oscp备考，oscp系列——sickos1.2靶场，PUT上传一句话木马，计划任务：chkrootkit 0.49 提权-CSDN博客

公众号：泷羽Sec-尘宇安全

前言

oscp备考，oscp系列——sickos1.2靶场，PUT上传一句话木马，计划任务：chkrootkit 0.49 提权
难度简单

对于低权限shell获取涉及：PUT上传一句话木马，使用脚本寻找流量出口
对于提权：计划任务：chkrootkit 0.49 提权
下载地址：

https://www.vulnhub.com/entry/sickos-12,144/

nmap

主机发现

└─# nmap -sn 192.168.88.0/24                
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-28 13:27 CST
Nmap scan report for 192.168.88.1
Host is up (0.00026s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 192.168.88.2
Host is up (0.00018s latency).
MAC Address: 00:50:56:F2:C6:98 (VMware)
Nmap scan report for 192.168.88.187
Host is up (0.00030s latency).
MAC Address: 00:0C:29:7D:66:60 (VMware)
Nmap scan report for 192.168.88.254
Host is up (0.00033s latency).
MAC Address: 00:50:56:F4:70:75 (VMware)
Nmap scan report for 192.168.88.128
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 21.97 seconds

端口扫描

详细端口扫描

└─# nmap -sV -sT -sC -O -p22,80 192.168.88.187 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-28 13:33 CST
Nmap scan report for 192.168.88.187
Host is up (0.00064s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 5.9p1 Debian 5ubuntu1.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 66:8c:c0:f2:85:7c:6c:c0:f6:ab:7d:48:04:81:c2:d4 (DSA)
|   2048 ba:86:f5:ee:cc:83:df:a6:3f:fd:c1:34:bb:7e:62:ab (RSA)
|_  256 a1:6c:fa:18:da:57:1d:33:2c:52:e4:ec:97:e2:9e:af (ECDSA)
80/tcp open  http    lighttpd 1.4.28
|_http-title: Site doesn't have a title (te