MoonlitSyntax

nmap -sC -sV 10.10.195.244 (base)Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-26 16:41 CSTNmap scan report for 10.10.195.244Host is up (0.29s latency).Not shown: 997 filtered tcp ports (no-response)PORT STATE SERVICE VERSION21/tcp open ftp vsftpd 3.0.3| ftp-syst:| STAT:| FTP server status:| Connected to ::ffff:10.14.69.58| Logged in as ftp| TYPE: ASCII| No session bandwi ...

上来先扫 扫完了之后访问那几个, robots.txt里的是Wubbalubbadubdub一开始以为没什么用,后来发现是密码,不要放过任何可能的信息!!! 用户名在80端口的页面的注释里,R1ckRul3s 登录上去是个命令执行的 过滤的很少,只有6个,大概是cat less head之类读文件的,问题不大\绕过即可 三个flag分别在,本目录,/home/*/*,/root/*,最后一个是sudo -l发现不需要密码,于是sudo ca\t,最后一个cat *的会出问题,不知道为什么,只有写对文件名才有

起手就是一个nmap -sC -sV 10.10.240.107 带上Pn可能会更快些 nmap -sC -sV 10.10.240.107 (base)Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-26 19:56 CSTNmap scan report for 10.10.240.107Host is up (0.22s latency).Not shown: 987 closed tcp ports (conn-refused)PORT STATE SERVICE VERSION53/tcp open domain Simple DNS Plus80/tcp open http Microsoft IIS httpd 10.0| http-methods:|_ Potentially r ...

search search type:auxiliary telnet info RHOSTS 远程主机 还可以用文件 LHOSTS本地IP LPORT 反向shell连接的端口 setg就是全局set background进入后台 或者Ctrl + z sessions查看现有会话 sessions -i 1切换会话 扫描 search portscan 0 auxiliary/scanner/portscan/ftpbounce normal No FTP Bounce Port Scanner1 auxiliary/scanner/natpmp/natpmp_portscan normal No NAT-PMP External Port Scanner2 auxiliary/scanner/sap/sap_router_portscanner normal No SAPRouter Po ...

steghide info Extinction.jpg 查看数据 steghide extract -sf Extinction.jpg 提取 简单逆向 r2 文件[0x00001060]> aaaINFO: Analyze all flags starting with sym. and entry0 (aa)INFO: Analyze all functions arguments/locals (afva@@@F)INFO: Analyze function calls (aac)INFO: Analyze len bytes of instructions for references (aar)INFO: Finding and parsing C++ vtables (avrr)INFO: Type matching analysis for all functions (aaft)INFO: Propagate noreturn information (aanr)INFO: Use -AA or aaaa to perform additional experi ...

爆破 再爆破,发现.ticket后缀,再爆破 gobuster dir -u 10.10.13.232/island/2100 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .ticket 扫到这个/green_arrow.ticket RTy8yhBQdscX base58解密!#th3h00d,…有什么毛病 用户名在注释里,vigilante 三个图片,又要补文件头 8950 4e47 0d0a 1a0a 没看懂 额,就是密码是password This is your visa to Land on Lian_Yu # Just for Fun ***a small Note about itHaving spent years on the island, Oliver learned how to be resourceful and set booby traps all over the island in the common event he ran into dangerou ...