Vulnhub-dc5

靶场下载

https://download.vulnhub.com/dc/DC-5.zip

信息收集

# nmap -sn 192.168.1.0/24 -oN live.port
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-21 20:56 CST
Nmap scan report for 192.168.1.1 (192.168.1.1)
Host is up (0.00057s latency).
MAC Address: 00:50:56:C0:00:08 (VMware)
Nmap scan report for 0bcc61d9e6ea39148e78c7c68571e53 (192.168.1.2)
Host is up (0.00036s latency).
MAC Address: 00:50:56:FE:B1:6F (VMware)
Nmap scan report for 192.168.1.92 (192.168.1.92)
Host is up (0.00028s latency).
MAC Address: 00:0C:29:45:22:BD (VMware)
Nmap scan report for 192.168.1.254 (192.168.1.254)
Host is up (0.00021s latency).
MAC Address: 00:50:56:F3:42:A3 (VMware)
Nmap scan report for 192.168.1.60 (192.168.1.60)
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 1.98 seconds

判断到存活主机的IP地址为192.168.1.92

# nmap -sT --min-rate 10000 -p- 192.168.1.92 -oN port.nmap 
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-21 20:56 CST
Nmap scan report for 192.168.1.92 (192.168.1.92)
Host is up (0.0037s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT      STATE SERVICE
80/tcp    open  http
111/tcp   open  rpcbind
38242/tcp open  unknown
MAC Address: 00:0C:29:45:22:BD (VMware)

开放端口信息为80 111 38242 其中111端口是远程过程调用探测一下UDP端口信息：

# nmap -sU --min-rate 10000 -p- 192.168.1.92 -oN UDP.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-21 20:58 CST
Warning: 192.168.1.92 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.1.92 (192.168.1.92)
Host is up (0.00086s latency).
Not shown: 65455 open|filtered udp ports (no-response), 78 closed udp ports (port-unreach)
PORT      STATE SERVICE
111/udp   open  rpcbind
35126/udp open  unknown
MAC Address: 00:0C:29:45:22:BD (VMware)

Nmap done: 1 IP address (1 host up) scanned in 72.80 seconds

UDP端口探测，会发现开放了两个端口：分别是111 端口和 35126端口！

# nmap -sT -sC -sV -O -p80,111,38242 192.168.1.92 -oN details.nmap
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-21 20:58 CST
Nmap scan report for 192.168.1.92 (192.168.1.92)
Host is up (0.00047s latency).

PORT      STATE SERVICE VERSION
80/tcp    open  http    nginx 1.6.2
|_http-title: Welcome
|_http-server-header: nginx/1.6.2
111/tcp   open  rpcbind 2-4 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  3,4          111/tcp6  rpcbind
|   100000  3,4          111/udp6  rpcbind
|   100024  1          35126/udp   status
|   100024  1          38242/tcp   status
|   100024  1          48330/tcp6  status
|_  100024  1          52887/udp6  status
38242/tcp open  status  1 (RPC #100024)
MAC Address: 00:0C:29:45:22:BD (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.2 - 4.9 (98%), Linux 3.10 - 4.11 (94%), Linux 3.13 (94%), OpenWrt Chaos Calmer 15.05 (Linux 3.18) or Designated Driver (Linux 4.1 or 4.4) (94%), Linux 4.10 (94%), Linux 3.2 - 3.16 (94%), Android 5.0 - 6.0.1 (Linux 3.4) (93%), Linux 3.2 - 3.10 (93%), Linux 4.2 (93%), Linux 3.13 - 3.16 (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop

端口详细信息探测，80端口上是nginx 1.6.2 剩下的两个端口便是rpc的相关服务

# nmap -sT --script=vuln -p80,111,35242 192.168.1.92 -oN vuln.nmap 
Starting Nmap 7.94 ( https://nmap.org ) at 2024-01-21 21:00 CST
Pre-scan script results:
| broadcast-avahi-dos: 
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
Nmap scan report for 192.168.1.92 (192.168.1.92)
Host is up (0.00034s latency).

PORT      STATE  SERVICE
80/tcp    open   http
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.1.92
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://192.168.1.92:80/contact.php
|     Form id: fname
|_    Form action: thankyou.php
|_http-dombased-xss: Couldn't find any DOM based XSS.
111/tcp   open   rpcbind
35242/tcp closed unknown
MAC Address: 00:0C:29:45:22:BD (VMware)

默认漏洞脚本信息的探测结果没什么价值信息，csrf漏洞在我们渗透测试过程中，难以利用；这里还是先在80端口上寻找突破点！