HackTheBox-多种姿势渗透beep靶机

最新推荐文章于 2022-11-09 01:59:01 发布

fHack1r

最新推荐文章于 2022-11-09 01:59:01 发布

阅读量347

点赞数

分类专栏：靶机测试文章标签：渗透测试

本文链接：https://blog.csdn.net/weixin_43111940/article/details/115873260

版权

本文详细介绍了渗透beep靶机的四种不同姿势，包括利用弱口令、版本漏洞、文件包含及shellshock漏洞。在姿势一中，通过SIPVicious扫描获取shell；姿势二利用CRM目录的本地文件包含，结合SMTP服务获取asterisk用户的shell；姿势三通过包含配置文件获取密码并SSH连接；姿势四利用10000端口的shellshock漏洞。文章强调了渗透过程中的思路和方法选择的重要性。

摘要由CSDN通过智能技术生成

端口信息

PORT      STATE  SERVICE    VERSION
22/tcp    open   ssh        OpenSSH 4.3 (protocol 2.0)
| ssh-hostkey: 
|   1024 ad:ee:5a:bb:69:37:fb:27:af:b8:30:72:a0:f9:6f:53 (DSA)
|_  2048 bc:c6:73:59:13:a1:8a:4b:55:07:50:f6:65:1d:6d:0d (RSA)
25/tcp    open   smtp       Postfix smtpd
|_smtp-commands: beep.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, ENHANCEDSTATUSCODES, 8BITMIME, DSN, 
80/tcp    open   http       Apache httpd 2.2.3
|_http-server-header: Apache/2.2.3 (CentOS)
|_http-title: Did not follow redirect to https://10.10.10.7/
|_https-redirect: ERROR: Script execution failed (use -d to debug)
110/tcp   open   pop3       Cyrus pop3d 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4
|_pop3-capabilities: UIDL EXPIRE(NEVER) IMPLEMENTATION(Cyrus POP3 server v2) RESP-CODES USER STLS AUTH-RESP-CODE PIPELINING TOP APOP LOGIN-DELAY(0)
111/tcp   open   rpcbind    2 (RPC #100000)
143/tcp   open   imap       Cyrus imapd 2.3.7-Invoca-RPM-2.3.7-7.el5_6.4
|_imap-capabilities: Completed ID UNSELECT ACL THREAD=ORDEREDSUBJECT LIST-SUBSCRIBED LITERAL+ RIGHTS=kxte ANNOTATEMORE URLAUTHA0001 NO IMAP4rev1 RENAME X-NETSCAPE OK CATENATE SORT CONDSTORE BINARY CHILDREN NAMESPACE LISTEXT QUOTA STARTTLS SORT=MODSEQ IDLE MULTIAPPEND IMAP4 MAILBOX-REFERRALS THREAD=REFERENCES ATOMIC UIDPLUS
443/tcp   open   ssl/https?
|_ssl-date: 2021-04-19T02:17:51+00:00; +1m26s from scanner time.
884/tcp   closed unknown
993/tcp   open   ssl/imap   Cyrus imapd
|_imap-capabilities: CAPABILITY
995/tcp   open   pop3       Cyrus pop3d
3306/tcp