首页 > 其他分享 >Shenzi pg walkthrough Intermediate window

Shenzi pg walkthrough Intermediate window

时间:2024-12-17 09:31:17浏览次数:3  
标签:Windows tcp walkthrough window Intermediate 192.168 open Microsoft 2.4

nmap
└─# nmap -p- -A -sS -T5 192.168.218.55
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-16 23:45 UTC
Stats: 0:00:02 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 0.97% done
Stats: 0:00:03 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 3.03% done; ETC: 23:47 (0:01:36 remaining)
Stats: 0:00:04 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 3.09% done; ETC: 23:48 (0:02:37 remaining)
Warning: 192.168.218.55 giving up on port because retransmission cap hit (2).
Nmap scan report for 192.168.218.55
Host is up (0.072s latency).
Not shown: 65521 closed tcp ports (reset)
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           FileZilla ftpd 0.9.41 beta
| ftp-syst: 
|_  SYST: UNIX emulated by FileZilla
80/tcp    open  http          Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-title: Welcome to XAMPP
|_Requested resource was http://192.168.218.55/dashboard/
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
443/tcp   open  ssl/http      Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-title: Welcome to XAMPP
|_Requested resource was https://192.168.218.55/dashboard/
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
| tls-alpn: 
|_  http/1.1
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6
445/tcp   open  microsoft-ds?
3306/tcp  open  mysql?
| fingerprint-strings: 
|   LDAPBindReq, NULL, SIPOptions: 
|_    Host '192.168.45.250' is not allowed to connect to this MariaDB server
5040/tcp  open  unknown
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3306-TCP:V=7.94SVN%I=7%D=12/16%Time=6760BC0D%P=x86_64-pc-linux-gnu%
SF:r(NULL,4D,"I\0\0\x01\xffj\x04Host\x20'192\.168\.45\.250'\x20is\x20not\x
SF:20allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(LDAPB
SF:indReq,4D,"I\0\0\x01\xffj\x04Host\x20'192\.168\.45\.250'\x20is\x20not\x
SF:20allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server")%r(SIPOp
SF:tions,4D,"I\0\0\x01\xffj\x04Host\x20'192\.168\.45\.250'\x20is\x20not\x2
SF:0allowed\x20to\x20connect\x20to\x20this\x20MariaDB\x20server");
Aggressive OS guesses: Microsoft Windows 10 1909 (92%), OpenWrt Kamikaze 7.09 (Linux 2.6.22) (91%), OpenWrt 0.9 - 7.09 (Linux 2.4.30 - 2.4.34) (90%), OpenWrt White Russian 0.9 (Linux 2.4.30) (90%), Microsoft Windows Server 2019 (90%), Linux 2.4.18 (89%), Microsoft Windows XP SP3 (88%), Microsoft Windows 7 SP1 or Windows Server 2008 (88%), Microsoft Windows 7 Ultimate (88%), Microsoft Windows 8.1 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-12-16T23:50:10
|_  start_date: N/A
|_clock-skew: -1s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

TRACEROUTE (using port 993/tcp)
HOP RTT      ADDRESS
1   69.89 ms 192.168.45.1
2   69.94 ms 192.168.45.254
3   70.08 ms 192.168.251.1
4   81.29 ms 192.168.218.55

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 293.06 seconds


先试了试ftp 登录不进去

然后我们再看看80端口和443端口
发现80端口和443端口 都是一个页面
image
右上角能发现phpifno 和 phpmyadmin的跳转图标

点击访问
image
发现phpmyadmin不能访问

再点击phpinfo看看
image

能发现一个用户名

dirsearch扫扫看优啥东西
发现啥也没有

然后我们看看445 和 139端口
image
很神奇 enum4linux 没有枚举出来但是smbclient 就发现了共享文件夹
image

看看这个文件夹里面有啥吧
把里面的文件全部获取下来一个一个看
image
在password.txt里面有一个wordpress的admin账户和密码
但是我找了半天也没发现wordpress的路径
看wp 发现wp的路径是该用户名
服了 有点脑洞了
image
好了进入后台我们就可以为所欲为了

改写404.php 写入webshell
image

image

接下来看看能不能反弹shell
好像靶场又出问题了 shell弹不回来
只能先拿个local.txt的flag了
image

由于靶场出了问题提权部分就没法打了 我们浅浅看看wp
wp说在winpeas的帮助下发现了msi提权
好像是只要执行一个msi就能触发提权
问问chatgpt老师
image

好了我懂了
下播

标签:Windows,tcp,walkthrough,window,Intermediate,192.168,open,Microsoft,2.4
From: https://www.cnblogs.com/wssw/p/18611557

相关文章

  • Windows系统下无头构建Linux系统下的so文件
     (开始执行以下步骤时,确保已经在系统下安装2017版Labview软件,及其驱动软件,压缩包内包含32位java插件安装包与NILinuxReal-TimeEclipseEdition的C/C++开发工具包***建议均使用默认路径安装***C盘空间配置大一些)1.首先我们需要在Windows系统里面安装Java插件(建议使用32位......
  • Hutch PG walkthrough Intermediate window
    NMAP└─#nmap-p--A-sS192.168.196.122StartingNmap7.94SVN(https://nmap.org)at2024-12-1601:39UTCNmapscanreportfor192.168.196.122Hostisup(0.071slatency).Notshown:65515filteredtcpports(no-response)PORTSTATESERVICEV......
  • Fortify Static Code Analyzer 24.2 for macOS, Linux & Windows - 静态应用安全测试
    FortifyStaticCodeAnalyzer24.2formacOS,Linux&Windows-静态应用安全测试FortifySCA-代码漏洞扫描工具|静态代码测试|代码安全分析请访问原文链接:https://sysin.org/blog/fortify-static-code-analyzer/查看最新版。原创作品,转载请保留出处。作者主页:sysin.......
  • Windows 10 下编译 64 位 OpenJDK 8 并单步调试
    Windows10下编译64位OpenJDK8软件版本操作系统:Windows10Cygwin:3.5.4-1VisualStudio:2010英文版freetype:2.7BootJDK:7编译的OpenJDK版本:8安装bootJDK从下载链接下载JDK,然后在Windows上安装。安装完成后配置JAVE_HOME环境变量,如下......
  • Windows 下将无线网卡变 WiFi 热点
    首先打开cmd运行如下命令确认当前无线网卡是否支持承载网络:netshwlanshowdrivers若显示支持的承载网络:是则可继续,否则代表无线网卡不支持变热点。先设置网络配置:netshwlansethostednetworkmode=allowssid=wifinamekey=password即设置WiFi名称为wifiname,密码......
  • Nickel pg walkthrough Intermediate window
    nmap┌──(root㉿kali)-[~]└─#nmap-p--A-sS192.168.196.99StartingNmap7.94SVN(https://nmap.org)at2024-12-1600:19UTCStats:0:01:37elapsed;0hostscompleted(1up),1undergoingSYNStealthScanSYNStealthScanTiming:About98.92%done;ET......
  • Windows DXGI屏幕捕获实现
    WindowsDXGI方式屏幕捕获实现主要步骤graphTBA[D3D11CreateDevice]-->B[ID3D11Device]A[D3D11CreateDevice]-->C[ID3D11DeviceContext]B-.QueryInterface.->D[IDXGIDevice]B-.GetParent.->E[IDXGIAdapter]E-.EnumOutputs.->F[IDXG......
  • Windows 应用程序图标设置完全指南
    目录简介图标基础知识实现方案代码实现常见问题最佳实践进阶技巧简介在Windows应用程序开发中,正确设置应用程序图标是提升用户体验的重要环节。一个应用程序的图标会出现在多个位置:任务栏窗口标题栏系统托盘开始菜单文件资源管理器每个位置都有其特定的要求......
  • Windows系统-Python获取当前资源管理器路径及打开控制台、资源管理器到指定路径的方法
    Python获取当前资源管理器路径及打开控制台、资源管理器到指定路径的方法文章目录Python获取当前资源管理器路径及打开控制台、资源管理器到指定路径的方法获取资源管理器路径方法运行错误打开控制台到指定路径方法打开资源管理器到指定路径方法闲着没事还开发了个......
  • WindowsServer2022部署DHCP服务器及其中继服务器
    Step0:环境检查首先需要关闭VMware自带的DHCP服务,这个会影响自己的DHCP服务 把使用本地DHCP服务将IP地址分配关闭即可 给VM1网卡一个静态的IP地址,需要在子网81.6.63.0/24网段里即可  我这里给的是81.6.63.100/24Step1:在WindowsServer上的配置    ......