Tryhackme-Boiler CTF

Boiler CTF

Task1 Questions #1

1.File extension after anon login

txt

通过ftp访问21端口,使用anonymous账号无密码访问,发现.info.txt文本文件,

Whfg jnagrq gb frr vs lbh svaq vg. Yby. Erzrzore: Rahzrengvba vf gur xrl!

解密文本文件内容得到提示枚举是关键;

2.What is on the highest port?

ssh

3.What’s running on port 10000?

Webmin

4.Can you exploit the service running on that port? (yay/nay answer)

nay

5.What’s CMS can you access?

joomla

6.Keep enumerating, you’ll know when you find it.

7.The interesting file name in the folder?

log.txt

访问http:///joomla/_test,发现sar2html(将sar程序执行的二进制结果数据转为图形的HTML格式)

sar2html 3.2.1 - ‘plot’ Remote Code Execution - PHP webapps Exploit (exploit-db.com) plot参数存在远程代码执行;

点击页面左侧出现http://10.10.252.237/joomla/_test/index.php?plot=NEW,将plot参数改为;ls,即可任意代码执行,在Selelct Host处可以查看结果,发现文件log.txt;

Task2 Questions #2

1.Where was the other users pass stored(no extension, just the name)?

backup

在log文件中发现ssh账密basterd:superduperp@$$,尝试ssh登录,无法直接登录;远程命令执行反弹shell,本机监听,得到shell;

获取反弹shell后使用ssh账密提权,获取basterd用户权限;

在basterd用户家目录下,发现backup.sh,注释中含有账密stoner:superduperp@$$no1knows

REMOTE=1.2.3.4SOURCE=/home/stoner
TARGET=/usr/local/backupLOG=/home/stoner/bck.logDATE=`date +%y\.%m\.%d\.`USER=stoner
#superduperp@$$no1knowsssh $USER@$REMOTE mkdir $TARGET/$DATEif [ -d "$SOURCE" ]; thenfor i in `ls $SOURCE | grep 'data'`;doecho "Begining copy of" $i  >> $LOGscp  $SOURCE/$i $USER@$REMOTE:$TARGET/$DATEecho $i "completed" >> $LOGif [ -n `ssh $USER@$REMOTE ls $TARGET/$DATE/$i 2>/dev/null` ];thenrm $SOURCE/$iecho $i "removed" >> $LOGecho "####################" >> $LOGelseecho "Copy not complete" >> $LOGexit 0fidoneelseecho "Directory is not present" >> $LOGexit 0
fi

2.user.txt

You made it till here, well done

成功切换账户后,在stoner用户家目录下,找到.secret

3.What did you exploit to get the privileged user?

find

find程序具有+S权限,普通用户可以以所有者身份执行;

4.root.txt

It wasn’t that hard, was it

参考find | GTFOBins,find命令具有S权限,添加-p命令执行;

默认情况下 bash 在执行时，如果发现 euid 和 uid 不匹配，会将 euid（即 suid）强制重置为uid 。如果使用了 -p 参数，则不会再覆盖。