Hackmyvm target series (2) -warrior

One 、 information gathering

Scan network segment first , Detect live hosts , Because there are too many campus network hosts , I'll steal a little lazy .
Target host found IP

nmap -sP 192.168.200.0/24 | grep -i -B 2 virtualbox

Use nmap Scan the target port , Explore open services .

nmap -sT -T4 -sV -sC -O -A -p- 192.168.200.183

Here's the picture , Scan to two ports , Namely ssh and http service

Visit http service , View the source code , However, no useful information was found .
Use dirsearch Do a directory scan .

dirsearch -u http://192.168.200.183/ -e php,html,txt,db,bak,zip,7z,gz -x 404,301,500-599 -t 50 -r -R 3

Find the following information .

visit robots.txt file , I found these files and directories below , Visit one by one .

user.txt, It should be a user name

Translate it , This probably means to constantly change mac Last digit of address , And up there secret.txt Because this is the scope of transformation , just 16 position .

Two 、 Exploit

Change the computer's MAC Address , The use cases are as follows ：
Prevent some software from recording your true MAC Address
The network administrator blocked your MAC Address

After testing, only mac The address is 00:00:00:00:00:af Successful access

ifconfig eth0 down
ifconfig eth0 hw ether 00:00:00:00:00:af
ifconfig eth0 up

Pictured above , Got the code Zurviv0r1
First I used user.txt In the middle of loco, But login failed . But I saw that sentence mentioned bro, So log in again with this user . Login successful ！( Hey ！ Fortunately, the picture was cut at that time )

Get the first one flag

3、 ... and 、 Elevated privileges

Let's see if it works sudo The abuse of .
？？？ There is no such order ？
Don't panic , try suid Raise the right .
View with s Permission file , I found that there was actually one sudo. Quickly check the environment variables .？？？ Really , No environment variables /usr/sbin/ Catalog .
Enter the following command , Find out task The command does not need a password to be able to root Permission to run

sudo -l

utilize task Order to raise rights

/usr/sbin/sudo task execute /bin/bash

Pictured , Successfully promoted the permission to root

Get the last one flag