CTF靶场系列-De-ICE:_S2.100 – 作者:陌度

下载地址

https://download.vulnhub.com/deice/De-ICE_S2.100_%28de-ice.net-2.100-1.0%29.iso

实战演练

原文再续，书接上文s1.100的系统

任务信息

寻找用户信息

信息收集

netdiscover发现有两个IP，看来有点东西啊

看看FTP有没有anonymous账号，发现没有东西

只有一个显示信息的PHP

web目录也没啥信息

看看192.168.2.101的web系统有什么信息

没啥东西

找到邮箱信息，还有服务器开放smtp，我们枚举一下smtp账号

Samuel Pickwick	[email protected]
Nathaniel Winkle	[email protected]
Augustus Snodgrass	[email protected]
Tracy	Tupman	[email protected]
Sam	Weller	[email protected]
Tony	Weller	[email protected]
Estella Havisham	[email protected]
Abel Magwitch	[email protected]
Philip Pirrip	[email protected]
Nicholas Nickleby	[email protected]
Ralph Nickleby	[email protected]
Newman Noggs	[email protected]
Wackford Squeers	[email protected]
Thomas Pinch	[email protected]
Mark Tapley	[email protected]
Sarah Gamp	[email protected]
Jacob Marley	[email protected]
Ebenezer Scrooge	[email protected]
Bob Cratchit	[email protected]
Bill Sikes	[email protected]
Jack Dawkins	[email protected]
Noah Claypole	[email protected]

#用户表

Pickwick
Winkle
Snodgrass
Tupman
Weller
Weller
Havisham
Magwitch
Pirrip
Nickleby
Nickleby
Noggs
Squeers
Pinch
Tapley
Gamp
Marley
Scrooge
Cratchit
Sikes
Dawkins
Claypole
Samuel
Nathaniel
Augustus
Tracy
Sam
Tony
Estella
Abel
Philip
Nicholas
Ralph
Newman
Wackford
Thomas
Mark
Sarah
Jacob
Ebenezer
Bob
Bill
Jack
Noah
spickwick
nwinkle
asnodgrass
ttupman
sweller
tweller
ehavisham
amagwitch
ppirrip
nnickleby
rnickleby
nnoggs
wsqueers
tpinch
mtapley
sgamp
jmarley
escrooge
bcratchit
bsikes
jdawkins
nclaypole

找到三个账号

按照社会工程学的思想，加上上面扫描到~root目录，试试~+用户名爆破web的方式

100的web服务器

101服务器上找到ssh的认证文件，下载下来

修改证书权限，就可以登录

找信息

查看邮件信息，第七封邮件有信息

pirrip@slax:~$ mail
mailx version nail 11.25 7/29/05.  Type ? for help.
"/var/mail/pirrip": 7 messages 7 new
>N  1 Abel Magwitch      Sun Jan 13 23:53   20/748   Estella
 N  2 Estella Havisham   Sun Jan 13 23:53   20/780   welcome to the team
 N  3 Abel Magwitch      Sun Jan 13 23:53   20/875   havisham
 N  4 Estella Havisham   Mon Jan 14 00:05   20/861   next month
 N  5 Abel Magwitch      Mon Jan 14 00:05   20/868   vacation
 N  6 Abel Magwitch      Mon Jan 14 00:05   20/915   vacation
 N  7 [email protected] Mon Jan 14 00:05   29/983   Fermion Account Login Reminder
? 
Message  1:
From [email protected]  Sun Jan 13 23:53:37 2008
Return-Path: <[email protected]>
From: Abel Magwitch <[email protected]>
Date: Sun, 13 Jan 2008 23:47:48 +0000
To: [email protected]
Subject: Estella
User-Agent: nail 11.25 7/29/05
Content-Type: text/plain; charset=us-ascii
Status: R

Will do.

? 
Message  2:
From [email protected]  Sun Jan 13 23:53:37 2008
Return-Path: <[email protected]>
From: Estella Havisham <[email protected]>
Date: Sun, 13 Jan 2008 23:50:33 +0000
To: [email protected]
Subject: welcome to the team
User-Agent: nail 11.25 7/29/05
Content-Type: text/plain; charset=us-ascii
Status: R

Thanks!  Glad to be here.

? 
Message  3:
From [email protected]  Sun Jan 13 23:53:37 2008
Return-Path: <[email protected]>
From: Abel Magwitch <[email protected]>
Date: Sun, 13 Jan 2008 23:48:57 +0000
To: [email protected]
Subject: havisham
User-Agent: nail 11.25 7/29/05
Content-Type: text/plain; charset=us-ascii
Status: R

I set her up with an accountus servers.  I set her password to "changeme" and will swing by tomorrow and make sure she changes her pw.

? 
Message  4:
From [email protected]  Mon Jan 14 00:05:15 2008
Return-Path: <[email protected]>
From: Estella Havisham <[email protected]>
Date: Mon, 14 Jan 2008 00:03:56 +0000
To: [email protected]
Subject: next month
User-Agent: nail 11.25 7/29/05
Content-Type: text/plain; charset=us-ascii
Status: R

Abel filled me in about next month.  I wanted to ask you if I can grab the week you get back for vacation?  Thanks.

? 
Message  5:
From [email protected]  Mon Jan 14 00:05:15 2008
Return-Path: <[email protected]>
From: Abel Magwitch <[email protected]>
Date: Sun, 13 Jan 2008 23:55:41 +0000
To: [email protected]
Subject: vacation
User-Agent: nail 11.25 7/29/05
Content-Type: text/plain; charset=us-ascii
Status: R

Hey, I'll be taking vacation the second week of next month.  Have any additional tasks that need to be taen care of in advance?

? 
Message  6:
From [email protected]  Mon Jan 14 00:05:15 2008
Return-Path: <[email protected]>
From: Abel Magwitch <[email protected]>
Date: Sun, 13 Jan 2008 23:58:28 +0000
To: [email protected]
Subject: vacation
User-Agent: nail 11.25 7/29/05
Content-Type: text/plain; charset=us-ascii
Status: R

Sure - so far, she's doing just fine.  I have assigned her a couple web issues and the ftp installation for 2.100.  She seems to be very comfortable, even with the new stuff.

? 
Message  7:
From [email protected]  Mon Jan 14 00:05:15 2008
Return-Path: <[email protected]>
From: [email protected]
Date: Sun, 13 Jan 2008 23:54:42 +0000
To: [email protected]
Subject: Fermion Account Login Reminder
User-Agent: nail 11.25 7/29/05
Content-Type: text/plain; charset=us-ascii
Status: R

Fermion Account Login Reminder

Listed below are your Fermion Account login credentials.  Please let us know if you have any questions or problems.

Regards,
Fermion Support


E-Mail: [email protected]
Password: 0l1v3rTw1st

使用上面这个密码进行登录，再使用vi查看shadow文件

使用vi启动sh，shift键+:出来输入!/bin/sh

找到文件

由于空间不足，无法解压，干脆拉到kali上面来看看

找到了最后的key

来源：freebuf.com 2019-03-02 10:54:31 by: 陌度