跳到主要内容

Venus 41-50

Stage - header​

flag - 041​

8===nLCR949OMr4pLhMepKCM===D~~

任务目标​

/pwned/header/mission.txt
################
# MISSION 0x42 #
################

## EN ##
The password of mercy is hidden in this directory.

行动​

ls -lah
total 36K
drwxr-x--- 2 root  sarah 4.0K Jul 26  2023 .
drwxr-xr-x 1 root  root  4.0K Jul 26  2023 ..
-rw-r----- 1 root  sarah   16 Jul 26  2023 ...
-rw-r--r-- 1 sarah sarah  220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 sarah sarah 3.5K Apr 23  2023 .bashrc
-rw-r--r-- 1 sarah sarah  807 Apr 23  2023 .profile
-rw-r----- 1 root  sarah   31 Jul 26  2023 flagz.txt
-rw-r----- 1 root  sarah  175 Jul 26  2023 mission.txt
cat ./...
ym5yyXZ163uIS8L

Stage - mercy​

flag - 42​

8===pBpnZCBSELaY0xQJ8YAY===D~~

任务目标​

/pwned/mercy/mission.txt
################
# MISSION 0x43 #
################

## EN ##
User mercy is always wrong with the password of paula.

行动​

ls -lah
total 36K
drwxr-x--- 2 root  mercy 4.0K Jul 26  2023 .
drwxr-xr-x 1 root  root  4.0K Jul 26  2023 ..
-rw-r----- 1 root  mercy  133 Jul 26  2023 .bash_history
-rw-r--r-- 1 mercy mercy  220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 mercy mercy 3.5K Apr 23  2023 .bashrc
-rw-r--r-- 1 mercy mercy  807 Apr 23  2023 .profile
-rw-r----- 1 root  mercy   31 Jul 26  2023 flagz.txt
-rw-r----- 1 root  mercy  190 Jul 26  2023 mission.txt
cat .bash_history
ls -A
ls
rm /
ps
sudo -l
watch tv
vi /etc/logs
su paula
dlHZ6cvX6cLuL8p
history
history -c
logout
ssh paula@localhost
cat .
ls
ls -l

Stage - paula​

flag - 43​

8===2pwlvMk65rw81lymKLJE===D~~

任务目标​

/pwned/paula/mission.txt
################
# MISSION 0x44 #
################

## EN ##
The user karla trusts me, she is part of my group of friends.

行动​

ls -lah
total 32K
drwxr-x--- 2 root  paula 4.0K Jul 26  2023 .
drwxr-xr-x 1 root  root  4.0K Jul 26  2023 ..
-rw-r--r-- 1 paula paula  220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 paula paula 3.5K Apr 23  2023 .bashrc
-rw-r--r-- 1 paula paula  807 Apr 23  2023 .profile
-rw-r----- 1 root  paula   31 Jul 26  2023 flagz.txt
-rw-r----- 1 root  paula  197 Jul 26  2023 mission.txt
find / -group hidden -type f -exec cat {} ; 2>/dev/null
gYAmvWY3I7yDKRf

Stage - karla​

flag - 44​

8===SARQC95X3AWK9K4BBTMJ===D~~

任务目标​

/pwned/karla/mission.txt
################
# MISSION 0x45 #
################

## EN ##
User denise has saved her password in the image.

行动​

ls -lah
total 68K
drwxr-x--- 2 root  karla 4.0K Jul 26  2023 .
drwxr-xr-x 1 root  root  4.0K Jul 26  2023 ..
-rw-r--r-- 1 karla karla  220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 karla karla 3.5K Apr 23  2023 .bashrc
-rw-r--r-- 1 karla karla  807 Apr 23  2023 .profile
-rw-r----- 1 root  karla   31 Jul 26  2023 flagz.txt
-rw-r----- 1 root  karla  176 Jul 26  2023 mission.txt
-rw-r----- 1 root  karla  33K Jul 26  2023 yuju.jpg
exiftool yuju.jpg
......
About                           : pFg92DpGucMWccA
......

Stage - denise​

flag - 45​

8===uMXbjLdQde2iQFoWc8zf===D~~

任务目标​

/pwned/denise/mission.txt
################
# MISSION 0x46 #
################

## EN ##
The user zora is screaming doas!

行动​

ls -lah
total 32K
drwxr-x--- 2 root   denise 4.0K Jul 26  2023 .
drwxr-xr-x 1 root   root   4.0K Jul 26  2023 ..
-rw-r--r-- 1 denise denise  220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 denise denise 3.5K Apr 23  2023 .bashrc
-rw-r--r-- 1 denise denise  807 Apr 23  2023 .profile
-rw-r----- 1 root   denise   31 Jul 26  2023 flagz.txt
-rw-r----- 1 root   denise  144 Jul 26  2023 mission.txt
find / -name doas 2>/dev/null
/usr/share/doc/doas
/usr/bin/doas
/etc/pam.d/doas

Stage - zora​

flag - 46​

8===hhp0gFTIaedSX3faXDqP===D~~

任务目标​

/pwned/zora/mission.txt
################
# MISSION 0x47 #
################

## EN ##
The user belen has left her password in venus.hmv

行动​

ls -lah
total 36K
drwxr-x--- 2 root zora 4.0K Jul 26  2023 .
drwxr-xr-x 1 root root 4.0K Jul 26  2023 ..
-rw-r--r-- 1 zora zora  220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 zora zora 3.5K Apr 23  2023 .bashrc
-rw-r--r-- 1 zora zora  807 Apr 23  2023 .profile
-rw-r----- 1 root zora   31 Jul 26  2023 flagz.txt
-rw-r----- 1 root zora  173 Jul 26  2023 mission.txt
-rw-r----- 1 root zora   16 Jul 26  2023 zora_pass.txt
curl venus.hmv
2jA0E8bQ4WrGwWZ

Stage - belen​

flag - 47​

8===FzDIkqJtVgyQYfRVGH1r===D~~

任务目标​

/pwned/belen/mission.txt
################
# MISSION 0x48 #
################

## EN ##
It seems that belen has stolen the password of the user leona...

行动​

ls -lah
total 36K
drwxr-x--- 2 root  belen 4.0K Jul 26  2023 .
drwxr-xr-x 1 root  root  4.0K Jul 26  2023 ..
-rw-r--r-- 1 belen belen  220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 belen belen 3.5K Apr 23  2023 .bashrc
-rw-r--r-- 1 belen belen  807 Apr 23  2023 .profile
-rw-r----- 1 root  belen   31 Jul 26  2023 flagz.txt
-rw-r----- 1 root  belen  197 Jul 26  2023 mission.txt
-rw-r----- 1 root  belen   32 Jul 26  2023 stolen.txt
cat stolen.txt
$1$leona$lhWp56YnWAMz6z32Bw53L0
# freedom

Stage - leona​

flag - 48​

8===jObs3nfIJG4dDtxhWuKg===D~~

任务目标​

/pwned/leona/mission.txt
################
# MISSION 0x49 #
################

## EN ##
User ava plays a lot with the DNS of venus.hmv lately...

行动​

ls -lah
total 32K
drwxr-x--- 2 root  leona 4.0K Jul 26  2023 .
drwxr-xr-x 1 root  root  4.0K Jul 26  2023 ..
-rw-r--r-- 1 leona leona  220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 leona leona 3.5K Apr 23  2023 .bashrc
-rw-r--r-- 1 leona leona  807 Apr 23  2023 .profile
-rw-r----- 1 root  leona   31 Jul 26  2023 flagz.txt
-rw-r----- 1 root  leona  195 Jul 26  2023 mission.txt
cat /etc/bind/db.venus.hmv
;
; BIND data file for local loopback interface
;
    604800
@       IN      SOA     ns1.venus.hmv. root.venus.hmv. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL

;@      IN      NS      localhost.
;@      IN      A       127.0.0.1
;@      IN      AAAA    ::1
@       IN      NS      ns1.venus.hmv.

;IP address of Name Server

ns1     IN      A       127.0.0.1
ava IN      TXT     oCXBeeEeYFX34NU

Stage - ava​

flag - 49​

8===7XsGiUHUZNouh6K6CyY2===D~~

任务目标​

/pwned/ava/mission.txt
################
# MISSION 0x50 #
################

## EN ##
The password of maria is somewhere...

行动​

ls -lah
total 32K
drwxr-x--- 2 root ava  4.0K Jul 26  2023 .
drwxr-xr-x 1 root root 4.0K Jul 26  2023 ..
-rw-r--r-- 1 ava  ava   220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 ava  ava  3.5K Apr 23  2023 .bashrc
-rw-r--r-- 1 ava  ava   807 Apr 23  2023 .profile
-rw-r----- 1 root ava    31 Jul 26  2023 flagz.txt
-rw-r----- 1 root ava   153 Jul 26  2023 mission.txt
maria 的 密码
.--. .- .--. .- .--. .- .-. .- -.. .. ... .

Stage - maria​

flag - 50​

8===ZLNu1CHYSYf0PvkK2iqS===D~~

任务目标​

/pwned/maria/mission.txt
################
# MISSION 0x51 #
################

## EN ##
Congrats!

行动​

ls -lah
total 32K
drwxr-x--- 2 root  maria 4.0K Jul 26  2023 .
drwxr-xr-x 1 root  root  4.0K Jul 26  2023 ..
-rw-r--r-- 1 maria maria  220 Apr 23  2023 .bash_logout
-rw-r--r-- 1 maria maria 3.5K Apr 23  2023 .bashrc
-rw-r--r-- 1 maria maria  807 Apr 23  2023 .profile
-rw-r----- 1 root  maria   31 Jul 26  2023 flagz.txt
-rw-r----- 1 root  maria   96 Jul 26  2023 mission.txt