PORT STATE SERVICE REASON VERSION [69/137] 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC82vTuN1hMqiqUfN+Lwih4g8rSJjaMjDQdhfdT8vEQ67urtQIyPszlNtkCDn6MNcBfibD/7Zz4r8lr1iNe/Afk6LJqTt3OWewzS2a1TpCrEbvoileYAl/Feya5PfbZ8mv77+MWEA+kT0pAw1xW9b pkhYCGkJQm9OYdcsEEg1i+kQ/ng3+GaFrGJjxqYaW1LXyXN1f7j9xG2f27rKEZoRO/9HOH9Y+5ru184QQXjW/ir+lEJ7xTwQA5U1GOW1m/AgpHIfI5j9aDfT/r4QMe+au+2yPotnOGBBJBz3ef+fQzj/Cq7OGRR96ZBfJ3i00B/Waw/RI19qd7+ybNXF /gBzptEYXujySQZSu92Dwi23itxJBolE6hpQ2uYVA8VBlF0KXESt3ZJVWSAsU3oguNCXtY7krjqPe6BZRy+lrbeska1bIGPZrqLEgptpKhz14UaOcH9/vpMYFdSKr24aMXvZBDK1GJg50yihZx8I9I367z0my8E89+TnjGFY2QTzxmbmU= | 256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBH2y17GUe6keBxOcBGNkWsliFwTRwUtQB3NXEhTAFLziGDfCgBV7B9Hp6GQMPGQXqMk7nnveA8vUz0D7ug5n04A= | 256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKfXa+OM5/utlol5mJajysEsV4zb/L0BJ1lKxMPadPvR 8080/tcp open http-proxy syn-ack ttl 63 Werkzeug/1.0.1 Python/2.7.18 | http-title: Site doesn't have a title (text/html; charset=utf-8). |_Requested resource was http://10.129.219.103:8080/login |_http-server-header: Werkzeug/1.0.1 Python/2.7.18 .......
看起來只有22和8080端口開啓了。
0x1 8080 - OpenPLC
由於一開始什麽密碼都沒有給，所以嘗試下默認密碼登錄
The default username and password is openplc (login) and openplc (password). This means that the first thing you must do after logging in for the first time is change the default username and password! It is very easy to do that. Just go to the Users menu, click on the OpenPLC User and change the information as you like.
//----------------------------------------------------------------------------- int ignored_bool_inputs[] = {-1}; int ignored_bool_outputs[] = {-1}; int ignored_int_inputs[] = {-1}; int ignored_int_outputs[] = {-1};
root@attica01:/opt/PLC/OpenPLC_v3/webserver# id uid=0(root) gid=0(root) groups=0(root)
0x2 linpeas
爲了快速知道自己在哪裏，於是隨手跑了下linpeas，下面是一些有趣的地方：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
# 我在 LXC 容器裏面 Is this a virtual machine? ..... Yes (lxc) Is this a container? ........... lxccontainer_ttys AppArmor profile? .............. lxc-container-default-cgns (enforce)
# can break out ???? ?? release_agent breakout 1........ No ?? release_agent breakout 2........ Yes
root@attica01:/root# ip a ... 5: wlan0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000 link/ether 02:00:00:00:02:00 brd ff:ff:ff:ff:ff:ff
Found 1 processes that could cause trouble. Kill them using 'airmon-ng check kill' before putting the card in monitor mode, they will interfere by changing channels and sometimes putting the interface back in managed mode
PID Name 165 wpa_supplicant
PHY Interface Driver Chipset
phy2 wlan0 mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211 (mac80211 monitor mode vif enabled for [phy2]wlan0 on [phy2]wlan0mon) (mac80211 station mode vif disabled for [phy2]wlan0)
# 然後會有新的網卡出現，一般都是 網卡名字 + mon root@attica01:/root# ip a 3: wlan0mon: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UNKNOWN group default qlen 1000 link/ieee802.11/radiotap 02:00:00:00:02:00 brd ff:ff:ff:ff:ff:ff
[+] Waiting for beacon from 02:00:00:00:01:00 [+] Received beacon from 02:00:00:00:01:00 [!] Found packet with bad FCS, skipping... [+] Associated with 02:00:00:00:01:00 (ESSID: plcrouter)
root@attica01:.root # dmesg [ 6845.699206] wlan0: deauthenticating from 02:00:00:00:01:00 by local choice (Reason: 3=DEAUTH_LEAVING) [ 6851.939751] wlan0: authenticate with 02:00:00:00:01:00 [ 6851.954209] wlan0: send auth to 02:00:00:00:01:00 (try 1/3) [ 6851.954930] wlan0: authenticated [ 6851.955450] wlan0: authenticate with 02:00:00:00:01:00 [ 6851.955453] wlan0: send auth to 02:00:00:00:01:00 (try 1/3) [ 6851.957134] wlan0: authenticated [ 6851.959535] mac80211_hwsim hwsim2 wlan0: disabling HT as WMM/QoS is not supported by the AP [ 6851.959539] mac80211_hwsim hwsim2 wlan0: disabling VHT as WMM/QoS is not supported by the AP [ 6851.962609] wlan0: associate with 02:00:00:00:01:00 (try 1/3) [ 6851.964090] wlan0: RX AssocResp from 02:00:00:00:01:00 (capab=0x411 status=0 aid=1) [ 6851.964123] wlan0: associated [ 6851.969811] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 6861.985657] wlan0: deauthenticating from 02:00:00:00:01:00 by local choice (Reason: 3=DEAUTH_LEAVING) [ 6866.063118] wlan0: authenticate with 02:00:00:00:01:00 [ 6866.063248] wlan0: send auth to 02:00:00:00:01:00 (try 1/3) [ 6866.065000] wlan0: authenticated [ 6866.067452] mac80211_hwsim hwsim2 wlan0: disabling HT as WMM/QoS is not supported by the AP [ 6866.067455] mac80211_hwsim hwsim2 wlan0: disabling VHT as WMM/QoS is not supported by the AP [ 6866.090034] wlan0: associate with 02:00:00:00:01:00 (try 1/3) [ 6866.090916] wlan0: RX AssocResp from 02:00:00:00:01:00 (capab=0x411 status=0 aid=1) [ 6866.090940] wlan0: associated
然後查看網卡
1 2 3 4 5 6
6: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether 42:00:00:00:02:00 brd ff:ff:ff:ff:ff:ff inet 192.168.1.71/24 metric 1024 brd 192.168.1.255 scope global dynamic wlan0 valid_lft 43158sec preferred_lft 43158sec inet6 fe80::4000:ff:fe00:200/64 scope link valid_lft forever preferred_lft forever
看到 state UP 就可以了，一開始的時候要等一下才可以獲得ip地址，我試過獲取ip地址最長的時間也等了20分鐘。
root@attica01:/opt/PLC/OpenPLC_v3/webserver# ssh root@192.168.1.1 The authenticity of host '192.168.1.1 (192.168.1.1)' can't be established. ED25519 key fingerprint is SHA256:ZcoOrJ2dytSfHYNwN2vcg6OsZjATPopYMLPVYhczadM. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.1.1' (ED25519) to the list of known hosts. BusyBox v1.36.1 (2023-11-14 13:38:11 UTC) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt 23.05.2, r23630-842932a63d ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. --------------------------------------------------
如果你是新手，使用上面的鏈接加入 HTB 的 academy 就可以免費看 Tire 0 的所有教程，這對初學者來説是很友好的。 （建議先完成 INTRODUCTION TO ACADEMY）
If you are a beginner, join HTB’s academy with this link to get free access to all the tutorials for Tire 0. This is very beginner friendly. (It is recommended to complete INTRODUCTION TO ACADEMY first)
