对于教务处的源代码审计发现是正方教务系统。然而能力不够，无法利用正方教务系统的漏洞。
那么先试试看吧，正方使用211端口，开放211端口的主机非常多，但似乎外网对211端口的连接请求被拒绝了（值得怀疑）
所有的端口全都被过滤了，这其实也就是扫描存活的主机，愚蠢的我并没有什么端口渗透经验··
D:\CTF\Nmap>nmap -sV -p 211 202.115.128.*
Starting Nmap 7.60 ( https://nmap.org ) at 2017-09-16 15:51 ?D1ú±ê×?ê±??
Nmap scan report for cam-r1.cdut.edu.cn (202.115.128.1)
Host is up (0.047s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for cdut-cam-r3.cdut.edu.cn (202.115.128.3)
Host is up (0.063s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for cam-r6.cdut.edu.cn (202.115.128.6)
Host is up (0.047s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.21
Host is up (0.063s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.25
Host is up (0.14s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.26
Host is up (0.032s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.28
Host is up (0.14s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for pridns.cdut.edu.cn (202.115.128.33)
Host is up (0.11s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for secdns.cdut.edu.cn (202.115.128.34)
Host is up (0.11s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.37
Host is up (0.094s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for email.cdut.edu.cn (202.115.128.60)
Host is up (0.031s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.62
Host is up (0.062s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.63
Host is up (0.042s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.91
Host is up (0.031s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.108
Host is up (0.093s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for vmdp.cdut.cn (202.115.128.114)
Host is up (0.032s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.115
Host is up (0.11s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.128
Host is up (0.094s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.132
Host is up (0.094s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.169
Host is up (0.047s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.189
Host is up (0.078s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.190
Host is up (0.046s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.225
Host is up (0.047s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.227
Host is up (0.062s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.228
Host is up (0.062s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.231
Host is up (0.062s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.238
Host is up (0.11s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.254
Host is up (0.078s latency).
PORT STATE SERVICE VERSION
211/tcp filtered 914c-g
Service detection performed. Please report any incorrect results at https://nmap
.org/submit/ .
Nmap done: 256 IP addresses (28 hosts up) scanned in 70.80 seconds
D:\CTF\Nmap>nmap -sV -A 202.115.128.238
Starting Nmap 7.60 ( https://nmap.org ) at 2017-09-16 16:33 ?D1ú±ê×?ê±??
Nmap scan report for 202.115.128.238
Host is up (0.048s latency).
Not shown: 995 filtered ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.0.7+ (ext.1)
80/tcp open http Seagate Black Armor 440 NAS http config (PHP 4.4.9)
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
|_http-title: Seagate NAS - BA-35532E
111/tcp open rpcbind 2 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
|_ 100000 2 111/udp rpcbind
548/tcp open afp Netatalk 2-2-0-p6 (name: BA-35532E; protocol 3.3)
| afp-serverinfo:
| Server Flags:
| Flags hex: 0x8f7d
| Super Client: true
| UUIDs: true
| UTF8 Server Name: true
| Open Directory: true
| Reconnect: false
| Server Notifications: true
| TCP/IP: true
| Server Signature: true
| Server Messages: true
| Password Saving Prohibited: true
| Password Changing: false
| Copy File: true
| Server Name: BA-35532E
| Machine Type: Netatalk 2-2-0-p6
| AFP Versions: AFP2.2, AFPX03, AFP3.1, AFP3.2, AFP3.3
| UAMs: DHX2, DHCAST128, Cleartxt Passwrd, No User Authent
| Server Signature: 30303130373533353533326500000000
| Network Addresses:
| 202.115.128.238
|_ UTF8 Server Name: BA-35532E
9876/tcp open gcs-clientgw Galaxy Control Systems Client GW
Warning: OSScan results may be unreliable because we could not find at least 1 o
pen and 1 closed port
Aggressive OS guesses: AVM FRITZ!Box FON WLAN 7050, Linksys WAG200G, or Netgear
DG834GT wireless broadband router (93%), Linksys WRV200 wireless broadband route
r (89%), Kyocera CopyStar CS-2560 printer (89%), D-Link DSL-G624T wireless ADSL
router (MontaVista embedded Linux 2.4.17), or Netgear DG834Bv3 ADSL router or DG
834G WAP (87%), Extreme Networks ExtremeXOS 12.5.4 (86%), Western Digital MyBook
World Edition 2 NAS device (Linux 2.6.17.14) (86%), Supermicro IPMI remote mana
gement (86%), Sony Bravia HX720-series TV (86%), Dell Remote Access Controller (
DRAC 6) (85%), Linux 2.4.18 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: Host: BA-35532E; OS: Unix; Device: security-misc
TRACEROUTE (using port 21/tcp)
HOP RTT ADDRESS
1 0.00 ms 192.168.1.1
2 32.00 ms 110.191.168.1
3 ...
4 47.00 ms 202.115.128.238
OS and Service detection performed. Please report any incorrect results at https
://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 169.20 seconds
首先是21
http://202.115.128.37/
http://202.115.128.60/
http://202.115.128.62和63/
https://202.115.128.108/
https://202.115.128.225/
https://202.115.128.228/
https://202.115.128.231/cgi-bin/
http://202.115.128.238/
