渗透测试靶机实战---系统篇07 （中危漏洞）

傷城~ 2023-06-08 04:48 7阅读 0赞

### [（续）渗透测试靶机实战---系统篇06][---_06] ###

--------------------

上篇最后一个是中危漏洞，从这篇开始主要是针对中危漏洞的一些渗透：

### 1. [awiki Multiple Local File Include Vulnerabilities][] ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1][]

--------------------

### 2.[Check if Mailserver answer to VRFY and EXPN requests][] ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 2][]

msf5 auxiliary(scanner/http/ssl_version) > search VRFY
    
    Matching Modules
    ================
    
       #  Name                              Disclosure Date  Rank    Check  Description
       -  ----                              ---------------  ----    -----  -----------
       0  auxiliary/scanner/smtp/smtp_enum                   normal  Yes    SMTP User Enumeration Utility
    
    
    msf5 auxiliary(scanner/http/ssl_version) >  use auxiliary/scanner/smtp/smtp_enum
    msf5 auxiliary(scanner/smtp/smtp_enum) > show options
    
    Module options (auxiliary/scanner/smtp/smtp_enum):
    
       Name       Current Setting                                                Required  Description
       ----       ---------------                                                --------  -----------
       RHOSTS                                                                    yes       The target address range or CIDR identifier
       RPORT      25                                                             yes       The target port (TCP)
       THREADS    1                                                              yes       The number of concurrent threads
       UNIXONLY   true                                                           yes       Skip Microsoft bannered servers when testing unix users
       USER_FILE  /usr/share/metasploit-framework/data/wordlists/unix_users.txt  yes       The file that contains a list of probable users accounts.
    
    msf5 auxiliary(scanner/smtp/smtp_enum) > set RHOSTS 192.168.10.149
    RHOSTS => 192.168.10.149
    msf5 auxiliary(scanner/smtp/smtp_enum) > show options
    
    Module options (auxiliary/scanner/smtp/smtp_enum):
    
       Name       Current Setting                                                Required  Description
       ----       ---------------                                                --------  -----------
       RHOSTS     192.168.10.149                                                 yes       The target address range or CIDR identifier
       RPORT      25                                                             yes       The target port (TCP)
       THREADS    1                                                              yes       The number of concurrent threads
       UNIXONLY   true                                                           yes       Skip Microsoft bannered servers when testing unix users
       USER_FILE  /usr/share/metasploit-framework/data/wordlists/unix_users.txt  yes       The file that contains a list of probable users accounts.
    
    msf5 auxiliary(scanner/smtp/smtp_enum) > run
    
    [*] 192.168.10.149:25     - 192.168.10.149:25 Banner: 220 metasploitable.localdomain ESMTP Postfix (Ubuntu)
    [+] 192.168.10.149:25     - 192.168.10.149:25 Users found: , backup, bin, daemon, distccd, ftp, games, gnats, irc, libuuid, list, lp, mail, man, news, nobody, postgres, postmaster, proxy, service, sshd, sync, sys, syslog, user, uucp, www-data
    [*] 192.168.10.149:25     - Scanned 1 of 1 hosts (100% complete)
    [*] Auxiliary module execution completed

上面UserFound可以看到系统里面有哪些用户。

[---_06]: https://blog.csdn.net/m0_37268841/article/details/102584210
[awiki Multiple Local File Include Vulnerabilities]: https://127.0.0.1:9392/omp?cmd=get_result&result_id=2107a39e-d1f2-444d-bc8e-21754c000200&apply_overrides=&min_qod=&task_id=&name=&report_id=b3a6ca2f-d88a-475a-b945-3657a6aaa375&filter=&filt_id=&overrides=&autofp=&report_result_id=2107a39e-d1f2-444d-bc8e-21754c000200&token=59709318-1915-4001-9b06-ebff33668b5d
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70]: /images/20230531/8404f5145c4d4bd69f7ec2251d8f2586.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 1]: /images/20230531/cae412c7ec2147dc9697ca4ddb66b210.png
[Check if Mailserver answer to VRFY and EXPN requests]: https://127.0.0.1:9392/omp?cmd=get_result&result_id=cd96a654-b4e9-4ce8-82bc-0c0afa29086b&apply_overrides=&min_qod=&task_id=&name=&report_id=b3a6ca2f-d88a-475a-b945-3657a6aaa375&filter=&filt_id=&overrides=&autofp=&report_result_id=cd96a654-b4e9-4ce8-82bc-0c0afa29086b&token=a27b12dd-faeb-43dd-81d8-dfcd4664fcf6
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L20wXzM3MjY4ODQx_size_16_color_FFFFFF_t_70 2]: /images/20230531/a224b9d206244478985ae79f26362031.png