<h1>THLPWN</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/141">https://labs.thehackerslabs.com/machine/141</a>
</blockquote>
<img src="/post-images/TheHackersLabsTHLPWN/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-python">➜ THLPWN nmap -sT -min-rate 10000 -p- 192.168.56.131 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-27 22:59 CST
Nmap scan report for 192.168.56.131
Host is up (0.0023s latency).
Not shown: 65531 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
25/tcp open smtp
80/tcp open http
110/tcp open pop3

Nmap done: 1 IP address (1 host up) scanned in 26.38 seconds
</code></pre>
<pre><code class="hljs language-python">➜ THLPWN nmap -sT -A -p 22,25,80,110 192.168.56.131 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-27 23:01 CST
Nmap scan report for 192.168.56.131
Host is up (0.00060s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
| 256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
|_ 256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
25/tcp open tcpwrapped
|_smtp-commands: Couldn't establish connection on port 25
80/tcp open http nginx 1.22.1
|_http-title: 403 Forbidden
|_http-server-header: nginx/1.22.1
110/tcp open tcpwrapped
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: WAP|general purpose
Running: Actiontec embedded, Linux 2.4.X
OS CPE: cpe:/h:actiontec:mi424wr-gen3i cpe:/o:linux:linux_kernel cpe:/o:linux:linux_kernel:2.4.37
OS details: Actiontec MI424WR-GEN3I WAP, DD-WRT v24-sp2 (Linux 2.4.37)
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 0.24 ms 192.168.111.2
2 0.57 ms 192.168.56.131

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 53.40 seconds
</code></pre>
<h3>枚举</h3>
看来还运行着邮件服务
<img src="/post-images/TheHackersLabsTHLPWN/image1.png" alt="image.png">
我们根据 <code>thl</code> 的默认规则即可访问
<img src="/post-images/TheHackersLabsTHLPWN/image2.png" alt="image.png">
一番摸索后在网站下载页面中能下载到一个 ELF 文件
<img src="/post-images/TheHackersLabsTHLPWN/image3.png" alt="image.png">
通过 <code>strings</code> 可以拿到疑似用户的账户密码
<img src="/post-images/TheHackersLabsTHLPWN/image4.png" alt="image.png">
通过凭据 <code>thluser:9Kx7mP2wQ5nL8vT4bR6zY</code> 成功进入后台
<img src="/post-images/TheHackersLabsTHLPWN/image5.png" alt="image.png">
读取 <code>user.txt</code>
<pre><code class="hljs language-python">thluser@thlpwn:~$ cat flag.txt 
TxxxxxxxxxxxxxxxxxxxxxxH}
</code></pre>
<h2>提权</h2>
查看 sudo 权限，666
<pre><code class="hljs language-python">thluser@thlpwn:~$ sudo -l
Matching Defaults entries for thluser on thlpwn:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User thluser may run the following commands on thlpwn:
 (ALL) NOPASSWD: /bin/bash
</code></pre>
直接 <code>root</code> 了
<pre><code class="hljs language-python">thluser@thlpwn:~$ sudo /bin/bash -p
root@thlpwn:/home/thluser# 
</code></pre>
我真没招了。。。
<img src="/post-images/TheHackersLabsTHLPWN/image6.png" alt="image.png">

THLPWN https://labs.thehackerslabs.com/machine/141 Recon PortScan 枚举 看来还运行着邮件服务 我们根据 thl 的默认规则即可访问 一番摸索后在网站下载页面中能下载到一个 ELF 文件 通过 strings 可以拿到疑似用户的账户密码...

TheHackersLabs - THLPWN

念念碎