duangsues.is_a? SaltedFish
59 subscribers
609 photos
6 videos
91 files
562 links
🌶🐔🐟 duangsuse 的日常
尤其喜欢发些奇奇怪怪的东西
和转载别人的东西
Download Telegram
大概的报告:

45.62.110.178.16clouds.com 80: Apache 2.2.15
bwg,,可以正常访问,收到一份网址列表 Linux 2.6 (CentOS)

mmallv2u.net 80:Tengine 443:ssl 843:adobe-crossdomain 1935:tcpwrapped
Tiandy NVR (89%), IPCop 2 firewall (Linux 3.4) (87%), Linux 3.2 (87%)

103.208.220.66 22:ssh 80:nginx 1.10.2 443:tcpwrapped
Linux 4.4

o2olr.com 443:ssl/rtsp OpenVPN-AS (robots.txt)

charity100.org (🌶🐔)
21: FTP Pure-FTPd
25: SMTP?
53: domain ISC BIND 9.8.2rc1 (RHEL 6)
80: http Apache (WordPress 4.8.6) (robots.txt)
110: pop3 Dovecot pop3d
143: imap Dovecot imapd
443: ssl Apache (robots.txt) (cPanel)
voukgroup.org server.voukgroup.org
DNS:charity100.org, DNS:charity100.voukgroup.org, DNS:cpanel.charity100.org, DNS:mail.charity100.org, DNS:webdisk.charity100.org, DNS:webmail.charity100.org, DNS:www.charity100.org, DNS:www.charity100.voukgroup.org

465:ssl/smtp Exim smtpd 4.89_1
587: ^
993: Dovecot imapd
995: Dovecot pop3d
3306: mysql

Linux 2.6 RHEL6

mbidesaku.com (🌶🐔)
同上
DNS:mbidesaku.com, DNS:mail.mbidesaku.com, DNS:webdisk.mbidesaku.com, DNS:www.mbidesaku.com

mfcclub.com CloudFlare
g10w1.com CloudFlare
mbiv2u.com CloudFlare
mcademy.asia CloudFlare
mcalls.asia CloudFlare
mface.me CloudFlare
linktu.com CloudFlare
gameview.asia CloudFlare
mmallv2u.com CloudFlare

m-darts.com (🌶🐔)
21/tcp   open  ftp             Pure-FTPd
25/tcp open smtp?
|_smtp-commands: Couldn't establish connection on port 25
53/tcp open domain ISC BIND 9.8.2rc1 (RedHat Enterprise Linux 6)
| dns-nsid:
|_ bind.version: 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.5
80/tcp open http Apache httpd
110/tcp open pop3 Dovecot pop3d
143/tcp open imap Dovecot imapd
443/tcp open ssl/http Apache httpd (PHP 7.0.29)
DNS:m-darts.com, DNS:m-darts.masterlo.com, DNS:www.m-darts.com, DNS:www.m-darts.masterlo.com
465/tcp open ssl/smtp Exim smtpd 4.89_1
587/tcp open smtp Exim smtpd 4.89_1
993/tcp open ssl/imap Dovecot imapd
995/tcp open ssl/pop3 Dovecot pop3d
3306/tcp open mysql MySQL 5.5.58-cll
| mysql-info:
| Protocol: 10
| Version: 5.5.58-cll
| Thread ID: 9357480
5666/tcp open tcpwrapped
8888/tcp open sun-answerbook?


139.162.20.209 (🐔)
22/tcp   open     ssh            OpenSSH 7.4 (protocol 2.0)
80/tcp open http nginx 1.12.2
443/tcp open ssl/http nginx 1.12.2
3306/tcp open mysql MySQL (unauthorized)
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)

Linux 3.10 - 3.12

mbi88.net Xserver.co.jp

mbivip.com (🐔)
21/tcp   open  ftp      Microsoft ftpd
80/tcp open http Microsoft IIS httpd 7.5
5555/tcp open freeciv?

Microsoft Windows Server 2008 R2 SP1 (94%)
Uptime guess: 12.551 days

mcteam.info (🌶🐔)
Device type: WAP|firewall
Running: Motorola embedded, ZyXEL ZyNOS 3.X
OS details: Motorola RFS 6000 wireless switch, ZyXEL ZyWALL 2 firewall or Prestige 660HW-61 ADSL router (ZyNOS 3.62)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
| ms-sql-info:
| 183.136.132.176:1433:
| Version:
| name: Microsoft SQL Server 2000 SP4
| number: 8.00.2039.00
| Product: Microsoft SQL Server 2000
| Service pack level: SP4
|_ Product_Version: 5.2.3790
| Post-SP patches applied: false
|_ TCP port: 1433
3333/tcp open http Microsoft IIS httpd 6.0
1030/tcp open http Microsoft IIS httpd 6.0
Metasploit 好用
duangsuse 先把目标指向 🌶🐔 mcteam.com
duangsues.is_a? SaltedFish
Metasploit 好用
🌚 fx 告诉我 Metasploit 的一个 Java GUI 客户端是恶意软件 🌚
他们还有商业版的, 和 burp suite 一样
burp 真好用 🌚...
/opt/metasploit-framework/embedded/bin/ruby --version
ruby 2.4.1p111 (2017-03-22 revision 58053) [x86_64-linux]

ruby --version
ruby 2.6.0dev (2018-04-19 trunk 63191) [x86_64-linux]
This media is not supported in your browser
VIEW IN TELEGRAM
那个主机视图不能用
Armitage 的功能废掉一半, 回去用 msfconsole 算了
This media is not supported in your browser
VIEW IN TELEGRAM
用 WebDav 的那个 buffer ovf
第一次看起来好像正常,但最后没会话
后来告诉我 WebDav 响应不正常
RHOST = www.mcteam.info
RPORT = 333

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <https://" in a PROPFIND request, as exploited in the wild in July or August 2016. Original exploit by Zhiniang Peng and Chen Wu.

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <https://" in a PROPFIND request, as exploited in the wild in July or August 2016. Original exploit by Zhiniang Peng and Chen Wu.