Explorer

靶机说明

一、信息收集

1、主机探测

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
┌──(root㉿kali)-[~/miaosec/vulnyx/explorer]
└─# nmap -sn 192.168.2.0/24               
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-14 16:15 CST
Nmap scan report for 192.168.2.1
Host is up (0.00047s latency).
MAC Address: 0A:00:27:00:00:07 (Unknown)
Nmap scan report for 192.168.2.2
Host is up (0.00032s latency).
MAC Address: 08:00:27:EA:4D:3E (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.2.11
Host is up (0.00089s latency).
MAC Address: 08:00:27:09:E6:80 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.2.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.21 seconds

靶机IP：192.168.2.11

2、端口扫描

1.全端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿kali)-[~/miaosec/vulnyx/explorer]
└─# nmap --min-rate 10000 -p- 192.168.2.11                                                      
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-14 16:16 CST
Nmap scan report for 192.168.2.11
Host is up (0.00067s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:09:E6:80 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 6.23 seconds

开放端口：22、80

2.详细信息扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
┌──(root㉿kali)-[~/miaosec/vulnyx/explorer]
└─# nmap --min-rate 10000 -sT -sV -sC -O -p22,80 192.168.2.11
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-14 16:16 CST
Nmap scan report for 192.168.2.11
Host is up (0.00061s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 a9:a8:52:f3:cd:ec:0d:5b:5f:f3:af:5b:3c:db:76:b6 (ECDSA)
|_  256 73:f5:8e:44:0c:b9:0a:e0:e7:31:0c:04:ac:7e:ff:fd (ED25519)
80/tcp open  http    Apache httpd 2.4.65 ((Debian))
|_http-server-header: Apache/2.4.65 (Debian)
|_http-title: Site doesn't have a title (text/html).
| http-robots.txt: 1 disallowed entry 
|_/extplorer
MAC Address: 08:00:27:09:E6:80 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.79 seconds
  1. 22端口： ssh服务，用于远程登录
  2. 80端口： http服务，存在robots.txt文件

3.UDP端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿kali)-[~/miaosec/vulnyx/explorer]
└─# nmap -sU --top-ports 100 192.168.2.11                    

Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-14 16:17 CST
Nmap scan report for 192.168.2.11
Host is up (0.00094s latency).
Not shown: 99 closed udp ports (port-unreach)
PORT   STATE         SERVICE
68/udp open|filtered dhcpc
MAC Address: 08:00:27:09:E6:80 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 105.00 seconds

没有开放的端口

二、80端口测试

访问80端口，是服务的默认页面，没有什么东西

1
2
3
4
5
6
7
8
9
┌──(root㉿kali)-[~/miaosec/vulnyx/explorer]
└─# curl http://192.168.2.11    
<html>
<body>
  <h1>It works!</h1>
  <p>This is the default web page for this server.</p>
  <p>The web server software is running but no content has been added, yet.</p>
</body>
</html>

根据上面信息收集到的信息，访问/robots.txt文件，找到目录extplorer

1
2
3
4
┌──(root㉿kali)-[~/miaosec/vulnyx/explorer]
└─# curl http://192.168.2.11/robots.txt
User-agent: *
Disallow: /extplorer

三、extplorer测试

访问extplorer，发现是extplorer文件管理器

1
eXtplorer 是一个基于 php 的文件管理器，通过web页面进行操作，操作方式与本地电脑上的资源管理器很像，其主要作用是在本地电脑与服务器之间传送文件，并且能和本地电脑的资源管理器一样，对文件和目录进行编辑、复制、移动和删除等操作，甚至还能修改文件的权限属性。

1、弱口令

直接尝试admin:admin，发现成功登录

2、敏感信息泄露

直接查找到extplorer/config/conf.php文件，找到一个root的账号和密码

四、获取root权限

直接使用获取到的账号和密码root:AccessGranted#1进行登录，成功获得root权限

1
2
3
4
5
6
7
8
9
10
┌──(root㉿kali)-[~/miaosec/vulnyx/explorer]
└─# ssh root@192.168.2.11
The authenticity of host '192.168.2.11 (192.168.2.11)' can't be established.
ED25519 key fingerprint is SHA256:4K6G5c0oerBJXgd6BnT2Q3J+i/dOR4+6rQZf20TIk/U.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.2.11' (ED25519) to the list of known hosts.
root@192.168.2.11's password: 
root@explorer:~# id
uid=0(root) gid=0(root) grupos=0(root)

五、获取FLAG

1
2
3
root@explorer:~# cat /home/user.txt /root/root.txt 
3f2580ab16ac82c9e0adaf0dad3a900d
9a045d36c5a28f01784bdcfb326accfe
Vulnyx
#extplorer`文件管理器 #弱口令
Explorer
http://miao-sec.github.io/Vulnyx/Explorer/
作者
Miao
发布于
2026年1月9日
许可协议
BY-MIAO