kali@kali [~] ➜ sudo nmap -sT -p- --min-rate 1000 192.168.134.213 [17:25:47] [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-22 17:26 CST Nmap scan report for 192.168.134.213 Host is up (0.0021s latency). Not shown: 65532 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 6666/tcp open irc
服务渗透
靶机叫easypwn，估计6666是和pwn有关的吧，尝试连接看看
1 2 3 4
kali@kali [~] ➜ nc 192.168.134.213 6666 [17:26:11] aaaa Hackers, get out of my machine [*] 等待客户端连接...
有的，我们想办法拿到源码吧
1 2 3 4 5 6 7
kali@kali [~] ➜ curl http://192.168.134.213 </head> <body> <h1>Don't Hack Me</h1> <p>Enumerating directories on my server would ruin everything</p> </body> </html>
kali@kali [~] ➜ curl http://192.168.134.213/mysecret.txt [17:35:46] Go to the most evil port. You will get what you want. Please be gentle with him, maybe he will be afraid. In order to obtain its source code. Perhaps you will need the dictionary below.
kali@kali [~] ➜ gobuster dir --wordlist=/home/kali/dict -u http://192.168.134.213 [17:36:52] =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.134.213 [+] Method: GET [+] Threads: 10 [+] Wordlist: /home/kali/dict [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== Progress: 10 / 11 (90.91%) /ll104567 (Status: 200) [Size: 739584] =============================================================== Finished ===============================================================
curl发现是文件，我们wget下载
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
kali@kali [~] ➜ curl http://192.168.134.213/ll104567 [17:37:41] Warning: Binary output can mess up your terminal. Use "--output -" to tell Warning: curl to output it to your terminal anyway, or consider "--output Warning: <FILE>" to save to a file. kali@kali [~] ➜ wget http://192.168.134.213/ll104567 [17:38:02] --2025-04-22 17:38:44-- http://192.168.134.213/ll104567 正在连接 192.168.134.213:80... 已连接。 已发出 HTTP 请求，正在等待回应... 200 OK 长度：739584 (722K) 正在保存至: “ll104567”
ls id_rsa.pub mv id_rsa.pub authorized_keys ls authorized_keys id uid=1001(lamb) gid=1001(lamb) groups=1001(lamb)
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
kali@kali [~/.ssh] ➜ ssh lamb@192.168.134.213 [18:21:23] The authenticity of host '192.168.134.213 (192.168.134.213)' can't be established. ED25519 key fingerprint is SHA256:rXcjV9xeZG+J6KZLTr1t2Xi2ErBvMauXjxH4EBvhV0c. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.134.213' (ED25519) to the list of known hosts. Linux pwnding 4.19.0-12-amd64 #1 SMP Debian 4.19.152-1 (2020-10-18) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Feb 20 03:24:48 2025 from 192.168.1.32 lamb@pwnding:~$ cat use3e3e3e3e3sr.txt flag{3a463d08f2ae11efbeb6000c29094b2d}
提权
1 2 3 4 5 6 7 8 9 10 11 12
lamb@pwnding:~$ cat this_is_a_tips.txt There is a fun tool called cupp. I heard it's a good social engineering dictionary generator. Are there really people that stupid these days? haha. There is only one way to become ROOT, which is to execute getroot!!! And don't forget, this is a PWN type machine.
lamb@pwnding:~$ cat /var/backups/.secret/.verysecret/.noooooo/note2.txt The Compass and the Campfire
David knelt beside his ten-year-old son, Jake, their shared backpack spilling onto the forest floor. "Lost?" Jake whispered, staring at the identical trees clawing at the twilight. David’s calloused fingers brushed the cracked compass in his palm—a relic from his father, its needle trembling like a moth. "Not lost," he lied. "Just… rerouting."
Jake’s eyes narrowed, too sharp for comfort. "Your compass is broken."
A chuckle escaped David, brittle as dry leaves. "Compasses don’t break, bud. They… forget." He flipped it open, the glass fogged with age. "See? North isn’t where it should be. It’s where it chooses to be tonight."
The boy frowned, then yelped as a pinecone thudded beside him. A red squirrel chattered overhead, its tail flicking like a metronome. Jake’s fear dissolved into giggles. David watched, throat tight. He’s still young enough to laugh at squirrels.
"Dad?" Jake unzipped his jacket, revealing three granola bars and a glowstick. "We’ve got supplies. Let’s build a fort."
They wove branches into a crooked shelter, Jake’s hands steady where David’s shook. When the first stars pierced the canopy, David confessed: "Grandpa gave me this compass the day I got lost in the mall. Told me it’d always point home."
Jake snapped the glowstick, bathing their fort in alien green. "Does it work now?"
The needle quivered, settling northwest. Toward the distant highway hum, not their cabin’s woodsmoke. David closed the brass lid. "Nope. But you do." He nodded at Jake’s pocket—where a crumpled trail map peeked out, dotted with the boy’s doodled dinosaurs.
Dawn found them at the cabin’s porch, guided by Jake’s roars laughter and the squirrels he’d named "Sir Nibbles". The compass stayed in David’s pocket, its secret safe: true north had shifted years ago, anyway—from steel poles to a gap-toothed grin eating pancakes at 6 AM.
[+] Insert the information about the victim to make a dictionary [+] If you don't know all the info, just hit enter when asked! ;) > First Name: David > Surname: > Nickname: > Birthdate (DDMMYYYY): > Partners) name: > Partners) nickname: > Partners) birthdate (DDMMYYYY): > Child's name: Jake > Child's nickname: > Child's birthdate (DDMMYYYY): > Pet's name: > Company name: > Do you want to add some key words about the victim? Y/[N]: > Do you want to add special chars at the end of words? Y/[N]: > Do you want to add some random numbers at the end of words? Y/[N]: > Leet mode? (i.e. leet = 1337) Y/[N]:
[+] Now making a dictionary... [+] Sorting list and removing duplicates... [+] Saving dictionary to david.txt, counting 500 words. > Hyperspeed Print? (Y/n) : [+] Now load your pistolero with david.txt and shoot! Good luck!
