VulnHub-SkyDog: 1
靶机地址：https://www.vulnhub.com/entry/skydog-1,142/
目标：The purpose of this CTF is to find all six flags hidden throughout the server by hacking network and system services.
Flag #1 Home Sweet Home or (A Picture is Worth a Thousand Words)
Flag #2 When do Androids Learn to Walk?
Flag #3 Who Can You Trust?
Flag #4 Who Doesn’t Love a Good Cocktail Party?
Flag #5 Another Day at the Office
Flag #6 Little Black Box
nmap -sT -T4 -A -v 192.168.0.6
-sS/sT/sA/sW/sM：TCP SYN/Connect()/ACK/Window/Maimon扫描
-T<0-5>：设置计时模板(越高越快)
-A：启用操作系统检测、版本检测、脚本扫描和traceroute
-v：增加详细程度(使用-vv或更多效果)
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-31 09:11 CST
NSE: Loaded 155 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 09:11
Completed NSE at 09:11, 0.00s elapsed
Initiating NSE at 09:11
Completed NSE at 09:11, 0.00s elapsed
Initiating NSE at 09:11
Completed NSE at 09:11, 0.00s elapsed
Initiating ARP Ping Scan at 09:11
Scanning 192.168.0.6 [1 port]
Completed ARP Ping Scan at 09:11, 0.05s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 09:11
Completed Parallel DNS resolution of 1 host. at 09:11, 0.30s elapsed
Initiating Connect Scan at 09:11
Scanning 192.168.0.6 [1000 ports]
Discovered open port 80/tcp on 192.168.0.6
Discovered open port 22/tcp on 192.168.0.6
Completed Connect Scan at 09:11, 0.05s elapsed (1000 total ports)
Initiating Service scan at 09:11
Scanning 2 services on 192.168.0.6
Completed Service scan at 09:11, 6.02s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 192.168.0.6
NSE: Script scanning 192.168.0.6.
Initiating NSE at 09:11
Completed NSE at 09:11, 0.20s elapsed
Initiating NSE at 09:11
Completed NSE at 09:11, 0.00s elapsed
Initiating NSE at 09:11
Completed NSE at 09:11, 0.00s elapsed
Nmap scan report for 192.168.0.6
Host is up (0.00077s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 1024 c8f75b338a5a0c03bb6baf2da970d301 (DSA)
| 2048 019fdd98babede224a484bbe8d1a47f4 (RSA)
| 256 f8a965a57c501dfd715792388bee8c0a (ECDSA)
|_ 256 1deb574ab62366f0e7d5bb8d1ed7de23 (ED25519)
80/tcp open http Apache httpd 2.4.7 ((Ubuntu))
| http-methods:
|_ Supported Methods: POST OPTIONS GET HEAD
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.7 (Ubuntu)
| http-robots.txt: 252 disallowed entries (15 shown)
| /search /sdch /groups /catalogs /catalogues /news /nwshp
| /setnewsprefs? /index.html? /? /?hl=*& /?hl=*&*&gws_rd=ssl
|_/addurl/image? /mail/ /pagead/
MAC Address: 00:0C:29:75:50:BC (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Uptime guess: 0.039 days (since Wed May 31 08:15:10 2023)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 0.77 ms 192.168.0.6
NSE: Script Post-scanning.
Initiating NSE at 09:11
Completed NSE at 09:11, 0.00s elapsed
Initiating NSE at 09:11
Completed NSE at 09:11, 0.00s elapsed
Initiating NSE at 09:11
Completed NSE at 09:11, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.53 seconds
Raw packets sent: 23 (1.806KB) | Rcvd: 15 (1.278KB)
在 22 端口上有一个 SSH 服务，在 80 端口上有一个 Web 服务。
简要检查了SSH，但目前没有任何有价值的东西。
二、80端口
通过 nmap 可以看到有一个“robots.txt”文件。
/search
/sdch
/groups
/catalogs
/catalogues
/news
/nwshp
/setnewsprefs?
/index.html?
/?
/?hl=*&
/?hl=*&*&gws_rd=ssl
/addurl/image?
/mail/
/pagead/
三、登陆页面
页面上有一张 JPG图片。
下载图片后，使用exiftool来检查图片信息。
exiftool SkyDogCon_CTF.jpg
┌──(root㉿kali)-[~]
└─# exiftool SkyDogCon_CTF.jpg
ExifTool Version Number : 12.55
File Name : SkyDogCon_CTF.jpg
Directory : .
File Size : 85 kB
File Modification Date/Time : 2023:05:29 15:23:01+08:00
File Access Date/Time : 2023:05:31 08:05:06+08:00
File Inode Change Date/Time : 2023:05:31 08:04:39+08:00
File Permissions : -rw-------
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.01
Resolution Unit : inches
X Resolution : 96
Y Resolution : 96
Exif Byte Order : Big-endian (Motorola, MM)
Software : Adobe ImageReady
XP Comment : flag{abc40a2d4e023b42bd1ff04891549ae2}
Padding : (Binary data 2060 bytes, use -b option to extract)
Image Width : 900
Image Height : 525
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 900x525
Megapixels : 0.472
在XP注释字段中，得到了第一个标志。
Flag #1 Home Sweet Home or (A Picture is Worth a Thousand Words)
flag{abc40a2d4e023b42bd1ff04891549ae2}
接下来开始查看“robots.txt”文件中列出的目录。
四、robots.txt
为了完整，使用手动获取“robots.txt”文件。
# Congrats Mr. Bishop, your getting good - flag{cd4f10fcba234f0e8b2f60a490c306e6}
#
User-agent:*
Disallow: /search
Allow: /search/about
Disallow: /sdch
Disallow: /groups
Disallow: /catalogs
Allow: /catalogs/about
Allow: /catalogs/p?
Disallow: /catalogues
Allow: /newsalerts
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow: /index.html?
Disallow: /?
Allow: /?hl=
Disallow: /?hl=*&
Allow: /?hl=*&gws_rd=ssl$
Disallow: /?hl=*&*&gws_rd=ssl
Allow: /?gws_rd=ssl$
Allow: /?pt1=true$
Disallow: /addurl/image?
Allow: /mail/help/
Disallow: /mail/
Disallow: /pagead/
Disallow: /relpage/
Disallow: /relcontent
Disallow: /imgres
Disallow: /imglanding
Disallow: /sbd
Disallow: /keyword/
Disallow: /u/
Disallow: /univ/
Disallow: /cobrand
Disallow: /custom
Disallow: /advanced_group_search
Disallow: /googlesite
Disallow: /preferences
Disallow: /setprefs
Disallow: /swr
Disallow: /url
Disallow: /default
Disallow: /m?
Disallow: /m/
Allow: /m/finance
Disallow: /wml?
Disallow: /wml/?
Disallow: /wml/search?
Disallow: /xhtml?
Disallow: /xhtml/?
Disallow: /xhtml/search?
Disallow: /xml?
Disallow: /imode?
Disallow: /imode/?
Disallow: /imode/search?
Disallow: /jsky?
Disallow: /jsky/?
Disallow: /jsky/search?
Disallow: /pda?
Disallow: /pda/?
Disallow: /pda/search?
Disallow: /sprint_xhtml
Disallow: /sprint_wml
Disallow: /pqa
Disallow: /palm
Disallow: /gwt/
Disallow: /purchases
Disallow: /bsd?
Disallow: /linux?
Disallow: /mac?
Disallow: /microsoft?
Disallow: /unclesam?
Disallow: /answers/search?q=
Disallow: /local?
Disallow: /local_url
Disallow: /shihui?
Disallow: /shihui/
Disallow: /froogle?
Disallow: /products?
Disallow: /froogle_
Disallow: /product_
Disallow: /products_
Disallow: /products;
Disallow: /print
Disallow: /books/
Disallow: /bkshp?*q=*
Disallow: /books?*q=*
Disallow: /books?*output=*
Disallow: /books?*pg=*
Disallow: /books?*jtp=*
Disallow: /books?*jscmd=*
Disallow: /books?*buy=*
Disallow: /books?*zoom=*
Allow: /books?*q=related:*
Allow: /books?*q=editions:*
Allow: /books?*q=subject:*
Allow: /books/about
Allow: /booksrightsholders
Allow: /books?*zoom=1*
Allow: /books?*zoom=5*
Disallow: /ebooks/
Disallow: /ebooks?*q=*
Disallow: /ebooks?*output=*
Disallow: /ebooks?*pg=*
Disallow: /ebooks?*jscmd=*
Disallow: /ebooks?*buy=*
Disallow: /ebooks?*zoom=*
Allow: /ebooks?*q=related:*
Allow: /ebooks?*q=editions:*
Allow: /ebooks?*q=subject:*
Allow: /ebooks?*zoom=1*
Allow: /ebooks?*zoom=5*
Disallow: /patents?
Disallow: /patents/download/
Disallow: /patents/pdf/
Disallow: /patents/related/
Disallow: /scholar
Disallow: /citations?
Allow: /citations?user=
Disallow: /citations?*cstart=
Allow: /citations?view_op=new_profile
Allow: /citations?view_op=top_venues
Disallow: /complete
Disallow: /s?
Disallow: /sponsoredlinks
Disallow: /videosearch?
Disallow: /videopreview?
Disallow: /videoprograminfo?
Allow: /maps?*output=classic*
Allow: /maps/api/js?
Allow: /maps/d/
Disallow: /maps?
Disallow: /mapstt?
Disallow: /mapslt?
Disallow: /maps/stk/
Disallow: /maps/br?
Disallow: /mapabcpoi?
Disallow: /maphp?
Disallow: /mapprint?
Disallow: /maps/api/js/
Disallow: /maps/api/staticmap?
Disallow: /mld?
Disallow: /staticmap?
Disallow: /places/
Allow: /places/$
Allow: /Setec/
Disallow: /maps/preview
Disallow: /maps/place
Disallow: /help/maps/streetview/partners/welcome/
Disallow: /help/maps/indoormaps/partners/
Disallow: /lochp?
Disallow: /center
Disallow: /ie?
Disallow: /sms/demo?
Disallow: /katrina?
Disallow: /blogsearch?
Disallow: /blogsearch/
Disallow: /blogsearch_feeds
Disallow: /advanced_blog_search
Disallow: /uds/
Disallow: /chart?
Disallow: /transit?
Disallow: /mbd?
Disallow: /extern_js/
Disallow: /xjs/
Disallow: /calendar/feeds/
Disallow: /calendar/ical/
Disallow: /cl2/feeds/
Disallow: /cl2/ical/
Disallow: /coop/directory
Disallow: /coop/manage
Disallow: /trends?
Disallow: /trends/music?
Disallow: /trends/hottrends?
Disallow: /trends/viz?
Disallow: /trends/embed.js?
Disallow: /trends/fetchComponent?
Disallow: /notebook/search?
Disallow: /musica
Disallow: /musicad
Disallow: /musicas
Disallow: /musicl
Disallow: /musics
Disallow: /musicsearch
Disallow: /musicsp
Disallow: /musiclp
Disallow: /browsersync
Disallow: /call
Disallow: /archivesearch?
Disallow: /archivesearch/url
Disallow: /archivesearch/advanced_search
Disallow: /base/reportbadoffer
Disallow: /urchin_test/
Disallow: /movies?
Disallow: /codesearch?
Disallow: /codesearch/feeds/search?
Disallow: /wapsearch?
Disallow: /reviews/search?
Disallow: /orkut/albums
Allow: /jsapi
Disallow: /views?
Disallow: /c/
Disallow: /cbk
Allow: /cbk?output=tile&cb_client=maps_sv
Disallow: /recharge/dashboard/car
Disallow: /recharge/dashboard/static/
Disallow: /translate_a/
Disallow: /translate_c
Disallow: /translate_f
Disallow: /translate_static/
Disallow: /translate_suggestion
Disallow: /profiles/me
Allow: /profiles
Disallow: /s2/profiles/me
Allow: /s2/profiles
Allow: /s2/oz
Allow: /s2/photos
Allow: /s2/search/social
Allow: /s2/static
Disallow: /s2
Disallow: /transconsole/portal/
Disallow: /gcc/
Disallow: /aclk
Disallow: /cse?
Disallow: /cse/home
Disallow: /cse/panel
Disallow: /cse/manage
Disallow: /tbproxy/
Disallow: /imesync/
Disallow: /shenghuo/search?
Disallow: /support/forum/search?
Disallow: /reviews/polls/
Disallow: /hosted/images/
Disallow: /ppob/?
Disallow: /ppob?
Disallow: /adwordsresellers
Disallow: /accounts/ClientLogin
Disallow: /accounts/ClientAuth
Disallow: /accounts/o8
Allow: /accounts/o8/id
Disallow: /topicsearch?q=