nmap --min-rate=10000 -p- debug.thm Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-27 11:24 UTC Nmap scan report for debug.thm (10.10.2.3) Host is up (0.0060s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http MAC Address: 02:39:10:22:A6:7F (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 3.45 seconds
nmap -sC -sT -sV -O -p22,80 debug.thm Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-27 11:25 UTC Nmap scan report for debug.thm (10.10.2.3) Host is up (0.00040s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 44ee1eba072a5469ff11e349d7dba901 (RSA) | 256 8b2a8fd8409533d5fa7a406a7f29e403 (ECDSA) |_ 256 6559e4402ac2d70577b3af60dacdfc67 (ED25519) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Apache2 Ubuntu Default Page: It works MAC Address: 02:39:10:22:A6:7F (Unknown) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Aggressive OS guesses: Linux 3.10 - 3.13 (99%), Linux 3.8 (96%), ASUS RT-N56U WAP (Linux 3.4) (95%), Linux 3.16 (95%), Linux 3.1 (93%), Linux 3.2 (93%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (92%), Linux 3.10 (92%), Linux 3.12 (92%), Linux 3.19 (92%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 10.42 seconds
Getshell
访问80端口，是一个apache的默认界面，扫描目录
feroxbuster -u http://debug.thm/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x .php,zip,txt,sql,bak,db,rar ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.10.2 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://debug.thm/ 🚀 Threads │ 50 📖 Wordlist │ /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt 👌 Status Codes │ All Status Codes! 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.10.2 💉 Config File │ /etc/feroxbuster/ferox-config.toml 🔎 Extract Links │ true 💲 Extensions │ [php, zip, txt, sql, bak, db, rar] 🏁 HTTP methods │ [GET] 🔃 Recursion Depth │ 4 ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── 403 GET 9l 28w 274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 404 GET 9l 31w 271c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter 200 GET 15l 74w 6143c http://debug.thm/icons/ubuntu-logo.png 200 GET 375l 968w 11321c http://debug.thm/ 200 GET 31l 109w 4091c http://debug.thm/javascripts/default.js 200 GET 574l 1271w 10371c http://debug.thm/style.css 200 GET 204l 469w 5732c http://debug.thm/index.php 301 GET 9l 28w 311c http://debug.thm/javascript => http://debug.thm/javascript/ 200 GET 2l 20w 94c http://debug.thm/message.txt 301 GET 9l 28w 307c http://debug.thm/backup => http://debug.thm/backup/ 200 GET 574l 1271w 10371c http://debug.thm/backup/style.css 200 GET 375l 968w 11321c http://debug.thm/backup/index.html.bak 200 GET 239l 563w 6399c http://debug.thm/backup/index.php.bak 200 GET 42l 374w 2339c http://debug.thm/backup/readme.md 200 GET 31l 109w 4091c http://debug.thm/backup/javascripts/default.js 200 GET 31l 80w 1112c http://debug.thm/backup/less/mixins.less 200 GET 585l 1455w 12659c http://debug.thm/backup/less/style.less 200 GET 3404l 5575w 2221967c http://debug.thm/backup/grid/base-grid.psd 301 GET 9l 28w 305c http://debug.thm/grid => http://debug.thm/grid/ 200 GET 3404l 5575w 2221967c http://debug.thm/grid/base-grid.psd 301 GET 9l 28w 305c http://debug.thm/less => http://debug.thm/less/ 200 GET 585l 1455w 12659c http://debug.thm/less/style.less 200 GET 31l 80w 1112c http://debug.thm/less/mixins.less 301 GET 9l 28w 312c http://debug.thm/javascripts => http://debug.thm/javascripts/ [#####>--------------] - 18m 961218/3528992 36m found:22 errors:217 🚨 Caught ctrl+c 🚨 saving scan state to ferox-http_debug_thm_-1711540027.state ... [#####>--------------] - 18m 961253/3528992 36m found:22 errors:217 [#####>--------------] - 18m 517088/1764368 475/s http://debug.thm/ [####################] - 0s 1764368/1764368 441092000/s http://debug.thm/javascripts/ => Directory listing [#####>--------------] - 18m 444424/1764368 409/s http://debug.thm/javascript/ [####################] - 0s 1764368/1764368 11310051/s http://debug.thm/backup/ => Directory listing [####################] - 0s 1764368/1764368 26732848/s http://debug.thm/backup/less/ => Directory listing [####################] - 0s 1764368/1764368 35287360/s http://debug.thm/backup/javascripts/ => Directory listing [####################] - 0s 1764368/1764368 3600751/s http://debug.thm/backup/grid/ => Directory listing [####################] - 1s 1764368/1764368 3042014/s http://debug.thm/grid/ => Directory listing [####################] - 0s 1764368/1764368 20280092/s http://debug.thm/less/ => Directory listing [--------------------] - 0s 0/1764368 - http://debug.thm/icons/ubuntu-logo.png
有一个/bakcup目录，在里面能得到index.php的源码备份
<?php
class FormSubmit {
public $form_file = 'message.txt'; public $message = '';
