┌──(root㉿kali)-[~] └─# nmap -sn 192.168.2.0/24 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-09 16:57 +0800 Nmap scan report for 192.168.2.1 Host is up (0.00056s latency). MAC Address: 0A:00:27:00:00:06 (Unknown) Nmap scan report for 192.168.2.2 Host is up (0.00039s latency). MAC Address: 08:00:27:3A:E9:0C (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.18 Host is up (0.00049s latency). MAC Address: 08:00:27:74:12:A6 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 7.59 seconds
靶机IP：192.168.2.18
2、端口扫描
1.全端口扫描
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(root㉿kali)-[~] └─# nmap --min-rate 10000 -p- 192.168.2.18 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-09 16:58 +0800 Nmap scan report for 192.168.2.18 Host is up (0.00059s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 8080/tcp open http-proxy MAC Address: 08:00:27:74:12:A6 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 45.78 seconds
┌──(root㉿kali)-[~] └─# nmap --min-rate 10000 -sT -sC -sV -O -p21,22,8080 192.168.2.18 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-09 16:59 +0800 Nmap scan report for 192.168.2.18 Host is up (0.00081s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.0.8 or later 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 8080/tcp open http Werkzeug httpd 3.1.6 (Python 3.9.2) |_http-server-header: Werkzeug/3.1.6 Python/3.9.2 |_http-title: \xE7\xBD\x91\xE7\xBB\x9C\xE5\xAE\x89\xE5\x85\xA8\xE7\x9F\xA5\xE8\xAF\x86\xE6\x8C\x91\xE6\x88\x98 MAC Address: 08:00:27:74:12:A6 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.46 seconds```
3.udp扫描
1 2 3 4 5 6 7 8 9 10
┌──(root㉿kali)-[~] └─# nmap -sU --top-ports 100 192.168.2.18 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-09 16:59 +0800 Nmap scan report for 192.168.2.18 Host is up (0.00085s latency). All 100 scanned ports on 192.168.2.18 are in ignored states. Not shown: 58 closed udp ports (port-unreach), 42 open|filtered udp ports (no-response) MAC Address: 08:00:27:74:12:A6 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 58.10 seconds
┌──(root㉿kali)-[~/.ssh] └─# ssh root@192.168.2.18 ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html Linux Banner 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed Mar 18 04:15:30 2026 from 192.168.137.102 -bash: warning: setlocale: LC_ALL: cannot change locale (zh_CN.UTF-8) root@Banner:~# id uid=0(root) gid=0(root) groups=0(root)
