Hackmyvm on HYH's Blog

HackMyVM-Silentdev

Fri, 05 Sep 2025 00:00:00 +0000

the writeup of silentdev in Hackmyvm

HackMyVM-Lazzycorp

Tue, 19 Aug 2025 00:00:00 +0000

the writeup of lazzycorp in hackmyvm.

HackMyVM-Takedown

Thu, 31 Jul 2025 00:00:00 +0000

the writeup of Takedown in hackmyvm, SSTI, RSA

HackMyVM-Sabulaji

Fri, 13 Jun 2025 00:00:00 +0000

writeup of sabulaji in hackmyvm.eu

HackMyVM-Umz

Wed, 04 Jun 2025 00:00:00 +0000

Box Info

OS	Difficulty
Linux	Easy

Nmap

[root@kali] /home/kali/Umz  
❯ nmap 192.168.55.73 -sV -A -p-                                                                                                            
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
|   3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
|   256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_  256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
|_http-title: cyber fortress 9000
|_http-server-header: Apache/2.4.62 (Debian)

Dirsearch

[root@kali] /home/kali/Umz  
❯ dirsearch -u http://192.168.55.73                                      

  _|. _ _  _  _  _ _|_    v0.4.3                                                                                                                
 (_||| _) (/_(_|| (_| )                                                                                                                         
                                                                                                                                                
Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12289

Target: http://192.168.55.73/

[02:39:29] Scanning:                                                                                                                            
[02:39:30] 403 -   278B - /.php                                             
[02:39:38] 200 -    3KB - /index.html                                       
[02:39:38] 200 -    3KB - /index.php                                        
[02:39:38] 200 -    3KB - /index.php/login/                                 
[02:39:43] 403 -   278B - /server-status/                                   
[02:39:43] 403 -   278B - /server-status
                                                                             
Task Completed

Request Flood

来到index.php，可以看到过多请求会触发某种机制

HackMyVM-Homelab

Sat, 17 May 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Medium

Nmap

[root@kali] /home/kali/homelab  
❯ nmap 192.168.55.41 -sV -A -p- 

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.62 ((Unix))
|_http-favicon: Apache on Mac OS X
|_http-title: Mac OS X Server
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Apache/2.4.62 (Unix)

只有80端口开放了

Dir Fuzz

[root@kali] /home/kali/homelab  
❯ dirsearch -u http://192.168.55.41  

  _|. _ _  _  _  _ _|_    v0.4.3                                                                                                                
 (_||| _) (/_(_|| (_| )                                                                                                                         
                                                                                                                                                
Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25 | Wordlist size: 12289

Target: http://192.168.55.41/

[04:47:54] Scanning:                                                                                                                            
[04:48:00] 200 - 820B - /cgi-bin/printenv                                 
[04:48:00] 200 - 1KB - /cgi-bin/test-cgi                                 
[04:48:01] 200 - 4KB - /error.html                                       
[04:48:01] 200 - 8KB - /favicon.ico                                      
[04:48:02] 200 - 5KB - /index.html                                       
[04:48:05] 301 - 313B - /script  ->  http://192.168.55.41/script/         
[04:48:05] 403 - 276B - /script/
[04:48:06] 301 - 314B - /service  ->  http://192.168.55.41/service/       
[04:48:06] 301 - 319B - /service?Wsdl  ->  http://192.168.55.41/service/?Wsdl
[04:48:06] 301 - 312B - /style  ->  http://192.168.55.41/style/           
[04:48:10] 403 - 276B - /server-status/                                    
[04:48:11] 403 - 276B - /server-status

Task Completed                                                                                                                                  

[root@kali] /home/kali/homelab  
❯ curl http://192.168.55.41/service/      
Whoa! But sorry, this service is only available for myself!#

看到有一个service路径，但是好像需要认证

HackMyVM-Pycrt

Sun, 11 May 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Medium

Nmap

[root@kali] /home/kali/pycrt  
❯ nmap 192.168.55.36 -sV -A -p- 

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
|   3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
|   256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
|_  256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
80/tcp   open  http    Apache httpd 2.4.62 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.62 (Debian)
6667/tcp open  irc
| irc-info: 
|   users: 1
|   servers: 1
|   chans: 0
|   lusers: 1
|   lservers: 0
|   server: irc.local
|   version: InspIRCd-3. irc.local 
|   source ident: nmap
|   source host: 192.168.55.4
|_  error: Closing link: (nmap@192.168.55.4) [Client exited]

80端口没有可以利用的信息，只是一个静态页面

HackMyVM-Immortal

Sat, 26 Apr 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Medium

Nmap

[root@kali] /home/kali/immportal  
❯ nmap 192.168.55.17 -sV -A -p- 

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:192.168.55.4
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r-- 1 0        0             504 Feb 27  2024 message.txt
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
| ssh-hostkey: 
|   3072 e8:79:ad:8b:d1:a8:39:1b:ac:ed:52:ef:d0:22:0e:eb (RSA)
|   256 65:df:6d:1d:49:11:bd:f3:2f:fa:10:0c:3b:48:69:39 (ECDSA)
|_  256 f6:b7:bf:cf:a5:d5:1b:26:4e:13:08:31:07:d5:79:b1 (ED25519)
80/tcp open  http    Apache httpd 2.4.56 ((Debian))
|_http-title: Password
|_http-server-header: Apache/2.4.56 (Debian)

Own www-data

HackMyVM-Up

Sat, 26 Apr 2025 00:00:00 +0000

Box Info

OS	Linux
Diffculty	Easy

Nmap

[root@kali] /home/kali/up  
❯ nmap 192.168.55.16 -sV -A -p-

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: RodGar - Subir Imagen

进入之后是一个上传页面，经过测试没有漏洞

Feroxbuster

[root@kali] /home/kali/up  
❯ feroxbuster -u 'http://192.168.55.16/' -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt
                                                                                                                                                
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://192.168.55.16/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php, txt]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
403      GET        9l       28w      278c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
404      GET        9l       31w      275c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      150l      388w     4489c http://192.168.55.16/
301      GET        9l       28w      316c http://192.168.55.16/uploads => http://192.168.55.16/uploads/
301      GET        9l       28w      319c http://192.168.55.16/javascript => http://192.168.55.16/javascript/
200      GET      150l      388w     4489c http://192.168.55.16/index.php
403      GET       31l       94w      964c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET        1l        1w     1301c http://192.168.55.16/uploads/robots.txt
301      GET        9l       28w      329c http://192.168.55.16/javascript/clipboard => http://192.168.55.16/javascript/clipboard/
200      GET      858l     3081w    26377c http://192.168.55.16/javascript/clipboard/clipboard

Own www-data

注意到**/uploads下还有一个robots.txt**，经过解码得到源码

HackMyVM-Mathdop

Thu, 24 Apr 2025 00:00:00 +0000

Box Info

OS	Linux
Difficult	Easy

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.55.13 -sV -A -p-

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.4 (protocol 2.0)
| ssh-hostkey: 
|   2048 ac:78:16:74:49:a1:68:9d:54:84:8a:59:e9:38:10:bc (RSA)
|   256 06:0c:4d:9d:2c:32:43:d2:3d:f7:4f:82:c8:15:85:60 (ECDSA)
|_  256 3b:cd:fc:1f:dd:48:0f:ee:17:78:9a:f1:09:cb:8c:ec (ED25519)
7577/tcp open  http    Apache Tomcat (language: en)
| http-title: Site doesn't have a title (application/hal+json).
|_Requested resource was http://192.168.55.13:7577/api
| http-methods: 
|_  Potentially risky methods: PUT PATCH DELETE
9393/tcp open  http    Apache Tomcat (language: en)
| http-methods: 
|_  Potentially risky methods: PUT PATCH DELETE
|_http-title: Site doesn't have a title (application/hal+json).

CVE-2024-37084

进入到9393端口的dashboard

HackMyVM-Atom

Tue, 22 Apr 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Easy

Nmap

[root@kali] /home/kali/atom  
❯ nmap 192.168.55.12 -sV -A -p-

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey: 
|   256 e7:ce:f2:f6:5d:a7:47:5a:16:2f:90:07:07:33:4e:a9 (ECDSA)
|_  256 09:db:b7:e8:ee:d4:52:b8:49:c3:cc:29:a5:6e:07:35 (ED25519)

只有22端口开放？有趣

扫一下UDP端口

[root@kali] /home/kali/atom  
❯ nmap 192.168.55.12 -sU --top-ports 100                                                                                                      ⏎

PORT    STATE SERVICE
623/udp open  asf-rmcp

IPMI

IPMI（智能平台管理接口）能够横跨不同的操作系统、固件和硬件平台，可以智能的监视、控制和自动回报大量服务器的运作状况，以降低服务器系统成本。

HackMyVM-HackingToys

Mon, 21 Apr 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Medium

Nmap

[root@kali] /home/kali/hackingtoys  
❯ nmap 192.168.55.10 -sV -A -p-

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey: 
|   256 e7:ce:f2:f6:5d:a7:47:5a:16:2f:90:07:07:33:4e:a9 (ECDSA)
|_  256 09:db:b7:e8:ee:d4:52:b8:49:c3:cc:29:a5:6e:07:35 (ED25519)
3000/tcp open  ssl/ppp?
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: organizationName=Internet Widgits Pty Ltd/stateOrProvinceName=Some-State/countryName=FR
| Not valid before: 2024-05-20T15:36:20
|_Not valid after:  2038-01-27T15:36:20
| fingerprint-strings: 
|   GenericLines: 
|     HTTP/1.0 400 Bad Request
|     Content-Length: 930
|     Puma caught this error: Invalid HTTP format, parsing fails. Are you trying to open an SSL connection to a non-SSL Puma? (Puma::HttpParserError)
|     /usr/local/rvm/gems/ruby-3.1.0/gems/puma-6.4.2/lib/puma/client.rb:268:in `execute'
|     /usr/local/rvm/gems/ruby-3.1.0/gems/puma-6.4.2/lib/puma/client.rb:268:in `try_to_finish'
|     /usr/local/rvm/gems/ruby-3.1.0/gems/puma-6.4.2/lib/puma/server.rb:298:in `reactor_wakeup'
|     /usr/local/rvm/gems/ruby-3.1.0/gems/puma-6.4.2/lib/puma/server.rb:248:in `block in run'
|     /usr/local/rvm/gems/ruby-3.1.0/gems/puma-6.4.2/lib/puma/reactor.rb:119:in `wakeup!'
|     /usr/local/rvm/gems/ruby-3.1.0/gems/puma-6.4.2/lib/puma/reactor.rb:76:in `block in select_loop'
|     /usr/local/rvm/gems/ruby-3.1.0/gems/puma-6.4.2/lib/puma/reactor.rb:76:in `select'
|     /usr/local/rvm/gems/ruby-3.1.0/gems/puma-6.4.2/lib/puma/reactor.rb:76:in `select_loop'
|     /usr/loc
|   GetRequest: 
|     HTTP/1.0 403 Forbidden
|     content-type: text/html; charset=UTF-8
|     Content-Length: 5702
|     <!DOCTYPE html>
|     <html lang="en">
|     <head>
|     <meta charset="utf-8" />
|     <meta name="viewport" content="width=device-width, initial-scale=1">
|     <meta name="turbo-visit-control" content="reload">
|     <title>Action Controller: Exception caught</title>
|     <style>
|     body {
|     background-color: #FAFAFA;
|     color: #333;
|     color-scheme: light dark;
|     supported-color-schemes: light dark;
|     margin: 0px;
|     body, p, ol, ul, td {
|     font-family: helvetica, verdana, arial, sans-serif;
|     font-size: 13px;
|     line-height: 18px;
|     font-size: 11px;
|     white-space: pre-wrap;
|     pre.box {
|     border: 1px solid #EEE;
|     padding: 10px;
|     margin: 0px;
|     width: 958px;
|     header {
|     color: #F0F0F0;
|     background: #C00;
|_    padding:

查看3000端口服务，是Ruby on rails

HackMyVM-Pwned

Sun, 20 Apr 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Easy

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.56.158 -sV -A -p- 

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 fe:cd:90:19:74:91:ae:f5:64:a8:a5:e8:6f:6e:ef:7e (RSA)
|   256 81:32:93:bd:ed:9b:e7:98:af:25:06:79:5f:de:91:5d (ECDSA)
|_  256 dd:72:74:5d:4d:2d:a3:62:3e:81:af:09:51:e0:14:4a (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Pwned....!!

Feroxbuster

[root@kali] /home/kali/pwned  
❯ feroxbuster -u http://192.168.55.6/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -x php,txt
                                                                                                                             
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.11.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ http://192.168.55.6/
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.11.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 💲  Extensions            │ [php, txt]
 🏁  HTTP methods          │ [GET]
 🔃  Recursion Depth       │ 4
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        9l       31w      274c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter                                                                                                                   
403      GET        9l       28w      277c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter                                                                                                                   
200      GET       16l       27w      194c http://192.168.55.6/nothing/nothing.html
200      GET       75l      191w     3065c http://192.168.55.6/
200      GET        4l        7w       41c http://192.168.55.6/robots.txt
301      GET        9l       28w      314c http://192.168.55.6/nothing => http://192.168.55.6/nothing/
301      GET        9l       28w      318c http://192.168.55.6/hidden_text => http://192.168.55.6/hidden_text/
200      GET       22l       21w      211c http://192.168.55.6/hidden_text/secret.dic

下载这个dic用作扫描字典

HackMyVM-Gift

Sat, 19 Apr 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Easy

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.56.157 -sV -A -p- 

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.3 (protocol 2.0)
| ssh-hostkey: 
|   3072 2c:1b:36:27:e5:4c:52:7b:3e:10:94:41:39:ef:b2:95 (RSA)
|   256 93:c1:1e:32:24:0e:34:d9:02:0e:ff:c3:9c:59:9b:dd (ECDSA)
|_  256 81:ab:36:ec:b1:2b:5c:d2:86:55:12:0c:51:00:27:d7 (ED25519)
80/tcp open  http    nginx
|_http-title: Site doesn't have a title (text/html).

目录扫描失败

[root@kali] /home/kali  
❯ curl "http://192.168.56.157/" -v  
*   Trying 192.168.56.157:80...
* Connected to 192.168.56.157 (192.168.56.157) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: 192.168.56.157
> User-Agent: curl/8.12.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 200 OK
< Server: nginx
< Date: Sat, 19 Apr 2025 06:42:57 GMT
< Content-Type: text/html
< Content-Length: 57
< Last-Modified: Sun, 20 Sep 2020 16:29:39 GMT
< Connection: keep-alive
< ETag: "5f678373-39"
< Accept-Ranges: bytes
< 

Dont Overthink. Really, Its simple.
        <!-- Trust me -->

* Connection #0 to host 192.168.56.157 left intact

Hydra to ssh

尝试使用simple爆破登录

HackMyVM-buster

Thu, 17 Apr 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Easy

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.56.151 -sV -A                                                                                                                              

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u4 (protocol 2.0)
| ssh-hostkey: 
|   2048 c2:91:d9:a5:f7:a3:98:1f:c1:4a:70:28:aa:ba:a4:10 (RSA)
|   256 3e:1f:c9:eb:c0:6f:24:06:fc:52:5f:2f:1b:35:33:ec (ECDSA)
|_  256 ec:64:87:04:9a:4b:32:fe:2d:1f:9a:b0:81:d3:7c:cf (ED25519)
80/tcp open  http    nginx 1.14.2
| http-robots.txt: 1 disallowed entry 
|_/wp-admin/
|_http-server-header: nginx/1.14.2
|_http-generator: WordPress 6.7.1
|_http-title: bammmmuwe

直接就扫到了wordpress目录

HackMyVM-jan

Wed, 09 Apr 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Easy

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.56.144  -p-

PORT     STATE SERVICE
22/tcp   open  ssh
8080/tcp open  http-proxy

Gobuster

[root@kali] /home/kali  
❯ gobuster dir -u http://192.168.56.144:8080/ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -x php,html,txt --exclude-length 45
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.144:8080/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] Exclude Length:          45
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,html,txt
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/redirect             (Status: 400) [Size: 24]
/robots.txt           (Status: 200) [Size: 16]
Progress: 97322 / 882244 (11.03%)^C
[!] Keyboard interrupt detected, terminating.
Progress: 100724 / 882244 (11.42%)
===============================================================
Finished
===============================================================

发现一个**/redirect路由，并且需要url**参数

HackMyVM-Todd

Wed, 02 Apr 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Easy

Nmap

[root@kali] /home/kali/Todd  
❯ nmap 192.168.56.137 -sV -A  -p-

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 93:a4:92:55:72:2b:9b:4a:52:66:5c:af:a9:83:3c:fd (RSA)
|   256 1e:a7:44:0b:2c:1b:0d:77:83:df:1d:9f:0e:30:08:4d (ECDSA)
|_  256 d0:fa:9d:76:77:42:6f:91:d3:bd:b5:44:72:a7:c9:71 (ED25519)
80/tcp open  http    Apache httpd 2.4.59 ((Debian))
|_http-title: Mindful Listening
|_http-server-header: Apache/2.4.59 (Debian)

页面没有任何可以用的信息

然后再次进行Nmap，发现多了几个端口

HackMyVM-KrustyKrab

Thu, 27 Mar 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Easy

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.56.131 -sV -A  -p-

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2 (protocol 2.0)
| ssh-hostkey: 
|   256 f6:91:6b:ad:ea:ad:1d:b9:44:09:d8:74:a3:02:38:35 (ECDSA)
|_  256 b6:66:2f:f0:4c:26:7f:7d:14:ea:b3:62:09:64:a7:94 (ED25519)
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.62 (Debian)

进入80端口查看，是一个apache默认页

HackMyVM-SingDanceRap

Wed, 12 Mar 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Hard

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.56.116 -sV -A -p-

PORT      STATE    SERVICE VERSION
22/tcp    open     ssh     OpenSSH 7.9p1 Debian 10+deb10u4 (protocol 2.0)
| ssh-hostkey: 
|   2048 5d:41:2a:c1:2d:3b:6c:78:b3:af:ae:9d:42:fe:88:b8 (RSA)
|   256 3c:e9:64:eb:84:fe:5c:83:94:07:27:6c:12:14:c8:4c (ECDSA)
|_  256 09:9b:2b:18:de:6c:6d:f8:8b:15:df:6c:0f:c0:7c:b2 (ED25519)
80/tcp    open     http    Apache httpd 2.4.59 ((Debian))
|_http-server-header: Apache/2.4.59 (Debian)
|_http-title: News Website
65000/tcp filtered unknown

Gobuster

[root@kali] /home/kali  
❯ gobuster dir -u http://192.168.56.116/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50  -x php,html,txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.116/
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              php,html,txt
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.php                 (Status: 403) [Size: 279]
/index.html           (Status: 200) [Size: 3118]
/news.php             (Status: 200) [Size: 1301]
/.html                (Status: 403) [Size: 279]
/.php                 (Status: 403) [Size: 279]
/.html                (Status: 403) [Size: 279]
/littlesecrets        (Status: 301) [Size: 324] [--> http://192.168.56.116/littlesecrets/]
/server-status        (Status: 403) [Size: 279]
Progress: 882240 / 882244 (100.00%)
===============================================================
Finished
===============================================================

针对这个**/littlesecrets**再次进行扫描

HackMyVM-Matrioshka

Mon, 10 Mar 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Medium

Nmap

[root@kali] /home/kali/Matrioshka  
❯ nmap 192.168.56.108 -sV -A -p- -T4                     

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 b5:a4:7c:65:5c:1f:d7:89:42:bd:76:df:2c:8e:93:4e (ECDSA)
|_  256 5d:3d:2b:43:fc:89:fa:24:a3:f4:73:5f:7b:89:6c:e3 (ED25519)
80/tcp open  http    Apache httpd 2.4.61 ((Debian))
|_http-server-header: Apache/2.4.61 (Debian)
|_http-title: mamushka
MAC Address: 08:00:27:D5:7C:4C (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5
OS details: Linux 5.0 - 5.5
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

将mamushka.hmv添加到**/etc/hosts**

HackMyVM-Newbee

Sun, 09 Mar 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Easy

Nmap

[root@kali] /home/kali/debian  
❯ nmap 192.168.237.155 -sV -A -p- -T4

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0)
| ssh-hostkey: 
|   256 92:6e:6d:b0:bd:08:1e:db:9d:56:0e:f8:15:25:ca:21 (ECDSA)
|_  256 88:d7:08:bd:a2:95:75:cc:71:06:47:ae:fd:d3:8b:b9 (ED25519)
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
|_http-server-header: Apache/2.4.62 (Debian)
|_http-title: PHPJabbers.com | Free Food Store Website Template
MAC Address: 00:0C:29:0A:FF:81 (VMware)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.8
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

ParamScan

访问80端口，在网页注释中发现存在GET参数

HackMyVm-easypwn

Fri, 07 Mar 2025 00:00:00 +0000

Box Info

OS	Linux
Difficulty	Medium

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.56.105 -sV -A -Pn -T4 -p-
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-03 14:36 CST
Nmap scan report for 192.168.56.105
Host is up (0.00024s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 93:a4:92:55:72:2b:9b:4a:52:66:5c:af:a9:83:3c:fd (RSA)
|   256 1e:a7:44:0b:2c:1b:0d:77:83:df:1d:9f:0e:30:08:4d (ECDSA)
|_  256 d0:fa:9d:76:77:42:6f:91:d3:bd:b5:44:72:a7:c9:71 (ED25519)
80/tcp   open  http    Apache httpd 2.4.59 ((Debian))
|_http-title: Don't Hack Me
|_http-server-header: Apache/2.4.59 (Debian)
6666/tcp open  irc?
| fingerprint-strings: 
|   Help, Socks4, Socks5: 
|     Hackers, get out of my machine
|   beast2: 
|_    start: 11
|_irc-info: Unable to open connection

6666端口只能用nc连接，进入80端口发现需要扫描目录

HackMyVm-DC02

Mon, 03 Mar 2025 00:00:00 +0000

Box Info

OS	Windows
Difficulty	Medium

Nmap

[root@kali] /home/kali  
❯ nmap 192.168.56.126 -sV -Pn -T4  
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-02 18:44 CST
Nmap scan report for 192.168.56.126
Host is up (0.00028s latency).
Not shown: 989 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-03-02 23:47:04Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
MAC Address: 08:00:27:4E:CF:21 (Oracle VirtualBox virtual NIC)
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.84 seconds

把SOUPEDECODE.LOCAL、DC01.SOUPEDECODE.LOCAL添加到**/etc/hosts**

HackMyVM-DC03

Sat, 01 Mar 2025 00:00:00 +0000

Box Info

OS	Windows
Difficulty	Medium

Nmap

[root@kali] /home/kali/Desktop  
❯ nmap 192.168.56.103 -sSV -Pn -A -T4

PORT     STATE SERVICE       VERSION
53/tcp   open  domain?
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-03-02 03:01:34Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
MAC Address: 08:00:27:46:72:D1 (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|11|2016 (97%)
OS CPE: cpe:/o:microsoft:windows_server_2016
Aggressive OS guesses: Microsoft Windows Server 2022 (97%), Microsoft Windows 11 21H2 (91%), Microsoft Windows Server 2016 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 14h59m36s
| smb2-time: 
|   date: 2025-03-02T03:03:53
|_  start_date: N/A
|_nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:46:72:d1 (Oracle VirtualBox virtual NIC)

把DC01.SOUPEDECODE.LOCAL添加到**/etc/hosts**