第一次打window 从简单的开始打起吧

nmap 
└─# nmap -p- -A 192.168.150.65

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-10 00:19 UTC

Stats: 0:04:38 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan

NSE Timing: About 97.50% done; ETC: 00:24 (0:00:00 remaining)

Nmap scan report for 192.168.150.65

Host is up (0.071s latency).

Not shown: 65520 closed tcp ports (reset)

PORT      STATE SERVICE       VERSION

21/tcp    open  ftp           Microsoft ftpd

| ftp-anon: Anonymous FTP login allowed (FTP code 230)

| 04-29-20  09:31PM       <DIR>          ImapRetrieval

| 12-09-24  04:19PM       <DIR>          Logs

| 04-29-20  09:31PM       <DIR>          PopRetrieval

|_04-29-20  09:32PM       <DIR>          Spool

| ftp-syst:

|_  SYST: Windows_NT

80/tcp    open  http          Microsoft IIS httpd 10.0

|_http-server-header: Microsoft-IIS/10.0

|_http-title: IIS Windows

| http-methods:

|_  Potentially risky methods: TRACE

135/tcp   open  msrpc         Microsoft Windows RPC

139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn

445/tcp   open  microsoft-ds?

5040/tcp  open  unknown

7680/tcp  open  pando-pub?

9998/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

| uptime-agent-info: HTTP/1.1 400 Bad Request\x0D

| Content-Type: text/html; charset=us-ascii\x0D

| Server: Microsoft-HTTPAPI/2.0\x0D

| Date: Tue, 10 Dec 2024 00:24:05 GMT\x0D

| Connection: close\x0D

| Content-Length: 326\x0D

| \x0D

| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">\x0D

| <HTML><HEAD><TITLE>Bad Request</TITLE>\x0D

| <META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>\x0D

| <BODY><h2>Bad Request - Invalid Verb</h2>\x0D

| <hr><p>HTTP Error 400. The request verb is invalid.</p>\x0D

|_</BODY></HTML>\x0D

| http-title: Site doesn't have a title (text/html; charset=utf-8).

|_Requested resource was /interface/root

|_http-server-header: Microsoft-IIS/10.0

17001/tcp open  remoting      MS .NET Remoting services

49664/tcp open  msrpc         Microsoft Windows RPC

49665/tcp open  msrpc         Microsoft Windows RPC

49666/tcp open  msrpc         Microsoft Windows RPC

49667/tcp open  msrpc         Microsoft Windows RPC

49668/tcp open  msrpc         Microsoft Windows RPC

49669/tcp open  msrpc         Microsoft Windows RPC

No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

TCP/IP fingerprint:

OS:SCAN(V=7.94SVN%E=4%D=12/10%OT=21%CT=1%CU=43118%PV=Y%DS=4%DC=T%G=Y%TM=675

OS:78A35%P=x86_64-pc-linux-gnu)SEQ(SP=105%GCD=1%ISR=109%TI=I%CI=I%TS=U)SEQ(

OS:SP=106%GCD=1%ISR=10A%TI=I%CI=I%TS=U)OPS(O1=M578NW8NNS%O2=M578NW8NNS%O3=M

OS:578NW8%O4=M578NW8NNS%O5=M578NW8NNS%O6=M578NNS)WIN(W1=FFFF%W2=FFFF%W3=FFF

OS:F%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M578NW8NNS%CC=N%Q=)

OS:T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=80%W=

OS:0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T

OS:6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=80%IPL=1

OS:64%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=N)

Network Distance: 4 hops

Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:

| smb2-security-mode:

|   3:1:1:

|_    Message signing enabled but not required

| smb2-time:

|   date: 2024-12-10T00:24:08

|_  start_date: N/A

TRACEROUTE (using port 1723/tcp)

HOP RTT      ADDRESS

1   69.46 ms 192.168.45.1

2   69.45 ms 192.168.45.254

3   70.07 ms 192.168.251.1

4   70.55 ms 192.168.150.65

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 292.72 seconds

访问9998端口



发现cms但是没版本

搜索exp 由于他是easy难度所以觉得应该不会太难

https://www.exploit-db.com/exploits/49216

尝试这个exp

成功 而且好像就是system了 不用提权

Algernon pg walkthrough Window的更多相关文章

  1. ZK 长时操作带进度条

    LongProcess.zul: <?xml version="1.0" encoding="UTF-8"?> <window id=&quo ...

  2. algernon 基于golang 的独立的支持redis lua pg。。。 的web server

    algernon 看到github 的介绍很很强大,一下子想到了openresty,功能看着很强大,支持 redis pg lua markdown quic http2 mysql 限速 pongo ...

  3. JavaScript_解决safari浏览器window.open无法实现的问题

    解决 safari window.open 无法实现的问题 先说下问题是什么吧: safari 中没办法在回调函数里面执行window.open, 原因是safari的安全机制将其阻挡了(具体的原因可 ...

  4. Walkthrough: Arranging Controls on Windows Forms Using Snaplines

    https://msdn.microsoft.com/en-us/library/t5b5kc41(v=vs.110).aspx Spacing and Aligning Controls Using ...

  5. Burp Suite Walkthrough(英文版)

    Burp Suite is one of the best tools available for web application testing. Its wide variety of featu ...

  6. Burp Suite Walkthrough

    Burp Suite is one of the best tools available for web application testing. Its wide variety of featu ...

  7. Making your first driver - complete walkthrough（使用VisualDDK）

    This article describes how to create, build and debug your first driver using Visual Studio and Visu ...

  8. [转帖]PG的简单备份恢复 找时间进行测试

    转帖PG的简单使用 https://blog.csdn.net/lk_db/article/details/77971634 一: 纯文件格式的脚本: 示例:1. 只导出postgres数据库的数据, ...

  9. [Windows Azure] Walkthrough to Configure System Center Management Pack for Windows Azure Fabric Preview for SCOM 2012 SP1 (with a MetricsHub Bonus)

    The wait is finally over. This is a huge update to the Azure Management Pack over the one that was r ...

  10. window postgresql 10.4安装

    window installer下载地址:https://www.enterprisedb.com/downloads/postgres-postgresql-downloads 其他版本官网下载地址 ...

随机推荐

  1. toFullScreen：全屏------exitFullscreen：退出全屏

    toFullScreen:全屏 function toFullScreen(){ let elem = document.body; elem.webkitRequestFullScreen ? el ...

  2. isPCBroswer：检测是否为PC端浏览器模式

    function isPCBroswer() { let e = navigator.userAgent.toLowerCase() , t = "ipad" == e.match ...

  3. 开源 - Ideal库 - 枚举扩展设计思路及实现难点（三）

    今天想和大家分享关于枚举扩展设计思路和在实现过程中遇到的难点. 01.设计思路 设计思路说起来其实也很简单,就是通过枚举相关信息:枚举值.枚举名.枚举描述.枚举项.枚举类型,进行各种转换,通过一个信息 ...

  4. php 异步并行

    如果你有一批数据需要调用远程接口处理,而远程接口处理时间很长,比如需要1秒左右,那10条数据就是10秒,你的程序就要10S才能结束,而这样的话一旦接口提供方有点问题,就需要20秒 30秒甚至更久,这样 ...

  5. json编码格式化美化

    有时候你想存储一个json到文件中,然后让别人调用或者读取或者作为临时存储,诸如此类. 但是php json_encode后数据是压缩的没有格式化,导致读起来有点费劲. 所以你可以这样(php 5.4 ...

  6. (Redis基础教程之十) 如何在Redis中运行事务

    介绍 Redis是一个开源的内存中键值数据存储.Redis允许您计划一系列命令,然后一个接一个地运行它们,这一过程称为_transaction_.每个事务都被视为不间断且隔离的操作,以确保数据完整性. ...

  7. Node.js Express 框架(1)

    1.Express介绍 Express 是一个简洁而灵活的 node.js Web应用框架, 提供了一系列强大特性帮助你创建各种 Web 应用,和丰富的 HTTP 工具. Express的特点: 实现 ...

  8. WCF Bindings Needed For HTTPS

    原文地址:https://weblogs.asp.net/srkirkland/wcf-bindings-needed-for-https 我刚刚完成了我的第一个 WCF 应用,它在我的开发机上顺利工 ...

  9. 知乎 微软当年的 J++ 究竟是什么？为什么 Sun 要告它？ zz

    https://www.zhihu.com/question/22814456 考个古

  10. 一打开终端就默认进入conda的base环境，取消方法

    conda版本:4.10.3 安装conda之后,在使用VSCode的时候,每次在里面使用powershell终端都是默认进入base环境,稍不注意就会用错python解释器,所以考虑取消这一设置.经 ...