┌──(root㉿kali)-[/miao/maze-sec/sneak] └─# nmap -sn 192.168.2.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-14 19:04 CST Nmap scan report for 192.168.2.1 Host is up (0.00052s latency). MAC Address: 0A:00:27:00:00:0A (Unknown) Nmap scan report for 192.168.2.2 Host is up (0.0011s latency). MAC Address: 08:00:27:4E:1A:DF (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.57 Host is up (0.00085s latency). MAC Address: 08:00:27:42:27:37 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.01 seconds
靶机IP：192.168.2.57
二、端口扫描
1、全端口扫描
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[/miao/maze-sec/sneak] └─# nmap --min-rate 10000 -p- 192.168.2.57 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-14 19:05 CST Nmap scan report for 192.168.2.57 Host is up (0.0013s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:42:27:37 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 44.82 seconds
┌──(root㉿kali)-[/miao/maze-sec/sneak] └─# nmap --min-rate 10000 -sT -sV -sC -O -p22,80 192.168.2.57 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-14 19:06 CST Nmap scan report for 192.168.2.57 Host is up (0.00092s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) |_ 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) 80/tcp open http Apache httpd 2.4.62 ((Debian)) |_http-server-header: Apache/2.4.62 (Debian) |_http-title: Site doesn't have a title (text/html). MAC Address: 08:00:27:42:27:37 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 9.10 seconds
3、UDP端口扫描
1 2 3 4 5 6 7 8 9 10 11
┌──(root㉿kali)-[/miao/maze-sec/sneak] └─# nmap -sU --top-ports 100 192.168.2.57 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-14 21:30 CST Nmap scan report for 192.168.2.57 Host is up (0.0011s latency). Not shown: 99 closed udp ports (port-unreach) PORT STATE SERVICE 68/udp open|filtered dhcpc MAC Address: 08:00:27:42:27:37 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 104.56 seconds
┌──(root㉿kali)-[/miao/maze-sec/sneak] └─# dirsearch -u "http://192.168.2.57/cms" /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict
┌──(root㉿kali)-[/miao/maze-sec/sneak] └─# ssh sysadm@192.168.2.57 -i sysadm.key Warning: Permanently added '192.168.2.57' (ED25519) to the list of known hosts. Linux Sneak 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. sysadm@Sneak:~$ id uid=1002(sysadm) gid=1003(sysadm) groups=1003(sysadm)
2、more提权
使用sudo -l，发现可以more查看这个文件
1 2 3 4 5 6
sysadm@Sneak:~$ sudo -l Matching Defaults entries for sysadm on Sneak: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User sysadm may run the following commands on Sneak: (ALL) NOPASSWD: /usr/bin/more /var/log/custom/fake-cleanup.sh
但是文件长度不够导致无法分页进入shell
1 2 3
sysadm@Sneak:~$ /usr/bin/more /var/log/custom/fake-cleanup.sh # System cleanup script - DO NOT MODIFY #
