靶機Vulnhub的Empire Breakout攻略（不含提權）
阿新 • • 發佈：2022-04-14
首先掃描目標有哪些開放的埠:
# nmap -sV -A -sC -p- 192.168.140.164 Starting Nmap 7.92 ( https://nmap.org ) at 2022-04-14 00:16 EDT Nmap scan report for 192.168.140.164 Host is up (0.0012s latency). Not shown: 65530 closed tcp ports (reset) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.51 ((Debian))|_http-server-header: Apache/2.4.51 (Debian) |_http-title: Apache2 Debian Default Page: It works 139/tcp open netbios-ssn Samba smbd 4.6.2 445/tcp open netbios-ssn Samba smbd 4.6.2 10000/tcp open http MiniServ 1.981 (Webmin httpd) |_http-title: 200 — Document follows 20000/tcp open http MiniServ 1.830(Webmin httpd) |_http-title: 200 — Document follows MAC Address: 00:0C:29:26:7A:D8 (VMware) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.6 Network Distance: 1 hop Host script results: | smb2-security-mode:| 3.1.1: |_ Message signing enabled but not required | smb2-time: | date: 2022-04-14T04:17:00 |_ start_date: N/A |_nbstat: NetBIOS name: BREAKOUT, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) TRACEROUTE HOP RTT ADDRESS 1 1.24 ms 192.168.140.164 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 58.48 seconds
從掃描結果得知，有http服務、以及運行於高位埠（10000以及20000）的webmin服務，以及Samba服務。
首先分別登陸目標的80以及10000埠，發現80埠只有一個預設頁面，而10000埠也就是網站管理介面需要使用者名稱以及密碼。
80埠頁面雖然沒有什麼內容，但是頁面原始碼中發現如下資訊：
<!-- don't worry no one will get here, it's safe to share with you my access. Its encrypted :) ++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>++++++++++++++++.++++.>>+++++++++++++++++.----.<++++++++++.-----------.>-----------.++++.<<+.>-.--------.++++++++++++++++++++.<------------.>>---------.<<++++++.++++++. -->
這應該是一串加密後的程式碼。經查詢這是一種brainfuck加密方法：
Brainfuck是一種極小化的計算機語言，它是由Urban Müller在1993年建立的。由於fuck在英語中是髒話，這種語言有時被稱為brainf*ck或brainf**k，甚至被簡稱為BF。 Ook與Brainfuck類似，也是用替換法。 特徵： brainfuck語言用> < + - . , [ ]八種符號來替換C語言的各種語法和命令： 例如： +++++++++++++++++.>+++++++++++++++++++++++++++++++++++++++++
到網站 https://www.splitbrain.org/services/ook 進行破解，得到解密後的資訊：.2uqPEfj3D<P'a-3，應該是密碼什麼的,但是目前我們並沒有得到使用者名稱，因此用enum4linux嘗試一下：
# enum4linux 192.168.140.164 -a Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Thu Apr 14 00:32:55 2022 ========================== | Target Information | ========================== Target ........... 192.168.140.164 RID Range ........ 500-550,1000-1050 Username ......... '' Password ......... '' Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none ======================================================= | Enumerating Workgroup/Domain on 192.168.140.164 | ======================================================= [+] Got domain/workgroup name: WORKGROUP =============================================== | Nbtstat Information for 192.168.140.164 | =============================================== Looking up status of 192.168.140.164 BREAKOUT <00> - B <ACTIVE> Workstation Service BREAKOUT <03> - B <ACTIVE> Messenger Service BREAKOUT <20> - B <ACTIVE> File Server Service ..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name WORKGROUP <1d> - B <ACTIVE> Master Browser WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections MAC Address = 00-00-00-00-00-00 ======================================== | Session Check on 192.168.140.164 | ======================================== [+] Server 192.168.140.164 allows sessions using username '', password '' ============================================== | Getting domain SID for 192.168.140.164 | ============================================== Domain Name: WORKGROUP Domain Sid: (NULL SID) [+] Can't determine if host is part of domain or part of a workgroup ========================================= | OS information on 192.168.140.164 | ========================================= Use of uninitialized value $os_info in concatenation (.) or string at ./enum4linux.pl line 464. [+] Got OS info for 192.168.140.164 from smbclient: [+] Got OS info for 192.168.140.164 from srvinfo: BREAKOUT Wk Sv PrQ Unx NT SNT Samba 4.13.5-Debian platform_id : 500 os version : 6.1 server type : 0x809a03 ================================ | Users on 192.168.140.164 | ================================ Use of uninitialized value $users in print at ./enum4linux.pl line 874. Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 877. Use of uninitialized value $users in print at ./enum4linux.pl line 888. Use of uninitialized value $users in pattern match (m//) at ./enum4linux.pl line 890. ============================================ | Share Enumeration on 192.168.140.164 | ============================================ smbXcli_negprot_smb1_done: No compatible protocol selected by server. Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers IPC$ IPC IPC Service (Samba 4.13.5-Debian) Reconnecting with SMB1 for workgroup listing. protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE Unable to connect with SMB1 -- no workgroup available [+] Attempting to map shares on 192.168.140.164 //192.168.140.164/print$ Mapping: DENIED, Listing: N/A //192.168.140.164/IPC$ [E] Can't understand response: NT_STATUS_OBJECT_NAME_NOT_FOUND listing \* ======================================================= | Password Policy Information for 192.168.140.164 | ======================================================= [+] Attaching to 192.168.140.164 using a NULL share [+] Trying protocol 139/SMB... [+] Found domain(s): [+] BREAKOUT [+] Builtin [+] Password Info for Domain: BREAKOUT [+] Minimum password length: 5 [+] Password history length: None [+] Maximum password age: 37 days 6 hours 21 minutes [+] Password Complexity Flags: 000000 [+] Domain Refuse Password Change: 0 [+] Domain Password Store Cleartext: 0 [+] Domain Password Lockout Admins: 0 [+] Domain Password No Clear Change: 0 [+] Domain Password No Anon Change: 0 [+] Domain Password Complex: 0 [+] Minimum password age: None [+] Reset Account Lockout Counter: 30 minutes [+] Locked Account Duration: 30 minutes [+] Account Lockout Threshold: None [+] Forced Log off Time: 37 days 6 hours 21 minutes [+] Retieved partial password policy with rpcclient: Password Complexity: Disabled Minimum Password Length: 5 ================================= | Groups on 192.168.140.164 | ================================= [+] Getting builtin groups: [+] Getting builtin group memberships: [+] Getting local groups: [+] Getting local group memberships: [+] Getting domain groups: [+] Getting domain group memberships: ========================================================================== | Users on 192.168.140.164 via RID cycling (RIDS: 500-550,1000-1050) | ========================================================================== [I] Found new SID: S-1-22-1 [I] Found new SID: S-1-5-21-1683874020-4104641535-3793993001 [I] Found new SID: S-1-5-32 [+] Enumerating users using SID S-1-5-32 and logon username '', password '' S-1-5-32-500 *unknown*\*unknown* (8) S-1-5-32-501 *unknown*\*unknown* (8) S-1-5-32-502 *unknown*\*unknown* (8) S-1-5-32-503 *unknown*\*unknown* (8) S-1-5-32-504 *unknown*\*unknown* (8) S-1-5-32-505 *unknown*\*unknown* (8) S-1-5-32-506 *unknown*\*unknown* (8) S-1-5-32-507 *unknown*\*unknown* (8) S-1-5-32-508 *unknown*\*unknown* (8) S-1-5-32-509 *unknown*\*unknown* (8) S-1-5-32-510 *unknown*\*unknown* (8) S-1-5-32-511 *unknown*\*unknown* (8) S-1-5-32-512 *unknown*\*unknown* (8) S-1-5-32-513 *unknown*\*unknown* (8) S-1-5-32-514 *unknown*\*unknown* (8) S-1-5-32-515 *unknown*\*unknown* (8) S-1-5-32-516 *unknown*\*unknown* (8) S-1-5-32-517 *unknown*\*unknown* (8) S-1-5-32-518 *unknown*\*unknown* (8) S-1-5-32-519 *unknown*\*unknown* (8) S-1-5-32-520 *unknown*\*unknown* (8) S-1-5-32-521 *unknown*\*unknown* (8) S-1-5-32-522 *unknown*\*unknown* (8) S-1-5-32-523 *unknown*\*unknown* (8) S-1-5-32-524 *unknown*\*unknown* (8) S-1-5-32-525 *unknown*\*unknown* (8) S-1-5-32-526 *unknown*\*unknown* (8) S-1-5-32-527 *unknown*\*unknown* (8) S-1-5-32-528 *unknown*\*unknown* (8) S-1-5-32-529 *unknown*\*unknown* (8) S-1-5-32-530 *unknown*\*unknown* (8) S-1-5-32-531 *unknown*\*unknown* (8) S-1-5-32-532 *unknown*\*unknown* (8) S-1-5-32-533 *unknown*\*unknown* (8) S-1-5-32-534 *unknown*\*unknown* (8) S-1-5-32-535 *unknown*\*unknown* (8) S-1-5-32-536 *unknown*\*unknown* (8) S-1-5-32-537 *unknown*\*unknown* (8) S-1-5-32-538 *unknown*\*unknown* (8) S-1-5-32-539 *unknown*\*unknown* (8) S-1-5-32-540 *unknown*\*unknown* (8) S-1-5-32-541 *unknown*\*unknown* (8) S-1-5-32-542 *unknown*\*unknown* (8) S-1-5-32-543 *unknown*\*unknown* (8) S-1-5-32-544 BUILTIN\Administrators (Local Group) S-1-5-32-545 BUILTIN\Users (Local Group) S-1-5-32-546 BUILTIN\Guests (Local Group) S-1-5-32-547 BUILTIN\Power Users (Local Group) S-1-5-32-548 BUILTIN\Account Operators (Local Group) S-1-5-32-549 BUILTIN\Server Operators (Local Group) S-1-5-32-550 BUILTIN\Print Operators (Local Group) S-1-5-32-1000 *unknown*\*unknown* (8) S-1-5-32-1001 *unknown*\*unknown* (8) S-1-5-32-1002 *unknown*\*unknown* (8) S-1-5-32-1003 *unknown*\*unknown* (8) S-1-5-32-1004 *unknown*\*unknown* (8) S-1-5-32-1005 *unknown*\*unknown* (8) S-1-5-32-1006 *unknown*\*unknown* (8) S-1-5-32-1007 *unknown*\*unknown* (8) S-1-5-32-1008 *unknown*\*unknown* (8) S-1-5-32-1009 *unknown*\*unknown* (8) S-1-5-32-1010 *unknown*\*unknown* (8) S-1-5-32-1011 *unknown*\*unknown* (8) S-1-5-32-1012 *unknown*\*unknown* (8) S-1-5-32-1013 *unknown*\*unknown* (8) S-1-5-32-1014 *unknown*\*unknown* (8) S-1-5-32-1015 *unknown*\*unknown* (8) S-1-5-32-1016 *unknown*\*unknown* (8) S-1-5-32-1017 *unknown*\*unknown* (8) S-1-5-32-1018 *unknown*\*unknown* (8) S-1-5-32-1019 *unknown*\*unknown* (8) S-1-5-32-1020 *unknown*\*unknown* (8) S-1-5-32-1021 *unknown*\*unknown* (8) S-1-5-32-1022 *unknown*\*unknown* (8) S-1-5-32-1023 *unknown*\*unknown* (8) S-1-5-32-1024 *unknown*\*unknown* (8) S-1-5-32-1025 *unknown*\*unknown* (8) S-1-5-32-1026 *unknown*\*unknown* (8) S-1-5-32-1027 *unknown*\*unknown* (8) S-1-5-32-1028 *unknown*\*unknown* (8) S-1-5-32-1029 *unknown*\*unknown* (8) S-1-5-32-1030 *unknown*\*unknown* (8) S-1-5-32-1031 *unknown*\*unknown* (8) S-1-5-32-1032 *unknown*\*unknown* (8) S-1-5-32-1033 *unknown*\*unknown* (8) S-1-5-32-1034 *unknown*\*unknown* (8) S-1-5-32-1035 *unknown*\*unknown* (8) S-1-5-32-1036 *unknown*\*unknown* (8) S-1-5-32-1037 *unknown*\*unknown* (8) S-1-5-32-1038 *unknown*\*unknown* (8) S-1-5-32-1039 *unknown*\*unknown* (8) S-1-5-32-1040 *unknown*\*unknown* (8) S-1-5-32-1041 *unknown*\*unknown* (8) S-1-5-32-1042 *unknown*\*unknown* (8) S-1-5-32-1043 *unknown*\*unknown* (8) S-1-5-32-1044 *unknown*\*unknown* (8) S-1-5-32-1045 *unknown*\*unknown* (8) S-1-5-32-1046 *unknown*\*unknown* (8) S-1-5-32-1047 *unknown*\*unknown* (8) S-1-5-32-1048 *unknown*\*unknown* (8) S-1-5-32-1049 *unknown*\*unknown* (8) S-1-5-32-1050 *unknown*\*unknown* (8) [+] Enumerating users using SID S-1-5-21-1683874020-4104641535-3793993001 and logon username '', password '' S-1-5-21-1683874020-4104641535-3793993001-500 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-501 BREAKOUT\nobody (Local User) S-1-5-21-1683874020-4104641535-3793993001-502 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-503 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-504 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-505 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-506 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-507 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-508 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-509 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-510 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-511 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-512 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-513 BREAKOUT\None (Domain Group) S-1-5-21-1683874020-4104641535-3793993001-514 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-515 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-516 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-517 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-518 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-519 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-520 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-521 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-522 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-523 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-524 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-525 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-526 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-527 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-528 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-529 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-530 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-531 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-532 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-533 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-534 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-535 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-536 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-537 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-538 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-539 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-540 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-541 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-542 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-543 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-544 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-545 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-546 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-547 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-548 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-549 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-550 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1000 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1001 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1002 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1003 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1004 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1005 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1006 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1007 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1008 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1009 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1010 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1011 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1012 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1013 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1014 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1015 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1016 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1017 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1018 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1019 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1020 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1021 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1022 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1023 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1024 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1025 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1026 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1027 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1028 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1029 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1030 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1031 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1032 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1033 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1034 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1035 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1036 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1037 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1038 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1039 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1040 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1041 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1042 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1043 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1044 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1045 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1046 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1047 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1048 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1049 *unknown*\*unknown* (8) S-1-5-21-1683874020-4104641535-3793993001-1050 *unknown*\*unknown* (8) [+] Enumerating users using SID S-1-22-1 and logon username '', password '' S-1-22-1-1000 Unix User\cyber (Local User) ================================================ | Getting printer info for 192.168.140.164 |
從中發現了使用者名稱cyber,因此用該使用者名稱以及上面破解得到的密碼，看能否登陸webmin,10000埠登陸並不成功，20000埠可以成功登陸。
在頁面的地步（Cyber的左面，需要細心）發現了command_shell的功能,從而得到了user flag: 3mp!r3{You_Manage_To_Break_To_My_Secure_Access}