0x00 前期交互及信息收集
由于是对内网直接进行大扫描,所以直接判断这不仅是一个 Web 服务器(多个),同时还运行着 FTP、数据库。
在此,再次使用 nmap 扫描一次,结果如下:
$ sudo nmap -T4 -n -sS -sV -O 192.168.3.72
Nmap scan report for 192.168.3.72
Host is up (0.00076s latency).
Not shown: 974 closed ports
PORT STATE SERVICE VERSION
7/tcp open echo
9/tcp open discard?
13/tcp open daytime?
17/tcp open qotd Windows qotd (English)
19/tcp open chargen
21/tcp open ftp FileZilla ftpd
42/tcp open tcpwrapped
80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
999/tcp open http Apache httpd 2.4.33 ((Win32) OpenSSL/1.0.2o mod_fcgid/2.3.9 mod_jk/1.2.40)
1801/tcp open msmq?
2107/tcp open msrpc Microsoft Windows RPC
2383/tcp open ms-olap4?
3306/tcp open mysql MySQL 5.5.19
3389/tcp open ms-wbt-server?
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
8080/tcp open http Apache Tomcat/Coyote JSP engine 1.1
8082/tcp open http Microsoft IIS httpd 7.5
49152/tcp open msrpc Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port13-TCP:V=7.70%I=7%D=8/13%Time=5D53656C%P=x86_64-unknown-linux-gnu%r
SF:(NULL,12,"23:35:37\x202019/8/13\n")%r(NCP,12,"23:35:37\x202019/8/13\n");
Device type: general purpose
Running: Microsoft Windows Vista|2008|7
OS CPE: cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_vista::sp2 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_7
OS details: Microsoft Windows Vista SP1 - SP2, Windows Server 2008 SP2, or Windows 7
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows