# 查看版本信息 $ nmap --version Nmap version 7.95 ( https://nmap.org ) Platform: x86_64-pc-linux-gnu Compiled with: liblua-5.4.7 openssl-3.4.0 libssh2-1.11.1 libz-1.3.1 libpcre2-10.44 libpcap-1.10.5 nmap-libdnet-1.12 ipv6 Compiled without: Available nsock engines: epoll poll select # 扫描局域网内存活主机 $ nmap -sn 192.168.24.1-255 Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-27 17:37 CST Nmap scan report for 192.168.24.1 Host is up (0.00038s latency). MAC Address: 00:50:56:C0:00:08 (VMware) Nmap scan report for 192.168.24.2 Host is up (0.00025s latency). MAC Address: 00:50:56:E9:06:E0 (VMware) Nmap scan report for 192.168.24.82 Host is up (0.00030s latency). MAC Address: 00:0C:29:B2:5B:3E (VMware) Nmap scan report for 192.168.24.99 Host is up (0.00020s latency). MAC Address: 00:50:56:FC:C9:BF (VMware) Nmap scan report for 192.168.24.83 Host is up. Nmap done: 255 IP addresses (5 hosts up) scanned in 2.21 seconds # 探测主机操作系统 $ nmap -O 192.168.24.82 Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-27 17:38 CST Nmap scan report for 192.168.24.82 Host is up (0.0010s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 9090/tcp open zeus-admin MAC Address: 00:0C:29:B2:5B:3E (VMware) Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.19 Network Distance: 1 hop
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 1.75 seconds # 对主机进行详细探测 $ nmap -A 192.168.24.82 Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-27 17:40 CST Nmap scan report for 192.168.24.82 Host is up (0.00070s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6 (protocol 2.0) | ssh-hostkey: | 256 e8:51:03:73:4a:95:61:5d:1c:80:a0:8d:ef:2f:b0:f4 (ECDSA) |_ 256 48:f6:b9:9f:60:2b:bc:aa:db:18:58:3b:79:13:d0:b8 (ED25519) 9090/tcp open ssl/http Cockpit web service | ssl-cert: Subject: commonName=docker/organizationName=4d291dc545804923939908878491bfe1 | Subject Alternative Name: IP Address:127.0.0.1, DNS:localhost | Not valid before: 2025-02-21T12:54:30 |_Not valid after: 2026-03-23T12:54:30 |_ssl-date: TLS randomness does not represent time | fingerprint-strings: | GetRequest, HTTPOptions: | HTTP/1.1 400 Bad request | Content-Type: text/html; charset=utf8 | Transfer-Encoding: chunked | X-DNS-Prefetch-Control: off | Referrer-Policy: no-referrer | X-Content-Type-Options: nosniff | Cross-Origin-Resource-Policy: same-origin | X-Frame-Options: sameorigin | <!DOCTYPE html> | <html> | <head> | <title> | request | </title> | <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> | <meta name="viewport" content="width=device-width, initial-scale=1.0"> | <style> | body { | margin: 0; | font-family: "RedHatDisplay", "Open Sans", Helvetica, Arial, sans-serif; | font-size: 12px; | line-height: 1.66666667; | color: #333333; | background-color: #f5f5f5; | border: 0; | vertical-align: middle; |_ font-weight: 300; | http-robots.txt: 1 disallowed entry |_/ |_http-title: Loading... 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : MAC Address: 00:0C:29:B2:5B:3E (VMware) Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.70 ms 192.168.24.82
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 120.91 seconds # 对主机进行路由追踪 $ nmap -traceroute www.sujx.net Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-27 17:46 CST Nmap scan report for www.sujx.net (39.101.1.251) Host is up (0.0033s latency). Not shown: 997 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https
TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1 0.10 ms 192.168.24.2 2 0.12 ms 39.101.1.251
Nmap done: 1 IP address (1 host up) scanned in 53.96 seconds # 扫描指定端口 $ nmap -p 443 www.sujx.net Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-27 18:26 CST Nmap scan report for www.sujx.net (39.101.1.251) Host is up (0.0039s latency).
PORT STATE SERVICE 443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 0.48 seconds
$ fping -s -g 172.16.10.1 172.16.10.254 172.16.10.100 is alive 172.16.10.102 is alive 172.16.10.103 is alive 172.16.10.119 is alive 172.16.10.109 is alive 172.16.10.105 is alive ICMP Host Unreachable from 172.16.10.119 for ICMP Echo sent to 172.16.10.1 ICMP Host Unreachable from 172.16.10.119 for ICMP Echo sent to 172.16.10.1 ICMP Host Unreachable from 172.16.10.119 for ICMP Echo sent to 172.16.10.1 ICMP Host Unreachable from 172.16.10.119 for ICMP Echo sent to 172.16.10.1 ICMP Host Unreachable from 172.16.10.119 for ICMP Echo sent to 172.16.10.4 172.16.10.254 is alive
sudo nmap -sV --script=vulners www.dssf007.com Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-27 23:40 CST Nmap scan report for www.dssf007.com (39.97.111.87) Host is up (0.028s latency). Not shown: 998 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http OpenResty web app server |_http-server-header: openresty 443/tcp open ssl/http OpenResty web app server |_http-server-header: openresty
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 19.53 seconds
$ nikto -h www.dssf007.com - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 39.97.111.87 + Target Hostname: www.dssf007.com + Target Port: 80 + Start Time: 2025-02-27 23:42:02 (GMT8) --------------------------------------------------------------------------- + Server: openresty + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + /SCZPxMUi.pt: Cookie website_user_user_new created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies + /SCZPxMUi.pt: Cookie PHPSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies + /SCZPxMUi.pt: Cookie 1697588 created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies + No CGI Directories found (use '-C all' to force check all possible dirs) + /robots.txt: Entry '/self_define/TJStyle.php' is returned a non-forbidden or redirect HTTP code (200). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: contains 6 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt + Multiple index files found: /default.htm, /index.htm, /index.php, /index.shtml. + /vchat/msg.txt: VChat allows user information to be retrieved. See: https://www.securityfocus.com/bid/7186/info + /webcart-lite/config/import.txt: This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web. See: https://packetstormsecurity.com/files/32406/xmas.txt.html + /webcart-lite/orders/import.txt: This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web. See: https://packetstormsecurity.com/files/32406/xmas.txt.html + /webcart/config/clients.txt: This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web. See: https://packetstormsecurity.com/files/32406/xmas.txt.html + /webcart/orders/import.txt: This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web. See: https://packetstormsecurity.com/files/32406/xmas.txt.html
# 新增测试用户test $ sudo useradd test # 将test用户的密码设置为test $ sudo passwd test New password: Retype new password: passwd: password updated successfully # # 将密码影子表导出为hast文本，并将其他非目标用户内容删除 $ sudocat /etc/shadow > hash.txt # 执行破解 ┌──(sujx㉿kali)-[~] └─$ vim hash.txt $ john --format=crypt hash.txt Using default input encoding: UTF-8 Loaded 1 password hash (crypt, generic crypt(3) [?/64]) Cost 1 (algorithm [1:descrypt 2:md5crypt 3:sunmd5 4:bcrypt 5:sha256crypt 6:sha512crypt]) is 0 for all loaded hashes Cost 2 (algorithm specific iterations) is 1 for all loaded hashes Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status test (test) # 取得test用户密码test 1g 0:00:00:00 DONE 1/3 (2025-02-28 17:12) 4.000g/s 384.0p/s 384.0c/s 384.0C/s test..t999995 Use the "--show" option to display all of the cracked passwords reliably Session completed.
