vulnhub靶机 Connect-the-dots

vulnhub靶机 Connect-the-dots

靶机地址Connect The Dots: 1 ~ VulnHub

目标为 普通用户的user.txt和root用户的root.txt

靶机配置

下载好ova之后，使用vm打开导入，务必记得将网络适配器调成与自己kali的网段一致，一般都是nat

渗透测试

使用nmap进行扫描

└─# nmap -p- -sV -T4 192.168.5.128
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-05 11:11 CST
Nmap scan report for 192.168.5.128 (192.168.5.128)
Host is up (0.0017s latency).
Not shown: 65526 closed ports
PORT      STATE SERVICE  VERSION
21/tcp    open  ftp      vsftpd 2.0.8 or later
80/tcp    open  http     Apache httpd 2.4.38 ((Debian))
111/tcp   open  rpcbind  2-4 (RPC #100000)
2049/tcp  open  nfs_acl  3 (RPC #100227)
7822/tcp  open  ssh      OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0)
33661/tcp open  nlockmgr 1-4 (RPC #100021)
34979/tcp open  mountd   1-3 (RPC #100005)
50387/tcp open  mountd   1-3 (RPC #100005)
55027/tcp open  mountd   1-3 (RPC #100005)
MAC Address: 00:0C:29:AC:33:1F (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.05 seconds

发现80端口，则存在网页，对其进行目录扫描

└─# dirsearch -u "http://192.168.5.128/" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt     

  _|. _ _  _  _  _ _|_    v0.4.1                                                                                                                                                                                   
 (_||| _) (/_(_|| (_| )                                                                                                                                                                                            
                                                                                                                                                                                                                   
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 220520

Output File: /root/.dirsearch/reports/192.168.5.128/_21-09-04_23-00-33.txt

Error Log: /root/.dirsearch/logs/errors-21-09-04_23-00-33.log

Target: http://192.168.5.128/
                                                                                                                                                                                                                   
[23:00:33] Starting: 
[23:00:33] 301 -  315B  - /images  ->  http://192.168.5.128/images/
[23:00:34] 301 -  315B  - /manual  ->  http://192.168.5.128/manual/
[23:00:35] 301 -  319B  - /javascript  ->  http://192.168.5.128/javascript/
[23:00:51] 200 -    6KB - /backups                                
[23:01:01] 301 -  315B  - /mysite  ->  http://192.168.5.128/mysite/
[23:03:08] 403 -  301B  - /server-status                                                                                        
                                                                                                                                                                                                            
Task Completed   

访问http://192.168.5.128/mysite/发现其中b