Windy's little blog

一切生活中的杂七杂八, and I like CTF.

HackMyVm Superhuman Walkthrough

https://hackmyvm.eu/machines/machine.php?vm=Superhuman


Scan port 80 with big dic.

┌──(kali㉿mykali)-[~/Documents/superhuman]
└─$ gobuster dir -u http://192.168.56.95  -t 50  -w /usr/share/dirbuster/wordlists/directory-list-lowercase-2.3-big.txt   
-x .txt,.html,.php,.bak,.jpg,.zip -b 401,403,404,500 --wildcard  -o 80_root.log 
===============================================================                                                        
...                                                  
===============================================================                                                        
/index.html           (Status: 200) [Size: 658]
/nietzsche.jpg        (Status: 200) [Size: 22211]
/notes-tips.txt       (Status: 200) [Size: 358]

                                                  

Decrypt note-tip.txt with base85.

图片.png



Use crunch to make a new dic, and scan with some zip file extions.

crunch 13 13 -t salome_and_@@ > dic.txt
gobuster dir -u http://192.168.56.95  -t 50  -w dic.txt    -x .zip,.rar,.7z,.gz -b 401,403,404,500 --wildcard  -o poem.log
 ...
 ===============================================================  
 2021/04/05 14:42:49 Starting gobuster in directory enumeration mode     
 =============================================================== 
 /salome_and_me.zip    (Status: 200) [Size: 452]


Burteforce the pass of zip file. Get a poem.

┌──(kali㉿mykali)-[~/Documents/superhuman]  
                                          
PASSWORD FOUND!!!!: pw == turtle

┌──(kali㉿mykali)-[~/Documents/superhuman]
└─$ unzip salome_and_me.zip           
Archive:  salome_and_me.zip         
[salome_and_me.zip] salome_and_me.txt password: 
  inflating: salome_and_me.txt 
  
┌──(kali㉿mykali)-[~/Documents/superhuman]
└─$ cat salome_and_me.txt

----------------------------------------------------

             GREAT POEM FOR SALOME

----------------------------------------------------


My name is fred,                                           
And tonight I'm sad, lonely and scared,
Because my love Salome prefers schopenhauer, asshole,
I hate him he's stupid, ugly and a peephole,
My darling I offered you a great switch,
And now you reject my love, bitch
I don't give a fuck, I'll go with another lady,
And she'll call me BABY!


Cewl generate a dic file from the poem, and hydra ssh with username "fred".

图片.png                                              


After ssh in, use "dir" to list file. (ls has been changed.)

图片.png


Search file with capability.

图片.png


Get root privilege with node.

图片.png

发表评论:

◎欢迎参与讨论,请在这里发表您的看法、交流您的观点。

Powered By Z-BlogPHP 1.7.0