当前位置: 首页 > java >正文

oscp练习 PG Wombo

端口扫描

sudo nmap -Pn -n 192.168.125.69 -sU --top-ports=100 --reason
22/tcp    open   ssh        OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
| ssh-hostkey: 
|   2048 09:80:39:ef:3f:61:a8:d9:e6:fb:04:94:23:c9:ef:a8 (RSA)
|   256 83:f8:6f:50:7a:62:05:aa:15:44:10:f5:4a:c2:f5:a6 (ECDSA)
|_  256 1e:2b:13:30:5c:f1:31:15:b4:e8:f3:d2:c4:e8:05:b5 (ED25519)
53/tcp    closed domain
80/tcp    open   http       nginx 1.10.3
|_http-server-header: nginx/1.10.3
|_http-title: Welcome to nginx!
6379/tcp  open   redis      Redis key-value store 5.0.9
8080/tcp  open   http-proxy
|_http-title: Home | NodeBB
| fingerprint-strings: 
|   FourOhFourRequest: 
|     HTTP/1.1 404 Not Found
|     X-DNS-Prefetch-Control: off
|     X-Frame-Options: SAMEORIGIN
|     X-Download-Options: noopen
|     X-Content-Type-Options: nosniff
|     X-XSS-Protection: 1; mode=block
|     Referrer-Policy: strict-origin-when-cross-origin
|     X-Powered-By: NodeBB
|     set-cookie: _csrf=AKRIejeFqOf19DWJSKTOTeBQ; Path=/
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 11098
|     ETag: W/"2b5a-+XmglaYJQtF8oIwSJpWsPvdAhFE"
|     Vary: Accept-Encoding
|     Date: Sun, 01 Jun 2025 09:47:22 GMT
|     Connection: close
|     <!DOCTYPE html>
|     <html lang="en-GB" data-dir="ltr" style="direction: ltr;" >
|     <head>
|     <title>Not Found | NodeBB</title>
|     <meta name="viewport" content="width&#x3D;device-width, initial-scale&#x3D;1.0" />
|     <meta name="content-type" content="text/html; charset=UTF-8" />
|     <meta name="apple-mobile-web-app-capable" content="yes" />
|     <meta name="mobile-web-app-capable" content="yes" />
|     <meta property="og:site_n
|   GetRequest: 
|     HTTP/1.1 200 OK
|     X-DNS-Prefetch-Control: off
|     X-Frame-Options: SAMEORIGIN
|     X-Download-Options: noopen
|     X-Content-Type-Options: nosniff
|     X-XSS-Protection: 1; mode=block
|     Referrer-Policy: strict-origin-when-cross-origin
|     X-Powered-By: NodeBB
|     set-cookie: _csrf=V4koJZZNnpkNcNGLM5nPzBhp; Path=/
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 18181
|     ETag: W/"4705-JOnG/gj4ZMZr6OpzkjLBOjKBlZ4"
|     Vary: Accept-Encoding
|     Date: Sun, 01 Jun 2025 09:47:21 GMT
|     Connection: close
|     <!DOCTYPE html>
|     <html lang="en-GB" data-dir="ltr" style="direction: ltr;" >
|     <head>
|     <title>Home | NodeBB</title>
|     <meta name="viewport" content="width&#x3D;device-width, initial-scale&#x3D;1.0" />
|     <meta name="content-type" content="text/html; charset=UTF-8" />
|     <meta name="apple-mobile-web-app-capable" content="yes" />
|     <meta name="mobile-web-app-capable" content="yes" />
|     <meta property="og:site_name" content
|   HTTPOptions: 
|     HTTP/1.1 200 OK
|     X-DNS-Prefetch-Control: off
|     X-Frame-Options: SAMEORIGIN
|     X-Download-Options: noopen
|     X-Content-Type-Options: nosniff
|     X-XSS-Protection: 1; mode=block
|     Referrer-Policy: strict-origin-when-cross-origin
|     X-Powered-By: NodeBB
|     Allow: GET,HEAD
|     Content-Type: text/html; charset=utf-8
|     Content-Length: 8
|     ETag: W/"8-ZRAf8oNBS3Bjb/SU2GYZCmbtmXg"
|     Vary: Accept-Encoding
|     Date: Sun, 01 Jun 2025 09:47:22 GMT
|     Connection: close
|     GET,HEAD
|   RTSPRequest: 
|     HTTP/1.1 400 Bad Request
|_    Connection: close
| http-robots.txt: 3 disallowed entries 
|_/admin/ /reset/ /compose
27017/tcp open   mongodb    MongoDB 4.0.18 4.1.1 - 5.0
| mongodb-info: 
|   MongoDB Build info
|     modules
|     maxBsonObjectSize = 16777216
|     sysInfo = deprecated
|     debug = false
|     ok = 1.0
|     openssl
|       compiled = OpenSSL 1.1.0l  10 Sep 2019
|       running = OpenSSL 1.1.0l  10 Sep 2019
|     versionArray
|       2 = 18
|       1 = 0
|       0 = 4
|       3 = 0
|     bits = 64
|     version = 4.0.18
|     storageEngines
|       2 = mmapv1
|       1 = ephemeralForTest
|       0 = devnull
|       3 = wiredTiger
|     gitVersion = 6883bdfb8b8cff32176b1fd176df04da9165fd67
|     javascriptEngine = mozjs
|     allocator = tcmalloc
|     buildEnvironment
|       cxx = /opt/mongodbtoolchain/v2/bin/g++: g++ (GCC) 5.4.0
|       target_arch = x86_64
|       distarch = x86_64
|       linkflags = -pthread -Wl,-z,now -rdynamic -Wl,--fatal-warnings -fstack-protector-strong -fuse-ld=gold -Wl,--build-id -Wl,--hash-style=gnu -Wl,-z,noexecstack -Wl,--warn-execstack -Wl,-z,relro
|       cxxflags = -Woverloaded-virtual -Wno-maybe-uninitialized -std=c++14
|       target_os = linux
|       distmod = debian92
|       ccflags = -fno-omit-frame-pointer -fno-strict-aliasing -ggdb -pthread -Wall -Wsign-compare -Wno-unknown-pragmas -Winvalid-pch -Werror -O2 -Wno-unused-local-typedefs -Wno-unused-function -Wno-deprecated-declarations -Wno-unused-but-set-variable -Wno-missing-braces -fstack-protector-strong -fno-builtin-memcmp
|       cc = /opt/mongodbtoolchain/v2/bin/gcc: gcc (GCC) 5.4.0
|   Server status
|     code = 13
|     ok = 0.0
|     codeName = Unauthorized
|_    errmsg = command serverStatus requires authentication
| mongodb-databases: 
|   code = 13
|   ok = 0.0
|   codeName = Unauthorized
|_  errmsg = command listDatabases requires authentication

udp
在这里插入图片描述
可以看见有多个端口和服务开启

枚举

在这里插入图片描述
redis可以直接连接
在这里插入图片描述
发现5.x有一个rce利用,目前nmap显示redis版本为5.0.9
在这里插入图片描述
这里尝试了多个利用工具才成功
在这里插入图片描述
已经是root

http://www.xdnf.cn/news/10541.html

相关文章:

  • 「完整」AI文档库 | 5月20最新发布,221页,《北京大学AI+Agent与Agentic+AI的原理和应用洞察与未来展望》
  • ChatOn:智能AI聊天助手,开启高效互动新时代
  • pikachu靶场通关笔记09 XSS关卡05-DOM型XSS-X
  • 第18讲、Odoo接口开发详解:原理、类型与实践
  • 【软件测试】火狐驱动下载镜像
  • Golang学习之旅
  • linux驱动 - 5: simple usb device驱动
  • 小白的进阶之路系列之十----人工智能从初步到精通pytorch综合运用的讲解第三部分
  • CppCon 2014 学习:Exception-Safe Coding
  • [免费]微信小程序网上花店系统(SpringBoot后端+Vue管理端)【论文+源码+SQL脚本】
  • Cesium快速入门到精通系列教程四:加载渲染GEOJSON数据
  • BA-SAM: 用于 Segment Anything 模型的可扩展偏置模式注意力掩码
  • vue-13(延迟加载路由)
  • Oracle的Hint
  • 2025/6月最新Cursor(0.50.5版本)一键自动更换邮箱无限续杯教程
  • Spring 5 响应式编程:构建高性能全栈应用的关键
  • 数据库系统概论(十二)SQL 基于派生表的查询 超详细讲解(附带例题表格对比带你一步步掌握)
  • MySQL-多表关系、多表查询
  • Qt OpenGL 相机实现
  • 机器学习算法:逻辑回归
  • 操作系统复习
  • 方法重写与方法重载详解
  • CSS之动画(奔跑的熊、两面反转盒子、3D导航栏、旋转木马)
  • 谷歌CEO皮查伊眼中的“下一代平台“与未来图景
  • 基于FPGA的VGA显示文字和动态数字基础例程,进而动态显示数据,类似温湿度等
  • Pyomo中线性规划接口的使用
  • 为什么ping显示connect:network is unreachable,如何排查网络不通问题?
  • LearnOpenGL-笔记-其十三
  • py爬虫的话,selenium是不是能完全取代requests?
  • NodeJS全栈WEB3面试题——P2智能合约与 Solidity