# 查看版本信息 $ nmap --version Nmap version 7. 95 ( https://nmap.org ) Platform: x86_64-pc-linux-gnu Compiled with: liblua-5. 4. 7 openssl-3. 4. 0 libssh2-1. 11. 1 libz-1. 3. 1 libpcre2-10. 44 libpcap-1. 10. 5 nmap-libdnet-1. 12 ipv6 Compiled without: Available nsock engines: epoll poll select # 扫描局域网内存活主机 $ nmap -sn 192. 168. 24. 1-255 Starting Nmap 7. 95 ( https://nmap.org ) at 2025-02-27 17:37 CST Nmap scan report for 192. 168. 24. 1 Host is up ( 0. 00038s latency ). MAC Address: 00:50:56:C0:00:08 ( VMware ) Nmap scan report for 192. 168. 24. 2 Host is up ( 0. 00025s latency ). MAC Address: 00:50:56:E9:06:E0 ( VMware ) Nmap scan report for 192. 168. 24. 82 Host is up ( 0. 00030s latency ). MAC Address: 00:0C:29:B2:5B:3E ( VMware ) Nmap scan report for 192. 168. 24. 99 Host is up ( 0. 00020s latency ). MAC Address: 00:50:56:FC:C9:BF ( VMware ) Nmap scan report for 192. 168. 24. 83 Host is up. Nmap done: 255 IP addresses ( 5 hosts up ) scanned in 2. 21 seconds # 探测主机操作系统 $ nmap -O 192. 168. 24. 82 Starting Nmap 7. 95 ( https://nmap.org ) at 2025-02-27 17:38 CST Nmap scan report for 192. 168. 24. 82 Host is up ( 0. 0010s latency ). Not shown: 998 closed tcp ports ( reset ) PORT STATE SERVICE 22/tcp open ssh 9090/tcp open zeus-admin MAC Address: 00:0C:29:B2:5B:3E ( VMware ) Device type: general purpose Running: Linux 4. X|5. X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4. 15 - 5. 19 Network Distance: 1 hop
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address ( 1 host up ) scanned in 1. 75 seconds # 对主机进行详细探测 $ nmap -A 192. 168. 24. 82 Starting Nmap 7. 95 ( https://nmap.org ) at 2025-02-27 17:40 CST Nmap scan report for 192. 168. 24. 82 Host is up ( 0. 00070s latency ). Not shown: 998 closed tcp ports ( reset ) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9. 6 ( protocol 2. 0 ) | ssh-hostkey: | 256 e8:51:03:73:4a:95:61:5d:1c:80:a0:8d:ef:2f:b0:f4 ( ECDSA ) |_ 256 48:f6:b9:9f:60:2b:bc:aa:db:18:58:3b:79:13:d0:b8 ( ED25519 ) 9090/tcp open ssl/http Cockpit web service | ssl-cert: Subject: commonName=docker/organizationName=4d291dc545804923939908878491bfe1 | Subject Alternative Name: IP Address:127. 0. 0. 1, DNS:localhost | Not valid before: 2025-02-21T12:54:30 |_Not valid after: 2026-03-23T12:54:30 |_ssl-date: TLS randomness does not represent time | fingerprint-strings: | GetRequest, HTTPOptions: | HTTP/1. 1 400 Bad request | Content-Type: text/html; charset=utf8 | Transfer-Encoding: chunked | X-DNS-Prefetch-Control: off | Referrer-Policy: no-referrer | X-Content-Type-Options: nosniff | Cross-Origin-Resource-Policy: same-origin | X-Frame-Options: sameorigin | <!DOCTYPE html> | <html> | <head> | <title> | request | </title> | <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> | <meta name="viewport" content="width=device-width, initial-scale=1. 0"> | <style> | body { | margin: 0; | font-family: "RedHatDisplay", "Open Sans", Helvetica, Arial, sans-serif; | font-size: 12px; | line-height: 1. 66666667; | color: #333333; | background-color: #f5f5f5; | border: 0; | vertical-align: middle; |_ font-weight: 300; | http-robots.txt: 1 disallowed entry |_/ |_http-title: Loading... 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : MAC Address: 00:0C:29:B2:5B:3E ( VMware ) Device type: general purpose|router Running: Linux 4. X|5. X, MikroTik RouterOS 7. X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5. 6. 3 OS details: Linux 4. 15 - 5. 19, OpenWrt 21. 02 ( Linux 5. 4 ), MikroTik RouterOS 7. 2 - 7. 5 ( Linux 5. 6. 3 ) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0. 70 ms 192. 168. 24. 82
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address ( 1 host up ) scanned in 120. 91 seconds # 对主机进行路由追踪 $ nmap -traceroute www.sujx.net Starting Nmap 7. 95 ( https://nmap.org ) at 2025-02-27 17:46 CST Nmap scan report for www.sujx.net ( 39. 101. 1. 251 ) Host is up ( 0. 0033s latency ). Not shown: 997 filtered tcp ports ( no-response ) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https
TRACEROUTE ( using port 80/tcp ) HOP RTT ADDRESS 1 0. 10 ms 192. 168. 24. 2 2 0. 12 ms 39. 101. 1. 251
Nmap done: 1 IP address ( 1 host up ) scanned in 53. 96 seconds # 扫描指定端口 $ nmap -p 443 www.sujx.net Starting Nmap 7. 95 ( https://nmap.org ) at 2025-02-27 18:26 CST Nmap scan report for www.sujx.net ( 39. 101. 1. 251 ) Host is up ( 0. 0039s latency ).
PORT STATE SERVICE 443/tcp open https
Nmap done: 1 IP address ( 1 host up ) scanned in 0. 48 seconds
ns6. cctv.com. 5 IN A 118. 178. 171. 142 ns5. cctv.com. 5 IN A 182. 92. 20. 91 ns1. cctv.com. 5 IN A 203. 93. 27. 6 ns4. cctv.com. 5 IN A 219. 141. 244. 3
sudo nmap -sV --script=vulners www.dssf007. com Starting Nmap 7. 95 ( https://nmap.org ) at 2025-02-27 23:40 CST Nmap scan report for www.dssf007. com ( 39. 97. 111. 87 ) Host is up ( 0. 028s latency ). Not shown: 998 filtered tcp ports ( no-response ) PORT STATE SERVICE VERSION 80/tcp open http OpenResty web app server |_http-server-header: openresty 443/tcp open ssl/http OpenResty web app server |_http-server-header: openresty
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address ( 1 host up ) scanned in 19. 53 seconds
nikto
$ nikto -h www.dssf007. com - Nikto v2. 5. 0 --------------------------------------------------------------------------- + Target IP: 39. 97. 111. 87 + Target Hostname: www.dssf007. com + Target Port: 80 + Start Time: 2025-02-27 23:42:02 ( GMT8 ) --------------------------------------------------------------------------- + Server: openresty + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + /SCZPxMUi.pt: Cookie website_user_user_new created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies + /SCZPxMUi.pt: Cookie PHPSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies + /SCZPxMUi.pt: Cookie 1697588 created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies + No CGI Directories found ( use '-C all' to force check all possible dirs ) + /robots.txt: Entry '/self_define/TJStyle.php' is returned a non-forbidden or redirect HTTP code ( 200 ). See: https://portswigger.net/kb/issues/00600600_robots-txt-file + /robots.txt: contains 6 entries which should be manually viewed. See: https://developer.mozilla.org/en-US/docs/Glossary/Robots.txt + Multiple index files found: /default.htm, /index.htm, /index.php, /index.shtml. + /vchat/msg.txt: VChat allows user information to be retrieved. See: https://www.securityfocus.com/bid/7186/info + /webcart-lite/config/import.txt: This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web. See: https://packetstormsecurity.com/files/32406/xmas.txt.html + /webcart-lite/orders/import.txt: This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web. See: https://packetstormsecurity.com/files/32406/xmas.txt.html + /webcart/config/clients.txt: This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web. See: https://packetstormsecurity.com/files/32406/xmas.txt.html + /webcart/orders/import.txt: This may allow attackers to read credit card data. Reconfigure to make this file not accessible via the web. See: https://packetstormsecurity.com/files/32406/xmas.txt.html
# 新增测试用户test $ sudo useradd test # 将test用户的密码设置为test $ sudo passwd test New password: Retype new password: passwd: password updated successfully # # 将密码影子表导出为hast文本，并将其他非目标用户内容删除 $ sudocat /etc/shadow > hash.txt # 执行破解 ┌──( sujx㉿kali )-[~] └─$ vim hash.txt $ john --format=crypt hash.txt Using default input encoding: UTF-8 Loaded 1 password hash ( crypt, generic crypt( 3 ) [?/64] ) Cost 1 ( algorithm [1:descrypt 2:md5crypt 3:sunmd5 4:bcrypt 5:sha256crypt 6:sha512crypt] ) is 0 for all loaded hashes Cost 2 ( algorithm specific iterations ) is 1 for all loaded hashes Will run 4 OpenMP threads Proceeding with single, rules:Single Press 'q' or Ctrl-C to abort, almost any other key for status test ( test ) # 取得test用户密码test 1g 0:00:00:00 DONE 1/3 ( 2025-02-28 17:12 ) 4. 000g/s 384. 0p/s 384. 0c/s 384. 0C/s test.. t999995 Use the "--show" option to display all of the cracked passwords reliably Session completed.
微信
