1 Star 1 Fork 2

wuerror / hackthebox_oscp

Create your Gitee Account
Explore and code with more than 12 million developers,Free private repositories !:)
Sign up
This repository doesn't specify license. Please pay attention to the specific project description and its upstream code dependency when using it.
Clone or Download
mirai.md 2.00 KB
Copy Edit Raw Blame History
wuerror authored 2022-09-04 22:28 . 完成mirai

端口扫描

nmap -p- -v  -sV -A --min-rate 10000 10.10.10.48
22/tcp    open  ssh     OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0)
| ssh-hostkey: 
|   1024 aa:ef:5c:e0:8e:86:97:82:47:ff:4a:e5:40:18:90:c5 (DSA)
|   2048 e8:c1:9d:c5:43:ab:fe:61:23:3b:d7:e4:af:9b:74:18 (RSA)
|   256 b6:a0:78:38:d0:c8:10:94:8b:44:b2:ea:a0:17:42:2b (ECDSA)
|_  256 4d:68:40:f7:20:c4:e5:52:80:7a:44:38:b8:a2:a7:52 (ED25519)
53/tcp    open  domain  dnsmasq 2.76
| dns-nsid: 
|_  bind.version: dnsmasq-2.76
80/tcp    open  http    lighttpd 1.4.35
| http-methods: 
|_  Supported Methods: OPTIONS GET HEAD POST
|_http-server-header: lighttpd/1.4.35
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
1909/tcp  open  upnp    Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)
32400/tcp open  http    Plex Media Server httpd
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Server returned status 401 but no WWW-Authenticate header.
|_http-cors: HEAD GET POST PUT DELETE OPTIONS
|_http-favicon: Plex
|_http-title: Unauthorized
32469/tcp open  upnp    Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

80端口扫到admin目录, Pi-hole Version v3.1.4 Web Interface Version v3.1 FTL Version v2.10。尝试搜到的默认密码raspberry失败,空密码失败

==该版本<4.4,存在认证后的rce==

32400端口是plex media cms,从登录抓到的请求来看X-Plex-Version=3.9.1

注册接口可试探账号是否存在

ssh弱口令

看wp发现pi-hole搜到的那个口令可以用来登ssh。。。。。。

至此获得user.txt

发现有sudo权限,可以root身份执行任意命令

但root.txt里显示原始内容在usb stick里

经过搜索发现usb是挂载在/media目录下的

mount | grep usb

/dev/sdb on /media/usbstick type ext4 (ro,nosuid,nodev,noexec,relatime,data=ordered)

确认对应的真实设备文件是/dev/sdb,直接strings取巧获取flag

马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/wuerror/hackthebox_oscp.git
git@gitee.com:wuerror/hackthebox_oscp.git
wuerror
hackthebox_oscp
hackthebox_oscp
master

Search