LAMPSecurity: CTF7#

主机发现端口扫描#

1. 探测存活主机，140为靶机

   nmap -sP 192.168.75.0/24
   //
   Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 23:16 CST
   Nmap scan report for 192.168.75.1
   Host is up (0.00062s latency).
   MAC Address: 00:50:56:C0:00:08 (VMware)
   Nmap scan report for 192.168.75.2
   Host is up (0.00050s latency).
   MAC Address: 00:50:56:FB:CA:45 (VMware)
   Nmap scan report for 192.168.75.140
   Host is up (0.00013s latency).
   MAC Address: 00:0C:29:9D:12:A9 (VMware)
   Nmap scan report for 192.168.75.254
   Host is up (0.00032s latency).
   MAC Address: 00:50:56:F8:B3:1A (VMware)
   Nmap scan report for 192.168.75.131
   Host is up.

2. 扫描主机所有端口

   nmap -sT -min-rate 10000 -p- 192.168.75.140
   //
   Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 23:16 CST
   Nmap scan report for 192.168.75.140
   Host is up (0.00078s latency).
   Not shown: 65507 filtered tcp ports (no-response), 19 filtered tcp ports (host-unreach)
   PORT      STATE  SERVICE
   22/tcp    open   ssh
   80/tcp    open   http
   137/tcp   closed netbios-ns
   138/tcp   closed netbios-dgm
   139/tcp   open   netbios-ssn
   901/tcp   open   samba-swat
   5900/tcp  closed vnc
   8080/tcp  open   http-proxy
   10000/tcp open   snet-sensor-mgmt
   MAC Address: 00:0C:29:9D:12:A9 (VMware)

3. 扫描服务版本及系统版本

   nmap -sT -sV -O -p22,80,139,901,5900,8080,10000  192.168.75.140
   //
   Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 23:23 CST
   Nmap scan report for 192.168.75.140
   Host is up (0.00043s latency).
   
   PORT      STATE  SERVICE     VERSION
   22/tcp    open   ssh         OpenSSH 5.3 (protocol 2.0)
   80/tcp    open   http        Apache httpd 2.2.15 ((CentOS))
   139/tcp   open   netbios-ssn Samba smbd 3.X - 4.X (workgroup: MYGROUP)
   901/tcp   open   http        Samba SWAT administration server
   5900/tcp  closed vnc
   8080/tcp  open   http        Apache httpd 2.2.15 ((CentOS))
   10000/tcp open   http        MiniServ 1.610 (Webmin httpd)
   MAC Address: 00:0C:29:9D:12:A9 (VMware)
   Device type: general purpose
   Running: Linux 2.6.X|3.X
   OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
   OS details: Linux 2.6.32 - 3.13
   Network Distance: 1 hop

   MiniServ 1.610 通过搜索发现是文件服务器

4. 扫描漏洞

   nmap -script=vuln -p22,80,139,901,5900,8080,10000  192.168.75.140
   //
   Starting Nmap 7.93 ( https://nmap.org ) at 2024-09-23 23:26 CST
   Nmap scan report for 192.168.75.140
   Host is up (0.0019s latency).
   
   PORT      STATE  SERVICE
   22/tcp    open   ssh
   80/tcp    open   http
   |_http-csrf: Couldn't find any CSRF vulnerabilities.
   |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
   | http-slowloris-check: 
   |   VULNERABLE:
   |   Slowloris DOS attack
   |     State: LIKELY VULNERABLE
   |     IDs:  CVE:CVE-2007-6750
   |       Slowloris tries to keep many connections to the target web server open and hold
   |       them open as long as possible.  It accomplishes this by opening connections to
   |       the target web server and sending a partial request. By doing so, it starves
   |       the http server's resources causing Denial Of Service.
   |       
   |     Disclosure date: 2009-09-17
   |     References:
   |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
   |_      http://ha.ckers.org/slowloris/
   | http-fileupload-exploiter: 
   |   
   |     Couldn't find a file-type field.
   |   
   |     Couldn't find a file-type field.
   |   
   |     Couldn't find a file-type field.
   |   
   |_    Couldn't find a file-type field.
   |_http-trace: TRACE is enabled
   | http-enum: 
   |   /webmail/: Mail folder
   |   /css/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
   |   /icons/: Potentially interesting folder w/ directory listing
   |   /img/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
   |   /inc/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
   |   /js/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
   |_  /webalizer/: Potentially interesting folder
   |_http-dombased-xss: Couldn't find any DOM based XSS.
   | http-cookie-flags: 
   |   /: 
   |     PHPSESSID: 
   |_      httponly flag not set
   |_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
   139/tcp   open   netbios-ssn
   901/tcp   open   samba-swat
   5900/tcp  closed vnc
   8080/tcp  open   http-proxy
   | http-cookie-flags: 
   |   /: 
   |     PHPSESSID: 
   |       httponly flag not set
   |   /login.php: 
   |     PHPSESSID: 
   |_      httponly flag not set
   | http-slowloris-check: 
   |   VULNERABLE:
   |   Slowloris DOS attack
   |     State: LIKELY VULNERABLE
   |     IDs:  CVE:CVE-2007-6750
   |       Slowloris tries to keep many connections to the target web server open and hold
   |       them open as long as possible.  It accomplishes this by opening connections to
   |       the target web server and sending a partial request. By doing so, it starves
   |       the http server's resources causing Denial Of Service.
   |       
   |     Disclosure date: 2009-09-17
   |     References:
   |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
   |_      http://ha.ckers.org/slowloris/
   |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
   |_http-trace: TRACE is enabled
   | http-enum: 
   |   /login.php: Possible admin folder
   |   /phpmyadmin/: phpMyAdmin
   |   /docs/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
   |   /icons/: Potentially interesting folder w/ directory listing
   |_  /inc/: Potentially interesting directory w/ listing on 'apache/2.2.15 (centos)'
   10000/tcp open   snet-sensor-mgmt
   MAC Address: 00:0C:29:9D:12:A9 (VMware)
   
   Host script results:
   | smb-vuln-regsvc-dos: 
   |   VULNERABLE:
   |   Service regsvc in Microsoft Windows systems vulnerable to denial of service
   |     State: VULNERABLE
   |       The service regsvc in Microsoft Windows 2000 systems is vulnerable to denial of service caused by a null deference
   |       pointer. This script will crash the service if it is vulnerable. This vulnerability was discovered by Ron Bowes
   |       while working on smb-enum-sessions.
   |_          
   |_smb-vuln-ms10-054: false
   | smb-vuln-cve2009-3103: 
   |   VULNERABLE:
   |   SMBv2 exploit (CVE-2009-3103, Microsoft Security Advisory 975497)
   |     State: VULNERABLE
   |     IDs:  CVE:CVE-2009-3103
   |           Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2,
   |           Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a
   |           denial of service (system crash) via an & (ampersand) character in a Process ID High header field in a NEGOTIATE
   |           PROTOCOL REQUEST packet, which triggers an attempted dereference of an out-of-bounds memory location,
   |           aka "SMBv2 Negotiation Vulnerability."
   |           
   |     Disclosure date: 2009-09-08
   |     References:
   |       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
   |_      http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3103
   |_smb-vuln-ms10-061: false

   发现了很多可能会感兴趣的目录，并扫出了smb的漏洞，但是看描述可能只是对windows有害

   优先级大概是80→8080→10000→also

web渗透#