❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.129 08:00:27:49:f7:6d PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f0:6f:4b VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.070 seconds (123.67 hosts/sec). 4 responded ~/temp ❯ export ip=192.168.60.129 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- To scan or not to scan? That is the question. [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.129:22 Open 192.168.60.129:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-01 08:27 CST Initiating ARP Ping Scan at 08:27 Scanning 192.168.60.129 [1 port] Completed ARP Ping Scan at 08:27, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 08:27 Completed Parallel DNS resolution of 1 host. at 08:27, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 08:27 Scanning 192.168.60.129 [2 ports] Discovered open port 80/tcp on 192.168.60.129 Discovered open port 22/tcp on 192.168.60.129 Completed SYN Stealth Scan at 08:27, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.129 Host is up, received arp-response (0.00049s latency). Scanned at 2025-04-01 08:27:53 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:49:F7:6D (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
id uid=1000(KrustyKrab) gid=1000(debian) groups=1000(debian),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev),110(bluetooth),1002(krustygroup)
❯ ssh KrustyKrab@$ip -i ../.ssh/id_rsa The authenticity of host '192.168.60.129 (192.168.60.129)' can't be established. ED25519 key fingerprint is SHA256:0d4MWSfQ+tUZ0f4j8Wea2uYelBzzcaj0CI4NtYQIx0E. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.129' (ED25519) to the list of known hosts. Linux KrustyKrab 6.1.0-9-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.27-1 (2023-05-08) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Mar 27 08:25:58 2025 from 192.168.56.118 KrustyKrab@KrustyKrab:~$ cat user.txt dcc8b0c111c9fa1522c7abfac8d1864b
同时家目录中还存在help提示
1 2
KrustyKrab@KrustyKrab:~$ file help help: GIF image data, version 89a, 480 x 270
spongebob@KrustyKrab:~$ ls -al total 56 drwx------ 2 spongebob spongebob 4096 Mar 27 05:16 . drwxr-xr-x 6 root root 4096 Mar 27 02:30 .. -rw------- 1 spongebob spongebob 58 Mar 27 08:23 .bash_history -rw-r--r-- 1 spongebob spongebob 220 Mar 26 20:14 .bash_logout -rw-r--r-- 1 spongebob spongebob 3526 Mar 26 20:14 .bashrc -rw-r--r-- 1 root root 33 Mar 27 02:37 key1 -rw-r--r-- 1 root root 19259 Mar 27 02:32 key2.jpeg -rw------- 1 spongebob spongebob 113 Mar 27 05:16 .mysql_history -rw-r--r-- 1 root root 97 Mar 27 02:41 note.txt -rw-r--r-- 1 spongebob spongebob 807 Mar 26 20:14 .profile spongebob@KrustyKrab:~$ cat note.txt
Squidward is waiting for you!!!!
password is md5($key1$key2).
It's not so hard as you think. spongebob@KrustyKrab:~$ cat key1 e1964798cfe86e914af895f8d0291812 spongebob@KrustyKrab:~$ md5sum key2.jpeg 5e1d0c1a168dc2d70004c2b00ba314ae key2.jpeg spongebob@KrustyKrab:~$ echo -n "e1964798cfe86e914af895f8d02918125e1d0c1a168dc2d70004c2b00ba314ae" |md5sum 7ac254848d6e4556b73398dde2e4ef82 -
Root提权
尝试切换一下用户
1 2 3 4 5
spongebob@KrustyKrab:~$ su Squidward Password: $ bash Squidward@KrustyKrab:/home/spongebob$
