Vulnhub——DOUBLETROUBLE: 1

靶机下载地址：Vulnhub——DOUBLETROUBLE: 1

---

1. 靶机安装好以后如下图所示：
   
2. nmap -sP 局域网IP段（扫描靶机IP地址）“因为我是用VirtualBox搭建的所以这里还是比较方便识别的”
   
3. 拿到靶机IP

nmap -sV -A -p- -T4 10.36.101.156

扫描结果发现靶机开放了22和80端口

┌──(rootkali)-[~]
└─# nmap -sV -A -T4 10.36.101.165
Starting Nmap 7.91 ( https://nmap.org ) at 2022-06-01 04:28 EDT
Nmap scan report for 10.36.101.165
Host is up (0.0052s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 6a:fe:d6:17:23:cb:90:79:2b:b1:2d:37:53:97:46:58 (RSA)
|   256 5b:c4:68:d1:89:59:d7:48:b0:96:f3:11:87:1c:08:ac (ECDSA)
|_  256 61:39:66:88:1d:8f:f1:d0:40:61:1e:99:c5:1a:1f:f4 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: qdPM | Login
MAC Address: 08:00:27:62:E5:4E (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5
OS details: Linux 5.0 - 5.3
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   5.23 ms 10.36.101.165

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.61 seconds

4. dirb 扫一下

 ┌──(rootkali)-[~]
└─# dirb http://10.36.101.165

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Wed Jun  1 04:29:01 2022
URL_BASE: http://10.36.101.165/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://10.36.101.165/ ----
==> DIRECTORY: http://10.36.101.165/backups/                                                                                                      
==> DIRECTORY: http://10.36.101.165/batch/                                                                                                        
==> DIRECTORY: http://10.36.101.165/core/                                                                                                         
==> DIRECTORY: http://10.36.101.165/css/                                                                                                          
 1. http://10.36.101.165/favicon.ico (CODE:200|SIZE:894)                                                                                            
==> DIRECTORY: http://10.36.101.165/images/                                                                                                       
 2. http://10.36.101.165/index.php (CODE:200|SIZE:5812)                                                                                             
==> DIRECTORY: http://10.36.101.165/install/                                                                                                      
==> DIRECTORY: http://10.36.101.165/js/                                                                                                           
 3. http://10.36.101.165/robots.txt (CODE:200|SIZE:26)                                                                                              
==> DIRECTORY: http://10.36.101.165/secret/                                                                                                       
 4. http://10.36.101.165/server-status (CODE:403|SIZE:278)                                                                                          
==> DIRECTORY: http://10.36.101.165/sf/                                                                                                           
==> DIRECTORY: http://10.36.101.165/template/                                                                                                     
==> DIRECTORY: http://10.36.101.165/uploads/                                                                                                      
                                                                                                                                                  
---- Entering directory: http://10.36.101.165/backups/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                  
---- Entering directory: http