Enumeration Nmap command sudo nmap -sC -sV target -T4 result Nmap scan report for 10.129.228.217 Host is up (0.27s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 4f:e3:a6:67:a2:27:f9:11:8d:c3:0e:d7:73:a0:2c:28 (ECDSA) |_ 256 81:6e:78:76:6b:8a:ea:7d:1b:ab:d4:36:b7:f8:ec:c4 (ED25519) 80/tcp open http Apache httpd 2.4.52 |_http-server-header: Apache/2.4.52 (Ubuntu) |_http-title: Did not follow redirect to http://searcher.htb/ Service Info: Host: searcher.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel http 포트와 ssh 포트가 열려있는 것을 확인할 수 있습니다. gobuster command gobuster dir -u http://target -w ~/wordlists/dirb/common.txt result Progress: 0 / 1 (0.00%) 2025/10/10 14:04:20 the server returns a status code that matches the provided options for non existing urls. http://target/4a437574-206b-45c5-80a3-853688eb8182 => 302 (redirect to http://searcher.htb/) (Length: 276). Please exclude the response length or the status code or set the wildcard option.. To continue please exclude the status code or the length searcher.htb로 리다이렉트를 시킵니다. 따라서 /etc/hosts파일을 수정하여 타겟 ip와 해당 url을 맵핑합니다. ...

vmlinux 란? 리눅스 커널을 한 번이라도 빌드한 경험이 있다면 vmlinux와 vmlinuz라는 파일을 본 경험이 있을 것입니다. 빌드 경험이 없더라도, 리눅스 루트 파일시스템을 돌아다니다가 /boot 디렉토리 내에 있는 vmlinuz 혹은 bzImage를 보았을 수도 있고요. 이번 글에서는 위 파일들이 무엇이며, 어떤 역할을 하는지 한 번 알아보도록 하겠습니다. vmlinux 우선 리눅스 커널은 다른 프로그램과 마찬가지로 하나의 실행 가능한 프로그램입니다. gcc를 통해 c언어 소스코드 main.c를 빌드했을 때 a.out 이름의 ELF 바이너리가 나오는 것 처럼 커널도 빌드하면 ELF 바이너리가 나오게 됩니다. 그리고 이 바이너리가 vmlinux입니다. ...

About this lab Utilize enumeration, web enumeration, and WordPress enumeration techniques to identify vulnerabilities. Engage in database enumeration and implement privilege escalation strategies. Additionally, harness the abuse of sudo permissions to enhance your access. This lab is designed to capitalize on your skills in vulnerability exploitation. Enumeration Nmap command sudo nmap -p- T4 target result Host is up (0.098s latency). Not shown: 65523 filtered tcp ports (no-response) PORT STATE SERVICE 20/tcp closed ftp-data 21/tcp open ftp 22/tcp open ssh 53/tcp open domain 80/tcp open http 123/tcp closed ntp 137/tcp closed netbios-ns 138/tcp closed netbios-dgm 139/tcp open netbios-ssn 666/tcp open doom 3306/tcp open mysql 12380/tcp open unknown command ...

About this lab Engage in enumeration, web enumeration, and exploiting SQL injection techniques to identify vulnerabilities. Utilize password cracking methods and implement privilege escalation strategies to enhance your access. This lab is designed to capitalize on your skills in vulnerability exploitation. Enumeration Nmap command sudo nmap -p- -T4 target First, we have to scan all of the target ports. result Host is up (0.10s latency). Not shown: 65369 filtered tcp ports (no-response), 163 filtered tcp ports (host-prohibited) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http The ftp, ssh, and http ports are open. command ...

local ip : 192.168.45.231 remote ip : 192.168.152.136 Enumeration Nmap command sudo nmap -p- -T4 target result Not shown: 65498 closed tcp ports (reset), 31 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 80/tcp open http 389/tcp open ldap 443/tcp open https 5667/tcp open unknown command sudo nmap -sV -sC -p 22,25,80,389,443,5667 -T4 target result PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 b8:8c:40:f6:5f:2a:8b:f7:92:a8:81:4b:bb:59:6d:02 (RSA) | 256 e7:bb:11:c1:2e:cd:39:91:68:4e:aa:01:f6:de:e6:19 (ECDSA) |_ 256 0f:8e:28:a7:b7:1d:60:bf:a6:2b:dd:a3:6d:d1:4e:a4 (ED25519) 25/tcp open smtp Postfix smtpd | ssl-cert: Subject: commonName=ubuntu | Not valid before: 2020-09-08T17:59:00 |_Not valid after: 2030-09-06T17:59:00 |_smtp-commands: ubuntu, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN |_ssl-date: TLS randomness does not represent time 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-server-header: Apache/2.4.18 (Ubuntu) |_http-title: Nagios XI 389/tcp open ldap OpenLDAP 2.2.X - 2.3.X 443/tcp open ssl/http Apache httpd 2.4.18 | ssl-cert: Subject: commonName=192.168.1.6/organizationName=Nagios Enterprises/stateOrProvinceName=Minnesota/countryName=US | Not valid before: 2020-09-08T18:28:08 |_Not valid after: 2030-09-06T18:28:08 |_ssl-date: TLS randomness does not represent time |_http-title: Nagios XI |_http-server-header: Apache/2.4.18 (Ubuntu) | tls-alpn: |_ http/1.1 5667/tcp open tcpwrapped Service Info: Hosts: ubuntu, 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel Gobuster command ...