4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.936 seconds (132.23 hosts/sec). 4 responded ❯ export ip=192.168.60.144 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Real hackers hack time ⌛ [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.144:22 Open 192.168.60.144:80 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-08 13:03 CST Initiating ARP Ping Scan at 13:03 Scanning 192.168.60.144 [1 port] Completed ARP Ping Scan at 13:03, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 13:03 Completed Parallel DNS resolution of 1 host. at 13:03, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 13:03 Scanning 192.168.60.144 [2 ports] Discovered open port 80/tcp on 192.168.60.144 Discovered open port 22/tcp on 192.168.60.144 Completed SYN Stealth Scan at 13:03, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.144 Host is up, received arp-response (0.00035s latency). Scanned at 2025-01-08 13:03:46 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:18:5A:D3 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.25 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
❯ wfuzz -c -u "http://sarxixas.thl" -H "HOST:FUZZ.sarxixas.thl" -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --hc 302 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://sarxixas.thl/ Total requests: 207643 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 省略400返回值…… 000000984: 200 15 L 51 W 776 Ch "api - api"
再次编辑hosts
访问发现有个压缩包，down到本地
压缩包加密了，爆破一下
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
❯ cd Downloads ❯ ls Cocineros hash HostiaPilotes.zip ❯ zip2john HostiaPilotes.zip >hash ver 1.0 HostiaPilotes.zip/HostiaPilotes/ is not encrypted, or stored with non-handled compression type ver 1.0 efh 5455 efh 7875 HostiaPilotes.zip/HostiaPilotes/contraseña.txt PKZIP Encr: 2b chk, TS_chk, cmplen=31, decmplen=19, crc=DF1DBE40 ts=69C0 cs=69c0 type=0 ❯ john hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status babybaby (HostiaPilotes.zip/HostiaPilotes/contraseña.txt) 1g 0:00:00:00 DONE (2025-01-08 14:04) 100.0g/s 819200p/s 819200c/s 819200C/s 123456..whitetiger Use the "--show" option to display all of the cracked passwords reliably Session completed.
