【Vulnhub 靶场】【HackathonCTF: 2】【简单】【20210620】

1、环境介绍

靶场介绍:https://www.vulnhub.com/entry/hackathonctf-2,714/
靶场下载:https://download.vulnhub.com/hackathonctf/Hackathon2.zip
靶场难度:简单
发布日期:2021年06月20日
文件大小:2.6 GB
靶场作者:somu sen
靶场系列:HackathonCTF
靶场描述

  • 这是一台入门级的BootToRoot机器。有两个 Flag。找到 Flag 后,在推特上给我加标签(@Markme_1)。

打靶耗时:1+小时,毫无难度,毫无卡顿,非常顺畅,基础中的基础
打靶关键

  1. FTP 操作
  2. Web 目录扫描,页面静态检查
  3. SSH 非标准端口连接
  4. Linux 信息收集、SUID 提权

2、主机发现与端口扫描

(base) ┌──(root㉿kali)-[~]
└─# nmap -PR -sn 192.168.110.0/24
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-11-26 00:11 EST
Nmap scan report for 192.168.110.1
Host is up (0.00062s latency).
MAC Address: 00:50:56:C0:00:01 (VMware)
Nmap scan report for 192.168.110.137
Host is up (0.0010s latency).
MAC Address: 00:0C:29:89:E2:CB (VMware)
Nmap scan report for 192.168.110.254
Host is up (0.00042s latency).
MAC Address: 00:50:56:E0:2B:92 (VMware)
Nmap scan report for 192.168.110.131
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 15.12 seconds
  • 21端口:可以免密登录,并且有两个文件
  • 80端口:一个 Web 网页,可能没有什么内容
  • 7223端口:SSH端口,可能是个容器,需要逃逸
(base) ┌──(root㉿kali)-[~]
└─# nmap -T4 -sC -sV -p- -A --min-rate=1000 192.168.110.137
Starting Nmap 7.94SVN ( https://nmap.org ) at 2023-11-26 02:17 EST
Nmap scan report for 192.168.110.137
Host is up (0.0021s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--    1 1000     1000           47 Jun 18  2021 flag1.txt
|_-rw-r--r--    1 1000     1000          849 Jun 19  2021 word.dir
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:192.168.110.131
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
80/tcp   open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: hackathon2
| http-robots.txt: 1 disallowed entry 
|_*/
7223/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 70:4a:a9:69:c2:d1:68:23:86:bd:85:83:31:ca:80:0c (RSA)
|   256 a6:9e:a4:18:ad:a4:2b:7e:ea:f8:5e:63:29:6e:4f:24 (ECDSA)
|_  256 4e:db:a6:d2:eb:b9:53:a5:d7:21:0b:4e:57:a5:f5:c1 (ED25519)
MAC Address: 00:0C:29:89:E2:CB (VMware)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   2.06 ms 192.168.110.137

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.09 seconds

【Vulnhub 靶场】【HackathonCTF: 2】【简单】【20210620】_第1张图片

3、端口访问

3.1、21端口 - FTP 免密登录

  • 获取 flag 一个
  • 获取 字典 一个
(base) ┌──(root㉿kali)-[/usr/local/soft/hack]
└─# ftp 192.168.110.137
Connected to 192.168.110.137.
220 (vsFTPd 3.0.3)
Name (192.168.110.137:root): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||17626|)
150 Here comes the directory listing.
-rw-r--r--    1 1000     1000           47 Jun 18  2021 flag1.txt
-rw-r--r--    1 1000     1000          849 Jun 19  2021 word.dir
226 Directory send OK.
ftp> mget flag1.txt word.dir
mget flag1.txt [anpqy?]? 
229 Entering Extended Passive Mode (|||36686|)
150 Opening BINARY mode data connection for flag1.txt (47 bytes).
100% |******************************************************************|    47       10.98 KiB/s    00:00 ETA
226 Transfer complete.
47 bytes received in 00:00 (5.32 KiB/s)
mget word.dir [anpqy?]? 
229 Entering Extended Passive Mode (|||39054|)
150 Opening BINARY mode data connection for word.dir (849 bytes).
100% |******************************************************************|   849       63.78 KiB/s    00:00 ETA
226 Transfer complete.
849 bytes received in 00:00 (53.69 KiB/s)
ftp> exit
221 Goodbye.
(base) ┌──(root㉿kali)-[/usr/local/soft/hack]
└─# ls
flag1.txt  word.dir
                                                                                                               
(base) ┌──(root㉿kali)-[/usr/local/soft/hack]
└─# cat flag1.txt           
₣Ⱡ₳₲{7e3c118631b68d159d9399bda66fc684}
                                                                                                               
(base) ┌──(root㉿kali)-[/usr/local/soft/hack]
└─# cat word.dir 
happy
123456
12345
123456789
password
iloveyou
princess
......
basic1
basicone

3.2、80端口 - Web

  • 收集到的信息
    • 疑似用户名:@nohtakcah
    • 用户名:

你可能感兴趣的:(Vulnhub,渗透靶场)