Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-25 04:03 EDT Nmap scan report for 192.168.205.1 (192.168.205.1) Host is up (0.0012s latency). MAC Address: 00:50:56:C0:00:01 (VMware) Nmap scan report for 192.168.205.2 (192.168.205.2) Host is up (0.00089s latency). MAC Address: 00:50:56:F7:4F:9C (VMware) Nmap scan report for 192.168.205.136 (192.168.205.136) Host is up (0.00074s latency). MAC Address: 00:0C:29:19:D7:D3 (VMware) Nmap scan report for 192.168.205.254 (192.168.205.254) Host is up (0.00077s latency). MAC Address: 00:50:56:E0:48:99 (VMware) Nmap scan report for 192.168.205.128 (192.168.205.128) Host is up. Nmap done: 256 IP addresses (5 hosts up) scanned in 2.00 seconds
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-25 04:17 EDT Nmap scan report for 192.168.205.136 (192.168.205.136) Host is up (0.00034s latency). Not shown: 55528 filtered tcp ports (no-response), 10003 closed tcp ports (conn-refused) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http 3306/tcp open mysql MAC Address: 00:0C:29:19:D7:D3 (VMware)
发现4个端口
-oA nmapscan/ports 这里是为了数据化扫描结果
如果扫描过程中遇到的端口数量过大的情况下我们就可以进行一个筛选
grep open nmapscan/ports.nmap
21/tcp open ftp 22/tcp open ssh 80/tcp open http 3306/tcp open mysql
grep open nmapscan/ports.nmap |awk -F'/''{print $1}' 21 22 80 3306
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.0.8 or later | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:192.168.205.128 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 2 | vsFTPd 3.0.3 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) | drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 content | drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 docs |_drwxr-xr-x 2 ftp ftp 4096 Jan 28 2018 new-employees 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 07:e3:5a:5c:c8:18:65:b0:5f:6e:f7:75:c7:7e:11:e0 (RSA) | 256 03:ab:9a:ed:0c:9b:32:26:44:13:ad:b0:b0:96:c3:1e (ECDSA) |_ 256 3d:6d:d2:4b:46:e8:c9:a3:49:e0:93:56:22:2e:e3:54 (ED25519) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works 3306/tcp open mysql MySQL (unauthorized) MAC Address: 00:0C:29:19:D7:D3 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 3.10 - 4.11 (97%), Linux 3.2 - 4.14 (97%), Linux 5.1 - 5.15 (95%), Linux 3.13 - 4.4 (93%), Linux 3.8 - 3.16 (93%), Linux 4.10 (93%), Linux 3.4 - 3.10 (93%), Linux 3.10 (93%), Linux 3.13 - 3.16 (92%), Linux 4.4 (92%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: Host: W1R3S.inc; OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 20.41 seconds
在扫描的过程中我们可以进行一下udp的一个扫描
sudo nmap -sU --top-ports 20 192.168.205.136 -oA nmapscan/udp [sudo] kali 的密码： Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-25 05:22 EDT Nmap scan report for 192.168.205.136 (192.168.205.136) Host is up (0.0011s latency).
Nmap done: 1 IP address (1 host up) scanned in 1.72 second
还有进行nmap 漏洞脚本进行扫描
sudo nmap --script=vuln -p21,80,22,3306 192.168.205.136 -oA nmapscan/vuln Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-25 05:25 EDT Nmap scan report for 192.168.205.136 (192.168.205.136) Host is up (0.0014s latency).
PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-csrf: Couldn't find any CSRF vulnerabilities. | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server's resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 | http-enum: |_ /wordpress/wp-login.php: Wordpress login page. 3306/tcp open mysql MAC Address: 00:0C:29:19:D7:D3 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 322.12 seconds
这里没有发现可利用漏洞 ddos就不考虑了
然后分析刚刚的详细扫描
21/tcp open ftp vsftpd 2.0.8 or later
21端口 ftp 使用的是vsftpd 后缀带d基本上可以使用匿名登录
信息收集就到这 端口扫描 详细端口扫描 udp扫描 利用漏洞脚本扫描，可能还会有ipv6的扫描
匿名登录
ftp 192.168.205.136 Connected to 192.168.205.136. 220 Welcome to W1R3S.inc FTP service. Name (192.168.205.136:kali): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files.
这里注意ftp要切换成二进制模式
发现三个目录
drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 content drwxr-xr-x 2 ftp ftp 4096 Jan 23 2018 docs drwxr-xr-x 2 ftp ftp 4096 Jan 28 2018 new-employees
john md5.hash Created directory: /home/kali/.john Warning: detected hash type "sha512crypt", but the string is also recognized as "HMAC-SHA256" Use the "--format=HMAC-SHA256" option to force loading these as that type instead Using default input encoding: UTF-8 Loaded 3 password hashes with 3 different salts (sha512crypt, crypt(3) $6$ [SHA512 128/128 AVX 2x]) Cost 1 (iteration count) is 5000 for all loaded hashes Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status www-data (www-data) Almost done: Processing the remaining buffered candidate passwords, if any. Proceeding with wordlist:/usr/share/john/password.lst computer (w1r3s) Proceeding with incremental:ASCII
.png)
.png)
.png)