Vulnhub靶场 Metasploitable: 1 练习（上）

RrEeSsEeTt

已于 2024-11-07 13:57:30 修改

阅读量1.1k

点赞数 25

分类专栏： Web安全学习 Vulnhub靶场 Linux 文章标签：渗透测试网络安全 web安全弱口令 tomcat MSF kali

于 2024-11-07 13:56:06 首次发布

本文链接：https://blog.csdn.net/weixin_39762423/article/details/143591681

版权

0x00 准备

下载链接：https://download.vulnhub.com/metasploitable/Metasploitable.zip

介绍：Metasploitable is an Ubuntu 8.04 server install on a VMWare 6.5 image.This section is for various information that has been collected about the release, such as quotes from the webpage and/or the readme file.These sources of information are usually helpful towards the completion of the release as the author can drop hints* as well as methods to help get the release up and working.*** This is a ‘little’ hint**. Useful to help you get started and it shouldn’t give anything away that you quickly could find out for yourself.

环境搭建：
下载后解压出来，不是ova文件，是一些vmx等虚拟机文件。所以导入方式和DC系列的不一样。
对于ova文件，直接导入现有虚拟机就可以。
对于提供vmx等虚拟机文件的情况，就需要自己创建虚拟机，上面的描述中说明了这个靶场是基于Ubuntu 8.04 ，创建虚拟机的时候注意这个系统版本就可以了，选择虚拟磁盘的时候选择使用现有虚拟磁盘：
在这里插入图片描述

网络模式选择桥接。

0x01 主机信息收集

kali的ip：192.168.119.128，eth0

探测靶机ip，执行命令：netdiscover -i eth0 -r 192.168.22.0/24

目标主机的IP：192.168.119.131

探测目标主机的开放端口以及服务：nmap -sV -p 1-65535 -A 192.168.119.131

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-04 09:56 CST
Nmap scan report for 192.168.119.131
Host is up (0.0012s latency).
Not shown: 65522 closed tcp ports (reset)
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         ProFTPD 1.3.1
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
23/tcp   open  telnet      Linux telnetd
25/tcp   open  smtp        Postfix smtpd
| sslv2: 
|   SSLv2 supported
|   ciphers: 
|     SSL2_RC4_128_WITH_MD5
|     SSL2_DES_64_CBC_WITH_MD5
|     SSL2_DES_192_EDE3_CBC_WITH_MD5
|     SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
|     SSL2_RC2_128_CBC_WITH_MD5
|_    SSL2_RC4_128_EXPORT40_WITH_MD5
|_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN
|_ssl-date: 2024-11-04T01:56:58+00:00; +2s from scanner time.
| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName&