文章

Twisted

Twisted in hackmyvm

发表于 更新于
Preview Image
作者 gwiily
1 分钟阅读

信息收集

  • 端口扫描
1
2
3
4
5
6
7
8
9
10
11
12

╰─$ nmap 192.168.1.100 -sV                                                                                     1 ↵
Starting Nmap 7.94 ( https://nmap.org ) at 2024-04-10 17:03 CST
Nmap scan report for 192.168.1.100
Host is up (0.00016s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
80/tcp   open  http    nginx 1.14.2
2222/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.32 seconds
  • 访问web页面

  • 下载图片并使用stegseek解密
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

└─# stegseek cat-original.jpg
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: "westlife"
[i] Original filename: "markus.txt".
[i] Extracting to "cat-original.jpg.out".


┌──(root㉿kali)-[~]
└─# cat cat-original.jpg.out
markuslovesbonita

┌──(root㉿kali)-[~]
└─# stegseek cat-hidden.jpg
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: "sexymama"
[i] Original filename: "mateo.txt".
[i] Extracting to "cat-hidden.jpg.out".


┌──(root㉿kali)-[~]
└─# cat cat-hidden.jpg.out
thisismypassword
  • 尝试用解密信息登录ssh

ssh [email protected] -p 2222

1
2
3
4
5

markus@twisted:~$ cat note.txt
Hi bonita,
I have saved your id_rsa here: /var/cache/apt/id_rsa
Nobody can find it.
markus@twisted:~$

ssh [email protected] -p 2222

1
2
3
4

mateo@twisted:~$ ls
note.txt
mateo@twisted:~$ cat note.txt
/var/www/html/gogogo.wav
HMV
Twisted HMV
本文由作者按照 CC BY 4.0 进行授权