React

192.168.100.50

信息搜集

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
(venv) root@LAPTOP-O235O5EH [/opt/tools/cve/CVE-2021-3129] git:(main) ➜  rustscan -a 192.168.100.50                                                                     [19:15:42]
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
RustScan: Because guessing isn't hacking.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.100.50:22
Open 192.168.100.50:80
Open 192.168.100.50:3000
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-07 19:16 CST
Initiating ARP Ping Scan at 19:16
Scanning 192.168.100.50 [1 port]
Completed ARP Ping Scan at 19:16, 0.05s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:16
Completed Parallel DNS resolution of 1 host. at 19:16, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 19:16
Scanning 192.168.100.50 [3 ports]
Completed SYN Stealth Scan at 19:16, 1.23s elapsed (3 total ports)
Nmap scan report for 192.168.100.50
Host is up, received arp-response (0.00084s latency).
Scanned at 2026-01-07 19:16:01 CST for 1s

PORT STATE SERVICE REASON
22/tcp filtered ssh no-response
80/tcp filtered http no-response
3000/tcp filtered ppp no-response
MAC Address: 08:00:27:70:7B:D5 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 1.38 seconds
Raw packets sent: 7 (292B) | Rcvd: 1 (28B)

3000端口是一个nextjs的主页,想到最近刚出的react2shell于是扫描了一波​​

image

打点

发现确实存在,使用exp直接打了

https://github.com/Chocapikk/CVE-2025-55182

image

弹个shell

image

image

image

提权

sudo -l提权

可以看到/opt/react2shell/scanner.py

image

可以看到 -l可以指定输入的文件,-o在输出

读取root flag

image

获取root shell

linpeas扫描

用户添加的可执行文件里面有一个check_key

image

可以看到复制 /root/Reactrootpass.txt到/opt文件夹

image

因为在root下面bot用户没有权限所以可以使用之前的scanner.py读取

image

一个字符串,不知道是啥,尝试一下登录root

image

成功提权