HTB-Analytics

最新推荐文章于 2024-07-18 21:11:52 发布

Y4y17

最新推荐文章于 2024-07-18 21:11:52 发布

阅读量615

点赞数 8

分类专栏： HackTheBox 文章标签：网络安全学习安全威胁分析 web安全安全

本文链接：https://blog.csdn.net/weixin_44770698/article/details/136173970

版权

HackTheBox 专栏收录该内容

5 篇文章 0 订阅

订阅专栏

文章讲述了使用Nmap工具对靶机进行IP地址10.10.11.233的扫描，发现开放的端口和服务，并检测到22端口的SSH和80端口的HTTP服务。随后检测到Metabase服务的漏洞，并通过环境变量获取密码，最终利用提权脚本实现提权的过程。

摘要由CSDN通过智能技术生成

靶机的IP地址为10.10.11.233，攻击机的IP地址为10.10.16.30

信息收集

# nmap -sT --min-rate 10000 -p- 10.10.11.233 -oN port.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-19 14:50 CST
Warning: 10.10.11.233 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.233 (10.10.11.233)
Host is up (0.23s latency).
Not shown: 37448 closed tcp ports (conn-refused), 28085 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 102.12 seconds

仅开放了两个端口，分别是22端口ssh和80端口http服务！

# nmap -sT -sC -sV -O -p22,80 10.10.11.233 -oN details.nmap 
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-19 14:52 CST
Nmap scan report for 10.10.11.233 (10.10.11.233)
Host is up (0.27s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
|_  256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://analytical.htb/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.48 seconds

80端口上是nginx 1.18.0版本起的http服务！操作系统应该是ubuntu系统，看到了web-title是无法重定向，所以修改了一下/etc/hosts文件！最终修改之后，再次进行扫描，发现title变了！

# nmap -sT --script=vuln -p22,80 10.10.11.233 -oN vuls.nmap 
Starting Nmap 7.94 ( https://nmap.org ) at 2024-02-19 14:52 CST
Nmap scan report for 10.10.11.233 (10.10.11.233)
Host is up (0.22s latency).

PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.

Nmap done: 1 IP address (1 host up) scanned in 352.75 seconds

默认漏洞脚本可以不用看了，一点价值都没有。