第一次打window 从简单的开始打起吧

nmap 
└─# nmap -p- -A 192.168.150.65

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-10 00:19 UTC

Stats: 0:04:38 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan

NSE Timing: About 97.50% done; ETC: 00:24 (0:00:00 remaining)

Nmap scan report for 192.168.150.65

Host is up (0.071s latency).

Not shown: 65520 closed tcp ports (reset)

PORT      STATE SERVICE       VERSION

21/tcp    open  ftp           Microsoft ftpd

| ftp-anon: Anonymous FTP login allowed (FTP code 230)

| 04-29-20  09:31PM       <DIR>          ImapRetrieval

| 12-09-24  04:19PM       <DIR>          Logs

| 04-29-20  09:31PM       <DIR>          PopRetrieval

|_04-29-20  09:32PM       <DIR>          Spool

| ftp-syst:

|_  SYST: Windows_NT

80/tcp    open  http          Microsoft IIS httpd 10.0

|_http-server-header: Microsoft-IIS/10.0

|_http-title: IIS Windows

| http-methods:

|_  Potentially risky methods: TRACE

135/tcp   open  msrpc         Microsoft Windows RPC

139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn

445/tcp   open  microsoft-ds?

5040/tcp  open  unknown

7680/tcp  open  pando-pub?

9998/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

| uptime-agent-info: HTTP/1.1 400 Bad Request\x0D

| Content-Type: text/html; charset=us-ascii\x0D

| Server: Microsoft-HTTPAPI/2.0\x0D

| Date: Tue, 10 Dec 2024 00:24:05 GMT\x0D

| Connection: close\x0D

| Content-Length: 326\x0D

| \x0D

| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">\x0D

| <HTML><HEAD><TITLE>Bad Request</TITLE>\x0D

| <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>\x0D

| <BODY><h2>Bad Request - Invalid Verb</h2>\x0D

| <hr><p>HTTP Error 400. The request verb is invalid.</p>\x0D

|_</BODY></HTML>\x0D

| http-title: Site doesn't have a title (text/html; charset=utf-8).

|_Requested resource was /interface/root

|_http-server-header: Microsoft-IIS/10.0

17001/tcp open  remoting      MS .NET Remoting services

49664/tcp open  msrpc         Microsoft Windows RPC

49665/tcp open  msrpc         Microsoft Windows RPC

49666/tcp open  msrpc         Microsoft Windows RPC

49667/tcp open  msrpc         Microsoft Windows RPC

49668/tcp open  msrpc         Microsoft Windows RPC

49669/tcp open  msrpc         Microsoft Windows RPC

No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

TCP/IP fingerprint:

OS:SCAN(V=7.94SVN%E=4%D=12/10%OT=21%CT=1%CU=43118%PV=Y%DS=4%DC=T%G=Y%TM=675

OS:78A35%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=1%ISR=109%TI=I%CI=I%TS=U)SEQ(

OS:SP=106%GCD=1%ISR=10A%TI=I%CI=I%TS=U)OPS(O1=M578NW8NNS%O2=M578NW8NNS%O3=M

OS:578NW8%O4=M578NW8NNS%O5=M578NW8NNS%O6=M578NNS)WIN(W1=FFFF%W2=FFFF%W3=FFF

OS:F%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M578NW8NNS%CC=N%Q=)

OS:T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=

OS:0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T

OS:6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=1

OS:64%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=N)

Network Distance: 4 hops

Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:

| smb2-security-mode:

|   3:1:1:

|_    Message signing enabled but not required

| smb2-time:

|   date: 2024-12-10T00:24:08

|_  start_date: N/A

TRACEROUTE (using port 1723/tcp)

HOP RTT      ADDRESS

1   69.46 ms 192.168.45.1

2   69.45 ms 192.168.45.254

3   70.07 ms 192.168.251.1

4   70.55 ms 192.168.150.65

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 292.72 seconds

访问9998端口



发现cms但是没版本

搜索exp 由于他是easy难度所以觉得应该不会太难

https://www.exploit-db.com/exploits/49216

尝试这个exp

成功 而且好像就是system了 不用提权

Algernon pg walkthrough Window的更多相关文章

  1. ZK 长时操作带进度条

    LongProcess.zul: <?xml version="1.0" encoding="UTF-8"?> <window id=&quo ...

  2. algernon 基于golang 的独立的支持redis lua pg。。。 的web server

    algernon 看到github 的介绍很很强大,一下子想到了openresty,功能看着很强大,支持 redis pg lua markdown quic http2 mysql 限速 pongo ...

  3. JavaScript_解决safari浏览器window.open无法实现的问题

    解决 safari window.open 无法实现的问题 先说下问题是什么吧: safari 中没办法在回调函数里面执行window.open, 原因是safari的安全机制将其阻挡了(具体的原因可 ...

  4. Walkthrough: Arranging Controls on Windows Forms Using Snaplines

    https://msdn.microsoft.com/en-us/library/t5b5kc41(v=vs.110).aspx Spacing and Aligning Controls Using ...

  5. Burp Suite Walkthrough(英文版)

    Burp Suite is one of the best tools available for web application testing. Its wide variety of featu ...

  6. Burp Suite Walkthrough

    Burp Suite is one of the best tools available for web application testing. Its wide variety of featu ...

  7. Making your first driver - complete walkthrough（使用VisualDDK）

    This article describes how to create, build and debug your first driver using Visual Studio and Visu ...

  8. [转帖]PG的简单备份恢复 找时间进行测试

    转帖PG的简单使用 https://blog.csdn.net/lk_db/article/details/77971634 一: 纯文件格式的脚本: 示例:1. 只导出postgres数据库的数据, ...

  9. [Windows Azure] Walkthrough to Configure System Center Management Pack for Windows Azure Fabric Preview for SCOM 2012 SP1 (with a MetricsHub Bonus)

    The wait is finally over. This is a huge update to the Azure Management Pack over the one that was r ...

  10. window postgresql 10.4安装

    window installer下载地址:https://www.enterprisedb.com/downloads/postgres-postgresql-downloads 其他版本官网下载地址 ...

随机推荐

  1. Java Study For Five Day( 面向对象一)

    面向对象 1.面向对象的概念 2.理解面向对象 *面向对象其实是相对面向过程而言的,面向对象和面向过程都是一种思想,它们所强调的内容不一样. *面向对象:强调的是功能的行为,将功能进行了封装成了对象, ...

  2. 解读vue的webpack.base.conf.js配置

    'use strict' // 引入nodejs路径模块 const path = require('path') // 引入utils工具模块,utils主要用来处理css-loader和vue-s ...

  3. Linux命令之ncdu

    简介 Ncdu - NCurses Disk Usage Ncdu 是一个带有 ncurses 接口的磁盘使用分析器. 它旨在在您没有完整图形设置可用的远程服务器上查找空间占用,但即使在常规桌面系统上 ...

  4. Jx.Cms开发笔记（七）-升级BootstrapBlazor到6.9.x

    由于BootstrapBlazor升级到6.9以后的升级还是非常大的,比如图标库升级到了6.1.2,bs升级到了5.2.0.所以这里记录一下升级过程. 升级BootstrapBlazor主程序 直接升 ...

  5. ZCMU-1156

    思路: 要改变的是一个范围的情况,所以正常情况下会超时. 查阅后知道应该用一个叫做树状数组的结构. 查阅和树状数组的后续情况 这个也不错 注意: 我没怎么看懂,可能没太仔细看. 树状数组当中存在的是前 ...

  6. 正也科技S2P 数字化推动医药信息传播多元化

    在当今数字化迅猛发展的时代浪潮中,医药信息传播正经历着深刻而广泛的变革.这种变革犹如一场波澜壮阔的革命,席卷了医药领域的每一个角落,对医药行业的发展产生了深远且不可忽视的影响. 一.传播渠道的多元化拓 ...

  7. 关于Popup的小坑坑

    在做一个自定义的输入搜索框,用textbox+popup来实现.其中有一个小需求,当textbox激活并且没有文本输入的时候,也要显示popup.很自然的想到了使用IsKeyboardFocusedC ...

  8. 痞子衡嵌入式：i.MXRT1170上PXP对CM7 TCM进行随机地址短小数据写入操作限制

    大家好,我是痞子衡,是正经搞技术的痞子.今天痞子衡给大家分享的是i.MXRT1170上PXP对CM7 TCM进行随机地址短小数据写入操作限制. 在 MCU 里能够对片内外映射的存储器进行读写操作的主设 ...

  9. 【字符串哈希+二分】AcWing3508 最长公共子串

    题解 首先思考暴力枚举长度为 \(len∈[1, min(strlen(s), strlen(t))]\),最差情况下为字符串 \(s\) 和字符串 \(t\) 全为长度为 \(10000\) 的全英 ...

  10. FineReport其他js记录

    1.js修改日期组件 背景色 边框 setTimeout(function () { var color = "#092347"; var fontColor = "wh ...