Date
Mar 9, 2025 → Mar 9, 2025
Tag
Nmap
Brute Force
Web Exploitation
192.168.151.65
Nmap
Service scan Timing: About 16.67% done; ETC: 01:03 (0:00:30 remaining)
Nmap scan report for 192.168.151.65
Host is up (0.052s latency).
Not shown: 994 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
80/tcp open http Microsoft IIS httpd 10.0
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
9998/tcp open http Microsoft IIS httpd 10.0
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 56.53 seconds
80, 9998
80
9998
nothing can found, and dir burte force are keeping scanning, try try ftp
21
可以登录，Logs里面有个文件很感兴趣，拿下来看看
可以确定，用户名为admin
目录扫描也结束了，没有发现什么有用的地方，那么接下来的思路就是用户爆破。
9998 admin burte force
先尝试弱密码
不成功，并且会被强制锁次数
查看console，发现他是经过API去验证的，尝试绕过UI直接经API去burte force
提示domain没有找到但是我们目前不知道domain是什么
找到网页托管程序的版本，试试看能不能找到poc
尝试使用poc，成功进入
成功进入
