sudo nmap --min-rate 10000 -p- 192.168.56.121 [sudo] mikannse 的密码： Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-20 04:54 UTC Nmap scan report for 192.168.56.121 (192.168.56.121) Host is up (0.00010s latency). Not shown: 65524 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http 111/tcp open rpcbind 443/tcp open https 2049/tcp open nfs 3306/tcp open mysql 38977/tcp open unknown 42677/tcp open unknown 51475/tcp open unknown 60049/tcp open unknown MAC Address: 08:00:27:22:E0:5D (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 3.35 seconds
sudo nmap -sT -sV -sC -O -p21,22,80,111,443,2049,3306,38977,42677,51475,60049 192.168.56.121 Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-20 04:55 UTC Nmap scan report for 192.168.56.121 (192.168.56.121) Host is up (0.00037s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 ee:01:82:dc:7a:00:0e:0e:fc:d9:08:ca:d8:7e:e5:2e (RSA) | 256 44:af:47:d8:9f:ea:ae:3e:9f:aa:ec:1d:fb:22:aa:0f (ECDSA) |_ 256 6a:fb:b4:13:64:df:6e:75:b2:b9:4e:f1:92:97:72:30 (ED25519) 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-server-header: Apache/2.4.38 (Debian) |_http-title: Apache2 Debian Default Page: It works 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 3,4 111/tcp6 rpcbind | 100000 3,4 111/udp6 rpcbind | 100003 3 2049/udp nfs | 100003 3 2049/udp6 nfs | 100003 3,4 2049/tcp nfs | 100003 3,4 2049/tcp6 nfs | 100005 1,2,3 32792/udp mountd | 100005 1,2,3 37729/tcp6 mountd | 100005 1,2,3 51475/tcp mountd | 100005 1,2,3 53279/udp6 mountd | 100021 1,3,4 35971/udp nlockmgr | 100021 1,3,4 37273/tcp6 nlockmgr | 100021 1,3,4 38977/tcp nlockmgr | 100021 1,3,4 60334/udp6 nlockmgr | 100227 3 2049/tcp nfs_acl | 100227 3 2049/tcp6 nfs_acl | 100227 3 2049/udp nfs_acl |_ 100227 3 2049/udp6 nfs_acl 443/tcp open http Apache httpd 2.4.38 |_http-server-header: Apache/2.4.38 (Debian) |_http-title: Apache2 Debian Default Page: It works 2049/tcp open nfs 3-4 (RPC #100003) 3306/tcp open mysql MySQL 5.5.5-10.3.27-MariaDB-0+deb10u1 | mysql-info: | Protocol: 10 | Version: 5.5.5-10.3.27-MariaDB-0+deb10u1 | Thread ID: 89 | Capabilities flags: 63486 | Some Capabilities: SupportsLoadDataLocal, DontAllowDatabaseTableColumn, Speaks41ProtocolNew, SupportsCompression, LongColumnFlag, InteractiveClient, ConnectWithDatabase, Support41Auth, ODBCClient, SupportsTransactions, IgnoreSigpipes, Speaks41ProtocolOld, IgnoreSpaceBeforeParenthesis, FoundRows, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins | Status: Autocommit | Salt: YTy&N5^X"=NP'nu&Wcm{ |_ Auth Plugin Name: mysql_native_password 38977/tcp open nlockmgr 1-4 (RPC #100021) 42677/tcp open mountd 1-3 (RPC #100005) 51475/tcp open mountd 1-3 (RPC #100005) 60049/tcp open mountd 1-3 (RPC #100005) MAC Address: 08:00:27:22:E0:5D (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 5.X OS CPE: cpe:/o:linux:linux_kernel:5 OS details: Linux 5.0 - 5.5 Network Distance: 1 hop Service Info: Host: 127.0.1.1; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 12.95 seconds
信息搜集
ftp没有匿名登录，看下NFS
showmount -e 192.168.56.121 Export list for 192.168.56.121: /images/dev * /images *
sudo mkdir /tmp/kalinfs
sudo mount -t nfs 192.168.56.121:/images/dev /tmp/kalinfs
