vulnhub devguru渗透笔记

阅读原文时间：2022年04月16日阅读：1

devguru渗透笔记

信息收集

kali ip

目标ip

首先我们扫描一下开放端口

nmap -A -p- 192.168.20.143
Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-18 10:41 CST
Nmap scan report for bogon (192.168.20.143)
Host is up (0.00044s latency).
Not shown: 65532 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 2a:46:e8:2b:01:ff:57:58:7a:5f:25:a4:d6:f2:89:8e (RSA)
| 256 08:79:93:9c:e3:b4:a4:be:80:ad:61:9d:d3:88:d2:84 (ECDSA)
|_ 256 9c:f9:88:d4:33:77:06:4e:d9:7c:39:17:3e:07:9c:bd (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-generator: DevGuru
| http-git:
| 192.168.20.143:80/.git/
| Git repository found!
| Repository description: Unnamed repository; edit this file 'description' to name the…
| Last commit message: first commit
| Remotes:
| http://devguru.local:8585/frank/devguru-website.git
|_ Project type: PHP application (guessed from .gitignore)
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Corp - DevGuru
8585/tcp open unknown
| fingerprint-strings:
| GenericLines:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 200 OK
| Content-Type: text/html; charset=UTF-8
| Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
| Set-Cookie: i_like_gitea=3fa58b0407bb4cfd; Path=/; HttpOnly
| Set-Cookie: _csrf=1i6eRR0jsBy2m3oVLV7XjbmTO3Y6MTYzOTc5NTMyOTAyODgyNzUyOQ; Path=/; Expires=Sun, 19 Dec 2021 02:42:09 GMT; HttpOnly
| X-Frame-Options: SAMEORIGIN
| Date: Sat, 18 Dec 2021 02:42:09 GMT
|
|
|
|
|
|
| Gitea: Git with a cup of tea
|
|
|
|
|
|
|
|
| Page Not Found - Gitea: Git with a cup of tea
|
|
|
|_ https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port8585-TCP:V=7.91%I=7%D=12/18%Time=61BD4A81%P=x86\_64-pc-linux-gnu%r(G SF:enericLines,67,"HTTP/1\\.1\\x20400\\x20Bad\\x20Request\\r\\nContent-Type:\\x20 SF:text/plain;\\x20charset=utf-8\\r\\nConnection:\\x20close\\r\\n\\r\\n400\\x20Bad\\ SF:x20Request")%r(GetRequest,2A00,"HTTP/1\\.0\\x20200\\x20OK\\r\\nContent-Type: SF:\\x20text/html;\\x20charset=UTF-8\\r\\nSet-Cookie:\\x20lang=en-US;\\x20Path=/ SF:;\\x20Max-Age=2147483647\\r\\nSet-Cookie:\\x20i\_like\_gitea=3fa58b0407bb4cfd SF:;\\x20Path=/;\\x20HttpOnly\\r\\nSet-Cookie:\\x20\_csrf=1i6eRR0jsBy2m3oVLV7Xjb SF:mTO3Y6MTYzOTc5NTMyOTAyODgyNzUyOQ;\\x20Path=/;\\x20Expires=Sun,\\x2019\\x20D SF:ec\\x202021\\x2002:42:09\\x20GMT;\\x20HttpOnly\\r\\nX-Frame-Options:\\x20SAMEO SF:RIGIN\\r\\nDate:\\x20Sat,\\x2018\\x20Dec\\x202021\\x2002:42:09\\x20GMT\\r\\n\\r\\n< SF:!DOCTYPE\\x20html>\n\n\n\t\n\t\n\t\n\t\x20Gitea:\x20Git\x20with\x20a\x20cup\x20of\x20tea\x20\n\t\n\t
SF:\n\t\n\t\n\
SF:n\n\t\n\t\n\t\n\
SF:tPage\x20Not\x20Found\x20-\x20\x20Gitea:\x20Git\x20with\x20a\x20 SF:cup\x20of\x20tea\x20\n\t\n\t\n\t\n\t<m
SF:eta\x20name=\"description\"\x20content=\"Gitea\x20\(Git\x20with\x20a\x2
SF:0c");
MAC Address: 00:0C:29:49:16:E8 (VMware)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ADDRESS
1 0.44 ms bogon (192.168.20.143)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 94.30 seconds

开放了22，80，8585端口，内核版本认为是Linux4.x或5.x的版本，在80端口处提示了一个域名，那我们将域名和ip地址手动进行绑定一下