https://blog.qife122.com/tags/%E5%A4%87%E4%BB%BD%E6%8F%90%E6%9D%83/ Recent content in 备份提权 on 办公AI智能小助手 Hugo zh-cn qife Sat, 06 Sep 2025 07:31:18 +0800 https://blog.qife122.com/p/htb-code%E9%9D%B6%E6%9C%BA%E6%B8%97%E9%80%8Fpython%E4%BB%A3%E7%A0%81%E7%BC%96%E8%BE%91%E5%99%A8%E8%BF%87%E6%BB%A4%E7%BB%95%E8%BF%87%E4%B8%8E%E5%A4%87%E4%BB%BD%E8%84%9A%E6%9C%AC%E6%8F%90%E6%9D%83/ Sat, 06 Sep 2025 07:31:18 +0800 https://blog.qife122.com/p/htb-code%E9%9D%B6%E6%9C%BA%E6%B8%97%E9%80%8Fpython%E4%BB%A3%E7%A0%81%E7%BC%96%E8%BE%91%E5%99%A8%E8%BF%87%E6%BB%A4%E7%BB%95%E8%BF%87%E4%B8%8E%E5%A4%87%E4%BB%BD%E8%84%9A%E6%9C%AC%E6%8F%90%E6%9D%83/ <h1 id="htb-code">HTB: Code</h1> <h2 id="侦察">侦察</h2> <h3 id="nmap扫描">nmap扫描</h3> <p>nmap发现两个开放的TCP端口：SSH（22）和HTTP（5000）：</p> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt"> 1 </span><span class="lnt"> 2 </span><span class="lnt"> 3 </span><span class="lnt"> 4 </span><span class="lnt"> 5 </span><span class="lnt"> 6 </span><span class="lnt"> 7 </span><span class="lnt"> 8 </span><span class="lnt"> 9 </span><span class="lnt">10 </span><span class="lnt">11 </span><span class="lnt">12 </span><span class="lnt">13 </span><span class="lnt">14 </span><span class="lnt">15 </span><span class="lnt">16 </span><span class="lnt">17 </span><span class="lnt">18 </span><span class="lnt">19 </span><span class="lnt">20 </span><span class="lnt">21 </span><span class="lnt">22 </span><span class="lnt">23 </span><span class="lnt">24 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">oxdf@hacky$ nmap -p- --min-rate <span class="m">10000</span> 10.10.11.62 </span></span><span class="line"><span class="cl">Starting Nmap 7.94SVN <span class="o">(</span> https://nmap.org <span class="o">)</span> at 2025-03-25 21:22 UTC </span></span><span class="line"><span class="cl">Nmap scan report <span class="k">for</span> 10.10.11.62 </span></span><span class="line"><span class="cl">Host is up <span class="o">(</span>0.092s latency<span class="o">)</span>. </span></span><span class="line"><span class="cl">Not shown: <span class="m">65533</span> closed tcp ports <span class="o">(</span>reset<span class="o">)</span> </span></span><span class="line"><span class="cl">PORT STATE SERVICE </span></span><span class="line"><span class="cl">22/tcp open ssh </span></span><span class="line"><span class="cl">5000/tcp open upnp </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl">oxdf@hacky$ nmap -p 22,5000 -sCV 10.10.11.62 </span></span><span class="line"><span class="cl">Starting Nmap 7.94SVN <span class="o">(</span> https://nmap.org <span class="o">)</span> at 2025-03-25 21:23 UTC </span></span><span class="line"><span class="cl">Nmap scan report <span class="k">for</span> 10.10.11.62 </span></span><span class="line"><span class="cl">Host is up <span class="o">(</span>0.094s latency<span class="o">)</span>. </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl">PORT STATE SERVICE VERSION </span></span><span class="line"><span class="cl">22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 <span class="o">(</span>Ubuntu Linux<span class="p">;</span> protocol 2.0<span class="o">)</span> </span></span><span class="line"><span class="cl"><span class="p">|</span> ssh-hostkey: </span></span><span class="line"><span class="cl"><span class="p">|</span> <span class="m">3072</span> b5:b9:7c:c4:50:32:95:bc:c2:65:17:df:51:a2:7a:bd <span class="o">(</span>RSA<span class="o">)</span> </span></span><span class="line"><span class="cl"><span class="p">|</span> <span class="m">256</span> 94:b5:25:54:9b:68:af:be:40:e1:1d:a8:6b:85:0d:01 <span class="o">(</span>ECDSA<span class="o">)</span> </span></span><span class="line"><span class="cl"><span class="p">|</span>_ <span class="m">256</span> 12:8c:dc:97:ad:86:00:b4:88:e2:29:cf:69:b5:65:96 <span class="o">(</span>ED25519<span class="o">)</span> </span></span><span class="line"><span class="cl">5000/tcp open http Gunicorn 20.0.4 </span></span><span class="line"><span class="cl"><span class="p">|</span>_http-title: Python Code Editor </span></span><span class="line"><span class="cl"><span class="p">|</span>_http-server-header: gunicorn/20.0.4 </span></span><span class="line"><span class="cl">Service Info: OS: Linux<span class="p">;</span> CPE: cpe:/o:linux:linux_kernel </span></span></code></pre></td></tr></table> </div> </div><p>基于OpenSSH版本，主机可能运行Ubuntu 20.04 focal。端口5000上的Web服务器是Gunicorn，表明是一个Python应用程序。</p>