sudo nmap --min-rate 10000 -p- 192.168.56.106 Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-06 06:32 UTC Nmap scan report for 192.168.56.106 (192.168.56.106) Host is up (0.00029s latency). Not shown: 65529 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 80/tcp open http 110/tcp open pop3 119/tcp open nntp 995/tcp open pop3s MAC Address: 08:00:27:18:54:B8 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 2.52 seconds
sudo nmap -sT -sV -sC -O -p22,25,80,110,119,995 192.168.56.106 Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-06 06:32 UTC Nmap scan report for 192.168.56.106 (192.168.56.106) Host is up (0.00031s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 f0:f4:7d:ad:5d:2a:25:ec:17:b5:62:b0:2e:a5:8d:4f (RSA) | 256 f1:d8:01:07:9f:d7:8d:2e:da:a4:9f:36:a2:ff:2a:df (ECDSA) |_ 256 91:02:29:33:c5:ff:2d:d8:63:b8:47:f3:f3:d8:79:ac (ED25519) 25/tcp open smtp Postfix smtpd | ssl-cert: Subject: commonName=perlman | Subject Alternative Name: DNS:perlman | Not valid before: 2022-07-02T10:12:39 |_Not valid after: 2032-06-29T10:12:39 |_smtp-commands: perlman.hmv, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, SMTPUTF8, CHUNKING |_ssl-date: TLS randomness does not represent time 80/tcp open http Apache httpd 2.4.54 ((Debian)) |_http-server-header: Apache/2.4.54 (Debian) | http-git: | 192.168.56.106:80/.git/ | Git repository found! | Repository description: Unnamed repository; edit this file 'description' to name the... |_ Last commit message: wp |_http-title: Sync - Mobile App Landing Page HTML Template 110/tcp open pop3 Dovecot pop3d |_pop3-capabilities: TOP UIDL RESP-CODES USER SASL(PLAIN) PIPELINING AUTH-RESP-CODE STLS CAPA |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=perlman | Subject Alternative Name: DNS:perlman | Not valid before: 2022-07-02T10:12:39 |_Not valid after: 2032-06-29T10:12:39 119/tcp open nntp InterNetNews (INN) 2.6.4 995/tcp open ssl/pop3 Dovecot pop3d |_pop3-capabilities: TOP SASL(PLAIN) PIPELINING UIDL RESP-CODES AUTH-RESP-CODE USER CAPA |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=perlman | Subject Alternative Name: DNS:perlman | Not valid before: 2022-07-02T10:12:39 |_Not valid after: 2032-06-29T10:12:39 MAC Address: 08:00:27:18:54:B8 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: Hosts: perlman.hmv, server.example.net; OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 16.07 seconds
sudo nmap --script=vuln -p22,25,80,110,119,995 192.168.56.106 Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-06 06:38 UTC Nmap scan report for 192.168.56.106 (192.168.56.106) Host is up (0.00025s latency).
PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp | ssl-dh-params: | VULNERABLE: | Anonymous Diffie-Hellman Key Exchange MitM Vulnerability | State: VULNERABLE | Transport Layer Security (TLS) services that use anonymous | Diffie-Hellman key exchange only provide protection against passive | eavesdropping, and are vulnerable to active man-in-the-middle attacks | which could completely compromise the confidentiality and integrity | of any data exchanged over the resulting session. | Check results: | ANONYMOUS DH GROUP 1 | Cipher Suite: TLS_DH_anon_WITH_SEED_CBC_SHA | Modulus Type: Safe prime | Modulus Source: Unknown/Custom-generated | Modulus Length: 2048 | Generator Length: 8 | Public Key Length: 2048 | References: |_ https://www.ietf.org/rfc/rfc2246.txt | smtp-vuln-cve2010-4344: |_ The SMTP server is not Exim: NOT VULNERABLE 80/tcp open http | http-git: | 192.168.56.106:80/.git/ | Git repository found! | Repository description: Unnamed repository; edit this file 'description' to name the... |_ Last commit message: wp |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-internal-ip-disclosure: ERROR: Script execution failed (use -d to debug) |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-csrf: Couldn't find any CSRF vulnerabilities. | http-enum: | /.git/HEAD: Git folder | /css/: Potentially interesting directory w/ listing on 'apache/2.4.54 (debian)' | /images/: Potentially interesting directory w/ listing on 'apache/2.4.54 (debian)' |_ /js/: Potentially interesting directory w/ listing on 'apache/2.4.54 (debian)' 110/tcp open pop3 119/tcp open nntp 995/tcp open pop3s MAC Address: 08:00:27:18:54:B8 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 32.07 seconds
telnet perlman.hmv 110 Trying 192.168.56.106... Connected to 192.168.56.106. Escape character is '^]'. +OK Dovecot (Debian) ready. USER rita +OK PASS cookie +OK Logged in.
但是LIST发现0封邮件。。。
看WP的操作是需要以rita的身份发邮件来获得邮件
nc -v perlman.hmv 25 perlman.hmv [192.168.56.106] 25 (smtp) open 220 perlman.hmv ESMTP Postfix (Debian/GNU) EHLO perlman.hmv 250-perlman.hmv 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING VRFY rita 252 2.0.0 rita MAIL FROM:<rita> 250 2.1.0 Ok RCPT TO:non_existent_user0123456789@gmail.com 250 2.1.5 Ok data 354 End data with <CR><LF>.<CR><LF> Hello . 250 2.0.0 Ok: queued as 5B8044162C quit 221 2.0.0 Bye
