群友靶机-Easy-Sneak

这回也是罕见的写出了群里大佬的靶机

(虽然和其他师傅交流了下)

当时写的时候因为是和其他师傅交流的,也是比较乱,所以这里写个文档理理思路

信息收集

Nmap

PixPin_2025-07-14_23-14-54

Dirsearch

PixPin_2025-07-14_23-14-32

User

访问下来感觉找到的只有

http://192.168.198.250/cms/license.txt

http://192.168.198.250/cms/install/login.php

http://192.168.198.250/cms/.gitignore

倒是这个登录窗口怎么爆破都没消息

其他目录全部找了一遍,啥也没有

那没办法,只感觉这个license.txt有一点想法

PixPin_2025-07-14_23-22-58

最开始试的时候倒是试了好久,因为第一行是逆序的,然后到二行也是逆序的,于是尝试将整个密钥全部逆序,但是第二行和最后一行又是正序的,所以全部逆又感觉不对劲,这个时候又想起来题目sneak(🐍)那可能就是要绕,那就试着绕一下,发现突然就绕通了(也是猜到了)

PixPin_2025-07-14_23-31-19

Python 脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
list1 = [
"-----YEK ETAVIRP HSSNEPO NIGEB-----",
"b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn",
"sAdd/5SMN1KWatGo/1evq+7bfETGlpGM2U5Oi7e8nMF2/mDX2PJzAEYAAAQAAEwAAAAAhN",
"8vtXIS94jYewIuOQ3qS5ya5ET3o0Ok33k5m9oy+ekd2A8oHiJJUBD8CPst/BR4PMM+OIYq",
"CugO2A2hUNf4TK8+J/RSLgmuZ9PW5KHzTezkcuONjFFWCvgtGzY1YrCzvIjdVZn9JAngQ9",
"g/MRe8qLORDFocrlGt+h4NUfrgxaoBQhJfiMZ9ygZA1xYdC/5JtCuXeAvM69jREOaxLA13",
"zC2umAuwE4CUKEenEK2+4B4JRkq1wcVOYR8DeAbnAb/lvn/edv2QS74OgBZizuTo9ZS+20",
"+kQNrEKqcPUv/CEjnOL5225HYA5WIUaOPbS4wIrPewLXMZ4UCJrDR5qh2VlJgGxbkx86Rj",
"vPy1xifMKxxT35lAOQGMysOhSaohFWCoSdqx7H8mQIlRAMK5+g8vRR0MLfG6/8dziq5QYl",
"CMF4kKogzmcOR6RVA+jTkVB821JKS3e46Y5DoKh7AAAFiBz2r4oc9q+KAAAAB3NzaC1yc2",
"H2IevEyV7LPLQX3fuETTtilWrB6ft3rq/+2HxkRZqBjNVuj4uH/JTh9v5wl9TyMABGAAAE",
"sCLjkN6kucmuRE96NDpN95OZvaMvnpHdgPKB4iSVAQ/Aj7LfwUeDzDPjiGKvUIJwCfZ2VX",
"QkziKvXEzPogLojNgdIVzH+kCvfyfk0CopbW/jVuyx8k3MJnrTzYRhlwLYrxMWN2qw8LyY",
"xaHK5RrfoeDVH64MWqAUISX4jGfcoGQNcWHQv+SbQrl3gLzOvY0RDmsSwNd9NvkmfaE7s4",
"1DnqCxaDEp/sgtrJgLMBuAlCh3JhitPeAeSEpaNMXlDWE/gHw2Jw2f575vX3rNk0OuDYQm",
"L/whI5zi+dtuR2AOViFGjj20uMCKz3sC1zGeFAiaw0eaodlZSYBsW5MfOkY5WEOaos3fP+",
"n5MIqCJeBjw7jcds4HjSc80deJgDkBjMrTokGaYhlAqUna8+BvJESZEAjSuPI/bUENzynh",
"DkekVQPo05FQfNtSSkt3uOmOQ6CoewAAAAMBAAEAAAGAFNe6UNkdX5fRSQfSisl/9NzSIg",
"wAgRSzrZkhHVUXz3+T373wkBttVkjAd1t8iNU0udXCg3cZcclCFHDIP345xlkqtDxFQMsf",
"RATRmnKH4if3O/0p/vRBmMPEwHEmHbP2f+K8gEdKsV1oLBGkqSV3jnH0To72q9UMvNavZY",
"eWD9b8W0hSdu+qkbmlcI9FZmL+yXWpoiag+RPlnaIyk+OjzHfcUwnp81JNCIA8fObRHgW7",
"aJ3Q/ySGXsj7F8FkdHvZMpPDK4ZKMRdx7UalxY14RlUi2500eZawNbFd/cPUkVFSPl/mlY",
"O4yLkC4jUKtXW8Vu2GDlVz495SE5yIDqsP2d6s5RHXNfMVxYySHF3CyIxLuq5vclyku4sr",
"OTe2CmPjFYfQSrF4JT0JhQBMWXIrRetIUiyQULFFYxSvQZ0xm/wBZDiO8npE+0dG/Czelb",
"AAAAxklCGnnTo1Jbjs0N9uhlvzyL5fXTibhUvVhIeIvVxF3xkODLXJxV/BqhnpwPDM+rMN",
"wGg79PTiKC6HwVFRxxQGnPufZ8Go1KeLfpJ0TR3RQ0TNPh54eFH/O+YAmTRDKeDU5fxrQY",
"MRqZx7/je0GTAwbbpEVcf20lYLDc0ygsCnRF92ZnB4N6/KWCsDoVxX2+e6nF54K8w//5O1",
"R9wxe4c/2e9ifWnYljQe9PzOoPOCdZgz1v1jYvON17T+MVuudygdNRLZw+ZgBf1xVQYHBu",
"yCg1p+s+ASIw01U5AEMAAAwWaHDSG/RHnoJw4qBeiUTA0H6Uudn0FcVuC9UApP5Z8dCdP0",
"8kiVzZNbGxOKTWNPvubFREDC3rOKfxwIqkMMm22Kl1zOOKRL5KQYUeIPgm/FE27Q204TLN",
"tkwzr/RuH9nGj4X3UF+gxjDed5QkMf7f10+8BkVVh8PULRxKuyCbZ7Rlp+TnGiJud35I1u",
"jSQ7sjSRRjY7zJaF+PddkcnleejwHcNy48WUSesTKRSZQfTwqWN5DGIL23/BRhRWUr4iKq",
"D60XD8ng8Emm8qz1oh2GcYjM22s3MIZZkDQwAAAAT2ZbedvPMgwrxScQulmYH9cZCOP9Fh",
"T5AHbmxc0QWQIKpIyhH4/w1BTXfeBmoRca80dhpMUK+idiYG9TOYW2yAczR3nCUYHhYuV2",
"ujfICkFANZoCfe8p/aYoWunCn8aHt9EosO6yIZ0+UNd9rrI3arzLr7OertbKaPMMLUJJqS",
"sX74l65qBqWMs8knQ2mxI6hmmZ+Tqvl+b2KqtsdML7VbLXTlfJmNxKwDnzMJ1QrINssBDx",
"==wBGUABDIQArFWZuNFQtRWYzl3cMAAAAkn2WUqipD5tU8",
"-----END OPENSSH PRIVATE KEY-----"
]
for i in range(0,len(list1)):
if(i%2==0):
print(list1[i][::-1],end="\n")
else:
print(list1[i],end="\n")

然后就嘎巴一下卡这了。。。之后一直想着用这个密钥爆破用户名(也是能试的都试了)

这个时候,有师傅说打算从flatCorecms的nday入手,收到师傅提醒,也是继续从nday入手

于是开始百度

[春秋云镜]CVE-2021-41402-CSDN博客

acp!!!

于是也终于成功的找到了真正的入口点

http://192.168.198.250/cms/acp

PixPin_2025-07-14_23-39-57

看了下没注入什么的,那就直接开爆

PixPin_2025-07-14_23-42-59

然后就是非常朴实无华的文件上传,只要先在设置中添加php,然后找到上传点,就能直接上传了

PixPin_2025-07-14_23-45-58

这里记得改成file

(这里也要)

PixPin_2025-07-14_23-46-35

然后就能看到上传路径了

看了下home

PixPin_2025-07-14_23-48-19

那这个时候不就找到了sysadm

那就能直接连上了撒😁

PixPin_2025-07-14_23-49-28

然后就一直卡着😂

这个时候想到user看user的flag,结果看不到🤦‍♀️

(开摆)

那必然是不可能的

突然发现 /etc/passwd

PixPin_2025-07-14_23-53-04

挖去

也是搞到了

PixPin_2025-07-14_23-54-18

正常思路

等等

PixPin_2025-07-14_23-55-41

这个是啥,欸下一步好像已经做过了!!!

😂😂😂😂😂😂

发现作者的思路应该是 www –> 查看/etc/passwd/ —> 进入user —> 发现license —> 连接sysadm

好吧,虽然也是写出来了

Root

到提权这里,这里可能就不是非常擅长了,这里就是直接复现其他佬的步骤

在sysadm

1
sudo -l

发现提示

PixPin_2025-07-14_23-59-53

又more,大佬一下就猜出来是more的交互界面进行提权

然后按照more提权的步骤提

1
ssh -i ./a sysadm@192.168.198.250

PixPin_2025-07-15_00-02-43

缩小界面

按照提示输入

1
sudo /usr/bin/more /var/log/custom/fake-cleanup.sh

PixPin_2025-07-15_00-03-29

然后再输入

1
!/bin/bash

PixPin_2025-07-15_00-03-54

PixPin_2025-07-15_00-04-19