Dr4g0nB4ll

1.寻找 ip

ip a

我的电脑 kali 虚拟机地址一般就是

192.168.35.136/24

查看目前端口：ping 探测

sudo nmap -sn 192.168.35.0/24

找到靶机地址

192.168.35.140

对其进行端口扫描

sudo nmap -sT --min-rate 10000 -p- 192.168.35.140 -oA ports

                                                                                                                                                            
┌──(kali㉿kali)-[~]
└─$ sudo nmap -sT --min-rate 10000 -p- 192.168.35.140 -oA ports 
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-30 22:31 -0400
Nmap scan report for 192.168.35.140
Host is up (0.0016s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 00:0C:29:8B:74:81 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 10.51 seconds

开放了 ssh 和 http 一共 22 和 80 两个端口

2.扫描详细 TCP 端口

sudo nmap -sT -sV -sC -O -p22,80 192.168.35.140 -oA detail

Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-30 22:36 -0400
Nmap scan report for 192.168.35.140
Host is up (0.0010s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 b5:77:4c:88:d7:27:54:1c:56:1d:48:d9:a4:1e:28:91 (RSA)
|   256 c6:a8:c8:9e:ed:0d:67:1f:ae:ad:6b:d5:dd:f1:57:a1 (ECDSA)
|_  256 fa:a9:b0:e3:06:2b:92:63:ba:11:2f:94:d6:31:90:b2 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: DRAGON BALL | Aj's
|_http-server-header: Apache/2.4.38 (Debian)
MAC Address: 00:0C:29:8B:74:81 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4)
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.60 seconds

3.扫描 UDP 端口

sudo nmap -sU --top-ports 20 192.168.35.140 -oA udp

Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-30 22:42 -0400
Nmap scan report for 192.168.35.140
Host is up (0.0017s latency).

PORT      STATE         SERVICE
53/udp    closed        domain
67/udp    closed        dhcps
68/udp    open|filtered dhcpc
69/udp    closed        tftp
123/udp   closed        ntp
135/udp   closed        msrpc
137/udp   closed        netbios-ns
138/udp   closed        netbios-dgm
139/udp   closed        netbios-ssn
161/udp   closed        snmp
162/udp   closed        snmptrap
445/udp   closed        microsoft-ds
500/udp   closed        isakmp
514/udp   closed        syslog
520/udp   closed        route
631/udp   closed        ipp
1434/udp  closed        ms-sql-m
1900/udp  closed        upnp
4500/udp  closed        nat-t-ike
49152/udp closed        unknown
MAC Address: 00:0C:29:8B:74:81 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 19.26 seconds

基本都是 closed 状态，说明攻击点是在 TCP 方面

4. 漏洞扫描

sudo nmap --script=vuln -p22,80 192.168.35.140 -oA vuln

Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-30 22:51 -0400
Nmap scan report for 192.168.35.140
Host is up (0.00095s latency).

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| http-enum: 
|_  /robots.txt: Robots file
MAC Address: 00:0C:29:8B:74:81 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 32.19 seconds

我们发现了一个文件Robots. Txt，访问该页面可以得到一个 base 64 编码，解出来结果是

进行目录扫描

sudo gobuster dir -u http://192.168.35.140 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x txt,php,html

===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.35.140
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Extensions:              txt,php,html
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index.html           (Status: 200) [Size: 4355]
robots.txt           (Status: 200) [Size: 33]
server-status        (Status: 403) [Size: 279]
Progress: 882232 / 882232 (100.00%)
===============================================================
Finished
===============================================================

扫出 index. Html，robots. Txt。
根据上面的 base 64 解密结果，应该是有隐藏页面的
访问 index. Html
查看源码的时候发现有个奇怪的东西