《VulnHub》Lampião：1

---

title: 《VulnHub》Lampião：1
date: 2024-03-28 21:37:49
updated: 2024-03-28 21:37:50
categories: WriteUp：Cyber-Range
excerpt: 关键技术：主机发现，端口扫描、服务探测、操作系统探测，对开放的端口探测漏洞，dirb 爆破网站目录，cewl 创建社工密码字典，hydra 破解 ssh 密钥，使用 sh 脚本检测 Linux 系统的安全缺陷，在目录下开启简单 http 服务，40847 DirtyCow 利用。
comments: false
tags:
top_image: /images/backimg/SunsetClimbing.png

---

---

VulnHub 打靶记录。
VulnHub 官网：https://www.vulnhub.com

攻击机为 Kali-Linux-2023.3-vmware-amd64。
Kali NAT IP：192.168.8.15。

1：靶场信息

靶场地址：
https://www.vulnhub.com/entry/lampiao-1,249/

2：打靶

2.1：情报收集 & 威胁建模

主机发现：
nmap -sn 192.168.8.0/24

确定目标 IP 为 192.168.8.139。

进行端口扫描、服务探测、操作系统探测：
nmap 192.168.8.139 -p- -sV -sC -O

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-10 15:23 HKT
Nmap scan report for 192.168.8.139
Host is up (0.00076s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 46:b1:99:60:7d:81:69:3c:ae:1f:c7:ff:c3:66:e3:10 (DSA)
|   2048 f3:e8:88:f2:2d:d0:b2:54:0b:9c:ad:61:33:59:55:93 (RSA)
|   256 ce:63:2a:f7:53:6e:46:e2:ae:81:e3:ff:b7:16:f4:52 (ECDSA)
|_  256 c6:55:ca:07:37:65:e3:06:c1:d6:5b:77:dc:23:df:cc (ED25519)
80/tcp   open  http?
1898/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-generator: Drupal 7 (http://drupal.org)
|_http-title: Lampi\xC3\xA3o
| http-robots.txt: 36 disallowed entries (15 shown)
| /includes/ /misc/ /modules/ /profiles/ /scripts/ 
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt 
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt 
|_/LICENSE.txt /MAINTAINERS.txt
MAC Address: 00:0C:29:3E:06:9F (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linu