渗透测试演练 DC-6

DC-6

---

author：leadlife

data：2023/5/17

blog：https://tripse.github.io/

本次测试使用到的工具如下：

• 信息收集：nmap、fscan、cmseek、searchsploit、ffuf、burpsuite
• SHELL：MSF、netcat
• 内部信息收集：无
• 权限提升：无

外部信息收集

Nmap ICMP 扫描发现主机

本次测试靶机 IP：10.10.10.135

sudo nmap -sP 10.10.10.0/24 -T4 --min-rate 10000

Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-17 03:10 CST
Nmap scan report for 10.10.10.135
Host is up (0.00020s latency).
MAC Address: 08:00:27:D7:63:00 (Oracle VirtualBox virtual NIC)
Nmap scan report for 10.10.10.254
Host is up (0.00019s latency).
MAC Address: 00:50:56:FE:A1:CD (VMware)
Nmap scan report for 10.10.10.1
Host is up.
Nmap done: 256 IP addresses (3 hosts up) scanned in 0.36 seconds

Fsacn 探测开放端口

sudo fscan -h 10.10.10.135 -p 0-65535 -t 30

   ___                              _
  / _ \     ___  ___ _ __ __ _  ___| | __
 / /_\/____/ __|/ __| '__/ _` |/ __| |/ /
/ /_\\_____\__ \ (__| | | (_| | (__|   <
\____/     |___/\___|_|  \__,_|\___|_|\_\
                     fscan version: 1.8.1
start infoscan
(icmp) Target 10.10.10.135    is alive
[*] Icmp alive hosts len is: 1
10.10.10.135:22 open
10.10.10.135:80 open
[*] alive ports len is: 2
start vulscan
[*] WebTitle: http://10.10.10.135       code:301 len:0      title:None 跳转url: http://wordy/

Nmap 进行详细端口扫描

sudo nmap -sS -sC -sV -O -T4 --min