┌──(kali㉿kali)-[/miao/hmv/hero] └─$ sudo nmap -sn 192.168.2.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 21:09 CST Nmap scan report for 192.168.2.1 Host is up (0.00015s latency). MAC Address: 0A:00:27:00:00:0A (Unknown) Nmap scan report for 192.168.2.2 Host is up (0.00019s latency). MAC Address: 08:00:27:40:3A:6A (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.9 Host is up (0.00065s latency). MAC Address: 08:00:27:D2:3D:FB (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.03 seconds
nmap扫描
（1）进行端口扫描
1 2 3 4 5 6 7 8 9 10 11 12
┌──(kali㉿kali)-[/miao/hmv/hero] └─$ sudo nmap -sT --min-rate 10000 -p- 192.168.2.9 -oA nmapscan/ports Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 21:10 CST Nmap scan report for 192.168.2.9 Host is up (0.0050s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 80/tcp open http 5678/tcp open rrac MAC Address: 08:00:27:D2:3D:FB (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 1.92 seconds
┌──(kali㉿kali)-[/miao/hmv/hero] └─$ sudo nmap -sT -sV -O --min-rate 10000 -p80,5678 192.168.2.9 -oA nmapscan/detail Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 21:12 CST Nmap scan report for 192.168.2.9 Host is up (0.00045s latency).
PORT STATE SERVICE VERSION 80/tcp open http nginx 5678/tcp open rrac? 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port5678-TCP:V=7.94SVN%I=7%D=2/7%Time=67A606D3%P=x86_64-pc-linux-gnu%r( SF:GetRequest,8DC,HTTP/1\.1\x20200\x20OK\r\nAccept-Ranges:\x20bytes\r\nCa SF:che-Control:\x20public,\x20max-age=86400\r\nLast-Modified:\x20Fri,\x200 MAC Address: 08:00:27:D2:3D:FB (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.75 seconds
（3）进行UDP扫描
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(kali㉿kali)-[/miao/hmv/hero] └─$ sudo nmap -sU -p80,5678 192.168.2.9 -oA nmapscan/udp [sudo] kali 的密码： Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 21:12 CST Nmap scan report for 192.168.2.9 Host is up (0.00057s latency).
PORT STATE SERVICE 80/udp closed http 5678/udp closed rrac MAC Address: 08:00:27:D2:3D:FB (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds
┌──(kali㉿kali)-[/miao/hmv/hero] └─$ sudo nmap --script=vuln -p22,80,5678 192.168.2.9 -oA nmapscan/vuln Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-07 21:15 CST Nmap scan report for 192.168.2.9 Host is up (0.00030s latency).
PORT STATE SERVICE 22/tcp closed ssh 80/tcp open http |_http-dombased-xss: Couldn't find any DOM based XSS. | http-vuln-cve2011-3192: | VULNERABLE: | Apache byterange filter DoS | State: VULNERABLE | IDs: BID:49303 CVE:CVE-2011-3192 | The Apache web server is vulnerable to a denial of service attack when numerous | overlapping byte ranges are requested. | Disclosure date: 2011-08-19 | References: | https://seclists.org/fulldisclosure/2011/Aug/175 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192 | https://www.securityfocus.com/bid/49303 |_ https://www.tenable.com/plugins/nessus/55976 |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. 5678/tcp open rrac MAC Address: 08:00:27:D2:3D:FB (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 73.60 seconds
┌──(kali㉿kali)-[/miao/hmv/hero] └─$ ssh shawa@192.168.2.9 -i id_rsa -p 2222 The authenticity of host '[192.168.2.9]:2222 ([192.168.2.9]:2222)' can't be established.' ED25519 key fingerprint is SHA256:EBZrmf2l6+BtffXHAEtSx6Suq5Wf09yzZlVqbQaGOVM. This host key is known by the following other names/addresses: ~/.ssh/known_hosts:3: [hashed name] Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[192.168.2.9]:2222' (ED25519) to the list of known hosts. shawa was here. Welcome to Alpine!
The Alpine Wiki contains a large amount of how-to guides and general information about administrating Alpine systems. See <https://wiki.alpinelinux.org/>.
You can setup the system with the command: setup-alpine
You may change this message by editing /etc/motd.
hero:~$ cat user.txt
提权
（1）查看sshd_config，发现Banner /opt/banner.txt，进行查看
1 2 3 4
hero:~$ cat /opt/banner.txt shawa was here. hero:~$ ls -la /opt/banner.txt -rw-rw-rw- 1 root root 16 Feb 6 10:09 /opt/banner.txt
hero:~$ ssh root@172.17.0.1 The authenticity of host '172.17.0.1 (172.17.0.1)' cant be established. ED25519 key fingerprint is SHA256:EBZrmf2l6+BtffXHAEtSx6Suq5Wf09yzZlVqbQaGOVM. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '172.17.0.1' (ED25519) to the list of known hosts. HMVNOTINPRODLOL root@172.17.0.1's password:
