19/javascript/ ----
==> DIRECTORY: http://192.168.32.19/javascript/jquery/                                                                                                                                                                                    
                                                                                                                                                                                                                                          
---- Entering directory: http://192.168.32.19/phpmyadmin/ ----
==> DIRECTORY: http://192.168.32.19/phpmyadmin/doc/                                                                                                                                                                                       
+ http://192.168.32.19/phpmyadmin/favicon.ico (CODE:200|SIZE:22486)                                                                                                                                                                       
+ http://192.168.32.19/phpmyadmin/index.php (CODE:200|SIZE:10525)                                                                                                                                                                         
==> DIRECTORY: http://192.168.32.19/phpmyadmin/js/                                                                                                                                                                                        
+ http://192.168.32.19/phpmyadmin/libraries (CODE:403|SIZE:278)                                                                                                                                                                           
==> DIRECTORY: http://192.168.32.19/phpmyadmin/locale/                                                                                                                                                                                    
+ http://192.168.32.19/phpmyadmin/phpinfo.php (CODE:200|SIZE:10527)                                                                                                                                                                       
+ http://192.168.32.19/phpmyadmin/setup (CODE:401|SIZE:460)                                                                                                                                                                               
==> DIRECTORY: http://192.168.32.19/phpmyadmin/sql/                                                                                                                                                                                       
+ http://192.168.32.19/phpmyadmin/templates (CODE:403|SIZE:278)                                                                                                                                                                           
==> DIRECTORY: http://192.168.32.19/phpmyadmin/themes/                                                                                                                                                                                    
                                                                                                                                                                                                                                          
---- Entering directory: http://192.168.32.19/wordpress/ ----
+ http://192.168.32.19/wordpress/index.php (CODE:301|SIZE:0)                                                                                                                                                                              
+ http://192.168.32.19/wordpress/robots.txt (CODE:200|SIZE:22)                                                                                                                                                                            
==> DIRECTORY: http://192.168.32.19/wordpress/wp-admin/                                                                                                                                                                                   
==> DIRECTORY: http://192.168.32.19/wordpress/wp-content/                                                                                                                                                                                 
==> DIRECTORY: http://192.168.32.19/wordpress/wp-includes/                                                                                                                                                                                
+ http://192.168.32.19/wordpress/xmlrpc.php (CODE:405|SIZE:42)                                                                                                                                                                            
                                                                                                                                                                                                                                          
---- Entering directory: http://192.168.32.19/javascript/jquery/ ----
+ http://192.168.32.19/javascript/jquery/jquery (CODE:200|SIZE:268026)   
```

访问：`/wordpress/`

![image-20220914100958242](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-e4eff4e1a888c73171bec4855de96f8385c966d2%2Fimage-20220914100958242.png?alt=media)

访问：`/wordpress/robots.txt`

![image-20220914101031818](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-f179502f1ad06c79db29ebd2b30c082dfaa74637%2Fimage-20220914101031818.png?alt=media)

枚举用户

```
┌──(root㉿kali)-[~]
└─# wpscan --url http://192.168.32.19/wordpress/ -eu

[i] User(s) Identified:

[+] haclabs
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] yash
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

```

访问：`/wordpress/robots.html`，输入内容，弹窗，看不出什么东西。

![image-20220914101453486](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-bceaecd8e7c463765d4f97d0f1431e3849b2fcce%2Fimage-20220914101453486.png?alt=media)

查看页面源代码，说要点击大于15次就会跳转到：`admindelete.html`

```
<html>
<body>
<script>
var count = 1;
function myFunction() {
  if (count<15) {
    var input = document.getElementById("uname").value;
    alert("clicks left for noob "+ input +":"+ (50-count));
    count++;
  }
  else {
   window.location="admindelete.html";
  }
};
</script>
  <input type="text" id="uname" placeholder="your name"</input>
  <br>
  <button onclick="myFunction()">show quest</button>
</body>
</html>

```

直接访问：`admindelete.html`

![image-20220914101639788](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-7bb910648c0cba7e07162a46b2489128e8e7fd7d%2Fimage-20220914101639788.png?alt=media)

按照提示，访问：`hint.html`

![image-20220914102112144](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-d9f09ad05f8ebf8314275c8736a1937f28fea37e%2Fimage-20220914102112144.png?alt=media)

回去首页，收集API token

![image-20220914102211915](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-f43afa8f827bb6e14454c6ad90ba02a30babc59c%2Fimage-20220914102211915.png?alt=media)

```
<!--
    Modified from the Debian original for Ubuntu
    Last updated: 2016-11-16
    API old0 : 5F4DCC3B5AA
    See: https://launchpad.net/bugs/1288690
   
  -->
  <!--API old2 : 327DEB -->
  <!--API old 1 : 765D61D8 -->
  <!--API new : 882CF99-->
```

收集所有 API 并将它们排列成一行后，所有 API 令牌看起来像这样：**5F4DCC3B5AA765D61D8327DEB882CF99**

我尝试了所有 API 令牌登录用户名 yash 和密码创建了所有 API 密钥，我得到了 yash 用户 shell

```
ssh yash@192.168.32.19
```

![image-20220914102614141](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-a972400e78f3b6902e1f57871be9ae30cc9e75e3%2Fimage-20220914102614141.png?alt=media)

获得第一个flag

```
yash@haclabs:~$ ls
flag1.txt
yash@haclabs:~$ cat flag1.txt 
JUST BELIEVE IN YOU!!

71C480DF93D6AE2F1EFAD1447C66C9525E316218CF51FC8D9ED832F2DAF18B73

```

我们尝试使用 cat 命令读取此文件的内容。我发现了一些非常有用的东西。

```
cat .systemlogs
```

![image-20220914102915548](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-131a4aa311b4be9d6da984744ca7987555b2ac69%2Fimage-20220914102915548.png?alt=media)

（第一个是 `haclabs` ）和（第二个是**A=123456789**）（第三个是\*\*+A\[::-1]\*\*）

我将第二个值视为变量，第三个看起来像 String Slicing the variable A，我们找到了这样的值（hacklabs987654321）

使用su（切换用户命令）将当前用户yash更改为haclabs并尝试密码**haclabs987654321**，我们的shell更改成功

![image-20220914103121105](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-50d61668a59f98f9b3591f42a28f4598a5790186%2Fimage-20220914103121105.png?alt=media)

我移动到 haclabs 主目录，我们看到了我们的第二个标志

![image-20220914103218956](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-7a567e29fc52e2dd732347587ad34e00212d912e%2Fimage-20220914103218956.png?alt=media)

再次使用密码 haclabs 将我们的 shell 普通用户升级为超级用户 root sudo su 命令

![image-20230208134530793](https://3435151113-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F7n39F0laH6bbmYKdILcq%2Fuploads%2Fgit-blob-22b1832f0599007e330b69f65b36f12c6ff51c3a%2Fimage-20230208134530793.png?alt=media)
