┌──(kali㉿kali)-[~/Downloads/devrandomCTF_v1.1] └─$ sudo nmap --min-rate 10000 -p- 192.168.56.137 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-30 21:50 EDT Nmap scan report for 192.168.56.137 Host is up (0.00042s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:4F:E8:0F (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 9.13 seconds
┌──(kali㉿kali)-[~/Downloads/devrandomCTF_v1.1] └─$ sudo nmap -sT -sV -sC -O -p22,80 192.168.56.137 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-30 21:50 EDT Nmap scan report for 192.168.56.137 Host is up (0.00042s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 83:e5:a1:51:b1:f6:98:d3:19:e7:59:10:f7:f4:e8:5e (RSA) | 256 b2:a6:79:c3:ad:2f:ba:cc:02:b3:42:0d:a2:a3:9e:60 (ECDSA) |_ 256 ec:1f:d4:29:9f:a5:ae:ca:93:f4:a8:6b:fd:61:44:45 (ED25519) 80/tcp open http Apache httpd | http-robots.txt: 3 disallowed entries |_/wp-admin/ /wp-login.php /?include=info |_http-server-header: Apache |_http-title: Site doesn\'t have a title (text/html; charset=UTF-8). MAC Address: 08:00:27:4F:E8:0F (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 15.46 seconds
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Mon Mar 23 17:54:37 2020 trevor@lucifer:~$ whoami trevor trevor@lucifer:~$ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 08:00:27:4f:e8:0f brd ff:ff:ff:ff:ff:ff inet 192.168.56.137/24 brd 192.168.56.255 scope global dynamic enp0s3 valid_lft 454sec preferred_lft 454sec inet6 fe80::a00:27ff:fe4f:e80f/64 scope link valid_lft forever preferred_lft forever trevor@lucifer:~$ id uid=1005(trevor) gid=1005(trevor) groups=1005(trevor) trevor@lucifer:~$ sudo -l Matching Defaults entries for trevor on lucifer: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User trevor may run the following commands on lucifer: (root) NOPASSWD: /usr/bin/dpkg
提权
sudo -l 给了无需密码可执行的 dpkg 命令，在 gtfobins 中找到了利用手法
1 2 3 4 5 6 7 8 9
root@lucifer:/home/trevor# whoami root root@lucifer:/home/trevor# cd /root root@lucifer:~# ls flag.txt root@lucifer:~# cat flag.txt WELl DONE
