当前位置：首页 > news >正文

tryhackme--Anonymous靶场wp

news 2025/10/24 6:35:09

TryHackMe Anonymous

1.枚举计算机。有多少个端口打开？

nmap扫描目标端口情况.

nmap -sC -sV 10.201.56.165
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-10 14:23 CST
Nmap scan report for 10.201.56.165
Host is up (0.29s latency).
Not shown: 996 closed tcp ports (reset)
PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 2.0.8 or later
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.9.0.110
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 2
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxrwxrwx    2 111      113          4096 Jun 04  2020 scripts [NSE: writeable]
22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 8b:ca:21:62:1c:2b:23:fa:6b:c6:1f:a8:13:fe:1c:68 (RSA)
|   256 95:89:a4:12:e2:e6:ab:90:5d:45:19:ff:41:5f:74:ce (ECDSA)
|_  256 e1:2a:96:a4:ea:8f:68:8f:cc:74:b8:f0:28:72:70:cd (ED25519)
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
Service Info: Host: ANONYMOUS; OS: Linux; CPE: cpe:/o:linux:linux_kernelHost script results:
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: anonymous
|   NetBIOS computer name: ANONYMOUS\x00
|   Domain name: \x00
|   FQDN: anonymous
|_  System time: 2025-08-10T06:23:37+00:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_nbstat: NetBIOS name: ANONYMOUS, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-08-10T06:23:37
|_  start_date: N/A

可以看出开放了4个端口：21、22、139、445

2.端口 21 上运行什么服务？

根据扫描结果可知为tcp服务

3.端口 139 和 445 上运行什么服务？

根据扫描结果可知139和445上开启了smb服务

4.用户的计算机上有一个共享。它叫什么？

已知开启了smb服务，使用smbclient进行smb服务渗透。

smbclient -L //10.201.56.165 -N进行匿名枚举共享。

可以看到存在pics共享文件夹。

4.user.txt

尝试匿名连接pics：smbclinet //10.201.56.165/pics -N

ls命令查看当前目录下的文件并通过get命令下载到本地查看

(但是并没有搜集到有用的信息）

还开放了21端口的匿名ftp登录服务，并且scripts目录具有可读写执行权限。

那我们尝试匿名登录它，用户名为anonymous（匿名），密码为空，并进入scripts目录，下载所有文件到本地进行分析。

可以看到一共有三个文件，首先是clean.sh：

#!/bin/bashtmp_files=0
echo $tmp_files
if [ $tmp_files=0 ]
thenecho "Running cleanup script:  nothing to delete" >> /var/ftp/scripts/removed_files.log
elsefor LINE in $tmp_files; dorm -rf /tmp/$LINE && echo "$(date) | Removed file /tmp/$LINE" >> /var/ftp/scripts/removed_files.log;done
fi

这是一个用于检查和清理/tmp目录下的文件的脚本，
而remove_files.log则是它的清理日志文件，
接下来是ro_do.txt：I really need to disable the anonymous login...it's really not safe

根据remove_files.log文件的内容来看，这个clean.bash应该是个定时运行的文件，没过一会就会执行文件清理脚本，而clean.sh又可写，那我们可以在里面写入反弹shell脚本，然后它就应该可以被执行。

写入反弹shell文件，并开启监听，等待一会即可得到反弹shell。