nmap --min-rate=10000 -p- 10.10.237.69 Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-26 15:18 UTC Nmap scan report for ip-10-10-149-178.eu-west-1.compute.internal (10.10.237.69) Host is up (0.011s latency). Not shown: 65510 filtered tcp ports (no-response), 19 filtered tcp ports (host-prohibited) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http 139/tcp open netbios-ssn 443/tcp open https 445/tcp open microsoft-ds MAC Address: 02:A4:78:F1:74:81 (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 13.42 seconds
nmap -sV -sT -sC -O -p21,22,80,139,443,445 10.10.237.69 Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-26 15:20 UTC Nmap scan report for ip-10-10-149-178.eu-west-1.compute.internal (10.10.237.69) Host is up (0.00052s latency).
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.2 | ftp-syst: | STAT: | FTP server status: | Connected to ::ffff:10.10.171.240 | Logged in as ftp | TYPE: ASCII | No session bandwidth limit | Session timeout in seconds is 300 | Control connection is plain text | Data connections will be plain text | At session startup, client count was 2 | vsFTPd 3.0.2 - secure, fast, stable |_End of status | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_drwxr-xr-x 2 0 0 6 Jun 09 2021 pub 22/tcp open ssh OpenSSH 7.4 (protocol 2.0) | ssh-hostkey: | 2048 092362a2186283690440623297ff3ccd (RSA) | 256 33663536b0680632c18af601bc4338ce (ECDSA) |_ 256 1498e3847055e6600cc20977f8b7a61c (ED25519) 80/tcp open http Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips) |_http-title: Apache HTTP Server Test Page powered by CentOS | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 443/tcp open ssl/http Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips) | http-methods: |_ Potentially risky methods: TRACE |_http-title: Apache HTTP Server Test Page powered by CentOS | ssl-cert: Subject: commonName=aratus/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=-- | Not valid before: 2021-11-23T12:28:26 |_Not valid after: 2022-11-23T12:28:26 |_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips |_ssl-date: TLS randomness does not represent time 445/tcp open netbios-ssn Samba smbd 4.10.16 (workgroup: WORKGROUP) MAC Address: 02:A4:78:F1:74:81 (Unknown) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|specialized Running (JUST GUESSING): Linux 3.X (98%), Crestron 2-Series (90%) OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:crestron:2_series Aggressive OS guesses: Linux 3.10 - 3.13 (98%), Linux 3.8 (92%), Crestron XPanel control system (90%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: Host: ARATUS; OS: Unix
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 27.49 seconds
Getshell
能够匿名登录，有一个pub目录但是里面是空的
enum4linux得到一个共享目录
print$ Disk Printer Drivers
temporary share Disk
smbclient //10.10.237.69/'temporary share' Password for [WORKGROUP\mikannse]: Anonymous login successful Try "help" to get a list of possible commands. smb: \> ls . D 0 Mon Jan 10 13:06:44 2022 .. D 0 Tue Nov 23 16:24:05 2021 .bash_logout H 18 Wed Apr 1 02:17:30 2020 .bash_profile H 193 Wed Apr 1 02:17:30 2020 .bashrc H 231 Wed Apr 1 02:17:30 2020 .bash_history H 0 Sun Mar 17 14:01:57 2024 chapter1 D 0 Tue Nov 23 10:07:47 2021 chapter2 D 0 Tue Nov 23 10:08:11 2021 chapter3 D 0 Tue Nov 23 10:08:18 2021 chapter4 D 0 Tue Nov 23 10:08:25 2021 chapter5 D 0 Tue Nov 23 10:08:33 2021 chapter6 D 0 Tue Nov 23 10:12:24 2021 chapter7 D 0 Tue Nov 23 11:14:27 2021 chapter8 D 0 Tue Nov 23 10:12:45 2021 chapter9 D 0 Tue Nov 23 10:12:53 2021 .ssh DH 0 Mon Jan 10 13:05:34 2022 .viminfo H 0 Sun Mar 17 14:01:57 2024 message-to-simeon.txt N 251 Mon Jan 10 13:06:44 2022
37726212 blocks of size 1024. 35598260 blocks available
有一张纸条
Simeon,
Stop messing with your home directory, you are moving files and directories insecurely! Just make a folder in /opt for your book project...
Also you password is insecure, could you please change it? It is all over the place now!
