【Vulnhub】Vulnhub2018-DeRPnStiNK

最新推荐文章于 2025-12-12 15:13:36 发布

原创最新推荐文章于 2025-12-12 15:13:36 发布 · 236 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#linux #网络安全

信息收集

在这里插入图片描述
开了三个端口21，22，80
访问80端口，flag1在源码下

没什么东西就扫描目录

几个有用的
http://192.168.83.154/php/phpmyadmin/
http://192.168.83.154/weblog/
http://192.168.83.154/weblog/wp-admin/----弱口令爆破 admin admin

在这里插入图片描述
对文件上传没有过滤，上传一个后门

在这里插入图片描述
配置文件，还有一个phpmyadmin没登陆

root mysql

在这里插入图片描述
flag2

unclestinky $P$BW6NTkFvboVVCHU2R9qmNai1WfHSC41
用john爆破  wedgie57

在这里插入图片描述
再次登录wordpress没发现啥，前面用web打入服务器了，先用那个，有两个用户，尝试用之前的密码登录一下

stinky wedgie57

flag3
在这里插入图片描述
尝试用stinky wedgie57登录ftp

mv derpissues.pcap ~/ftp/files/---移动到ftp目录下

发现了sshkey

在这里插入图片描述
用xshell连接。然后对derpissues.pacp进行分析

mrderp："derpderpderpderpderpderpderp"

在这里插入图片描述

mrderp@DeRPnStiNK:~/Desktop$ cat helpdesk.log
From: Help Desk helpdesk@derpnstink.local
Date: Thu, Aug 23, 2017 at 1:29 PM
Subject: sudoers ISSUE=242 PROJ=26
To: Derp, Mr (mrderp) [C]
When replying, type your text above this line.
Help Desk Ticket Notification
Thank you for contacting the Help Desk. Your ticket information is below. If you have any
additional information to add to this ticket, please reply to this notification.
If you need immediate help (i.e. you are within two days of a deadline or in the event of a
security emergency), call us. Note that the Help Desk’s busiest hours are between 10 a.m. (ET)
and 3 p.m. (ET).
Toll-free: 1-866-504-9552
Phone: 301-402-7469
TTY: 301-451-5939
Ticket Title: Sudoers File issues
Ticket Number: 242
Status: Break/fix
Date Created: 08/23/2017
Latest Update Date: 08/23/2017
Contact Name: Mr Derp
CC’s: Uncle Stinky
Full description and latest notes on your Ticket: Sudoers File issues
Notification
Regards,
Service Desk
Listen with focus, answer with accuracy, assist with compassion.
From: Help Desk
Date: Mon, Sep 10, 2017 at 2:53 PM
Subject: sudoers ISSUE=242 PROJ=26
To: Derp, Mr (mrderp) [C]
When replying, type your text above this line.
Closed Ticket Notification
Thank you for contacting the Help Desk. Your ticket information and its resolution is
below. If you feel that the ticket has not been resolved to your satisfaction or you need additional
assistance, please reply to this notification to provide additional information.
If you need immediate help (i.e. you are within two days of a deadline or in the event of a
security emergency), call us or visit our Self Help Web page at https://pastebin.com/RzK9WfGw
Note that the Help Desk’s busiest hours are between 10 a.m. (ET)
and 3 p.m. (ET).
Toll-free: 1-866-504-9552
Phone: 301-402-7469
TTY: 301-451-5939
Ticket Title: sudoers issues
Ticket Number: 242
Status: Closed
Date Created: 09/10/2017
Latest Update Date: 09/10/2017
CC’s:
Resolution: Closing ticket. ticket notification.
Regards,
eRA Service Desk
Listen with focus, answer with accuracy, assist with compassion.
For more information, dont forget to visit the Self Help Web page!!!

没啥用，看看有什么root权限的文件

sudo -l

在这里插入图片描述
没有这个文件，直接运行

echo “/bin/bash” > /home/mrderp/binaries/derpy.sh
chmod +x derpy.sh
sudo ./derpy.sh

然后就是root权限
在这里插入图片描述