当前位置：网站首页 > 网络安全培训 > 正文

CTF靶场系列-De-ICE:_S2.100

freebuf 2019-03-02 502 0

本文来源:

下载地址

https://download.vulnhub.com/deice/De-ICE_S2.100_%28de-ice.net-2.100-1.0%29.iso

实战演练

原文再续，书接上文s1.100的系统

任务信息

寻找用户信息

信息收集

netdiscover发现有两个IP，看来有点东西啊

看看FTP有没有anonymous账号，发现没有东西

只有一个显示信息的PHP

web目录也没啥信息

看看192.168.2.101的web系统有什么信息

没啥东西

找到邮箱信息，还有服务器开放smtp，我们枚举一下smtp账号

Samuel Pickwick	pickwick@herot.net Nathaniel Winkle	winkle@herot.net Augustus Snodgrass	snodgrass@herot.net Tracy	Tupman	tupman@herot.net Sam	Weller	weller@herot.net Tony	Weller	tweller@herot.net Estella Havisham	havisham@herot.net Abel Magwitch	magwitch@herot.net Philip Pirrip	pirrip@herot.net Nicholas Nickleby	nickleby@herot.net Ralph Nickleby	rnickleby@herot.net Newman Noggs	noggs@herot.net Wackford Squeers	squeers@herot.net Thomas Pinch	pinch@herot.net Mark Tapley	tapley@herot.net Sarah Gamp	gamp@herot.net Jacob Marley	marley@herot.net Ebenezer Scrooge	scrooge@herot.net Bob Cratchit	cratchit@herot.net Bill Sikes	sikes@herot.net Jack Dawkins	dawkins@herot.net Noah Claypole	claypole@herot.net

#用户表

Pickwick Winkle Snodgrass Tupman Weller Weller Havisham Magwitch Pirrip Nickleby Nickleby Noggs Squeers Pinch Tapley Gamp Marley Scrooge Cratchit Sikes Dawkins Claypole Samuel Nathaniel Augustus Tracy Sam Tony Estella Abel Philip Nicholas Ralph Newman Wackford Thomas Mark Sarah Jacob Ebenezer Bob Bill Jack Noah spickwick nwinkle asnodgrass ttupman sweller tweller ehavisham amagwitch ppirrip nnickleby rnickleby nnoggs wsqueers tpinch mtapley sgamp jmarley escrooge bcratchit bsikes jdawkins nclaypole

找到三个账号

按照社会工程学的思想，加上上面扫描到~root目录，试试~+用户名爆破web的方式

100的web服务器

101服务器上找到ssh的认证文件，下载下来

修改证书权限，就可以登录

找信息

查看邮件信息，第七封邮件有信息

pirrip@slax:~$ mail mailx version nail 11.25 7/29/05.  Type ? for help. "/var/mail/pirrip": 7 messages 7 new >N  1 Abel Magwitch      Sun Jan 13 23:53   20/748   Estella  N  2 Estella Havisham   Sun Jan 13 23:53   20/780   welcome to the team  N  3 Abel Magwitch      Sun Jan 13 23:53   20/875   havisham  N  4 Estella Havisham   Mon Jan 14 00:05   20/861   next month  N  5 Abel Magwitch      Mon Jan 14 00:05   20/868   vacation  N  6 Abel Magwitch      Mon Jan 14 00:05   20/915   vacation  N  7 noreply@fermion.he Mon Jan 14 00:05   29/983   Fermion Account Login Reminder ?  Message  1: From magwitch@slax.example.net  Sun Jan 13 23:53:37 2008 Return-Path: magwitch@slax.example.net> From: Abel Magwitch magwitch@slax.example.net> Date: Sun, 13 Jan 2008 23:47:48 +0000 To: pirrip@slax.example.net Subject: Estella User-Agent: nail 11.25 7/29/05 Content-Type: text/plain; charset=us-ascii Status: R  Will do.  ?  Message  2: From havisham@slax.example.net  Sun Jan 13 23:53:37 2008 Return-Path: havisham@slax.example.net> From: Estella Havisham havisham@slax.example.net> Date: Sun, 13 Jan 2008 23:50:33 +0000 To: pirrip@slax.example.net Subject: welcome to the team User-Agent: nail 11.25 7/29/05 Content-Type: text/plain; charset=us-ascii Status: R  Thanks!  Glad to be here.  ?  Message  3: From magwitch@slax.example.net  Sun Jan 13 23:53:37 2008 Return-Path: magwitch@slax.example.net> From: Abel Magwitch magwitch@slax.example.net> Date: Sun, 13 Jan 2008 23:48:57 +0000 To: pirrip@slax.example.net Subject: havisham User-Agent: nail 11.25 7/29/05 Content-Type: text/plain; charset=us-ascii Status: R  I set her up with an accountus servers.  I set her password to "changeme" and will swing by tomorrow and make sure she changes her pw.  ?  Message  4: From havisham@slax.example.net  Mon Jan 14 00:05:15 2008 Return-Path: havisham@slax.example.net> From: Estella Havisham havisham@slax.example.net> Date: Mon, 14 Jan 2008 00:03:56 +0000 To: pirrip@slax.example.net Subject: next month User-Agent: nail 11.25 7/29/05 Content-Type: text/plain; charset=us-ascii Status: R  Abel filled me in about next month.  I wanted to ask you if I can grab the week you get back for vacation?  Thanks.  ?  Message  5: From magwitch@slax.example.net  Mon Jan 14 00:05:15 2008 Return-Path: magwitch@slax.example.net> From: Abel Magwitch magwitch@slax.example.net> Date: Sun, 13 Jan 2008 23:55:41 +0000 To: pirrip@slax.example.net Subject: vacation User-Agent: nail 11.25 7/29/05 Content-Type: text/plain; charset=us-ascii Status: R  Hey, I'll be taking vacation the second week of next month.  Have any additional tasks that need to be taen care of in advance?  ?  Message  6: From magwitch@slax.example.net  Mon Jan 14 00:05:15 2008 Return-Path: magwitch@slax.example.net> From: Abel Magwitch magwitch@slax.example.net> Date: Sun, 13 Jan 2008 23:58:28 +0000 To: pirrip@slax.example.net Subject: vacation User-Agent: nail 11.25 7/29/05 Content-Type: text/plain; charset=us-ascii Status: R  Sure - so far, she's doing just fine.  I have assigned her a couple web issues and the ftp installation for 2.100.  She seems to be very comfortable, even with the new stuff.  ?  Message  7: From noreply@fermion.herot.net  Mon Jan 14 00:05:15 2008 Return-Path: noreply@fermion.herot.net> From: noreply@fermion.herot.net Date: Sun, 13 Jan 2008 23:54:42 +0000 To: pirrip@slax.example.net Subject: Fermion Account Login Reminder User-Agent: nail 11.25 7/29/05 Content-Type: text/plain; charset=us-ascii Status: R  Fermion Account Login Reminder  Listed below are your Fermion Account login credentials.  Please let us know if you have any questions or problems.  Regards, Fermion Support   E-Mail: pirrip@slax.example.net Password: 0l1v3rTw1st

使用上面这个密码进行登录，再使用vi查看shadow文件

使用vi启动sh，shift键+:出来输入!/bin/sh