vulnhub之metasploitable2

小鲤鱼不想吐泡泡了

已于 2023-06-11 00:35:14 修改

阅读量651

点赞数

文章标签：网络 tcp/ip udp

于 2023-06-11 00:33:41 首次发布

本文链接：https://blog.csdn.net/li1136594919/article/details/131148620

版权

这是台练习渗透的靶机，有各种各样的进攻路线，非常适合我这种菜鸟。

1、信息收集

1.1 扫描tcp开放端口

┌──(kali㉿kali)-[~/vulnhub/metasploitable2]
└─$ cat tcp_open_port.nmap
# Nmap 7.93 scan initiated Sat Jun 10 23:58:10 2023 as: nmap --min-rate 10000 -p- -oA tcp_open_port 192.168.62.180
Warning: 192.168.62.180 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.62.180
Host is up (0.060s latency).
Not shown: 37075 filtered tcp ports (no-response), 28436 closed tcp ports (reset)
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp open smtp
53/tcp open domain
80/tcp open http
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
512/tcp open exec
513/tcp open login
1099/tcp open rmiregistry
1524/tcp open ingreslock
3306/tcp open mysql
3632/tcp open distccd
5432/tcp open postgresql
5900/tcp open vnc
6000/tcp open X11
6697/tcp open ircs-u
8009/tcp open ajp13
8787/tcp open msgsrvr
42664/tcp open unknown
43696/tcp open unknown
44653/tcp open unknown
MAC Address: 00:0C:29:01:74:A1 (VMware)

# Nmap done at Sat Jun 10 23:59:23 2023 -- 1 IP address (1 host up) scanned in 72.52 seconds

2.2 扫描udp开放端口

┌──(kali㉿kali)-[~/vulnhub/metasploitable2]
└─$ cat udp_open_port.nmap
# Nmap 7.93 scan initiated Sat Jun 10 23:59:23 2023 as: nmap -sU --min-rate 10000 -p- -oA udp_open_port 192.168.62.180
Warning: 192.168.62.180 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.62.180
Host is up (0.0039s latency).
Not shown: 65451 open|filtered udp ports (no-response), 77 closed udp ports (port-unreach)
PORT STATE SERVICE
53/udp open domain
111/udp open rpcbind
137/udp open netbios-ns
2049/udp open nfs
43019/udp open unknown
52973/udp open unknown
59372/udp open unknown
MAC Address: 00:0C:29:01:74:A1 (VMware)

# Nmap done at Sun Jun 11 00:00:36 2023 -- 1 IP address (1 host up) scanned in 72.89 seconds

2.3 扫描开放端口服务及其版本版本、nmap默认脚本扫描

──(kali㉿kali)-[~/vulnhub/metasploitable2]
└─$ cat open_port_service.nmap
# Nmap 7.93 scan initiated Sun Jun 11 00:00:43 2023 as: nmap -sT -sV -O -sC -p21,22,23,25,53,80,111,139,445,512,513,1099,1524,3306,3632,5432,5900,6000,6697,8009,8787,42664,43696,44653, -oA open_port_service 1
92.168.62.180
Nmap scan report for 192.168.62.180
Host is up (0.013s latency).

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst:
| STAT:
| FTP server status:
| Connected to 192.168.62.156
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| vsFTPd 2.3.4 - secure, fast, stable
|_End of status
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey:
| 1024 600fcfe1c05f6a74d69024fac4d56ccd (DSA)
|_ 2048 5656240f211ddea72bae61b1243de8f3 (RSA)
23/tcp open telnet Linux telnetd
25/tcp open smtp Postfix smtpd
| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Not valid before: 2010-03-17T14:07:45
|_Not valid after: 2010-04-16T14:07:45
| sslv2:
| SSLv2 supported
| ciphers:
| SSL2_RC4_128_EXPORT40_WITH_MD5
| SSL2_DES_64_CBC_WITH_MD5
| SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
| SSL2_DES_192_EDE3_CBC_WITH_MD5
| SSL2_RC4_128_WITH_MD5
|_ SSL2_RC2_128_CBC_WITH_MD5
|_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN
|_ssl-date: 2023-06-10T16:04:06+00:00; -4s from scanner time.
53/tcp open domain ISC BIND 9.4.2
| dns-nsid:
|_ bind.version: 9.4.2
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)
|_http-title: Metasploitable2 - Linux
|_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100000 2 111/udp rpcbind
| 100003 2,3,4 2049/tcp nfs
| 100003 2,3,4 2049/udp nfs
| 100005 1,2,3 43696/tcp mountd
| 100005 1,2,3 59372/udp mountd
| 100021 1,3,4 34773/tcp nlockmgr
| 100021 1,3,4 43019/udp nlockmgr
| 100024 1 42664/tcp status
|_ 100024 1 52973/udp status
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
512/tcp open exec netkit-rsh rexecd
513/tcp open login OpenBSD or Solaris rlogind
1099/tcp open java-rmi GNU Classpath grmiregistry
1524/tcp open bindshell Metasploitable root shell
3306/tcp open mysql MySQL 5.0.51a-3ubuntu5
| mysql-info:
| Protocol: 10
| Version: 5.0.51a-3ubuntu5
| Thread ID: 16
| Capabilities flags: 43564
| Some Capabilities: Support41Auth, LongColumnFlag, SupportsTransactions, ConnectWithDatabase, SwitchToSSLAfterHandshake, SupportsCompression, Speaks41ProtocolNew
| Status: Autocommit
|_ Salt: H_'ARZNWJL|OU>sJX]G.
3632/tcp open distccd distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
5432/tcp open postgresql PostgreSQL DB 8.3.0 - 8.3.7
| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Not valid before: 2010-03-17T14:07:45
|_Not valid after: 2010-04-16T14:07:45
|_ssl-date: 2023-06-10T16:04:07+00:00; -4s from scanner time.
5900/tcp open vnc VNC (protocol 3.3)
| vnc-info:
| Protocol version: 3.3
| Security types:
|_ VNC Authentication (2)
6000/tcp open X11 (access denied)
6697/tcp open irc UnrealIRCd
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
|_ajp-methods: Failed to get a valid response for the OPTION request
8787/tcp open drb Ruby DRb RMI (Ruby 1.8; path /usr/lib/ruby/1.8/drb)
42664/tcp open status 1 (RPC #100024)

43696/tcp open mountd 1-3 (RPC #100005)
44653/tcp open java-rmi GNU Classpath grmiregistry
MAC Address: 00:0C:29:01:74:A1 (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop
Service Info: Hosts: metasploitable.localdomain, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Jun 11 00:04:11 2023 -- 1 IP address (1 host up) scanned in 213.37 seconds

2.4 80端口目录爆破

┌──(kali㉿kali)-[~/vulnhub/metasploitable2]
└─$ cat web_scan.txt
/index (Status: 200) [Size: 891]
/test (Status: 301) [Size: 320] [--> http://192.168.62.180/test/]
/twiki (Status: 301) [Size: 321] [--> http://192.168.62.180/twiki/]
/tikiwiki (Status: 301) [Size: 324] [--> http://192.168.62.180/tikiwiki/]
/phpinfo (Status: 200) [Size: 48008]
/server-status (Status: 403) [Size: 300]
/phpMyAdmin (Status: 301) [Size: 326] [--> http://192.168.62.180/phpMyAdmin/]