靶机介绍：This CTF gives a clear analogy how hacking strategies can be performed on a network to compromise it in a safe environment. This vm is very similar to labs I faced in OSCP. The objective being to compromise the network/machine and gain Administrative/root privileges on them.
信息收集
端口发现和服务探测
使用 Nmap 基于 TCP 协议扫描端口：
1 2 3 4 5 6 7 8 9 10 11
$ sudo nmap -sT -p- --min-rate 10000 192.168.213.130 -oN nmapscan/portscan.txt [sudo] password for kali: Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-11 04:01 EDT Nmap scan report for 192.168.213.130 Host is up (0.00061s latency). Not shown: 65532 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 3128/tcp open squid-http 8080/tcp closed http-proxy MAC Address: 00:0C:29:74:56:35 (VMware)
$ sudo nmap -sT -p 22,3128,8080 -sV -sC -O 192.168.213.130 -oN nmapscan/servscan.txt [sudo] password for kali: Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-13 01:52 EDT Nmap scan report for 192.168.213.130 Host is up (0.00037s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 5.9p1 Debian 5ubuntu1.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 093d29a0da4814c165141e6a6c370409 (DSA) | 2048 8463e9a88e993348dbf6d581abf208ec (RSA) |_ 256 51f6eb09f6b3e691ae36370cc8ee3427 (ECDSA) 3128/tcp open http-proxy Squid http proxy 3.1.19 |_http-title: ERROR: The requested URL could not be retrieved |_http-server-header: squid/3.1.19 8080/tcp closed http-proxy MAC Address: 00:0C:29:74:56:35 (VMware) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 33.16 seconds
$ nc -lvnp 10234 listening on [any] 10234 ... connect to [192.168.213.129] from (UNKNOWN) [192.168.213.130] 49343 Linux SickOs 3.11.0-15-generic #25~precise1-Ubuntu SMP Thu Jan 30 17:42:40 UTC 2014 i686 athlon i386 GNU/Linux 18:09:34 up 6:48, 0 users, load average: 0.00, 0.01, 0.03 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=33(www-data) gid=33(www-data) groups=33(www-data) bash: no job control in this shell www-data@SickOs:/$
提权
注释
Squid 服务
Squid is a caching and forwarding HTTP web proxy. It has a wide variety of uses, including speeding up a web server by caching repeated requests, caching web, DNS and other computer network lookups for a group of people sharing network resources, and aiding security by filtering traffic. Although primarily used for HTTP and FTP, Squid includes limited support for several other protocols including Internet Gopher, SSL, TLS and HTTPS. Squid does not support the SOCKS protocol, unlike Privoxy, with which Squid can be used in order to provide SOCKS support. (From here).
