{"id":221,"date":"2025-02-19T13:21:48","date_gmt":"2025-02-19T05:21:48","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=221"},"modified":"2026-01-29T16:16:16","modified_gmt":"2026-01-29T08:16:16","slug":"221","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2025\/02\/19\/221\/","title":{"rendered":"HTB\u9776\u673a Titanic \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"
\n

\u76ee\u6807\u4fe1\u606f<\/h1>\n

IP\u5730\u5740\uff1a<\/strong>10.10.11.55<\/strong><\/code><\/p><\/blockquote>\n

\n

\u4fe1\u606f\u6536\u96c6<\/h1>\n

ICMP\u68c0\u6d4b<\/h2>\n
PING 10.10.11.55 (10.10.11.55) 56(84) bytes of data.\n64 bytes from 10.10.11.55: icmp_seq=1 ttl=63 time=233 ms\n64 bytes from 10.10.11.55: icmp_seq=2 ttl=63 time=230 ms\n64 bytes from 10.10.11.55: icmp_seq=3 ttl=63 time=228 ms\n64 bytes from 10.10.11.55: icmp_seq=4 ttl=63 time=227 ms\n\n--- 10.10.11.55 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3001ms\nrtt min\/avg\/max\/mdev = 227.349\/229.478\/233.172\/2.347 ms<\/code><\/pre>\n
\u9776\u573a\u7f51\u7edc\u72b6\u51b5\u826f\u597d\u3002<\/p>\n
\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n
# Nmap 7.95 scan initiated Tue Feb 18 19:54:52 2025 as: \/usr\/lib\/nmap\/nmap -sF -p- --min-rate 3000 -oN .\/fin_report.txt 10.10.11.55\nWarning: 10.10.11.55 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.11.55\nHost is up (0.23s latency).\nNot shown: 65533 closed tcp ports (reset)\nPORT   STATE         SERVICE\n22\/tcp open|filtered ssh\n80\/tcp open|filtered http\n\n# Nmap done at Tue Feb 18 19:55:22 2025 -- 1 IP address (1 host up) scanned in 29.28 seconds<\/code><\/pre>\n
\u9776\u673a\u7591\u4f3c\u5f00\u653e\u4e86SSH<\/code>\u548cHTTP<\/code>\u670d\u52a1\u3002<\/p>\n
\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n
TCP<\/code>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Tue Feb 18 19:57:47 2025 as: \/usr\/lib\/nmap\/nmap -sS -sV -A -p- --min-rate 3000 -oN .\/tcp_report.txt 10.10.11.55\nWarning: 10.10.11.55 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.11.55\nHost is up (0.23s latency).\nNot shown: 65533 closed tcp ports (reset)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 73:03:9c:76:eb:04:f1:fe:c9:e9:80:44:9c:7f:13:46 (ECDSA)\n|_  256 d5:bd:1d:5e:9a:86:1c:eb:88:63:4d:5f:88:4b:7e:04 (ED25519)\n80\/tcp open  http    Apache httpd 2.4.52\n|_http-title: Did not follow redirect to http:\/\/titanic.htb\/\n|_http-server-header: Apache\/2.4.52 (Ubuntu)\nDevice type: general purpose\nRunning: Linux 4.X|5.X\nOS CPE: cpe:\/o:linux:linux_kernel:4 cpe:\/o:linux:linux_kernel:5\nOS details: Linux 4.15 - 5.19\nNetwork Distance: 2 hops\nService Info: Host: titanic.htb; OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using port 8080\/tcp)\nHOP RTT       ADDRESS\n1   226.90 ms 10.10.14.1\n2   227.25 ms 10.10.11.55\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Tue Feb 18 19:58:35 2025 -- 1 IP address (1 host up) scanned in 48.01 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Tue Feb 18 19:59:10 2025 as: \/usr\/lib\/nmap\/nmap -sU -p- --min-rate 3000 -oN .\/udp_ports.txt 10.10.11.55\nWarning: 10.10.11.55 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.11.55\nHost is up (0.25s latency).\nAll 65535 scanned ports on 10.10.11.55 are in ignored states.\nNot shown: 65298 open|filtered udp ports (no-response), 237 closed udp ports (port-unreach)\n\n# Nmap done at Tue Feb 18 20:03:12 2025 -- 1 IP address (1 host up) scanned in 242.37 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
\uff08\u65e0\uff09<\/code><\/pre>\n
\u540c\u65f6\u53d1\u73b0\uff0c\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3aUbuntu Linux<\/code>\uff0c\u53ea\u5f00\u653e\u4e86SSH<\/code>\u548cHTTP Web<\/code>\u670d\u52a1\uff0c\u57df\u540d\u4e3atitanic.htb<\/code>\u3002<\/p>\n
\n
\u670d\u52a1\u63a2\u6d4b<\/h1>\n
SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n
\u7aef\u53e3Banner<\/code>\uff1a<\/p>\n
\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/megumin\/Documents\/pentest_notes\/titanic]\n\u2514\u2500# nc -nv 10.10.11.55 22                                       \n(UNKNOWN) [10.10.11.55] 22 (ssh) open\nSSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.10<\/code><\/pre>\n
Web\u5e94\u7528\u7a0b\u5e8f\uff0880\u7aef\u53e3\uff09<\/h2>\n
\u5b50\u57df\u540d\u63a2\u6d4b<\/h3>\n
\u5c1d\u8bd5\u4f7f\u7528wfuzz<\/code>\u63a2\u6d4b\u7f51\u7ad9\u5b50\u57df\u540d\uff1a<\/p>\n
wfuzz -w \/usr\/share\/wordlists\/seclists\/Discovery\/DNS\/subdomains-top1million-110000.txt -u 10.10.11.55 -H \"Host: FUZZ.titanic.htb\" -t 60 --hw 28 --hc 400<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\u53d1\u73b0\u5b50\u57df\u540ddev.titanic.htb<\/code>\u3002<\/p>\n
\u4e3b\u7ad9<\/h3>\n
\u6253\u5f00\u4e3b\u9875\uff1ahttp:\/\/titanic.htb\/<\/code><\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u8c8c\u4f3c\u662f\u4e00\u4e2a\u65c5\u6e38\u9884\u8ba2\u7cfb\u7edf\u7684\u5ba2\u6237\u9875\u9762\u3002\u70b9\u51fbBook Your Trip<\/code>\u6309\u94ae\uff0c\u5f39\u51fa\u4e86\u4e2a\u4eba\u4fe1\u606f\u767b\u8bb0\u8868\u5355\uff1a<\/p>\n
\"\"<\/p>\n
\u65c1\u7ad9\uff08dev\uff09<\/h3>\n
\u6253\u5f00\u7f51\u5740\uff1ahttp:\/\/dev.titanic.htb\/<\/code><\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u90e8\u7f72\u4e86Gitea<\/code>\u6e90\u4ee3\u7801\u6258\u7ba1\u7cfb\u7edf\uff0c\u7248\u672c\u4e3av1.22.1<\/code>\uff0c\u672a\u53d1\u73b0\u6f0f\u6d1e\u3002<\/p>\n
\u70b9\u51fb\u63a2\u7d22\u6309\u94ae\uff0c\u53d1\u73b0\u4e24\u4e2a\u516c\u5171\u4ee3\u7801\u5e93\uff1aflask-app<\/code>\u548cdocker-config<\/code>\u3002<\/p>\n
\"\"<\/p>\n
\u5728docker-config<\/code>\u5e93\u5185\u53d1\u73b0\u654f\u611f\u6587\u4ef6\uff1a.\/gitea\/docker-compose.yml<\/code>\u548c.\/mysql\/docker-compose.yml<\/code>\uff0c\u6587\u4ef6\u5185\u5bb9\u5982\u4e0b\uff1a<\/p>\n
# .\/gitea\/docker-compose.yml\nversion: '3'\n\nservices:\n  gitea:\n    image: gitea\/gitea\n    container_name: gitea\n    ports:\n      - \"127.0.0.1:3000:3000\"\n      - \"127.0.0.1:2222:22\"  # Optional for SSH access\n    volumes:\n      - \/home\/developer\/gitea\/data:\/data # Replace with your path\n    environment:\n      - USER_UID=1000\n      - USER_GID=1000\n    restart: always<\/code><\/pre>\n
# .\/mysql\/docker-compose.yml\nversion: '3.8'\n\nservices:\n  mysql:\n    image: mysql:8.0\n    container_name: mysql\n    ports:\n      - \"127.0.0.1:3306:3306\"\n    environment:\n      MYSQL_ROOT_PASSWORD: 'MySQLP@$w0rd!'\n      MYSQL_DATABASE: tickets \n      MYSQL_USER: sql_svc\n      MYSQL_PASSWORD: sql_password\n    restart: always<\/code><\/pre>\n
\u53d1\u73b0\u7591\u4f3cMySQL<\/code>\u51ed\u636e\uff1a<\/p>\n