vulhub - CH4INRULZ_v1.0.1 writeup

主机来源：www.vulnhub.com

下载链接：https://www.vulnhub.com/entry/ch4inrulz-101,247/

---

准备工作：

下载.ova文件，直接双击即可安装成功

设置连接方式为NAT，攻击机器使用kali，也设置为NAT。

发现IP

刚安装的虚拟机并不知道IP地址，使用netdiscover发现IP。

简介下netdiscover的用法：

-i 指定网卡

-r 指定地址范围

root@kali:~# netdiscover -i eth0 -r 10.0.3.0/24

 Currently scanning: Finished!   |   Screen View: Unique Hosts                                              
                                                                                                            
 4 Captured ARP Req/Rep packets, from 4 hosts.   Total size: 240                                            
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 10.0.3.1        00:50:56:c0:00:08      1      60  VMware, Inc.                                             
 10.0.3.2        00:50:56:ff:6c:8b      1      60  VMware, Inc.                                             
 10.0.3.130      00:0c:29:a7:4f:85      1      60  VMware, Inc.                                             
 10.0.3.254      00:50:56:e2:86:33      1      60  VMware, Inc.                                             

发现IP为10.0.3.130。

端口发现

使用nmap进行端口扫描

root@kali:~# nmap -A -p- 10.0.3.130
Starting Nmap 7.70 ( https://nmap.org ) at 2019-03-29 15:03 CST
Nmap scan report for 10.0.3.130
Host is up (0.00062s latency).
Not shown: 65531 closed ports
PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 2.3.5
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.0.3.198
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count