How to intrude into RedHatLinux

Article title: Teach you how to intrude into RedHatLinux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

The purpose of this article is not to teach people to intrude, but to improve their own technology and enhance the security awareness of network administrators. That's all! Careless network administrators should understand that a small mistake may cause the entire network to fall! This article focuses on LPD: network printing service attacks.

First, determine the target, assuming: www.XXX.com

Let's see if it's connected first:

C: \ pingwww.XXX.com

Pingingwww.XXX.com [202.106.184.200] with32bytesofdata:

Replyfrom202.106.184.200: bytes = 32 time = 541 msTTL = 244

Replyfrom202.106.184.200: bytes = 32 time = 620 msTTL = 244

Replyfrom202.106.184.200: bytes = 32 time = 651 msTTL = 244

Replyfrom202.106.184.200: bytes = 32 time = 511 msTTL = 244

Pingstatisticsfor202.106.184.200:

Packets: Sent = 4, stored ed = 4, Lost = 0 (0% loss ),

Approximateroundtriptimesinmilli-seconds:

Minimum = 511 ms, Maximum = 651 ms, Average = 580 ms

Hey, not only is it connected, but the speed is not bad ......

Telnet to see the banner:

C: \ telnet www.XXX.com

The connection to the host is lost.

Try again ftp,

C: \ ftp www.XXX.com

Connected to www.fbi.gov.tw.

220 XXX-www FTP server (Version wu-2.6.1 (1) Wed Aug 9 05:54:50 EDT 2000) ready.

User (www.XXX.com :( none )):

Wu-2.6.1 looks a little eye-catching. This machine is like RedHat7.0! First of all, you must confirm that the stepping stone connecting to Alibaba Cloud:

C: \ telnetxxx. xxx

RedHatLinuxrelease7.0 (Guinness)

Kernel2.2.16-22smponani686

Login: fetdog

Password:

Bash-2.04 $

Take the nmap scanner and look at its mysteries ~~~

Bash-2.04 $ nmap-sT-Owww.XXX.com

StartingnmapV.2.54BETA7 (www.insecure.org/nmap /)

WARNING! Thefollowingfilesexistandarereadable:/usr/local/sha

-Servicesand./nmap-services.Iamchoosing/usr/local/share/nmap/

Sforsecurityreasons. setNMAPDIR =. togiveprioritytofilesin

Irectory

Interestingportson (www.XXX.com ):

(The1520portsscannedbutnotshownbelowareinstate: closed)

PortStateService

25/tcpopensmtp

79/tcpopenfinger

80/tcpopenhttp

111/tcpopensunrpc

113/tcpopenauth

443/tcpopenhttps

513/tcpopenlogin

514/tcpopenshell

515/tcpopenprinter

587/tcpopensubmission

1024/tcpopenkdm

TCPSequencePrediction: Class = randompositiveincrements

Difficulty = 3247917 (Goodluck !)

Remoteoperatingsystemguess: Linux2.1.122-2.2.16

Nmapruncompleted -- 1 IPaddress (1 hostup) scannedin9seconds

There are many opened ports, which means the possibility of intrusion is increased. 79/tcpopenfinger. check this vulnerability first, but linux does not have the finger user list vulnerability.

Bash-2.04 $ finger @ www.XXX.com

[Www.XXX.com]

No one logged on.

Let's take a look at 111/tcpopensunrpc. Rpc vulnerabilities have become popular recently. do you know if RH7 is available? Let's take a look!

Bash-2.04 $ rpcinfo-pwww.XXX.com

Programversprotoportservice

1000002tcp111rpcbind

1000002udp111rpcbind

1000211udp1024nlockmgr

1000w.udp1024nlockmgr

1000241udp1025status

1000241tcp1024status

[1] [2] Next page