hackmyvm-baseme-wp

baseme

扫描开了22和80 80

80上全是base64编码的内容

解码后内容如下：

ALL, absolutely ALL that you need is in BASE64. Including the password that you need  Remember, BASE64 has the answer to all your questions. -lucas

同时有注释内容

iloveyou youloveyou shelovesyou helovesyou weloveyou theyhatesme

根据提示都是要base64的，所以扫描路径要base64编码，扫到一个id_rsa

要密码，所以是上面字典的其中一个，手工试了下是aWxvdmV5b3UK

这里很坑编码的其实是b"iloveyoun"

登录root失败，尝试登录lucas成功，拿下user.txt

sudo -l发现base64可以提权

User lucas may run the following commands on baseme: (ALL) NOPASSWD: /usr/bin/base64

sudo /usr/bin/base64 /root/root.txt直接获得flag就行

拿下

原文始发于微信公众号（BlueIris）：hackmyvm-baseme-wp