┌──(kali㉿kali)-[~/Downloads/VICTIM_1] └─$ sudo nmap --min-rate 10000 -p- 192.168.56.120 Starting Nmap 7.94 ( https://nmap.org ) at 2023-06-27 07:48 EDT Nmap scan report for 192.168.56.120 Host is up (0.00036s latency). Not shown: 65530 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8080/tcp open http-proxy 8999/tcp open bctp 9000/tcp open cslistener MAC Address: 08:00:27:CE:FC:4B (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 13.42 seconds
┌──(kali㉿kali)-[~/Downloads/VICTIM_1] └─$ sudo nmap -sT -sV -sC -O -p22,80,8080,8999,9000 192.168.56.120 Starting Nmap 7.94 ( https://nmap.org ) at 2023-06-27 07:49 EDT Nmap scan report for 192.168.56.120 Host is up (0.00033s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 ea:e8:15:7d:8a:74:bc:45:09:76:34:13:2c:d8:1e:62 (RSA) | 256 51:75:37:23:b6:0f:7d:ed:61:a0:61:18:21:89:35:5d (ECDSA) |_ 256 7d:36:08:ba:91:ef:24:9f:7b:24:f6:64:c7:53:2c:b0 (ED25519) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) |_http-title: 403 Forbidden |_http-server-header: Apache/2.4.29 (Ubuntu) 8080/tcp open http BusyBox httpd 1.13 |_http-title: 404 Not Found 8999/tcp open http WebFS httpd 1.21 |_http-server-header: webfs/1.21 |_http-title: 0.0.0.0:8999/ 9000/tcp open http PHP cli server 5.5 or later (PHP 7.2.30-1) |_http-title: Uncaught Exception: MissingDatabaseExtensionException MAC Address: 08:00:27:CE:FC:4B (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|storage-misc Running (JUST GUESSING): Linux 4.X|5.X|2.6.X|3.X (93%), Synology DiskStation Manager 5.X (87%) OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:linux:linux_kernel:3 cpe:/a:synology:diskstation_manager:5.2 Aggressive OS guesses: Linux 4.15 - 5.8 (93%), Linux 5.0 - 5.4 (93%), Linux 5.0 - 5.5 (90%), Linux 2.6.32 (87%), Linux 3.10 - 4.11 (87%), Linux 3.2 - 4.9 (87%), Linux 3.4 - 3.10 (87%), Synology DiskStation Manager 5.2-5644 (87%), Linux 2.6.32 - 3.10 (86%), Linux 2.6.32 - 3.13 (86%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 28.68 seconds
┌──(kali㉿kali)-[~/Downloads/VICTIM_1] └─$ sudo nmap --script=vuln -p22,80,8080,8999,9000 192.168.56.120 Starting Nmap 7.94 ( https://nmap.org ) at 2023-06-27 08:01 EDT Nmap scan report for 192.168.56.120 Host is up (0.00033s latency).
PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-stored-xss: Couldn\'t find any stored XSS vulnerabilities. |_http-dombased-xss: Couldn\'t find any DOM based XSS. |_http-csrf: Couldn\'t find any CSRF vulnerabilities. 8080/tcp open http-proxy | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server\'s resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 8999/tcp open bctp 9000/tcp open cslistener MAC Address: 08:00:27:CE:FC:4B (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 94.78 seconds
漏洞脚本扫描没什么结果。依次查看各个端口的界面
Web 服务查看
80 端口提示No configuration file found and no installation code available. Exiting...
