對于教務處的源代碼審計發現是正方教務系統。然而能力不夠，無法利用正方教務系統的漏洞。
那么先試試看吧，正方使用211端口，開放211端口的主機非常多，但似乎外網對211端口的連接請求被拒絕了（值得懷疑）
所有的端口全都被過濾了，這其實也就是掃描存活的主機，愚蠢的我并沒有什么端口滲透經驗··
D:\CTF\Nmap>nmap -sV -p 211 202.115.128.*
Starting Nmap 7.60 ( https://nmap.org ) at 2017-09-16 15:51 ?D1ú±ê×?ê±??
Nmap scan report for cam-r1.cdut.edu.cn (202.115.128.1)
Host is up (0.047s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for cdut-cam-r3.cdut.edu.cn (202.115.128.3)
Host is up (0.063s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for cam-r6.cdut.edu.cn (202.115.128.6)
Host is up (0.047s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.21
Host is up (0.063s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.25
Host is up (0.14s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.26
Host is up (0.032s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.28
Host is up (0.14s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for pridns.cdut.edu.cn (202.115.128.33)
Host is up (0.11s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for secdns.cdut.edu.cn (202.115.128.34)
Host is up (0.11s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.37
Host is up (0.094s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for email.cdut.edu.cn (202.115.128.60)
Host is up (0.031s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.62
Host is up (0.062s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.63
Host is up (0.042s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.91
Host is up (0.031s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.108
Host is up (0.093s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for vmdp.cdut.cn (202.115.128.114)
Host is up (0.032s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.115
Host is up (0.11s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.128
Host is up (0.094s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.132
Host is up (0.094s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.169
Host is up (0.047s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.189
Host is up (0.078s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.190
Host is up (0.046s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.225
Host is up (0.047s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.227
Host is up (0.062s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.228
Host is up (0.062s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.231
Host is up (0.062s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.238
Host is up (0.11s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Nmap scan report for 202.115.128.254
Host is up (0.078s latency).
PORT? ? STATE? ? SERVICE VERSION
211/tcp filtered 914c-g
Service detection performed. Please report any incorrect results at https://nmap
.org/submit/ .
Nmap done: 256 IP addresses (28 hosts up) scanned in 70.80 seconds
D:\CTF\Nmap>nmap -sV -A 202.115.128.238
Starting Nmap 7.60 ( https://nmap.org ) at 2017-09-16 16:33 ?D1ú±ê×?ê±??
Nmap scan report for 202.115.128.238
Host is up (0.048s latency).
Not shown: 995 filtered ports
PORT? ? STATE SERVICE? ? ? VERSION
21/tcp? open? ftp? ? ? ? ? vsftpd 2.0.7+ (ext.1)
80/tcp? open? http? ? ? ? Seagate Black Armor 440 NAS http config (PHP 4.4.9)
| http-cookie-flags:
|? /:
|? ? PHPSESSID:
|_? ? ? httponly flag not set
|_http-title: Seagate NAS - BA-35532E
111/tcp? open? rpcbind? ? ? 2 (RPC #100000)
| rpcinfo:
|? program version? port/proto? service
|? 100000? 2? ? ? ? ? ? 111/tcp? rpcbind
|_? 100000? 2? ? ? ? ? ? 111/udp? rpcbind
548/tcp? open? afp? ? ? ? ? Netatalk 2-2-0-p6 (name: BA-35532E; protocol 3.3)
| afp-serverinfo:
|? Server Flags:
|? ? Flags hex: 0x8f7d
|? ? Super Client: true
|? ? UUIDs: true
|? ? UTF8 Server Name: true
|? ? Open Directory: true
|? ? Reconnect: false
|? ? Server Notifications: true
|? ? TCP/IP: true
|? ? Server Signature: true
|? ? Server Messages: true
|? ? Password Saving Prohibited: true
|? ? Password Changing: false
|? ? Copy File: true
|? Server Name: BA-35532E
|? Machine Type: Netatalk 2-2-0-p6
|? AFP Versions: AFP2.2, AFPX03, AFP3.1, AFP3.2, AFP3.3
|? UAMs: DHX2, DHCAST128, Cleartxt Passwrd, No User Authent
|? Server Signature: 30303130373533353533326500000000
|? Network Addresses:
|? ? 202.115.128.238
|_? UTF8 Server Name: BA-35532E
9876/tcp open? gcs-clientgw Galaxy Control Systems Client GW
Warning: OSScan results may be unreliable because we could not find at least 1 o
pen and 1 closed port
Aggressive OS guesses: AVM FRITZ!Box FON WLAN 7050, Linksys WAG200G, or Netgear
DG834GT wireless broadband router (93%), Linksys WRV200 wireless broadband route
r (89%), Kyocera CopyStar CS-2560 printer (89%), D-Link DSL-G624T wireless ADSL
router (MontaVista embedded Linux 2.4.17), or Netgear DG834Bv3 ADSL router or DG
834G WAP (87%), Extreme Networks ExtremeXOS 12.5.4 (86%), Western Digital MyBook
World Edition 2 NAS device (Linux 2.6.17.14) (86%), Supermicro IPMI remote mana
gement (86%), Sony Bravia HX720-series TV (86%), Dell Remote Access Controller (
DRAC 6) (85%), Linux 2.4.18 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 4 hops
Service Info: Host: BA-35532E; OS: Unix; Device: security-misc
TRACEROUTE (using port 21/tcp)
HOP RTT? ? ? ADDRESS
1? 0.00 ms? 192.168.1.1
2? 32.00 ms 110.191.168.1
3? ...
4? 47.00 ms 202.115.128.238
OS and Service detection performed. Please report any incorrect results at https
://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 169.20 seconds
首先是21
http://202.115.128.37/
http://202.115.128.60/
http://202.115.128.62和63/
https://202.115.128.108/
https://202.115.128.225/
https://202.115.128.228/
https://202.115.128.231/cgi-bin/
http://202.115.128.238/
