HexBlog

0%

靶场8

发表于 更新于 分类于

靶场八

看网页源代码,得到flag1flag1{Q0lBIC0gT3BlcmF0aW9uIFRyZWFkc3RvbmU=}

解码得到CIA – Operation Treadstone cwel 爬取字典https://bourne.fandom.com/wiki/Operation_Treadstone

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
# root @ Divint3 in /home/divint3 [21:12:08] C:130
$ dirb http://172.17.135.8/ -S 

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Fri May 31 21:12:11 2019
URL_BASE: http://172.17.135.8/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt
OPTION: Silent Mode

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://172.17.135.8/ ----
==> DIRECTORY: http://172.17.135.8/admin/
==> DIRECTORY: http://172.17.135.8/css/
==> DIRECTORY: http://172.17.135.8/db/
==> DIRECTORY: http://172.17.135.8/dist/
+ http://172.17.135.8/index.php (CODE:200|SIZE:2433)
+ http://172.17.135.8/server-status (CODE:403|SIZE:292)
==> DIRECTORY: http://172.17.135.8/squirrelmail/
==> DIRECTORY: http://172.17.135.8/supplier/
==> DIRECTORY: http://172.17.135.8/upload/
==> DIRECTORY: http://172.17.135.8/user/
==> DIRECTORY: http://172.17.135.8/vendor/

nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# root @ Divint3 in /home/divint3 [21:49:01] 
$ nmap 172.17.135.8 -Pn -sS                        

Starting Nmap 7.40 ( https://nmap.org ) at 2019-05-31 22:00 CST
Nmap scan report for 172.17.135.8
Host is up (0.0021s latency).
Not shown: 993 filtered ports
PORT    STATE SERVICE
21/tcp  open  ftp
22/tcp  open  ssh
80/tcp  open  http
110/tcp open  pop3
143/tcp open  imap
993/tcp open  imaps
995/tcp open  pop3s

Nmap done: 1 IP address (1 host up) scanned in 20.90 seconds

# root @ Divint3 in /home/divint3 [21:14:25] C:130
$ nmap 172.17.135.8 -A -O -sS

Starting Nmap 7.40 ( https://nmap.org ) at 2019-05-31 21:14 CST
Nmap scan report for 172.17.135.8
Host is up (0.0020s latency).
Not shown: 993 filtered ports
PORT    STATE SERVICE  VERSION
21/tcp  open  ftp      vsftpd 3.0.2
22/tcp  open  ssh      OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 a9:98:84:aa:90:7e:f1:e6:be:c0:84:3e:fa:aa:83:8a (DSA)
|   2048 07:5c:77:15:30:5a:17:95:8e:0f:91:f0:2d:0b:c3:7a (RSA)
|_  256 2f:9c:29:b5:f5:dc:f4:95:07:6d:41:ee:f9:0d:15:b8 (ECDSA)
80/tcp  open  http     Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: BlackMarket Weapon Management System
110/tcp open  pop3     Dovecot pop3d
|_pop3-capabilities: AUTH-RESP-CODE SASL STLS PIPELINING RESP-CODES UIDL CAPA TOP
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2017-11-01T07:05:35
|_Not valid after:  2027-11-01T07:05:35
|_ssl-date: TLS randomness does not represent time
143/tcp open  imap     Dovecot imapd (Ubuntu)
|_imap-capabilities: listed OK IDLE more ID ENABLE LOGIN-REFERRALS LITERAL+ STARTTLS post-login capabilities SASL-IR Pre-login LOGINDISABLEDA0001 have IMAP4rev1
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2017-11-01T07:05:35
|_Not valid after:  2027-11-01T07:05:35
|_ssl-date: TLS randomness does not represent time
993/tcp open  ssl/imap Dovecot imapd (Ubuntu)
|_imap-capabilities: listed OK IDLE IMAP4rev1 AUTH=PLAINA0001 LOGIN-REFERRALS LITERAL+ post-login more ID SASL-IR capabilities Pre-login have ENABLE
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2017-11-01T07:05:35
|_Not valid after:  2027-11-01T07:05:35
|_ssl-date: TLS randomness does not represent time
995/tcp open  ssl/pop3 Dovecot pop3d
|_pop3-capabilities: AUTH-RESP-CODE SASL(PLAIN) USER PIPELINING RESP-CODES UIDL CAPA TOP
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2017-11-01T07:05:35
|_Not valid after:  2027-11-01T07:05:35
|_ssl-date: TLS randomness does not represent time
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.10 - 4.2, Linux 3.16 - 4.6, Linux 3.2 - 4.6, Linux 4.4
Network Distance: 3 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT     ADDRESS
1   ...
2   5.15 ms bogon (192.168.230.30)
3   3.27 ms 172.17.135.8

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 26.36 seconds

配置漏洞扫描器

1
2
3
4
5
6
7
cd /usr/share/nmap/scripts/
git clone https://github.com/vulnersCom/nmap-vulners.git
git clone https://github.com/scipag/vulscan.git
cd vulscan/utilities/updater/
chmod +x updateFiles.sh
./updateFiles.sh

1
nmap --script vulscan  -sV 172.17.135.8
恰饭,恰饭