┌──(root㉿Eecho)-[~] └─# rustscan -a 192.168.43.116 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Port scanning: Making networking exciting since... whenever.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.43.116:22 Open 192.168.43.116:80 Open 192.168.43.116:139 Open 192.168.43.116:445 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.116 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-14 05:58 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 05:58 Completed NSE at 05:58, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 05:58 Completed NSE at 05:58, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 05:58 Completed NSE at 05:58, 0.00s elapsed Initiating ARP Ping Scan at 05:58 Scanning 192.168.43.116 [1 port] Completed ARP Ping Scan at 05:58, 0.03s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 05:58 Completed Parallel DNS resolution of 1 host. at 05:58, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 05:58 Scanning 192.168.43.116 [4 ports] Discovered open port 80/tcp on 192.168.43.116 Discovered open port 22/tcp on 192.168.43.116 Discovered open port 139/tcp on 192.168.43.116 Discovered open port 445/tcp on 192.168.43.116 Completed SYN Stealth Scan at 05:58, 0.02s elapsed (4 total ports) Initiating Service scan at 05:58 Scanning 4 services on 192.168.43.116 Completed Service scan at 05:58, 11.02s elapsed (4 services on 1 host) Initiating OS detection (try #1) against 192.168.43.116 NSE: Script scanning 192.168.43.116. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 05:58 Completed NSE at 05:58, 0.92s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 05:58 Completed NSE at 05:58, 0.03s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 05:58 Completed NSE at 05:58, 0.00s elapsed Nmap scan report for 192.168.43.116 Host is up, received arp-response (0.00064s latency). Scanned at 2026-05-14 05:58:31 CST for 14s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0) | ssh-hostkey: | 256 d1:ab:7b:af:5c:3b:5e:52:23:9a:97:57:a8:aa:a1:f5 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMP5y9qII4Y1Fsf0MbIX17fw4Y0Gdhcu92GoL2olzME0PXunSKQ1a6UokdyltMoGd5dEkvX7HpitnQemJ1iGZYQ= | 256 73:d9:ad:9e:c0:96:12:d8:ed:1b:ee:c0:15:ba:34:98 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBPz0mRGRuiKwzaRFH/6u+5rgtzMGSTbz8+p0bokJYV 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.59 ((Debian)) |_http-favicon: Unknown favicon MD5: 0B11A9699AE33DE62A1D05BE8F733486 | http-robots.txt: 13 disallowed entries | /.github/ /.phan/ /assets/ /backup/ /bin/ /cache/ /logs/ |_/system/ /tests/ /tmp/ /user/ /vendor/ /webserver-configs/ |_http-title: webos.thl | Grav |_http-server-header: Apache/2.4.59 (Debian) |_http-generator: GravCMS | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS 139/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 3.X - 4.X (workgroup: THE HACKERS LABS - WEBOS) 445/tcp open netbios-ssn syn-ack ttl 64 Samba smbd 4.17.12-Debian (workgroup: THE HACKERS LABS - WEBOS) MAC Address: 08:00:27:48:3F:94 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=5/14%OT=22%CT=%CU=33506%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=6A04F415%P=x86_64-pc-linux-gnu)SEQ(SP=10A%GCD=1%ISR=108%TI=Z%CI=Z%II=I% OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5 OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6= OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O% OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0 OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N OS:%T=40%CD=S)
Uptime guess: 18.069 days (since Sun Apr 26 04:18:55 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=266 (Good luck!) IP ID Sequence Generation: All zeros Service Info: Host: THEHACKERSLABS-WEBOS; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Sharename Type Comment --------- ---- ------- print$ Disk Printer Drivers webos Disk Archivo compartido en Samba IPC$ IPC IPC Service (Samba 4.17.12-Debian) nobody Disk Home Directories Reconnecting with SMB1 for workgroup listing.
┌──(root㉿Eecho)-[~] └─# smbclient //192.168.43.116/webos -U webos Password for [WORKGROUP\webos]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Thu Jul 18 02:47:07 2024 .. D 0 Thu Jul 18 17:31:55 2024 MamaÑema.txt N 245 Thu Jul 18 02:47:07 2024
19480400 blocks of size 1024. 16319196 blocks available smb: \> get MamaÑema.txt getting file \MamaÑema.txt of size 245 as MamaÑema.txt (59.8 KiloBytes/sec) (average 59.8 KiloBytes/sec) smb: \> ┌──(root㉿Eecho)-[~] └─# cat MamaÑema.txt ++++++++++[>++++++++++>++++++++++>+++++++++++>+++++++++++>+++++++++++>++++++>++++++++>++++++++++>+++++++++++>+++++++++++>++++++++++>+++++++++++>+++++>++++++>++++<<<<<<<<<<<<<<<-]>---.>.>-.>-----.>.>--.>.>+.>++++.>-----.>-.>+.>++++.>---.>++.....
Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes Cost 2 (iteration count) is 16 for all loaded hashes Will run 24 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status freestyle (id_rsa2) 1g 0:00:00:12 DONE (2026-05-14 06:32) 0.07824g/s 285.4p/s 285.4c/s 285.4C/s girls..654123 Use the "--show" option to display all of the cracked passwords reliably Session completed.
获取私钥的用户名
1 2 3 4
┌──(root㉿Eecho)-[/tmp/bbbb] └─# ssh-keygen -y -f id_rsa2 Enter passphrase for "id_rsa2": ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDKenJrjXC6OCWl5WhP4KDa+B7Rv9GdhlZa91O1noGKfOBLqderInRTRJxvhiuMFbpO4xwjhB4A5QYcp114PQ6h2b5NLvoKxcLvlGqCBhKM9DtveO144I/Fp/XlDN5yh1roWVx8rfRHp2kFQK122q9D8fycSIHL45H5adPb5qK+QlV9xzCoVR7qhxK4QBbz/Pzrl8bPqMlw3EA8of8wsus1b5WBNsXv/CqtRT8/OIVZA560b8maqf1dI0RxdUkggBYll0xtcQPoT08rawJbUrIV98OZW+KwJBp5MiSJBDxr6x+TSMJRuAxtf75hQjjIo6+EAItwyYzrva+tAl5y4bzZgMeNv7213CMkW0ljBwB6Kyl+4IDcagT4DOwI0wQGQPFMWSewhDcItbyWq6dYeru5Cbj/SiQ7fhPOpsg78RoZA3tbHbfdGOcC1vXpH3jAL6QR+ByK9HeGtKl8xvrC33Vc7vm+pQdCzllyfjQ4jiNMZKB7EOZT1Ea8jZW+XARzuIBxlZzLMDAK5BnBtR7UA+uC4MbkXDwD4WjG6uHyu4RF2guyD3/1T4T8e3Z9ZiYcwntg1stBXc34kc+PVmDpUPtLhJ8TyHca3gDDifRLOyfSThRlo7Hg33wPgUTjjlL2BgUEW0kyGIIpx7Q9FCk5dK/LKORImoeNVumW2gXcl681Lw== webos@debian
www-data@TheHackersLabs-Webos:/opt$ ssh webos@127.0.0.1 -i id_rsa The authenticity of host '127.0.0.1 (127.0.0.1)' can't be established. ED25519 key fingerprint is SHA256:w8UgTBmuwG1smfcGc48qBPhvE6qd3suezLv4a6dEt2M. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Could not create directory '/var/www/.ssh' (Permission denied). Failed to add the host to the list of known hosts (/var/www/.ssh/known_hosts). Enter passphrase for key 'id_rsa': Linux TheHackersLabs-Webos 6.1.0-22-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.94-1 (2024-06-21) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu Jul 18 11:45:53 2024 from 192.168.18.19 webos@TheHackersLabs-Webos:~$ id uid=1001(webos) gid=1001(webos) grupos=1001(webos),1002(webito) webos@TheHackersLabs-Webos:~$
