$ sudo nmap -sn 192.168.205.0/24 [sudo] kali 的密码： Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-31 07:49 EDT Nmap scan report for 192.168.205.1 (192.168.205.1) Host is up (0.00058s latency). MAC Address: 00:50:56:C0:00:01 (VMware) Nmap scan report for 192.168.205.2 (192.168.205.2) Host is up (0.00014s latency). MAC Address: 00:50:56:F7:4F:9C (VMware) Nmap scan report for 192.168.205.137 (192.168.205.137) Host is up (0.00039s latency). MAC Address: 00:0C:29:32:80:FE (VMware) Nmap scan report for 192.168.205.254 (192.168.205.254) Host is up (0.00029s latency). MAC Address: 00:50:56:FD:69:37 (VMware) Nmap scan report for 192.168.205.128 (192.168.205.128) Host is up. Nmap done: 256 IP addresses (5 hosts up) scanned in 1.97 seconds
or
$ sudo arp-scan -l Interface: eth0, type: EN10MB, MAC: 00:0c:29:e7:49:b2, IPv4: 192.168.205.128 Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan) 192.168.205.1 00:50:56:c0:00:01 VMware, Inc. 192.168.205.2 00:50:56:f7:4f:9c VMware, Inc. 192.168.205.137 00:0c:29:32:80:fe VMware, Inc. 192.168.205.254 00:50:56:fd:69:37 VMware, Inc.
4 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0: 256 hosts scanned in 1.998 seconds (128.13 hosts/sec). 4 responded
确定137是我们的目标主机
首先进行tcp扫描然后保存
sudo nmap -sT --min-rate 10000 -p- 192.168.205.137 -oA nmapscan/tcp Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-31 07:53 EDT Nmap scan report for 192.168.205.137 (192.168.205.137) Host is up (0.0011s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 00:0C:29:32:80:FE (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds
发现两个端口打开 这里为了保持好习惯 假设碰上多个端口的话（只是进行练习）
grep open nmapscan/tcp.nmap|awk -F'/' '{print($1)}'|paste -sd ","
22,80
对这个连个端口进行全面扫描
sudo nmap -sT -sV -sC -O -p22,80 192.168.205.137 -oA nmapscan/web Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-31 07:57 EDT Nmap scan report for 192.168.205.137 (192.168.205.137) Host is up (0.00092s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 8d:c5:20:23:ab:10:ca:de:e2:fb:e5:cd:4d:2d:4d:72 (RSA) | 256 94:9c:f8:6f:5c:f1:4c:11:95:7f:0a:2c:34:76:50:0b (ECDSA) |_ 256 4b:f6:f1:25:b6:13:26:d4:fc:9e:b0:72:9f:f4:69:68 (ED25519) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: HacknPentest MAC Address: 00:0C:29:32:80:FE (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.14, Linux 3.8 - 3.16 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.96 seconds
于此同时发现对udp端口进行扫描
$ sudo nmap -sU --top-ports 20 192.168.205.137 -oA nmapscan/udp [sudo] kali 的密码： Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-31 07:59 EDT Nmap scan report for 192.168.205.137 (192.168.205.137) Host is up (0.00086s latency).
Nmap done: 1 IP address (1 host up) scanned in 23.42 seconds
631/udp open|filtered ipp
68/udp open|filtered dhcpc
发现可能打开的两个端口
用脚本扫描端口漏洞于此同时对打开的80端口进行目录扫描
$ sudo nmap --script=vuln -p80,22 192.168.205.137 -oA nmapscan/vuln Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-31 08:04 EDT Nmap scan report for 192.168.205.137 (192.168.205.137) Host is up (0.00042s latency).
PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug) |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-csrf: Couldn't find any CSRF vulnerabilities. | http-enum: | /wordpress/: Blog |_ /wordpress/wp-login.php: Wordpress login page. MAC Address: 00:0C:29:32:80:FE (VMware)
Nmap done: 1 IP address (1 host up) scanned in 174.19 seconds
sudo curl 192.168.205.137/secret.txt Looks like you have got some secrets.
Ok I just want to do some help to you.
Do some more fuzz on every page of php which was finded by you. And if you get any right parameter then follow the below steps. If you still stuck Learn from here a basic tool with good usage for OSCP.
sudo wfuzz -c -w /usr/share/wfuzz/wordlist/general/common.txt --hh 136 http://192.168.205.137/index.php?FUZZ=something /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.
Do something better <br><br><br><br><br><br>ok well Now you reah at the exact parameter <br><br>Now dig some more for next one <br>use 'secrettier360' parameter on some other php page for more fun. </html>
<body> <img src='hacknpentest.png' alt='hnp security' width="1300" height="595" /></p></p></p> </body> finaly you got the right parameter<br><br><br><br></html>
.png)
.png)
.png)