$ nmap -sC -sV 10.10.10.210 Starting Nmap 7.91 ( https://nmap.org ) at 2020-11-02 13:18 CST Nmap scan report for 10.10.10.210 Host is up (0.069s latency). Not shown: 991 filtered ports PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 8.5 |_http-server-header: Microsoft-IIS/8.5 |_http-title: 403 - Forbidden: Access is denied. 443/tcp open ssl/http Microsoft IIS httpd 8.5 | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/8.5 |_http-title: IIS Windows Server | ssl-cert: Subject: commonName=Reel2 | Subject Alternative Name: DNS:Reel2, DNS:Reel2.htb.local | Not valid before: 2020-07-30T10:12:46 |_Not valid after: 2025-07-30T10:12:46 |_ssl-date: 2020-11-02T05:20:05+00:00; 0s from scanner time. 6001/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 6002/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 6004/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 6005/tcp open msrpc Microsoft Windows RPC 6006/tcp open msrpc Microsoft Windows RPC 6007/tcp open msrpc Microsoft Windows RPC 8080/tcp open http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.2.32) | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set | http-open-proxy: Potentially OPEN proxy. |_Methods supported:CONNECTION |_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.2.32 |_http-title: Welcome | Wallstant Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 78.46 seconds
80
80访问是403:
443
443直接访问是IIS默认页面：
8080
8080随意注册登录进去，里面有一些用户名可以提取出来作为用户名字典,并且处理一下不同格式：
usernames
names.txt
1 2 3 4 5 6
cube cube cube0x0 cube0x0 sven svensson lars larsson jenny adams teresa trump
# ID used to uniquely identify this document GUID = '08c0fdac-36ef-43b5-931f-68171c4c8200'
# Author of this document Author = 'cube0x0'
# Description of the functionality provided by these settings # Description = ''
# Company associated with this document CompanyName = 'Unknown'
# Copyright statement for this document Copyright = '(c) 2020 cube0x0. All rights reserved.'
# Modules to import when applied to a session # ModulesToImport = 'MyCustomModule', @{ ModuleName = 'MyCustomModule'; ModuleVersion = '1.0.0.0'; GUID = '4d30d5f0-cb16-4898-812d-f20a6c596bdf' }
# Aliases to make visible when applied to a session # VisibleAliases = 'Item1', 'Item2'
# Cmdlets to make visible when applied to a session # VisibleCmdlets = 'Invoke-Cmdlet1', @{ Name = 'Invoke-Cmdlet2'; Parameters = @{ Name = 'Parameter1'; ValidateSet = 'Item1', 'Item2' }, @{ Name = 'Parameter2'; ValidatePattern = 'L*' } }
# Functions to make visible when applied to a session # VisibleFunctions = 'Invoke-Function1', @{ Name = 'Invoke-Function2'; Parameters = @{ Name = 'Parameter1'; ValidateSet = 'Item1', 'Item2' }, @{ Name = 'Parameter2'; ValidatePattern = 'L*' } }
# External commands (scripts and applications) to make visible when applied to a session # VisibleExternalCommands = 'Item1', 'Item2'
# Providers to make visible when applied to a session # VisibleProviders = 'Item1', 'Item2'
# Scripts to run when applied to a session # ScriptsToProcess = 'C:\ConfigData\InitScript1.ps1', 'C:\ConfigData\InitScript2.ps1'
# Aliases to be defined when applied to a session # AliasDefinitions = @{ Name = 'Alias1'; Value = 'Invoke-Alias1'}, @{ Name = 'Alias2'; Value = 'Invoke-Alias2'}
# Functions to define when applied to a session FunctionDefinitions = @{ 'Name' = 'Check-File' 'ScriptBlock' = {param($Path,$ComputerName=$env:COMPUTERNAME) [bool]$Check=$Path-like"D:\*" -or $Path-like"C:\ProgramData\*" ; if($check) {get-content$Path}} }
# Variables to define when applied to a session # VariableDefinitions = @{ Name = 'Variable1'; Value = { 'Dynamic' + 'InitialValue' } }, @{ Name = 'Variable2'; Value = 'StaticInitialValue' }
# Environment variables to define when applied to a session # EnvironmentVariables = @{ Variable1 = 'Value1'; Variable2 = 'Value2' }
# Type files (.ps1xml) to load when applied to a session # TypesToProcess = 'C:\ConfigData\MyTypes.ps1xml', 'C:\ConfigData\OtherTypes.ps1xml'
# Format files (.ps1xml) to load when applied to a session # FormatsToProcess = 'C:\ConfigData\MyFormats.ps1xml', 'C:\ConfigData\OtherFormats.ps1xml'
# Assemblies to load when applied to a session # AssembliesToLoad = 'System.Web', 'System.OtherAssembly, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'
# Version number of the schema used for this document SchemaVersion = '2.0.0.0'
# ID used to uniquely identify this document GUID = 'd6a39756-aa53-4ef6-a74b-37c6a80fd796'
# Author of this document Author = 'cube0x0'
# Description of the functionality provided by these settings # Description = ''
# Session type defaults to apply for this session configuration. Can be 'RestrictedRemoteServer' (recommended), 'Empty', or 'Default' SessionType = 'RestrictedRemoteServer'
# Directory to place session transcripts for this session configuration # TranscriptDirectory = 'C:\Transcripts\'
# Whether to run this session configuration as the machine's (virtual) administrator account RunAsVirtualAccount = $true
# Scripts to run when applied to a session # ScriptsToProcess = 'C:\ConfigData\InitScript1.ps1', 'C:\ConfigData\InitScript2.ps1'
# User roles (security groups), and the role capabilities that should be applied to them when applied to a session RoleDefinitions = @{ 'htb\jea_test_account' = @{ 'RoleCapabilities' = 'jea_test_account' } }
# Language mode to apply when applied to a session. Can be 'NoLanguage' (recommended), 'RestrictedLanguage', 'ConstrainedLanguage', or 'FullLanguage' LanguageMode = 'NoLanguage'
