2019-08-25-Vulnhub渗透测试实战writeup(

emmm这次镜像拖了很久。。。#Symfonos2

p1

首先上nmap结果：

root@HLKali:~# nmap -p- -A -sV 172.16.64.133

Starting Nmap 7.40 ( https://nmap.org ) at 2019-08-25 11:27 EDT
Nmap scan report for 172.16.64.133
Host is up (0.00064s latency).
Not shown: 65530 closed ports
PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         ProFTPD 1.3.5
|_ftp-bounce: no banner
22/tcp  open  ssh         OpenSSH 7.4p1 Debian 10+deb9u6 (protocol 2.0)
| ssh-hostkey: 
|   2048 9d:f8:5f:87:20:e5:8c:fa:68:47:7d:71:62:08:ad:b9 (RSA)
|_  256 04:2a:bb:06:56:ea:d1:93:1c:d2:78:0a:00:46:9d:85 (ECDSA)
80/tcp  open  http        WebFS httpd 1.21
|_http-server-header: webfs/1.21
|_http-title: Site doesn't have a title (text/html).
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 4.5.16-Debian (workgroup: WORKGROUP)
MAC Address: 00:0C:29:1D:C0:6B (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.6
Network Distance: 1 hop
Service Info: Host: SYMFONOS2; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_nbstat: NetBIOS name: SYMFONOS2, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.5.16-Debian)
|   Computer name: symfonos2
|   NetBIOS computer name: SYMFONOS2\x00
|   Domain name: \x00
|   FQDN: symfonos2
|_  System time: 2019-08-25T10:27:44-05:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smbv2-enabled: Server supports SMBv2 protocol

TRACEROUTE
HOP RTT     ADDRESS
1   0.64 ms 172.16.64.133

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 37.91 seconds

可以看到开放了21，22，80，139，445端口，开放了139和445意味着有smb可以探测，直接上enum4linux

p2

可以看到空密码。。。
直接smbclient连接

p3
直接看到有个anonymous文件夹
p4

拿下日志文件，查看一番发现用户名aeolus,尝试ftp以及ssh密码爆破。。。爆破ssh密码为sergioteamo
直接连接以后发现还开放其他端口

p5
外面没扫到8080,应该是http服务，所以可以直接找找漏洞。。。
这里肯定要做所谓的端口转发，端口转发分本地端口转发以及远程端口转发，区别在于ssh连接以及转发的服务连接方向是否一致，一致则为本地端口转发。
这里命令如下：

ssh -L 7001:localhost:8080 aeolus@172.16.64.133

7001为我的端口，8080为对面端口。

p6
这里直接访问7001端口就能转发了。
p7
这里librenms cms有漏洞，可参考(https://www.anquanke.com/post/id/169295)
这里登录账号密码同ssh,aeolus:sergioteamo
p8
p9
然后尝试提权，先sudo -l看看有哪些特权程序
p10
这样直接uuid提权
p11
p12
The end...