lanSSudoyy

信息搜集

192.168.100.70

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
┌──(root㉿LAPTOP-O235O5EH)-[~]
└─# rustscan -a 192.168.100.70
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
Open ports, closed hearts.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.100.70:22
Open 192.168.100.70:80
[~] Starting Script(s)
[~] Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-25 17:39 +0800
Initiating ARP Ping Scan at 17:39
Scanning 192.168.100.70 [1 port]
Completed ARP Ping Scan at 17:39, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 17:39
Completed Parallel DNS resolution of 1 host. at 17:39, 2.50s elapsed
DNS resolution of 1 IPs took 2.50s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 3, CN: 0]
Initiating SYN Stealth Scan at 17:39
Scanning 192.168.100.70 [2 ports]
Discovered open port 80/tcp on 192.168.100.70
Discovered open port 22/tcp on 192.168.100.70
Completed SYN Stealth Scan at 17:39, 0.01s elapsed (2 total ports)
Nmap scan report for 192.168.100.70
Host is up, received arp-response (0.00089s latency).
Scanned at 2026-03-25 17:39:30 CST for 0s

PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 64
80/tcp open http syn-ack ttl 64
MAC Address: 08:00:27:BB:C6:C4 (Oracle VirtualBox virtual NIC)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 2.63 seconds
Raw packets sent: 3 (116B) | Rcvd: 3 (116B)

枚举 80/tcp

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
┌──(root㉿LAPTOP-O235O5EH)-[~]
└─# gobuster dir -u http://192.168.100.70/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.100.70/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Extensions: html,txt,php
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index.php (Status: 200) [Size: 927]
index.html (Status: 200) [Size: 6]
server-status (Status: 403) [Size: 279]
Progress: 882232 / 882232 (100.00%)
===============================================================
Finished
===============================================================

index.php才是主页是一个购买的web界面

image

可以看到账号的余额是直接明文存放在cookie里面的所以只需要修改cookie就能获取到Flag

image

image

image

得到凭证

sublarge:SublargePass2026

image

提权

sublarge -> root

在opt中存在CVE-2021-3156的sudo

image

image

直接使用exp

https://github.com/worawit/CVE-2021-3156/blob/main/exploit_nss.py

image